Operationalizing Threat Aware Authentication
April 29, 2020
Shout out to @Casey Switzer, @Josh Randall & @Larry Hammond. Without their help, the lab,...
Microsoft 365, MS Threat Intelligence, Azure and Qualys Dashboards for RSA NetWitness Evolved SIEM
April 10, 2020
Interested in having a central single pane of glass view across your cloud, on-prem and virtual...
Custom File Blacklists in NWE 11.4.x and above
April 6, 2020
Every SOC analyst should spend at least part of his/her day reading various blog posts and white...
Dell Technologies (RSA) Named a Leader in 2020 Gartner Magic Quadrant for SIEM
February 28, 2020
We are excited to share that Dell Technologies (RSA) has been positioned as a “Leader” by Gartner...
ESA Notification script broken in version 10.6.6.1
October 12, 2019
If you use notification scripts as part of your ESA rules and recently migrated to version 10.6.6.1...
Detecting DNS Tunnel Activity in RSA NetWitness
April 22, 2019
Introduction There are many, many ways to exfiltrate data from a network, but one common way to do...
Custom IIOC Creation in RSA NetWitness Endpoint v4.4
March 19, 2019
Instant Indicators of Compromise (IIOC)s are a feature within the NetWitness Endpoint (NWE)...
Amazon VPC Flow & RSA NetWitness Integration
January 3, 2019
Amazon Virtual Private Clouds (VPC) are used in hybrid cloud enterprise environments to securely...
Parsing Suricata JSON logs with NW
August 13, 2018
To successfully parse Suricata JSON logs via syslog collector we need to use LUA parser in...
New Text Indexing Features in RSA NetWitness v11.1
May 4, 2018
RSA NetWitness v11.1 introduces powerful new text indexing features to the RSA NetWitness core...