LogRhythm - RSA NetWitness Suite Integration Guide
June 28, 2017
The 'NetWitness-LogRhythm' integration guide contains references on how to enable basic right-click...
Analyst's Reference: Windows 4625
June 3, 2017
Overview We all are so familiar with the 4625 as a failed logon, but did you know that the 4625 has...
Feed Me! Cisco AMP ThreatGrid Intelligence Feeds
April 4, 2017
I'm sure you know that RSA Netwitness for Logs and Packets includes the ability to register for a...
Identifying BITS Uploads and Downloads
March 20, 2017
Part 1: NetWitness for Packets I recently read an article from Microsoft (...
Investigating Endpoints with NWE Tracking Data
March 10, 2017
There has been a lot of great information published about Sysmon since Mark Russinovich's...
What's In Your NetWitness RSA SecurID Identities?
February 28, 2017
The RSA SecurID dashboard allows analysts to monitor specific identities and their behaviors. It...
Using IPMITool to Script iDRAC Configuration
February 28, 2017
When doing several changes at a time on several systems you can use the IPMITool to execute...
Getting to the root host of the problem
February 22, 2017
This came out of a separate discussion but I thought it could be helpful for others. A customer was...
Take me to the Shodan - Right Click your way to additional data
February 9, 2017
The RSA Netwitness Suite has a lot of data flowing into it. However, it does not take in...
How to approach in RSA Netwitness for the 'unknown' or 'undefined' logs
February 7, 2017
Issue This article provides the steps to check or verify the unknown or undefined logs in...