Threat Intel Integration with MISP and Minemeld
April 5, 2019
RSA NetWitness has a number of integrations with threat intel data providers but two that I have...
What's new with Device.IP
February 26, 2019
Recently, a question came from a customer who wanted to know if it was possible to alert when a new...
Bulk Content Deployment with Resource Bundles
February 19, 2019
Joshua Randall had a recent post that showed how to use the resourceBundle package to create a...
Scripting your Whitelists with Lua
February 12, 2019
A couple of interactions with customers recently sent me down the path of designing better...
Investigation Profiles for Analysts
January 21, 2019
RSA NetWitness v11.2 introduced a very useful feature to the Investigation workflow with the...
What's that Service again?
January 21, 2019
Most people don't remember the well known port number for a particular network protocol. Sometimes...
Log Device Health Report
January 21, 2019
There have been many improvements made over the past several releases to the RSA NetWitness product...
Hunting in RDP Traffic
November 12, 2018
I was just working in the NOC for HackFest 2018 in Quebec City (https://hackfest.ca/en/) and...
v11.x - Adding DR Investigation NW Head Server
October 25, 2018
Background Information: v10.6.x had a method in the UI to add a standalone NW head server for...
Windows Endpoint Logging with the Free RSA NetWitness Insights Agent
October 4, 2018
The RSA NetWitness Platform has an integrated agent available that currently does base Endpoint...