Gathering Stats with Salt - BIOS/iDRAC/PERC Edition
August 29, 2018
A recent advisory was sent out for firmware updates to a number of base components in NetWitness. ...
RSA NetWitness Query Syntax Compared to Wireshark Display Filters
August 23, 2018
Wireshark has been around for a long time and the display filters that exist are good reference...
Content - Domains with one UserAgent
June 3, 2018
I leverage many sources to get ideas around spotting anomalies in an environment. One of the...
Feed: MS Logon Type Description
May 14, 2018
logon.type has been a numeric value for windows logs in RSA NetWitness for a while, but it might...
Top Level Domain (TLD) Lua Parser for Logs
April 16, 2018
The TLD parser has been updated to now deploy on Log Decoders. The parser looks for the following...
How To Customize a Log Parser - LOGBinder Example
April 3, 2018
10.6.5.x and 11.1 now have the ability to apply -custom.xml log parser files to reduce the need for...
App Rules - Escaping your slashes
January 25, 2018
After spending some time writing application rules for detecting Powershell, lateral movement and...
NetWitness 11.0 - HTTP_lua options
January 8, 2018
Highlighting some of the new features available in NW11 (NetWitness 11.0). HTTP Lua Parser Options
Script - Using NwConsole to hunt query performance with Topquery
August 18, 2017
10.6 introduced a new CLI feature in NwConsole that allowed reporting with topquery. This neat...
Validate your custom index files with xmllint
May 12, 2017
Everyone makes mistakes in their syntax once in a while. Why wait for the service restart to...