This topic describes tasks required to migrate NetWitness Endpoint 4.4.0.x to NetWitness Platform 11.3.
Review the Endpoint architecture and choose one of the following deployments based on number, distribution, and location of endpoints, and data collected from the agents. For more information, see the "NetWitness Endpoint Architecture" topic in the Deployment Guide.
Small deployment includes NetWitness Server, an Endpoint Log Hybrid, and Event Stream Analysis (ESA).
Large deployment includes NetWitness Server, one or more Endpoint Log Hybrids, one or more ESA.
If you have multiple Endpoint Log Hybrids, install an Endpoint Broker. Once installed, it automatically queries all Endpoint servers in your deployment and provides a consolidated view of all Endpoint servers.
Review existing licenses and hardware, and procure them as required.
Make sure you have the required hardware for your deployment. For more information, see the "Supported Hardware" topic in the Physical Host Installation Guide.
If you have existing NetWitness Endpoint 4.4.0.x licenses, you do not need to procure a new license. Your existing NetWitness Endpoint 4.4.0.x licenses will be available on myRSA as a NetWitness Platform 11.3 license, with a different serial/license number.
For more information, see the Licensing Management Guide.
Configure the ports on your firewall. For more information, see the "Network Architecture and Ports" topic in the Deployment Guide.
- Install the following NetWitness Platform 11.3 components:
- NetWitness Server
Endpoint Log Hybrid
- Endpoint Broker (for more than one Endpoint Log Hybrids)
For more information, see the Physical Host Installation Guide.
If you have NetWitness Endpoint 4.4.0.x licenses:
With NetWitness Platform - Map your entitlements to the existing license server.
Without NetWitness Platform:
a. Install NetWitness Platform (see Task 2 - Set up NetWitness Platform 11.3)
b. Obtain License Server ID
c. Map entitlements
- Verify if licenses are reflected on ADMIN > System > Licenses.
Task 3 - Configure NetWitness Platform for Endpoints
Configure your RSA Live account and make sure the File Reputation service is enabled. For more information, see the Live Services Management Guide.
- Create users and assign appropriate roles. For more information, see the System Security and User Management Guide.
Configure Endpoint Meta forwarding on Endpoint Log Hybrid. For more information, see the NetWitness Endpoint Configuration Guide.
Deploy ESA rules.
The existing NetWitness Endpoint 4.4.0.x IIOCs are available as out-of-the-box Application rules and automatically available on installation.
You must configure the ESA Correlation server with an Endpoint Concentrator and deploy the ESA content for risk score calculation. For more information, see the ESA Configuration Guide.
Review the default Agent Endpoint (EDR) policy and create groups as required. If you want to enable agents for log collection, review and apply the Windows Log policy.
For more information, see the NetWitness Endpoint Configuration Guide.
Task 4 - Import NetWitness Endpoint 4.4.0.x Configurations
Import file status, certificate status, and blocked hashes from NetWitness Endpoint 4.4.0.x to NetWitness Platform. For more information, see Importing NetWitness Endpoint 4.4.0.x Configurations to NetWitness Platform.
Task 5 - Set up Other NetWitness Endpoint 4.4.0.x Configurations
You have to manually set up the following configurations:
Deploy Blacklisted IP addresses and other feeds that are relevant for your deployment from RSA Live through the NetWitness Platform user interface.
(Optional) For any other external threat feeds, such as blacklisted IP address, domain, and checksum, that you may want to use to tag endpoint metadata, see the "Create a Custom Feed" topic in the Live Services Management Guide.
For example, to notify an analyst about any communication from a host or file to a certain blacklisted IP address, domain, or hash, create a feed on the Log Decoder, and tag appropriate sessions for investigation and alerting .
(Optional) Review custom IIOCs and write Endpoint rule. For more information, see the "Custom Endpoint Rule for Risk Scoring" topic in the NetWitness Endpoint Configuration Guide.
Task 6 - Deploy Agents
- Generate an agent packager from NetWitness Platform 11.3.
Copy the agent packager (AgentPackager.zip) to a Windows machine and generate the 11.3 agent installers.
- Do one of the following to upgrade 4.4.0.x agents to 11.3:
If you have NetWitness Endpoint 188.8.131.52 Console Server, copy the agent installers to the NetWitness Endpoint Console Server, and upgrade from the NetWitness Endpoint user interface.
If you have 184.108.40.206 or 220.127.116.11, copy the agent installers, and use the third-party software distribution tool.
- Deploy the agents.
For more information, see the NetWitness Endpoint Agent Installation Guide.
Task 7 - Verify the Agent Migration
After the agent migration, verify the following:
Agents are able to communicate with the Endpoint Server and are listed in the INVESTIGATE > Hosts view.
Perform a scan and make sure that the snapshot details are displayed in the INVESTIGATE > Host Details view.
Hosts metadata is available in INVESTIGATE > Navigate and Event Analysis view.
If the Windows Log collection is enabled, make sure that the Windows logs are available in the Navigate and Event Analysis view.
File reputation, file status, risk scores are available in Hosts and Files view.
For detailed information on the features supported in NetWitness Platform 11.3, see the NetWitness Endpoint Configuration Guide.