RSA NetWitness® Platform 184.108.40.206 provides fixes for all products in the Platform. The components of the Platform are the NetWitness Server (Admin server, Config server, Integration server, Investigate server, Orchestration server, Respond server, Security sever, and Source server), Archiver, Broker, Concentrator, Context Hub, Decoder, Endpoint Log Hybrid, ESA Primary, ESA Secondary, Log Collector, Log Decoder, Malware Analysis, Reporting Engine, UEBA, Warehouse Connector, and Workbench.
The instructions in this guide apply to both physical and virtual hosts (including AWS and Azure Public Cloud) unless stated to the contrary.
The following update paths are supported for NetWitness Platform 220.127.116.11:
11.0.x to 18.104.22.168
- 11.1.x to 22.214.171.124
- 11.2.x to 126.96.36.199
- 10.6.6.x to 188.8.131.52
Go to the Master Table of Contents to find all NetWitness Platform Logs & Network 11.x documents.
See the RSA NetWitness Platform 10.6.6.x to 11.3 Physical Host Upgrade Guide and RSA NetWitness Platform 10.6.6.x to 11.3 Virtual Host Upgrade Guide for instructions on how to upgrade 10.6.6.x to 184.108.40.206.
Running in Mixed Mode
Running in mixed mode occurs when some services are updated to the latest version and some services are on older versions. See "Running in Mixed Mode" in the RSA NetWitness Platform Hosts and Services Getting Started Guide for further information.
Update Considerations for ESA Rule Deployments
After you update to 11.3, migrated ESA rule deployments have the following changes.
- If an ESA rule deployment contains two services before you upgrade to 11.3, the deployment splits into two deployments. You can only have one ESA Correlation service in an ESA rule deployment in version 11.3.
- If an ESA service has multiple ESA rule deployments before you upgrade to 11.3, they are combined into one deployment in version 11.3.
You can still access your old deployments. For a detailed example, see the ESA Configuration Guide for RSA NetWitness Platform 11.3.