Update Instructions: Introduction

Document created by RSA Information Design and Development on Apr 11, 2019Last modified by RSA Information Design and Development on Apr 18, 2019
Version 3Show Document
  • View in full screen mode

RSA NetWitness® Platform provides fixes for all products in the Platform. The components of the Platform are the NetWitness Server (Admin server, Config server, Integration server, Investigate server, Orchestration server, Respond server, Security sever, and Source server), Archiver, Broker, Concentrator, Context Hub, Decoder, Endpoint Log Hybrid, ESA Primary, ESA Secondary, Log Collector, Log Decoder, Malware Analysis, Reporting Engine, UEBA, Warehouse Connector, and Workbench.

Note: The Reporting Engine is installed on the NetWitness Server (NW Server) host, Workbench is installed on the Archiver host, Warehouse Connector can be installed on the Decoder host or Log Decoder host.

The instructions in this guide apply to both physical and virtual hosts (including AWS and Azure Public Cloud) unless stated to the contrary.

Update Path

The following update paths are supported for NetWitness Platform

  • 11.0.x to

  • 11.1.x to
  • 11.2.x to
  • 10.6.6.x to

Go to the Master Table of Contents to find all NetWitness Platform Logs & Network 11.x documents.
See the RSA NetWitness Platform 10.6.6.x to 11.3 Physical Host Upgrade Guide and RSA NetWitness Platform 10.6.6.x to 11.3 Virtual Host Upgrade Guide for instructions on how to upgrade 10.6.6.x to

Running in Mixed Mode

Running in mixed mode occurs when some services are updated to the latest version and some services are on older versions. See "Running in Mixed Mode" in the RSA NetWitness Platform Hosts and Services Getting Started Guide for further information.

Update Considerations for ESA Rule Deployments

Caution: In NetWitness Platform 11.3, the ESA Correlation service contains data source changes that require changes to migrated ESA rule deployments. The 11.3 ESA Correlation service replaces the Event Stream Analysis service in earlier versions.

After you update to 11.3, migrated ESA rule deployments have the following changes.

  1. If an ESA rule deployment contains two services before you upgrade to 11.3, the deployment splits into two deployments. You can only have one ESA Correlation service in an ESA rule deployment in version 11.3.
  2. If an ESA service has multiple ESA rule deployments before you upgrade to 11.3, they are combined into one deployment in version 11.3.

You can still access your old deployments. For a detailed example, see the ESA Configuration Guide for RSA NetWitness Platform 11.3.



You are here
Table of Contents > Introduction