NetWitness Platform creates a list of suspicious users that have an incident created against them and sends it to RSA SecurID Access. The list contains the email IDs of the corresponding suspicious users associated with the incident. RSA SecurID Access maintains this high-risk users list and reduces the access levels or blocks such users using defined policies. When an incident is closed in RSA Netwitness Platform, the associated email IDs are automatically removed from the RSA SecurID high-risk user list.
By default this configuration is disabled in the NetWitness Server. You can enable this feature by editing the yml file located at /etc/netwitness/respond-server/respond-server.yml.
Enable Threat Aware Authentication
To enable this configuration:
- Create a yml file at /etc/netwitness/respond-server/respond-server.yml
- Edit and enter rsa.respond.securid-integration.enabled: true
- Save the yml file and restart the Respond Server service.
Obtain SecurID API Key
A super administrator must generate and download a SecurID API key, and connect to RSA SecurID Access.
To obtain the API key from RSA SecurID Access:
Log in to the RSA SecurID Access Cloud Administration Console.
Click Platform > API Key Management.
The new key is displayed.
Change the Administrator role to Super Administrator.
- Click Save and Download to download and save the API key file.
For more information about generating the API Keys and other related details, see "Manage the Cloud Administration API Keys" at https://community.rsa.com/docs/DOC-94440 and "Determining Access Requirements for High-Risk Users in the Cloud Authentication Service" topic at https://community.rsa.com/docs/DOC-90586.
Configure RSA SecurID Access API Key
To configure RSA SecurID Access API key using RSA NetWitness Shell:
- SSH to the NetWitness Server.
- Type the command nw-shell.
A console window is displayed.
- Type connect --service respond-server.<service-id> to connect to the Respond Server.
For example: connect --service respond-server.36334277-9f93-4402-9523-ed15ad543bfa.
You can obtain the <service_id> from cat /etc/netwitness/respond-server/service-id.
Type login and enter admin username and password.
To set the API key:
Navigate to set-api-key node: cd /rsa/respond/securid/set-api-key
type: invoke --file <path to api key>
- Test the connection using the command:
- cd /rsa/respond/securid/test-secur-id-connection
- Type invoke.
A "Connection OK" message is displayed if test connection is successful.
- To start the process use the command:
For more information on how to define policies, see the RSA SecurID Access Guide on RSA link.
Configure Sync Frequency
By default, the sync frequency is set to 15 minutes.
To edit the frequency:
- Log in to NetWitness Platform.
- Go to ADMIN > Services, select the Respond Server service, and then select > > View > Explore.
- Edit the duration at rsa/respond/securid.