RSA NetWitness 11.3 Documentation - Configure & Manage

Document created by Susan Ewald Employee on Aug 16, 2019•Last modified by Susan Ewald Employee on Nov 7, 2019
Version 35Show Document
  • Comment • 0
  • View in full screen mode

Configure Basic Services

Understand Hosts and Services

Deploy a Host and Install Services

 

Configure Network Data (Packet) Capture

Configure a Network Decoder to Capture Data

Configure a Broker or Concentrator to Aggregate Data

Start and Stop Data Capture

Filter Unwanted Data and Set Up Rules for Alerting

Configure Feeds and Parsers

 

Configure Log Collection

Configure a Log Decoder to Capture Data

Configure Basic Log Collection

Configure Supported Event Sources

Configure Event Sources for Log Collection

Configure the Windows Legacy Collector

Customize Log Parsers

Use the Log Parser Tool to Edit Log Parsers (Advanced)

Archive Log Data

 

Configure Endpoint Data Collection

Configure the Endpoint Log Hybrid for Endpoint Data Collection
Forward Endpoint Data to a Log Decoder
Set Up NetWitness Endpoint 4.4.0.x IIOCs
Set Up Risk Score Calculation for Endpoints 
Install Agents and Define Agent Behavior  
Install and Configure a Relay Server to Monitor Endpoints outside Your Network | (Video)
Integrate RSA NetWitness Platform with NetWitness Endpoint 4.4.0.2 or Later 

 

Configure UEBA

Configure UEBA Users

 

Configure Real-Time Analysis, Enrichment Lookup, and Automated Threat Detection

Configure Event Stream Analytics
Review Best Practices for Writing ESA Rules
Configure Enrichment Lookup Capability 
Configure Automated Threat Detection

 

Configure Incident Management Capability

Configure Incident Response Settings

 

Configure Application Settings and Dashboards

Configure Access, Notification, Logging, Investigation, Live, and Syslog Settings

Configure Your Dashboard

Review the Dashboards Catalog

 

Configure Reports

Set Up RSA NetWitness for Report Generation

Configure and Generate Reports

Review RSA NetWitness Reports

Review Core Compliance Reports

 

Configure Security and User Access

Secure the RSA NetWitness Platform Network (Maintenance Contract Required)
Set Up System-Level Security Settings
Change the Default Admin Password
Configure External Authentication
Configure PKI Authentication
Use a Custom Server Certificate
Manage Users with Roles and Permissions
Implement Data Privacy

 

Maintain the System

Monitor Health and Wellness
Reissue Certificates
Track License Usage
Tune Core Database Performance
Manage Periodic Backups and Incidental Restoring

Attachments

    Outcomes

      Visibility: RSA NetWitness Platform 11.36358 Views
      Last modified on Nov 7, 2019 10:34 AM
      Categories: Table of Contents
      Ratings: