RSA NetWitness 11.3 Documentation - Investigate & Respond

Document created by Susan Ewald Employee on Aug 16, 2019•Last modified by RSA Product Team on Nov 24, 2019
Version 15Show Document
  • Comment • 0
  • View in full screen mode

Respond to Incidents

Configure Settings for Incident Management

Review Incident Response Use Case Examples

Respond to Incidents

Determine Which Incidents Require Action

Investigate an Incident

Escalate or Remediate an Incident

Review Threat Alerts

 

Configure System and View Settings for Investigate

Configure Query and Session Attributes for Analysts

Configure Global Default Settings and Limits for Investigate

Configure Navigate and Events View Settings (User Preference)

Configure Event Analysis View Settings (User Preference)

Configure Malware Analysis View Settings (User Preference)

 

Investigate Network Data and Logs

Understand Metadata and the Workflow of Investigation
Investigate Metadata in Logs and Network Data
Investigate Raw Events in Logs and Network Data
Query Data in the Navigate and Events Views
Search for Text Patterns in the Navigate and Events Views
Filter Results in the Navigate View
Filter Results in the Events View
Filter Results in the Event Analysis View
Manage Meta Groups
Manage Column Groups
Use Profiles to Encapsulate Common Investigations
Look Up Additional Context for a Data Point in the Navigate and Events Views
Look Up Additional Context in the Event Analysis View
Reconstruct an Event in the Navigate View or Events View
Reconstruct an Event in the Event Analysis View
Add Metadata to a Context Hub List
Create Incidents and Add Events to an Incident in the Events View
Conduct Malware Analysis

 

Investigate Endpoints

Review the Workflow of an Endpoint Investigation
 Analyze Legitimate and Suspicious Files
Investigate Suspicious Hosts and Detect Anomalies
Track Host Behavior and Analyze Risk Score
Analyze Process Behaviors
Advanced Analysis of Suspicious File
Remediate Threats

 

Analyze User and Entity Behavior

Understand How NetWitness UEBA Works
Review NetWitness UEBA Indicators
Investigate High-Risk Users
Investigate Top Alerts

 

Attachments

    Outcomes

      Visibility: RSA NetWitness Platform 11.313050 Views
      Last Modified by RSA Product Team on Nov 24, 2019 3:32 PM
      Ratings: