RSA announces the release of RSA NetWitness Platform

Document created by RSA Product Team Employee on Sep 26, 2019Last modified by RSA Product Team Employee on Sep 26, 2019
Version 2Show Document
  • View in full screen mode

RSA NetWitness is the latest version of the RSA NetWitness Platform and contains a number of important fixes for the 11.3.1 version of the system in addition to the capabilities originally introduced in 11.3.1. RSA recommends all 11.3 customers to upgrade to this release. Please refer to the Release Notes for more information on these fixes.


Customers upgrading from the 10.6.x release should upgrade to the newest version of 11.3 before installing


This latest version of RSA NetWitness Platform (NWP) continues to strengthen the platform’s threat detection capabilities by enabling offline endpoint visibility and expanding the detection of encrypted network sessions and anomalous user behaviors. In addition, numerous improvements to general performance, stability and platform-wide user auditing are addressed in this release.


BEFORE YOU UPGRADE: Review the RSA NetWitness Platform Update Instructions and Release Notes available on RSA Link.



Feature or EnhancementDescription
RSA NetWitness Relay enables offline reporting of NWE protected hostsRelay Servers (referred to as RAR in prior versions of RSA NetWitness Endpoint) extend RSA NetWitness Platform’s visibility into endpoints while connected outside the corporate network. By configuring a relay in either the cloud or DMZ, any NWE protected hosts can connect to the Relay Server to send updates on host activity and receive any time sensitive response actions. 
Expanded detection of encrypted channelsTo aid in identification of encrypted channels, the Network Decoder can produce the JA3 value of TLS clients and the JA3S value of TLS servers that are observed in a network session. 
Expanded RSA NetWitness UEBA detection capabilitiesRSA NetWitness UEBA adds support for RedHat Linux logs & Windows Network failed logons.
Improved RSA NetWitness UEBA scale and performanceRSA NetWitness UEBA has increased its scale of support for customers with large numbers of users (for example, 100,000 users) who generate large quantities of log and endpoint events.
Centralized & expanded audit loggingv11.3.1 now collects audit logs from all services and aggregates the logs into a single file in a centralized location for faster access and easy analysis.   Audit logging is also improved to provide further granularity on the action taken or the recipient of the action when that context is necessary. Audit logging descriptions for users logging on and off hosts have also been improved.
Performance optimizations for ESATo avoid unnecessary processing overhead, the Ignore Case option has been removed from the ESA Rule Builder - Build a Statement dialog for meta keys that do not contain text data values. ESA also now automatically adjusts the rule statement operator if an ESA rule references a meta key that changed from string to string array.
Apply version updates from UI without direct Internet accessAfter you update NetWitness Platform to 11.3.1, you can apply future version updates from the Hosts view in the user interface without a direct connection to the Internet.


Other Improvements:
• Save interval for Core Service indexes has been reduced to improve memory consumption.
• The Event Source Monitoring view is moved from Health & Wellness to the Event Sources Admin section.
• Health & Wellness monitoring is enabled for RSA NetWitness Endpoint Risk and Relay processes.
• Health & Wellness monitoring is expanded for Virtual Log Collectors & Log Collectors.
• Error messages for disabled ESA Rules are viewable in the RSA NetWitness Platform user
• Result messaging provides clarity for the reasons that events were not found in Investigate.
• New configurable Event Analysis view event limit in the ADMIN > System > Investigation panel.
• Configurable clearing of the reconstruction cache for the Event Analysis view to save disk space.
• Mitigated critical Python Security Vulnerability (RHSA-2019:0710).

For a full list of improvements and fixes in v11.3.1.1, please reference the RSA NWP v11.3.1.1 Release Notes.

For More Information:
Additional documentation, downloads, and more, visit the RSA NetWitness Platform page on RSA Link.

Have a Great Idea for Improving RSA NetWitness Platform?
Check out RSA Ideas for the RSA NetWitness Platform and either submit your idea for improving RSA NetWitness Platform or vote up other's ideas!


EOPS Policy:

RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.