Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Upgrade Guide 11.4: Upgrade Overview

Document created by RSA Information Design and Development Employee on Jan 30, 2020Last modified by RSA Information Design and Development Employee on Nov 18, 2020
Version 10Show Document
  • View in full screen mode

RSA NetWitness Platform provides enhancements and fixes for all products in the Platform. The components of the platform are: The NetWitness Server (Admin server, Config server, Integration server, Investigate server, Orchestration server, Respond server, Security sever, and Source server), Archiver, Broker, Concentrator, Context Hub, Decoder, Endpoint Broker, Endpoint Log Hybrid, ESA Primary, ESA Secondary, Health & Wellness Beta, Log Collector, Log Decoder, Log Hybrid, Log Hybrid Retention, Malware Analysis, Network Decoder, Network Hybrid, Reporting Engine, UEBA, and Warehouse Connector.

Note: The Reporting Engine is installed on the NetWitness Server (NW Server) host, Workbench is installed on the Archiver host, Warehouse Connector can be installed on the Decoder host or Log Decoder host.

The instructions in this guide apply to both physical and virtual hosts (including AWS and Azure Public Cloud) unless stated to the contrary.

Upgrade Path

The following upgrade paths are supported for NetWitness Platform

  • RSA NetWitness Platform 11.2.x.x to
  • RSA NetWitness Platform 11.3.0.x to
  • RSA NetWitness Platform 11.3.1.x to
  • RSA NetWitness Platform 11.3.2.x to

Go to the Master Table of Contents to find all RSA NetWitness Platform 11.x documents.
If you are upgrading from NetWitness Platform version 10.6.6.x, you must upgrade to before you can upgrade to 11.4. See the RSA NetWitness Platform 10.6.6.x to 11.3 Physical Host Upgrade Guide and RSA NetWitness Platform 10.6.6.x to 11.3 Virtual Host Upgrade Guide for instructions on how to upgrade 10.6.6.x to

The following matrix shows all the supported upgrade paths.

Upgrade matrix

Running in Mixed Mode

Running in mixed mode occurs when some services are upgraded to the latest version and some services are on older versions. See "Running in Mixed Mode" in the RSA NetWitness Platform Hosts and Services Getting Started Guide for further information.

Upgrade Considerations for ESA Rule Deployments

Caution: In NetWitness Platform 11.3 and later versions, the ESA Correlation service contains data source changes that require changes to migrated ESA rule deployments. The newer ESA Correlation service replaces the Event Stream Analysis service in 11.2.x.x versions.

If you are upgrading from 11.2.x.x to 11.4, migrated ESA rule deployments have the following changes.

  1. If an ESA rule deployment contains two services before you upgrade to 11.4, the deployment splits into two deployments. You can only have one ESA Correlation service in an ESA rule deployment in version 11.4.
  2. If an ESA service has multiple ESA rule deployments before you upgrade to 11.4, they are combined into one deployment in version 11.4.

You can still access your old deployments. For a detailed example, see the ESA Configuration Guide for RSA NetWitness Platform 11.4.

Change to Column Groups in the Events View

To improve consistency when loading results in the Events view, the number of columns in a column group is limited to 40.

After you upgrade to 11.4, column groups migrated to the Events view from the Legacy Events view still function with more than 40 columns. However, when you edit those groups, you receive a warning that tells you to reduce the number of columns below the limit of 40 columns.

Feedback on Product Documentation

You can send an email to to provide feedback on NetWitness Platform documentation.

Contacting Customer Care

Use the following contact information if you have any questions or need assistance.

RSA Link
Phone 1-800-995-5095, option 3
International Contacts
Basic Support

Technical Support for your technical issues is available from 8 AM to 5 PM your local time, Monday through Friday.

Enhanced Support Enhanced Support Technical Support is available by phone 24 x 7 x 365 for Severity 1 and Severity 2 issues only.

You are here
Table of Contents > Overview