NetWitness certifications begin with the Associate exam which is the prerequisite to the role-based Specialist exams. Advancing beyond the Associate level, the Specialist exams are specific to the Analyst or Administrator roles. Customers, partners, and employees can take certifications for one or for both roles.
The NetWitness Associate exam is based on the RSA NetWitness Platform Foundations course, RSA NetWitness Administration I course, and the RSA NetWitness Endpoint Foundations course.
The NetWitness Specialist exam: Administrator is based on the RSA NetWitness Administration I and Administration II courses, RSA NetWitness Content Creation courses, and other on-demand training.
The NetWitness Specialist exam: Analyst is based on the RSA NetWitness Platform Foundations, RSA NetWitness Endpoint Foundations, RSA NetWitness Platform Analysis, and RSA NetWitness Platform Introduction to Hunting courses.
At this time, no Expert or Master level exams are being offered for NetWitness.
For users that obtained certifications between January 1st, 2019 and when the new exams are launched, the following mappings will apply:
- Users who obtained legacy RSA NetWitness Logs and Network Administrator, RSA NetWitness Logs and Network Analysts, RSA NetWitness Endpoint Administrator, or RSA NetWitness Endpoint Analyst certifications will be granted the new RSA NetWitness Associate certification
Note: Due to the feature enhancements that went in to making RSA NetWitness a complete Security Information and Event Management (SIEM) solution, all users will need to take the Specialist level exam for their role of choice.
Users that obtained legacy RSA NetWitness certifications (Logs and Network Administrator or Analysts and Endpoint Administrator or Analyst) before January 1, 2019 or are just beginning their RSA NetWitness certification journey are encouraged to begin with the new RSA NetWitness Associate certification and continue through the Proven Professional program in their role of choice.
Important: Be sure to note the expiration date for each exam. Associate level exams do not expire, but subsequent exams carry a two-year lifespan. In order to advance to a higher-level exam, the previous level exam must still be active.
For the most recent information regarding RSA Product Certifications, please click here to access the RSA Certification page on RSA Link.