RSA NetWitness Platform 220.127.116.11 provides enhancements and fixes for all products in NetWitness Platform. The instructions in this guide apply to both physical and virtual hosts (including AWS, Azure Public Cloud, and Google Cloud Platform) unless stated to the contrary.
The following upgrade paths are supported for NetWitness Platform 18.104.22.168:
- RSA NetWitness Platform 11.3.x.x to 22.214.171.124
- RSA NetWitness Platform 11.4.x.x to 126.96.36.199
- RSA NetWitness Platform 11.5.x.x to 188.8.131.52
If you are upgrading from NetWitness Platform version (10.6.6.x) or (11.2.x.x or below), you must upgrade to 184.108.40.206 or 220.127.116.11 before you can upgrade to 18.104.22.168. For more information, see the guides that apply to your environment.
For upgrading from 22.214.171.124, or 126.96.36.199, see the Upgrade Guide for RSA NetWitness Platform 188.8.131.52. This guide applies to both physical and virtual hosts (including AWS and Azure Public Cloud).
Running in mixed mode occurs when some services are upgraded to the latest version and some services are on older versions. See "Running in Mixed Mode" in the RSA NetWitness Platform Hosts and Services Getting Started Guide for further information.
Upgrade Considerations for ESA Hosts
Mixed mode is not supported for ESA hosts in NetWitness Platform version 11.5 and later.
Upgrade Considerations for ESA Analytics
The Event Stream Analytics Server (ESA Analytics) service is not supported or available in NetWitness Platform version 11.5 and later. The Whois Lookup Configuration and ESA Analytics Mapping panels are no longer in the user interface ( (Admin) > System).
Upgrade Considerations for STIX Custom Feeds
The custom feeds created before version 11.5 are processed automatically. On upgrade, the data sources created for ADHOC, REST and TAXII server and the feeds are pulled automatically. See "Create a STIX Custom Feed" in the RSA NetWitness Platform Live Service Management Guide and "Configure STIX as a Data Source" in the RSA NetWitness Platform Context Hub Configuration Guide for further information.
Change to Column Groups in the Events View
To improve consistency when loading results in the Events view, the number of columns in a column group is limited to 40.
If you are upgrading from version 184.108.40.206 or later, after you upgrade to 220.127.116.11, column groups migrated to the Events view from the Legacy Events view still function with more than 40 columns. However, when you edit those groups, you receive a warning that tells you to reduce the number of columns below the limit of 40 columns.
Upgrade or install Windows Legacy Collection
Refer to the Windows Legacy Collection Guide for RSA NetWitness 11.x (https://community.rsa.com/docs/DOC-103165).
Feedback on Product Documentation
You can send an email to email@example.com to provide feedback on NetWitness Platform documentation.