RSA NetWitness Logs & Network Troubleshooting ESA EPL Rules

Document created by Craig Hansen Employee on Feb 4, 2016Last modified by Connor Mccarthy on Apr 26, 2018
Version 18Show Document
  • View in full screen mode

Register Now



In order to register for a class, you need to first create an EMC account

If you need further assistance, contact us



This on-demand learning will enable you to troubleshoot RSA NetWitness Logs & Network Event Stream Analysis (ESA) Rules.



This self-paced on-demand learning will improve your understanding of how to troubleshoot RSA NetWitness Logs & Network Event Stream Analysis (ESA) rules. While troubleshooting ESA in general is an important skill, the #1 issue in the field is troubleshooting ESA rules in particular. With "just show me" videos, this course addresses the most common reasons that rules don't work. It first discusses ways to determine whether or not it is a "rule issue." It outlines the most common “rule issues" and provides approaches to resolving them. The course continues with tips, tricks, and tools for troubleshooting rules and general strategies for working with rules. It also will help you avoid some common "Gotchas." The content is designed for troubleshooting the 10.x versions of the product.



Anyone interested in troubleshooting ESA EPL rules

Delivery Type
On-Demand Learning



1.5 hours


Prerequisite Knowledge/Skills

Students should have completed the following courses (or have equivalent knowledge) prior to taking this training:


Course Objectives

Upon successful completion of this course, participants should be able to:

  • Describe basic-practices for troubleshooting SA ESA rules
  • After viewing “just show me” style videos, identify where to go, what to look for, and a common methods for resolving common issues with ESA rules
  • Describe tips and tricks to avoid common misconfigurations


Course Outline

  1. Introduction
    • Narrow down ESA troubleshooting to “Rule Issues”
    • Cursory Considerations for Rule oriented issues
    • Cross-site Correlation
  2. Types of ESA Rules Issues
    • Issues Downloading Published Content
    • Missing Required Meta
    • Rules Not Able to Synchronize
    • Syntax Errors
    • Too Many Alerts
    • Memory Issues from Poorly Written Rules
    • Meta Value Case-Sensitivity
    • Time Window Issues
    • Misuse of Order and Memory
    • Problems Getting Alerts – and Storage High
    • Issues involving Too Many Events
  3. Summary
  4. Assessment
  5. Course Evaluation



Register Now



In order to register for a class, you need to first create an EMC account

If you need further assistance, contact us