000026811 - How to extract NWD (NetWitness data) files from RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026811
Applies ToRSA Security Analytics
RSA Security Analytics Concentrator
IssueHow to extract NWD (NetWitness data) files from RSA Security Analytics.
Resolution

NWD files are sometimes useful to Technical Support for troubleshooting. NWD files are pcap or log files which contain all parsers and meta information.


 


To extract NWD files from RSA Security Analytics, follow the steps below.


  1. From the Security Analytics UI, navigate to Investigation -> Navigate and select the concentrator in question.
  2. Iidentify the network or log event type for which you want to extract the NWD.
     

    For instance:


     




  3. As shown above, identify the session ID.



  4. Copy the following link into a browser: http://<concentratorIP>:50105/sdk/content?session=<session number>&&render=nwd
         Where concentratorIP is the IP address of the concentrator and session number is the session number you identify in the investigator module (in this example 244625).



  5. Once you browse to the link above, you will be asked to insert the RSA Security Analytics admin credentials.



  6. Once you insert the credentials, a file called "Content" will be downloaded. Change the extension of the file to .nwd This will be the nwd file that you need and will contain all parsers and meta information.


Notes

Once you open the session in the Investigator, this will be cached  in the concentrator server in /var/netwitness/concentrator/cache


Therefore you will have a file called sessionID.nwd (244625.nwd in this example). Alternatively you can use an SFTP client (such us WinSCP)  to download the sessionID.nwd file from the concentrator 

Legacy Article IDa65964

Attachments

    Outcomes