000026718 - How to track RSA NetWitness user activity

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026718
Applies ToRSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Log Decoder
RSA NetWitness Concentrator
RSA NetWitness Hybrid
RSA NetWitness Broker
RSA NetWitness Administrator
RSA NetWitness NwConsole
AuditLogDownload.png
IssueHow to track RSA NetWitness user activity.
Resolution

1).  How can I track the activity of NetWitness users?

You can track user acitivity using the audit log messages.

Below  is a sample of downloaded audit logs specific to the user account "testuser" on a concentrator for the previous 24 hours. As you can see, a full history of what testuser did, when they were logged in, when they were logged out, the exact queries run, in addition to the time and the IP address of the computer being used. In the sample queries below, testuser appears to be trying to view all traffic related to www.facebook.com.

The full text of every query is recorded in the audit trail. Although audit logs do not record query results you can copy the query out of the audit logs and run it to verify the query results. This can be performed thru Investigator or by running the query from NwConsole or Administrator (Explorer View or Console). Please see the attached PDF document for example NwConsole and Administrator queries. 

Sample audit log activities:

16161076 audit 2010-Apr-27 17:45:54 Engine User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has logged in
16161077 audit 2010-Apr-27 17:45:56 SDK-Info User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has requested the SDK summary info
16161271 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has issued values: id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.src where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
www.facebook.com\""
16161275 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has finished values (elapsed time 00:00:00): id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.src where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
www.facebook.com\""
16161276 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has issued values: id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.dst where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
www.facebook.com\""
16161277 audit 2010-Apr-27 17:46:37 SDK-Values User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has canceled values (elapsed time 00:00:00): id1=1 id2=2642656608 size=20 flags=2305 threshold=100000 fieldName=ipv6.dst where="time\=\"2010-Apr-26 21:47:16\"-\"2010-Apr-27 21:47:15\" && alias.host\=\"
www.facebook.com\""
16161279 audit 2010-Apr-27 17:46:38 Engine User testuser (session 4983789, [::ffff:10.21.12.128]:54423) has logged out

 

2).  How much log data can be stored and is it overwritten over time?

The log database is configured to store 1 GB of log messages. Once that is exceeded, the newest logs overwrite the oldest logs.

In most cases, 1 GB is sufficient for many months of log messages. However it can be adjusted under /logs/config, assuming enough disk space is available.

Notes
Legacy Article IDa58612

Attachments

    Outcomes