000026595 - How to configure efficient traffic filtering on RSA NetWitness PlatformDecoders

Document created by RSA Customer Support Employee on Jan 10, 2017Last modified by RSA Customer Support on Sep 25, 2019
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000026595
Applies ToRSA Product Set: NetWitness Logs and Network
RSA Product/Service Type: Packet Decoder
RSA Version/Condition: 10.6.x and 11.x

A common task in the care and maintenance of your RSA NetWitness Decoders is the review of traffic types to apply the appropriate network rule and application rule filters.  Filtering unwanted traffic is good for the overall health of the system.

Why filter traffic coming into your decoder(s)?

Network traffic allowed into your network should be covered by some type of governance or policy e.g. an information classification system.  If there are security controls in place that regulate traffic, then a decision may be made to accept the risk associated with certain types of common traffic and NOT monitor this traffic using the RSA NetWitness NextGen system.

One of the factors in this decision will be if this common traffic comprises a significant portion of daily collected traffic.

 Goals of Filtering

  • Improve visibility into unknown and untrusted traffic
    Once the more common traffic has been filtered, this allows for unusual or untrusted traffic to become more readily visible to your security analysts. 
    As an analogy, once you remove the forest, the trees become easier to see.
  • Reduce database overhead
    The decoders are essentially huge databases that have to categorize and store meta and session information on all traffic captured. 
    If large volumes of common traffic are filtered, then the database doesn't have to work as hard to maintain this data storage.
  • Speed queries, faster index
    If database overhead is reduced, queries for traffic become quicker and the index is more responsive.
  • Dedicate storage to uncommon and interesting
    Your long term storage of packet and meta information is important for historical purposes during incident response. 
    By filtering, you are able to dedicate more storage space that is retained for longer by eliminating traffic that is irrelevant to your forensic investigations.
  • Creates more meaningful alerts
    The alerts that come with RSA NetWitness or custom content become more valuable when you know that it is not alerting on false positives triggered by a common, trusted site or known accepted traffic.
NotesSome useful links for other KBs related to traffic filtering:



Legacy Article IDa59830