000026595 - How to configure efficient traffic filtering on RSA NetWitness Decoders

A common task in the care and maintenance of your RSA NetWitness Decoders is the review of traffic types to apply the appropriate network rule and application rule filters.  Filtering unwanted traffic is good for the overall health of the system.

Why filter traffic coming into your decoder(s)?

Network traffic allowed into your network should be covered by some type of governance or policy e.g. an information classification system.  If there are security controls in place that regulate traffic, then a decision may be made to accept the risk associated with certain types of common traffic and NOT monitor this traffic using the RSA NetWitness NextGen system.

One of the factors in this decision will be if this common traffic comprises a significant portion of daily collected traffic.

 Goals of Filtering

• Improve visibility into unknown and untrusted traffic
  Once the more common traffic has been filtered, this allows for unusual or untrusted traffic to become more readily visible to your security analysts.  As an analogy, once you remove the forest, the trees become easier to see.
• Reduce database overhead
  The decoders are essentially huge databases that have to categorize and store meta and session information on all traffic captured.  If large volumes of common traffic are filtered, then the database doesn't have to work as hard to maintain this data storage.
• Speed queries, faster index
  If database overhead is reduced, queries for traffic become quicker and the index is more responsive.
• Dedicate storage to uncommon and interesting
  Your long term storage of packet and meta information is important for historical purposes during incident response.  By filtering, you are able to dedicate more storage space that is retained for longer by eliminating traffic that is irrelevant to your forensic investigations.
• Creates more meaningful alerts
  The alerts that come with RSA NetWitness or custom content become more valuable when you know that it is not alerting on false positives triggered by a common, trusted site or known accepted traffic.