RSA NetWitness Endpoint Administration

Document created by Elena Komarova Employee on Mar 29, 2017Last modified by Connor Mccarthy on May 9, 2018
Version 10Show Document
  • View in full screen mode




In order to register for a class, you need to first create an EMC account

If you need further assistance, contact us



Learn and practice real-world NetWitness Endpoint administration tasks, including machine group creation, user privilege assignment, and performance evaluation.



This training is intended for anyone responsible for maintaining a deployment of RSA NetWitness Endpoint. The eLearning and on-demand lab provide instruction and practice in the core responsibilities of any RSA NetWitness Endpoint Administrator, including management of scans, notifications, and global parameters. Additional topics include machine and user group creation and assignment, endpoint agent roll-outs, performance and usability evaluation, endpoint memory capture for troubleshooting, and upgrade enablement. The lab exercises focus on practicing these common real-world tasks. Approximately 60 minutes of coursework with 30 minutes lab exercises in virtual environment.



Anyone responsible for maintaining a deployment of RSA NetWitness Endpoint


Delivery Type
On-Demand Lab

1.5 hours
Note: RSA University’s lab environment is provided for 10 hours of overall practice time over a 14-day period.

Accessing the Lab Environment
Lab exercises are performed in the RSA University virtual lab environment. The downloadable Lab Guide provides detailed instructions on access the environment. For more information please view the document Access RSA University Virtual Labs – available on the RSA University site: RSA University Content.

Prerequisite Knowledge/Skills

Students should have completed the following training (or have equivalent knowledge) prior to taking this training:

Understand the basic functionality and interface of RSA NetWitness Endpoint, so you should have completed either the RSA NetWitness Endpoint Fundamentals, the RSA NetWitness Endpoint Foundations instructor-led course, or have equivalent experience using the tool.


Learning Objectives

Upon completion of this course, participants should be able to:

  • Review architecture of deployment
  • Define admin responsibilities

  • Create and manage endpoint scans

  • Delete database artifacts

  • Optimize global parameters, including data retention period

  • Machine group creation and administration

  • User privilege management through user groups

  • Evaluate performance and usability to enable optimization

  • Prepare for RSA NetWitness Endpoint upgrades.


Course Outline

On-Demand Learning

1. Administration Basics

2. Performance and Resources

3. Upgrades and Additions

4. User Management

5. Scans and Machine groups
On-demand Lab

1. Assess deployment

2. Add agent

3. Set global parameters

4. Define user roles and privileges










In order to register for a class, you need to first create an EMC account

If you need further assistance, contact us