RSA NetWitness Platform Live is the gateway to a rich environment that offers access to feeds, tools, and other resources.
NetWitness Platform Live
Live is the component of NetWitness Platform that manages communication and synchronization between NetWitness Platform services and a library of Live content available to RSA NetWitness Platform customers. Live provides a simple interface for browsing, selecting, and deploying content from the NetWitness Platform Live Content Management System to NetWitness Platform services and software. In addition to managing feeds from the CMS Library, Live allows users to deploy custom feeds and packages.
The CMS Library
The content management system (CMS) library (known as Live) is a valuable source of the latest internet security resources for NetWitness Platform customers. It provides a view into the collective intelligence and analytical skills of the worldwide security community to ensure that users have the most current visibility into attack vectors.
Live gathers the best advanced threat intelligence and content in the global security community - the ideas, research, ongoing tracking, and analysis - and brings it directly into the user’s security operations center to definitively classify computers associated with botnets, malware, and other malicious exploits. Live aggregates, consolidates, and illuminates only the most pertinent information relevant to an organization on a real-time basis.
NetWitness Platform Feedback and Data Sharing
Live Feedback is intended to help improve RSA NetWitness Platform. Once you set up and configure a Live account, usage data is shared with RSA.
RSA Live Connect is a cloud based threat intelligence service. This service collects, analyzes, and assesses threat intelligence data such as IP addresses, domains, and files collected from various sources. It is Threat Insights, which provide analysts the ability to pull threat intelligence data from the Live Connect service. It also offers Analyst Behaviors, an automated data collection service with the goal of sharing potential threat intelligence for analysis.
For more details, see NetWitness Platform Feedback and Data Sharing.
For Debian Linux and NetWitness Endpoint Users
If you are upgrading to NetWitness Platform 11.5 or later, and you are using NetWitness Endpoint and also have any Debian Linux endpoint systems, RSA recommends that you go to Live and download the following application rules:
- autorun debian package mismatch
- autorun file path not part of debian package
- debian package hash mismatch in important system directory
- debian package hash mismatch
- file path not part of debian package in important system directory
- file path not part of debian package