RSA NetWitness Warehouse provides the capacity to process large amounts of current and long term data through a Hadoop-based distributed computing system that collects, manages, and enables advanced analytics and reporting on NetWitness Suite data. RSA NetWitness Warehouse requires a service called Warehouse Connector to collect metadata and events from Decoder and Log Decoder and write them in Avro format into a Hadoop-based distributed computing system. For more information on the Warehouse Connector, see "How Warehouse Connector Works" topic in the Warehouse Connector Configuration Guide.
The Warehouse is made up of three or more nodes depending on the organization's analytic, archiving, and resiliency requirements.
The following figure depicts the architecture of a NetWitness Suite network that implements the RSA NetWitness Warehouse component.
