After logging in to RSA NetWitness Platform, you can navigate into the application easier by setting up your default view based on your Security Operations (SOC) role. You can set your default view, also known as a landing page, in your user preferences.
On upgrade to version 11.5 or later, by default the Springboard is displayed if you have not configured the default landing page in previous versions.
In version 11.4 and prior versions, if you configured the default landing page as Respond or Investigate in the User Preferences, then on upgrade to version 11.5, the default landing page will be Respond or Investigate view.
On fresh install of RSA NetWitness Platform 11.5 version, when you log in, by default Springboard is the landing page.
The following figure shows the main NetWitness Platform views.
- Springboard: This view is for Analysts, who can see panels for prioritized alerts, incidents, risky hosts, risky users, risky files, and focused event data to help hunt and investigate faster than ever before.
- Investigate: This view is for Threat Hunters, who investigate and hunt for advanced threats. Other analysts such as Incident Responders may pivot into this view for deeper analysis of an incident.
- Respond: This view is for Incident Responders, who can view a list of incidents to triage and alerts.
- Users: This view is for SOC Managers and Analysts to discover, investigate, and monitor risky behaviors across entities namely Users and Network in your environment.
- Hosts: This view is for Analysts, who can investigate or perform analysis on hosts using attributes such as IP address, host name, Mac address, risk score, and so on.
- Files: This view is for Analysts, who can investigate or perform analysis on files using attributes such as IP address, host name, Mac address, risk score, and so on.
- Dashboard: This view is for all users. You can view dashboards on different areas of interest depending on your user permissions. You have the option to select a preconfigured dashboard, import a dashboard, or create your own custom dashboard.
- Reports: This view is for all users. You can view reports on different areas of interest depending on your user permissions.
- Configure: This view is for Threat Intel personnel (Content Experts), who configure data sources and inputs to NetWitness Platform. Content Experts use this area to download and manage Live content. They can also create and manage incident and ESA rules.
- Admin: This view is for System Administrators, who set up and maintain the overall application.
You can select any of the main NetWitness Platform views as your default view. In addition to the main views, NetWitness Platform has predefined dashboards that you can select in the Dashboards view depending on the tasks you perform:
Operations - Logs Dashboard
- Operations - Network Dashboard
- Overview Dashboard
Threat - Indicators Dashboard
- Threat - Intrusion Dashboard
The following table shows typical SOC roles and the available views you can select as your landing page in your user preferences based on your SOC role. If you have more than one role, select the view that is most appropriate for you to start with when you log in to NetWitness Platform.
Set Your Default View
The User Preferences dialog shows your current preferences.
In the Default Landing Page field, select the default view that you would like to see when you log in to NetWitness Platform. Use the above table to make your selection based on your SOC role. For example, if you are an Analyst, you can select Springboard; if you are an Incident Responder you can select Respond; and if you are a Threat Hunter, you can select Investigate.
Your preferences become effective immediately. You can change your default landing page at any time. For information on other preferences, see Setting User Preferences.
- To verify that you can see the correct default view, click Sign Out to log out and then log back in to NetWitness Platform.