NW: Setting Up Your Default View by SOC Role

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Jan 30, 2020
Version 12Show Document
  • View in full screen mode
 

After logging in to RSA NetWitness Platform, you can make navigating the application easier by setting up your default view based on your Security Operations (SOC) role. You set your default view, also known as a landing page, in your user preferences.

The following figure shows the main NetWitness Platform views.

Main Menu views: Respond, Investigate, Monitor, Configure, and Admin

  • Respond: This view is for Incident Responders, who can view a list of incidents to triage and alerts. For legacy 10.6 users, this view was known as the Incident Management view and the Respond > Alerts view replaces the ESA 10.6 Alerts > Summary view.
    Respond is the default opening view. If you do not have permission to see the Respond view, you will have Monitor as your default view.
  • Investigate: This view is for Threat Hunters, who investigate and hunt for advanced threats. Other analysts such as Incident Responders may pivot into this view for deeper analysis of an incident.
  • Monitor: This view is for all users and it is the classic view for previous application versions. You can view dashboards and reports on different areas of interest depending on your user permissions. You have the option to select a preconfigured dashboard, import a dashboard, or create your own custom dashboard.
  • Configure: This view is for Threat Intel personnel (Content Experts), who configure data sources and inputs to NetWitness Platform. Content Experts use this area to download and manage Live content. They can also create and manage incident and ESA rules.
    For legacy 10.6 users, this view was Live, Incidents > Configure, and Alerts > Configure.
  • Admin: This view is for System Administrators, who set up and maintain the overall application.

You can select any of the main NetWitness Platform views as your default view. In addition to the main views, NetWitness Platform has predefined dashboards that you can select in the Monitor view depending on the tasks you perform:

  • Default Dashboard

  • Identity Dashboard

  • Operations - Logs Dashboard

  • Operations - Network Dashboard
  • Overview Dashboard
  • Threat - Indicators Dashboard

  • Threat - Intrusion Dashboard

The following table shows typical SOC roles and the available views you can select as your landing page in your user preferences based on your SOC role. If you have more than one role, select the view that is most appropriate for you to start with when you log in to NetWitness Platform.

                                           
SOC RolesRole DescriptionConsider this Default Landing Page

Incident Responder
(Tier 1 Analyst)

Addresses incidents and alerts queued for them to review and mitigate.

RESPOND

Threat Hunter
(Tier 2/Tier 3 Analyst)

Investigates and hunts for advanced threats.

INVESTIGATE
For information on selecting the default Investigate view, see the NetWitness Investigate User Guide.

SOC Manager (SOC Management and Reporting)

Manages SOC readiness and responds to incidents and data breaches.

Monitor (Dashboard is in the Monitor view. When you log in, select the appropriate predefined dashboard for your SOC role. You can also import a dashboard or create your own dashboard.)

Content Expert
(Threat Intelligence)

Configures data sources and inputs to NetWitness Platform.

Monitor or Configure (Dashboard is in the Monitor view. When you log in, select the appropriate predefined dashboard for your SOC role. You can also import a dashboard or create your own dashboard. If you choose Monitor as your default view, you can navigate to the Configure view from the main menu.)

Data Privacy Officer
(DPO)

Similar to an Administrator, but a DPO monitors and protects privacy-sensitive information.

Monitor (Dashboard is in the Monitor view. When you log in, select the appropriate predefined dashboard for your SOC role. You can also import a dashboard or create your own dashboard.)

System Administrator

Focuses on the configuration and stability of the overall application. Manages user access.

ADMIN

Set Your Default View

  1. (Respond view and some Investigate views) On the main menu bar, select your username, for example, .

    The User Preferences dialog shows your current preferences.

    User Preferences dialog accessed from the Respond and Investigate views

  2. In the Default Landing Page field, select the default view that you would like to see when you log in to NetWitness Platform. Use the above table to make your selection based on your SOC role. For example, if you are an Incident Responder, you can select Respond and if you are a Threat Hunter, you can select Investigate.

    Your preferences become effective immediately. You can change your default landing page at any time. For information on other preferences, see Setting User Preferences.

  3. To verify that you can see the correct default view, click Sign Out to log out and then log back in to NetWitness Platform.

You are here
Table of Contents > Setting Up Your Default View by SOC Role

Attachments

    Outcomes