Investigate: Investigate NetWitness Endpoint 4.4.0.2 or Later Hosts

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Apr 3, 2018
Version 2Show Document
  • View in full screen mode
 

Note: The information in this topic applies to RSA NetWitness® Suite Version 11.1 and later.

If you have NetWitness Endpoint 4.4.0.2 or later in your deployment, you can view the endpoint data of these hosts in the INVESTIGATE > Hosts and INVESTIGATE > Files views.

If you do not see the NetWitness Endpoint 4.4.0.2 hosts listed here, see "Integrating NetWitness Endpoint 4.4.0.2 or Later with NetWitness Endpoint 11.1" in the RSA NetWitness Endpoint Insights Configuration Guide.

The NetWitness Endpoint 4.4.0.2 hosts can be identified in the Hosts View using the Agent Version. You cannot perform an on-demand scan on these hosts. To investigate these hosts, you must use the NetWitness Endpoint 4.4.0.2 or later user interface.

Note: To pivot to the thick client from the NetWitness Suite user interface, the NetWitness Endpoint 4.4.0.2 or later must be installed.

To investigate a host in the NetWitness Endpoint user interface:

  1. Go to INVESTIGATE > Hosts.
  2. Select the 4.4 host from the table.
  3. Click Pivot to Endpoint.

Note: The Pivot to Endpoint option is not applicable for the NetWitness Endpoint Insights11.1 hosts.

Previous Topic:Investigate Hosts
You are here
Table of Contents > Investigating Hosts and Files > Investigate NetWitness Endpoint 4.4 or Later Hosts

Attachments

    Outcomes