Investigate: Investigate NetWitness Endpoint or Later Hosts

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Sep 11, 2018
Version 4Show Document
  • View in full screen mode

Note: The information in this topic applies to RSA NetWitness® Platform Version 11.1 and later.

If you have NetWitness Endpoint or later in your deployment, you can view the endpoint data of these hosts in the INVESTIGATE > Hosts and INVESTIGATE > Files views.

If you do not see the NetWitness Endpoint hosts listed here, see "Integrating NetWitness Endpoint or Later with NetWitness Endpoint 11.1" in the Endpoint Insights Configuration Guide.

The NetWitness Endpoint hosts can be identified in the Hosts View using the Agent Version. You cannot perform an on-demand scan on these hosts. To investigate these hosts, you must use the NetWitness Endpoint or later user interface.

Note: To pivot to the thick client from the NetWitness Suite user interface, the NetWitness Endpoint or later must be installed.

To investigate a host in the NetWitness Endpoint user interface:

  1. Go to INVESTIGATE > Hosts.
  2. Select the 4.4 host from the table.
  3. Click Pivot to Endpoint.

Note: The Pivot to Endpoint option is not applicable for the NetWitness Endpoint Insights 11.1 hosts.

Previous Topic:Investigate Hosts
You are here
Table of Contents > Investigating Hosts and Files > Investigate NetWitness Endpoint 4.4 or Later Hosts