Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Investigate: Download Data in the Event Analysis View

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Jan 30, 2020
Version 8Show Document
  • View in full screen mode
 

In the Events view, you can download data from the Events panel and from a reconstruction. The Events panel download available in Version 11.4 is a bulk download of log and network events for all the event types. From within a reconstruction, you can download events, logs, and files.

Note: The information that you can view and download is managed by Role-Based Access Controls (RBAC) that your administrator has implemented. When RBAC is configured to prevent downloads of certain data, events for which you do not have download permission may appear to download successfully, but they are 0 byte in size. When RBAC is configured to prevent reconstruction of certain events, the reconstruction is disabled from the Events panel, but the bulk download button is still enabled.

Download Log or Network Events in the Events Panel (Version 11.4 and Later)

After submitting a query you can download logs and network events in your preferred format, directly from the Events panel. The preferences are set in the Event Preferences dialog and any changes made there are reflected inside the Download menu. See Configure the Events View for more information about preferences.

In the Events panel, you can select events individually or select all events returned by your search. The selection checkboxes appear only if you have permission to download the events. All checkboxes are deselected when a new query is submitted. When you select events and click Download, the Download menu is displayed. The number of events selected for each event type is displayed next to each option in the format Events of this type selected/ Total number of events selected. If an event type has no events selected, the corresponding download option is disabled and the number of events selected is displayed as 0 / Total number of events selected as shown in the following figure.

the menu for downloadin selected events

 

If the select all checkbox is selected, the event count is no longer displayed in the menu as shown in the following figure.

the Download All menu in the Events view

Note: When you select all events for download, only the events in the current result set are downloaded. If you canceled the query before all results were returned, only the events that were loaded are downloaded.

To download event data for one event, multiple events, or all events in the Events panel:

  1. Do one of the following:
    1. To select events individually, select the checkbox next to each event you want to download, and click the Download menu label to see the options.
      the menu for downloadin selected events
    2. To select all events displayed in the Events panel, select the checkbox at the top of the Events panel and click the Download All menu label.
      the Download All menu in the Events view
  2. Review the Default Options in effect in the top section of the menu. If you do not want to use the default format, you can choose a different format from the Other Options section of the menu.

    • Logs are downloaded in the preferred format that you selected in the Events Preference menu (Logs asText, Logs as CSV, Logs as JSON, or Logs as XML). If you want to choose a different format for this download, select one of the formats from lower part of the menu.

    • Network events are downloaded as a PCAP. When downloading multiple network events in the Events panel, the format is always PCAP. The preferred format that you specified in the Events Preference menu (Network as PCAP, Network as Payloads, Network as Request Payload, or Network as Response Payload) is ignored in this menu. Your preferred format applies only to downloading a single network event in the network reconstruction panel.
  3. Click the menu label: Download or Download All.
    The download begins immediately within the browser window if the Download extracted files automatically preference is set (Events view > Open Preferences icon). If the preference is not set, the download job for the selected events is added to the Jobs tray, where you can download the events.
    If the download fails, a message provides feedback regarding why the download failed. The download button is re-enabled and any selected events remain selected. These are examples of reasons for a failed download: timeout after X minutes, connection failed, event limit reached, and permission denied.
  4. To display the Jobs tray, go to Investigate > Navigate or Investigate > Events, and click the the Jobs icon Jobs icon, which looks like a stop watch.
    The jobs are displayed in the Jobs tray.
    download jobs in the Jobs tray

Download a Log in the Text Panel

When viewing a log reconstruction in the Text panel, you can download a log file in the following formats using options in the Download Log drop-down menu:

  • Comma-separated values (CSV) using the Download CSV option
  • Extensible Markup Language (XML) using the Download XML option
  • JavaScript Object Notation (JSON) using the Download JSON option

This is an example of a log reconstruction with the Download Log (11.3) or Download Text (11.4 and later) menu options displayed.

example of the Download Log menu

Note: TheDownload Log (11.3) or Download Text (11.4 and later) option is applicable only for endpoint events that have at least one meta value exceeding 256 characters. For an endpoint event, the raw log is populated only when the meta value exceeds 256 characters. Long running or historically downloaded files are not downloadable.
For example, the meta values like launch arguments can exceed 256 characters. In this case, 256 characters are available as meta value while the full value is available in the raw log to view.

The downloaded log file contains the log and is named to help identify the service on which the log was collected, the session ID, and the file type. This is an example of the filename for a raw log: Concentrator_SID2.log. The exported log file is named using the following convention:

<service-ID or host name>_SID<n>.<filetype>

where:

  • <service-ID or host name> is the name of the service (for example a Concentrator or Broker) where the session was saved.
  • SID<n> is the session ID number.
  • <filetype> identifies the format of the downloaded log. These are the possible log types: raw log, CSV, XML, and JSON. By default, the format is a raw log.

Note: Some formats do not have time stamps or the device IP where the event was generated, so a log downloaded in CSV, XML, or JSON format has an extra value called timestamp along with the raw log content. The additional information inside the log is in this form: Log timestamp="1490824512" source="10.12.35.65".

To download the log for a session:

In the Text panel of a log event, select one of the file formats for the downloaded log.

  • To download the log as a raw log (the default format), click Download Log.
  • To download the log in one of the other formats, click the downward arrow on the the Download Log (11.3) or Download Text (11.4 and later) button, and select one of the file formats for the downloaded log.

Text Analysis with Download Log menu

The log file is downloaded to your local file system in the format specified. If you initiate a download and move away from the view while the log is being extracted and before the log starts to download, the log is not downloaded in your browser. A message notifies you that you can find the downloaded log in the job queue.

Download Network Event Data in the Text Panel or the Packet Panel

When viewing a reconstructed network event in the Packet panel or the Text panel, you can export network data files for further analysis. The download includes events for the current time range and drill point. You can download the data in these forms:

  • The entire event as a packet capture (*.pcap) file using the Download PCAP option.
  • The payload as a *.payload file using the Download All Payloads (11.3) or Download Payloads (11.4) option.
  • The request payload as a *.payload1 file using the Download Request Payload option.
  • The response payload as a *.payload2 file using the Download Response Payload option.

The label on the download menu button is one of these formats, based on the setting selected in the Event Preferences dialog. If the event does not have that type of date, the menu button is dimmed. You can click on the menu button to see which options are available. For example, if an event has a request payload, but no response payload, the Download Response Payload button is dimmed. You can click on the button and select Download Request Payload for this download. After selecting a valid format, clicking the button executes the download.

This is an example of the filename for a PCAP file: C01 - Concentrator_SID1697309.pcap. The exported network data file is named using the following convention:

<service-ID or host name>_SID<n>.<filetype>

where:

  • <service-ID or host name> is the name of the service (for example a Concentrator or Broker) where the session was saved.
  • SID<n> is the session ID number.
  • <filetype> is pcap, payload, payload1, or payload2.

The network data is downloaded directly into your browser if the download is quick. If the download takes longer due to network factors or file size, the file is downloaded in the background and the task is tracked in the Jobs queue. In this case, you can check your jobs in the queue and get the file when the download is complete.

Note: If you initiate a download and move away from the view while the file is being extracted and before the file starts to download, the file is not downloaded in your browser. A message notifies you that you can find the downloaded document in the job queue.

To export an event as a network data file:

Go to the Packet panel of a network event click the Download menu button. The label is the same as the download option set in the Events Preferences dialog. Click the Download menu label to see other formats that you can select.

  • To download the event as a PCAP file (the system-defined default format) or in the user-defined default format, click Download <format> button.
  • To download the event in one of the other formats, click the downward arrow on the button, and select one of the file formats for the downloaded event data.

The network data file is downloaded to your local file system in the format specified.

Download Files from a Network Event in the File Panel

When viewing reconstructed network events that contain files in the File panel, you can select one or more files, or all files, to download to your local file system.

Note: If you initiate a download and move away from the view while the file is being extracted and before the file starts to download, the file is not downloaded in your browser. A message notifies you that you can find the downloaded file in the job queue.

When files are selected, the Download Files button becomes active and reflects the number of files selected.

example of the File Analysis with files selected

Clicking Download Files exports the selected files as a password-protected zip archive. The password to open the exported archive is netwitness. Exporting the files in this form ensures that:

  • The archive is not quarantined by antivirus software.
  • Potentially malicious files are not automatically opened by the default application and executed.

This is an example of the filename for an archive: C01 - Concentrator_SID1697309_FC1.zip. The exported archive is named using the following convention:

<service-ID or host name>_SID<n>_FC<n>.zip

where:

  • <service-ID or host name> is the name of the service (for example a Concentrator or Broker) where the session was saved.
  • SID<n> is the session ID number.
  • FC<n> is the file count or number of files in the archive.

Caution: Caution is advised when unzipping and opening files that are associated with a default application; for example, an Excel spreadsheet may automatically open in Excel before you have a chance to verify it is safe.

To export files in a reconstructed event:

  1. In the Events view, go to the File panel of an event that contains files.
    example of File Analysis with Files selected
  2. Click one or more files that you want to extract, and click Download File or Download Files.
    The job is scheduled and when complete the selected file are downloaded, in the form of a password-protected zip archive, to the local file system.
  3. To open the archive on your local file system, enter the following password when prompted: netwitness.

You are here
Table of Contents > Downloading and Acting Upon Results > Download Data in the Events View

Attachments

    Outcomes