Helpful "How To" Videos
I have created a few "how to videos" that I hope you find helpful. They are posted to YouTube and I have included the links below.
They are as follows:
Demo of the new ESI tool -->https://youtu.be/_FilrZc2qLc
How to Configure IIS Collection for Security Analytics --> IIS Device Configuration - YouTube
How to Configure Windows Collection via WinRm --> WINRM Windows Collection - YouTube
How to Configure Security Analytics to Collect Log files not currently Supported via SFTP --> FileSpec Creation - YouTube
ESI Beta 3 --> RSA ESI Beta 3 - YouTube
RSA Netwitness UI Walkthrough -->
Lua Parser Overview --> RSA Netwitness LUA Parser Overview - YouTube
Creating Parsers when No Message ID Exists in the Log --> Parser Development When No Message ID Exists - YouTube
Building and Scheduling Reports in Netwitness --> Building and Scheduling Reports in NetWitness - YouTube
Creating and Using Feeds and App Rules --> Using Application Rules and Feeds in NetWitness - YouTube
Correlation Rule Example --> YouTube
Creating Dashboards --> Dashboard Creation - YouTube
DNS Xfil Example --> https://www.youtube.com/watch?v=3x4rnmlrHww&t=7s
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
Really liked the video on the new ESI tool. Do you have any idea when there will be any updates to it as the current 'beta' version does tend to crash a bit. We were told at a recent user group that RSA were using an agile development approach for this particular tool and were to expect regular updates so would be good to hear one way or the other.
thanks for videos dave.
Any chance you or someone from RSA could publish detailed documentation/how to's on how to leverage the upcoming plugin framework and/or lua development for logs and packets? Specifically would like to learn how to learn how to leverage the plugin framework to normalize XML/JSON log structures
Are there any detailed examples of how to create a custom parser for event sources that do not supply a message ID in the header? I see some brief references, but am still looking for a good tutorial to handle the types of events I'm seeing.