AWS Installation Overview

Before you can deploy RSA NetWitness Platform in the Amazon Web Services (AWS) you need to:

  • Review the recommended compute and memory specifications needed for each RSA NetWitness Platform instance.

  • Get familiar with the RSA NetWitness Platform Storage Guide to understand the types of drives and volumes needed to support NetWitness instances. For more information, see the Storage Guide for RSA NetWitness® Platform 11.x.
  • Make sure that you have a NetWitness Platform Throughput license.

When you are ready to begin deployment, you can purchase any of the following Third-Party solutions for packet capture in AWS. If you engage one of these third-parties, they will assign an account representative and a professional services engineer to you who will work closely with RSA Support.

AWS Environment Recommendations

AWS instances have the same functionality as the NetWitness Platform Azure, virtual, and hardware hosts. RSA recommends that you perform the following tasks when you set up your AWS environment.

  • Based on the resource requirements of the different components, follow the best practices to use the system and the dedicated storage Elastic Block Store (EBS) Volumes appropriately.
  • Make sure that the compute capacity provides a write speed of 10% greater than the required sustained capture and ingest rate for the deployment.
  • Build a Concentrator directory for the index database on the Provisioned IOPS SSD.

AWS Deployment Scenarios

Before you can deploy NetWitness Platform you need to:

  • Consider the requirements of your enterprise and understand the deployment process.
  • Have a high-level picture of the complexity and scope of a NetWitness Platform deployment.


The components and topology of a NetWitness Platform network can vary greatly between installations, and should be carefully planned before the process begins. Initial planning includes:

  • Consideration of site requirements and safety requirements.
  • Review of the network architecture and port usage.
  • Support of group aggregation on Archivers and Concentrators, and virtual hosts.

When updating hosts and services, follow recommended guidelines under the "Running in Mixed Mode" topic in the RSA NetWitness Platform Host and Services Getting Started Guide.

You should also become familiar with Hosts, Host Types, and Services as they are used in the context of NetWitness Platform also described in the RSA NetWitness Platform Host and Services Getting Started Guide.

NetWitness Platform High-Level Deployment Diagram

The NetWitness Platform is inherently modular. Whether organizations are looking to deploy on-premise or in the cloud, the NetWitness components are decoupled in a way which allows flexible deployment architectures to satisfy a variety of use cases.

The following figure is an example of a hybrid cloud deployment, where the base of the components are residing within the SecOps VPC. Centralizing these components make management easier while keeping network latency to a minimum.

Network, log and endpoint traffic could then be aggregated up to the SecOps VPC. The on-premise location would function just like a normal physical deployment and would be accessible for investigations and analytics.

Cloud SaaS visibility could be captured from a Log Decoder residing in either the cloud or on-premise locations.

Example of NetWitness Platform deployment using a hybrid cloud environment.


You need the following items before you begin the installation process:

  • Ixia account (
  • Access to AWS console
  • Network rout-able (and proper AWS Security Groups) for the containers to transfer data to the NetWitness Platform Decoder.