Introduction

RSA NetWitness® UEBA standalone installation is designed to support other security tools such as Security Information and Event Management (SIEM). It allows users of a third-party SIEM solutions to leverage RSA NetWitness for UEBA.

RSA NetWitness® UEBA standalone installation includes:

1. NetWitness Admin Server

2. NetWitness Log Hybrid

3. NetWitness UEBA

Note: RSA NetWitness® UEBA standalone installation supports up to 100,000 users on a single running instance. If you have more than 100,000 users, contact RSA Customer Support.

Windows Log Sources

NetWitness UEBA standalone installation natively supports the following Windows log sources:

  • Windows Active Directory
  • Windows Logon and Authentication Activity
  • Windows File Servers
  • Windows Remote Management

For more information, see the "NetWitness UEBA Use Cases for Windows Logs" topic in the RSA NetWitness UEBA User Guide.