This website uses cookies. By clicking OK, you consent to the use of cookies. Click Here to learn more about how we use cookies.
OK
  • RSA.com
  • Products
    • Archer®
      • Archer®
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Ideas
      • Knowledge Base
      • Archer® Exchange
      • Training
      • Upcoming Events
      • Videos
    • RSA® Fraud & Risk Intelligence Suite
      • RSA® Fraud & Risk Intelligence Suite
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® FraudAction Services
      • RSA® Web Threat Detection
      • Upcoming Events
      • Videos
    • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication Cloud
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Events
      • Ideas
      • Knowledge Base
      • Training
      • Upcoming Patch Content
      • Videos
    • RSA® Adaptive Authentication Mobile SDK
      • RSA® Adaptive Authentication Mobile SDK
      • Advisories
      • Events
      • Ideas
      • Knowledge Base
      • Request Access
      • Training
    • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Events
      • Ideas
      • Knowledge Base
      • Training
      • Videos
    • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Events
      • Ideas
      • Knowledge Base
      • Training
      • Videos
    • RSA® Adaptive Authentication for eCommerce
      • RSA® Adaptive Authentication for eCommerce
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Ideas
      • Knowledge Base
      • Training
      • Videos
    • RSA® FraudAction Services
      • RSA® FraudAction Services
      • Advisories
      • Discussions
      • Documentation
      • Ideas
      • Videos
    • RSA® Web Threat Detection
      • RSA® Web Threat Detection
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Ideas
      • Knowledge Base
      • Videos
    • RSA NetWitness® Platform
      • RSA NetWitness® Platform
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Ideas
      • Integrations
      • Knowledge Base
      • Training
      • Upcoming Events
      • Videos
    • RSA NetWitness® Detect AI
      • RSA NetWitness® Detect AI
      • Documentation
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
    • RSA NetWitness® Investigator
      • RSA NetWitness® Investigator
      • Documentation
      • Download the Client
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
    • RSA NetWitness® Orchestrator
      • RSA NetWitness® Orchestrator
      • Overview
      • Documentation
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
    • RSA SecurID® Suite
      • RSA SecurID® Suite
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Knowledge Base
      • Ideas
      • Integrations
      • Training
      • Videos
    • RSA® Identity Governance & Lifecycle
      • RSA® Identity Governance & Lifecycle
      • Advisories
      • Blog
      • Community Exchange
      • Discussions
      • Documentation
      • Downloads
      • Ideas
      • Knowledge Base
      • Training
      • Upcoming Events
      • Videos
    • RSA SecurID® Access
      • RSA SecurID® Access
      • Advisories
      • Blog
      • Discussions
      • Documentation
      • Downloads
      • Ideas
      • Integrations
      • Knowledge Base
      • Training
      • Upcoming Events
      • Videos
    • Other RSA® Products
      • Other RSA® Products
      • RSA® Access Manager
      • RSA® Data Loss Prevention
      • RSA® Digital Certificate Solutions
      • RSA enVision®
      • RSA® Federated Identity Manager
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
      •  
  • Resources
    • Advisories
      • Product Advisories on RSA Link
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication Hosted
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® FraudAction Services
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Product Advisories
    • Blogs
      • Blogs on RSA Link
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Blogs on RSA Link
    • Discussion Forums
      • Discussion Forums
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® FraudAction Services
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Discussion Forums on RSA Link
    • Documentation
      • Product Documentation
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication Mobile SDK
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® FraudAction Services
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Documentation on RSA Link
    • Downloads
      • Product Downloads
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Downloads on RSA Link
    • Ideas
      • Idea Exchange
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication Mobile SDK
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® FraudAction Services
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Documentation on RSA Link
    • Knowledge Base
      • Knowledge Base
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication Mobile SDK
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Knowledge Base Pages on RSA Link
    • Upcoming Events on RSA Link
      • Upcoming Events
    • Videos
      • Videos on RSA Link
      • Archer®
      • RSA® Adaptive Authentication Cloud
      • RSA® Adaptive Authentication On-Premise
      • RSA® Adaptive Authentication On-Premise (Cassandra)
      • RSA® Adaptive Authentication for eCommerce
      • RSA® Identity Governance & Lifecycle
      • RSA NetWitness® Platform
      • RSA SecurID® Access
      • RSA® Web Threat Detection
      • All Videos on RSA Link
  • Support
    • RSA Link Support
      • RSA Link Support
      • News & Announcements
      • Getting Started
      • Support Forum
      • Support Knowledge Base
      • Ideas & Suggestions
    • RSA Product Support
      • RSA Product Support
      • General Security Advisories and Statements
      • Product Life Cycle
      • Support Information
      •  
      •  
      •  
      •  
      •  
  • RSA Ready
  • RSA University
    • Certification Program
      • Certification Program
    • Course Catalogs
      • Course Catalogs
      • Archer®
      • RSA NetWitness® Platform
      • RSA SecurID® Suite
    • On-Demand Subscriptions
      • On-Demand Subscriptions
      • Archer®
      • RSA NetWitness® Platform
      • RSA SecurID® Suite
    • Product Training
      • Product Training
      • Archer®
      • RSA® Fraud & Risk Intelligence Suite
      • RSA® Identity Governance & Lifecycle
      • RSA NeWitness® Platform
      • RSA SecurID® Access
    • Student Resources
      • Student Resources
      • Access On-Demand Learning
      • Access Virtual Labs
      • Contact RSA University
      • Enrollments & Transcripts
      • Frequently Asked Questions
      • Getting Started
      • Learning Modalities
      • Payments & Cancellations
      • Private Training
      • Training Center Locations
      • Training Credits
      • YouTube Channel
    • Upcoming Events
      • Upcoming Events
      • Full Calendar
      • Conferences
      • Live Classroom Training
      • Live Virtual Classroom Training
      • Webinars
Sign In Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Announcements

Visit the Known Issues dashboard if you are experiencing issues on RSA Link

View Dashboard

RSA NetWitness® Platform Online Documentation

Browse the official RSA NetWitness Platform Online documentation for helpful tutorials, step-by-step instructions, and other valuable resources.
  • RSA Link
  • :
  • Products
  • :
  • RSA NetWitness Platform
  • :
  • Documentation
  • :
  • Online Documentation
  • :
  • NetWitness Endpoint Configuration Guide for RSA N...
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • Options
    • Subscribe to RSS Feed
    • Bookmark
    • Subscribe
    • Email to a Friend
    • Printer Friendly Page
    • Report Inappropriate Content
    • English
    • French (Français)
    • German (Deutsche)
    • Japanese (日本人)
    • Spanish (Español)
Versions
Collections
All Downloads

Table of Contents

  •   Release Notes
    •   Release Notes 11.5
      •   What's New
      •   Fixed Issues
      •   Known Issues
      •   End of Life Functionality
      •   Product Documentation
      •   Getting Help with NetWitness Platform
      •   Build Numbers
      •   Revision History
    •   Release Notes 11.5.0.1
      •   Introduction
      •   Upgrade Instructions
      •   Build Numbers
      •   Appendix
    •   Release Notes 11.5.1
      •   What's New
      •   Fixed Issues
      •   Product Documentation
      •   Getting Help with NetWitness Platform
      •   Build Numbers
      •   Revision History
    •   Release Notes 11.5.2
      •   What's New
      •   Fixed Issues
      •   Product Documentation
      •   Getting Help with NetWitness Platform
      •   Build Numbers
      •   Revision History
    •   Release Notes 11.5 Language Pack
      •   Introduction
      •   Contact Customer Care
      •   Product Documentation
      •   Revision History
  •   Getting Started
    •   RSA NetWitness Platform
      •   Introduction
      •   User Roles
      •   Basic Navigation
      •   Logs and Network Investigation
      •   Endpoint Investigation
      •   User Entity Behavior Analysis
      •   Common Use Cases and Business Value
    •   Feeds, Parsers and Hunting Packs
      •   Content Quick Start Guide
      •   Network Data and Logs Hunting Guide
      •   UEBA Essentials Hunting Guide
      •   UEBA Essentials Hunting Pack
      •   Content Bundles (Packs)
      •   Investigation Model for Information Security Incident Response
      •   Investigation Feed
      •   Simple Feed Creation
      •   A Treatise on Writing Packet Parsers
      •   Log Parser Customization
      •   All RSA Content Information
  •   Install and Upgrade
    •   Understand the Architecture and Plan
      •   Look at Deployment from a High Level
      •   Choose Your Deployment Options
      •   Review the Architecture and Ports
      •   Third-Party Licenses
    •   Understand Licenses
      •   Understand NetWitness Licenses
    •   Download RSA NetWitness Platform Software
      •   View All Downloads
    •   Install on a Physical Host
      •   Set up Hardware
      •   Physical Host Installation
      •   Create a Build Stick
      •   Configure and Allocate Storage
    •   Install on an On-Premise Host
      •   Install on an On-Premise Virtual Host
      •   Configure and Allocate Storage
      •   Deploy Health and Wellness (BETA) on a Dedicated Virtual Host
    •   Install in the Cloud
      •   Install on an AWS Instance
      •   Install on an Azure Virtual Machine
      •   Install on a Google Cloud Platform Instance
      •   Configure and Allocate Storage
    •   Install Endpoints
      •   About Insights and Advanced Endpoint Agents
      •   Install an Endpoint Server
      •   Install Endpoint Agents
      •   Install and Configure an Endpoint Relay Server
      •   Migrate Version 4.4.0.x to RSA NetWitness Platform
    •   Install Standalone UEBA Server
      •   Install NetWitness UEBA
      •   Integrate with Third-Party SIEM
    •   Install Platform Licenses
      •   Understand How Licensing Works
      •   Understand License Types
      •   Install Product Licenses
    •   Upgrade from 11.x to 11.x
      •   11.x Physical or Virtual Host to Version 11.5
      •   11.x Physical or Virtual Host to Version 11.5.0.1
      •   11.x Physical or Virtual Host to 11.5.1
      •   11.x Physical or Virtual Host to 11.5.2
  •   Configure and Manage
    •   Basic Services
      •   Hosts and Services
      •   Deploy Hosts and Install Services
    •   Live Services
      •   Live Services Management
    •   Configure Network Data Capture
      •   Configure a Network Decoder
      •   Configure a Broker or Concentrator
      •   Start and Stop Data Capture
      •   Filter Data and Set Up Alert Rules
      •   Configure Feeds and Parsers
    •   Configure Log Collection
      •   Capture Data
      •   Basic Log Collection
      •   Supported Event Sources
      •   Event Sources for Log Collection
      •   Search for Specific Event Sources
      •   Windows Legacy Collector
      •   Customize Log Parsers
      •   Edit Log Parsers
      •   Archive Log Data
      •   Enable Endpoints for Log Collection
      •   Integration with LogStash
      •   Event Export Connector Installation and Configuration Guide
    •   Configure Endpoint Data Collection
      •   Configure the Endpoint Log Hybrid
      •   Forward Endpoint Data to a Log Decoder
      •   Define Agent Behavior
      •   Risk Score Calculation
      •   Monitor Endpoints outside Your Network
    •   Configure UEBA
      •   Configure UEBA Users
    •   Configure Real-Time Analysis, Enrichment Lookup, and Automated Threat Detection
      •   Event Stream Analytics
      •   Best Practices for Writing ESA Rules
      •   Enrichment Lookup Capability
      •   Automated Threat Detection
    •   Configure Incident Management Capability
      •   Incident Response Settings
    •   Configure Application Settings
      •   Configure Access, Notification, Logging, Investigation, Live, and Syslog Settings
      •   Configure Your Dashboard
      •   Review the Dashboards Catalog
    •   Configure Reports
      •   Set Up RSA NetWitness for Report Generation
      •   Generate Reports
      •   Review Reports
      •   Review Core Compliance Reports
    •   Configure Security and User Access
      •   Secure the RSA NetWitness Platform Network
      •   Set Up System-Level Security Settings
      •   Change the Default Admin Password
      •   Configure External Authentication
      •   Configure PKI Authentication
      •   Use a Custom Server Certificate
      •   Manage Users with Roles and Permissions
      •   Implement Data Privacy
    •   Configure Audit Logging and Notifications
      •   Monitor Health and Wellness
      •   Monitor Health and Wellness Using Kibana
      •   Reissue Certificates
      •   Track License Usage
      •   Tune Core Database Performance
      •   Manage Periodic Backups and Incidental Restoring
    •   Maintain the System
      •   Monitor Health and Wellness
      •   Monitor Health and Wellness Using Kibana
      •   Reissue Certificates
      •   Track License Usage
      •   Tune Core Database Performance
      •   Manage Periodic Backups and Incidental Restoring
  •   Investigate and Respond
    •   Respond to Incidents
      •   Incident Management
      •   Use Case Examples
    •   Configure System and View Investigate Settings
      •   Configure Query and Session Attributes for Analysts
      •   Configure Global Default Settings and Limits for Investigate
      •   Configure Navigate and Legacy Events View Settings (User Preference)
      •   Configure Events View Settings (User Preference)
      •   Configure Malware Analysis View Settings (User Preference)
    •   Investigate Network Data and Logs
      •   https://community.rsa.com/videos/34434
      •   Use Query Hints in the Events View
      •   Conduct Malware Analysis
    •   Investigate Endpoints
      •   Review the Workflow
      •   Isolate a Host from the Network
    •   Analyze User and Entity Behavior
  •   Integrate and Develop
    •   RSA NetWitness Platform Integrations Catalog
      •   Integration Catalog
      •   Integrate with RSA Archer
      •   Integrate with RSA SecurID
      •   Integrate with NetWitness Endpoints
    •   Developer Tools
      •   Use the NetWitness API
      •   Use the RESTful API
      •   Use the NwConsole
      •   Use the nw-shell Utility to Troubleshoot Operations

Product Resources

  •   Advisories
    •   Product Advisories
    •   Security Advisories
    •   Service Notifications
    •   Technical Advisories
  •   Blog
  •   Discussions
  •   Documentation
    •   Online Documentation
    •   Detect AI
    •   Hardware Setup Guides
    •   Investigator
    •   Orchestrator
    •   Threat Intelligence
  •   Downloads
    •   RSA NetWitness Platform
    •   RSA NetWitness Investigator
  •   Events
  •   Ideas
  •   Integrations
  •   Knowledge Base
  •   Training
  •   Videos
Attachments
Labels (2)
Labels:
  • Configuration

  • Version 11.5

Tags (24)
  • 11.5
  • Admin
  • advanced
  • Config
  • Config Guide
  • Configuration
  • Configuration Guide
  • content expert
  • Docs
  • Documentation
  • english
  • expanding
  • Getting Started
  • logs and packets
  • NetWitness
  • NW
  • NWP
  • pdf
  • Product Docs
  • Product Documentation
  • RSA NetWitness
  • RSA NetWitness Platform
  • Version 11.5
  • w-configuration
0 Likes
Was this article helpful? Yes No
Share
No ratings

On this page

Powered by Khoros
  • Products
  • Resources
  • Solutions
  • RSA University
  • Support
  • RSA Labs
  • RSA Ready
  • About RSA Link
  • Terms & Conditions
  • Privacy Statement
  • Provide Feedback
© 2020 RSA Security LLC or its affiliates.
All rights reserved.