RSA NetWitness 11.4 Documentation - Investigate & Respond

[#1]

Respond to Incidents

Configure Settings for Incident Management

Review Incident Response Use Case Examples

Respond to Incidents

Determine Which Incidents Require Action

Investigate an Incident

Escalate or Remediate an Incident

Review Threat Alerts

Configure System and View Settings for Investigate

Configure Query and Session Attributes for Analysts

Configure Global Default Settings and Limits for Investigate

Configure Navigate and Legacy Events View Settings (User Preference)

Configure Events View Settings (User Preference)

Configure Malware Analysis View Settings (User Preference)

Investigate Network Data and Logs

Understand Metadata and the Workflow of Investigation

Investigate Metadata in Logs and Network Data

Investigate Raw Events and Metadata in Logs and Network Data

Query Data in the Navigate and Legacy Events Views

Search for Text Patterns | Video

Filter Results in the Navigate View

Filter Results in the Legacy Events View

Filter Results in the Events View

Use Query Hints in the Events View

Manage Meta Groups

Use Columns and Column Groups in the Events List

Use Profiles to Encapsulate Common Investigations

Look Up Additional Context for Results

Reconstruct an Event in the Legacy Events View

Reconstruct an Event in the Events View

Create Incidents and Add Events to an Incident from the Events View

Conduct Malware Analysis

Investigate Endpoints

Review the Workflow of an Endpoint Investigation

Analyze Legitimate and Suspicious Files

Investigate Suspicious Hosts and Detect Anomalies

Track Host Behavior and Analyze Risk Score

Isolate a Host from the Network (Video)

Analyze Process Behaviors

Advanced Analysis of Suspicious File

Remediate Threats

Analyze User and Entity Behavior

Understand How NetWitness UEBA Works

Review NetWitness UEBA Indicators

Investigate High-Risk Users

Investigate Top Alerts