AnsweredAssumed Answered

nCircle IP360 integration

Question asked by Yogesh Mavani on Feb 17, 2016
Latest reply on Aug 16, 2017 by Eric Partington

Like • Show 1 Like1
Comment • 2

Hello,

We are planning to correlate IPS and VA scanner events. We integrated IPS.

We need to integrate nCircle IP360 with RSA SA. It is listed in supported devices. We gone through integration guide also but it is for ENVISION only.

Please assist us to integrate nCircle IP360.

No one else has this question

Outcomes

2 Replies

Robert Clum Aug 1, 2017 5:13 PM
Mark Correct
Correct Answer
An updated guide would be helpful for this, we are using Tripwire IP360 Version 8.1 and Netwitness 10.6.4
Like • Show 0 Likes0
Actions
Eric Partington Aug 16, 2017 4:11 PM
Mark Correct
Correct Answer
there is no VAM module in RSA NetWitness suite OOTB so an updated guide for that component is not planned AFAIK.

There may be a different method to your solution using the NW Feeds function.
what options other than XML are listed for the export format from IP360? is CSV an option ?

If so then
- you can export the ssh keys as listed in the envision doc
- use an SSH script from the NW head server using the keys exported to pull the CSV from IP360 to the default www directory on the NW server and use a recurring feed to read that vuln feed (/var/netwitness/srv/www/).
- use the recurring feed option to point you to http://127.0.0.1/feedname.csv and you should be able to reference the feed in the UI
- Map the feed columns to useful values from the NW metakeys and make the primary key the metakey that would match from the IPS event logs (cve?) so that when a matching IPS event occurs the feed data is written (providing vuln context) to make your determination.
- if you need to match more than 1 column in the feed (say CVE and OS) then you will need to create a multi-column feed from the CLI using this guide (and the implementation might get more complicated)
- https://community.rsa.com/message/895987?commentID=895987#comment-895987
Like • Show 0 Likes0
Actions

nCircle IP360 integration

Outcomes

Related Content

Recommended Content