I have a customer running NW for Log and he needs to know the date and time of the first event saw in the platform for each event source... How can I achieve that?
Thanks in advance
Max
I have a customer running NW for Log and he needs to know the date and time of the first event saw in the platform for each event source... How can I achieve that?
Thanks in advance
Max
Hello Max,
you should use a report with:
Rule Type: NetWitness DB
Name: First event of each event source
Summarize: Custom
Select: event.source, first(time)
Where: event.source exists
Group by: event.source
Ciao Roberto
PS:
not all events have event.source metadata, If you are interested in all the events saw in the platform, you should use device.ip or device.host instead of event.source