Hi All,
Please let us know the process to create a direct INC with the logs from Event View (New Tab) in Netwitness 11.1, In the Old View its straight forward but in this view i tried multiple options but no luck.
It seems to be a bug for me, If yes hope RSA will fix it ASAP because it very time consuming to redo all setup twice to get the logs to the INC. If No Please let me know the exact option to move the logs to the INC from the new Event View Tab
Below snapshot is for better understanding of the issue which am referring.
This is from the old event view, where we can check the log box and from the incidents we can create a new incident and the same will be log in SECOPS as well for further investigations
This is from the New Event View, where i am not able to find the option to raise an INC directly.
You have to look under "Events" Tab to create manual incident;
Also you will have to create an "Incident Rule" as below;
Hopefully this should solve your query.