Skip navigation
Log in to follow, share, and participate in this community.

Recent Activity

RSA Information Design and Development
You must schedule an alert to search for events on a regular schedule. To schedule an alert: Go to Reports to view the Manage tab. Click Alerts to open the Alert view. Select an alert to schedule. On the Alert toolbar, click Enable. The selected alert is scheduled. Previous Topic:Configure an Alert Next Topic:View an Alert You are here…
RSA Information Design and Development
The Reporting module user interface provides access to NetWitness alerts and alert templates as well. This topic contains descriptions of the user interface as well as other reference information to help users manage alert templates. Topics: Create or Modify Template View Template View Previous Topic:Import Alert Dialog Next Topic:Alert…
RSA Information Design and Development
Click to view contentIn the Alert Schedules view, you can view all the alerts scheduled. Alternately, you can also disable the scheduled alerts. Workflow The following workflow shows the tasks involved in creating or modifying an alert.   What do you want to do?                                             Role I want to... Documentation Administrator/ Analyst…
RSA Information Design and Development
Click to view contentThis section provides troubleshooting instructions for issues faced when using the Reporting module in NetWitness Platform. Configuring SFTP Server Issue Procedure Try the following steps if you face any issues while configuring the Linux SFTP server: If the Report Output Action for the configured SFTP fails, you must SSH to the SFTP server…
RSA Information Design and Development
Ensure that: You have Decoders that are connected to the Concentrator added to the Reporting Engine for the selected data source, before creating an alert rule. You have installed and configured a Syslog server that supports TCP/TLS in your environment. For example, WinSyslog. You can configure the Reporting Engine to send Syslog messages over…
RSA Information Design and Development
Click to view contentThis section describes the different rule syntax supported in the Reporting Engine. NWDB Rule Syntax The NWDB rule is one of the rule syntax supported in the Reporting Engine. To enhance the execution time of your reporting entities, see "Reporting Guidelines" section in Reporting Overview. A Rule is a function that manipulates the result set of…
RSA Information Design and Development
Click to view contentIn the Lists Permissions dialog, you can manage access permissions for a user role at the list or list group level. Only a user with Read and Write permission can configure the list in the Reporting Module. Workflow This workflow shows the procedure to manage lists or list groups. You can set access control at the list or list group level so…
RSA Information Design and Development
You can view an alert or a list of all alerts. You can view the alerts triggered and investigate any alert in the Investigation module and customize these views to show alerts for a specific period of time, and set the maximum number of alerts displayed in a single page. To view an alert: Go to Reports to view the Manage tab. Click Alerts to…
RSA Information Design and Development
Click to view contentThis figure is an overview of the entire process of configuring and generating a report. To configure and generate a report, perform the following tasks: Configure Reporting Engine - You must configure the Reporting Engine before you can configure and generate a report. You must also specify the data source in the Reporting Engine from…
RSA Information Design and Development
Click to view contentYou can configure an alert by setting up alert notifications and adding a notification method to a rule. Note: Only Administrators can set up these notifications. To configure an alert: Go to Reports. The Manage tab is displayed. Click Alerts. The Alert view is displayed. In the Alert toolbar, click . The Create/Modify Alert panel…
Load more items