About rataide

dflodstrom · ‎03-26-2019

To run a second NetWitness query using this app, netwitness_query, you can copy the nwsdk_query.conf file to a new file like nwsdk_query_dns.conf . Configure the query and last_mid_file values and then create a stanza for this file in inputs.conf. [script://./bin/nwsdk_query.py nwsdk_query_dns] . @rataide provided this answer in the comments, I only expanded on it slightly. There is no need to copy or modify the script.

teja2007 · ‎04-21-2017

I have sent an email to both your @netwitness.com and @rsa.com Please reply back there.

rataide · ‎03-29-2017

Hi, I'm not sure I completely follow your issue, the value is for meta keys per call not "events/sessions" if there's no value being read from the config file for some reason the code actually defaults to 500k meta pieces per call so at 25,000 events it would be an average of 20 keys per event which if you only have 20 keys select would be about right. You should be able to increase that value to close to about 1.5M more than that the REST endpoint wouldn't really be able to handle. That aside, I don't think the app will ever cope with the rates you are describing of 35,000k EPS can you give me a bit more background on what you are trying to do? Please feel free to contact me directly via the e-mail on the app files. Hope this helps! Thank you, Rui

caraki · ‎03-07-2017

Thanks again for your assistance with troubleshooting this!

nychawk · ‎10-27-2015

Yes, two decoders, one to capture non-SSL, the other to receive from a decryption device; both the same concentrator. Will send via PM. Thank you, -mi

rataide · ‎02-22-2017

I have now created at few in case anyone finds this page in future. [1SA_Session] display_location = both fields = sessionid label = Show Session in SA link.method = get link.target = blank link.uri = https://<SAIPADDRESS>/investigation/<DEVICEID>/reconstruction/$sessionid$/AUTO type = link [1SA_SrcIP] display_location = both fields = src_ip label = Show Source $src_ip$ in SA link.method = get link.target = blank link.uri = https://<SAIPADDRESS>/investigation/<DEVICEID>/navigate/query/ip.src=$src_ip$ type = link [1SA_DstIP] display_location = both fields = dest_ip label = Show Destination $dest_ip$ in SA link.method = get link.target = blank link.uri = https://<SAIPADDRESS>/investigation/<DEVICEID>/navigate/query/ip.dst=$dest_ip$ type = link [1SA_AliasHost] display_location = both fields = dest_host label = Show $dest_host$ in SA link.method = get link.target = blank link.uri = https://<SAIPADDRESS>/investigation/<DEVICEID>/navigate/query/alias.host=$dest_host$ type = link Hope this helps. Cheers, Rui

rataide · ‎06-20-2014

There are 3 apps that all work both with SA and NW as the REST API hasn't changed since 9.8.5.9 when it was released. You can find them here http://apps.splunk.com/apps/#/search/netwitness Hope that helps! Regards, Rui

rataide · ‎04-03-2014

Sorry for the delay getting back to you! I've only just seen this! Can you please post your query from the configuration file? "group" is normally assigned very early and the only reason of it not to be so is if there is no data returned from the NW device. Thank you, Rui

rataide · ‎03-12-2013

Great! Glad to hear you got it sorted. Thank you for letting me know!

rataide · ‎06-04-2014

Apologies for not being clear. That's the README on the ../bin/ directory, I was referring to the README.txt on the apps' main directory. Just one up from that one. Its contents start with '# Splunk/NetWitness REST API Session Meta scripted input '# Version : 0.9.1 '# Date: 12 Dec 2012 Unfortunately, it's too big to post here.

rgonzale6 · ‎02-15-2012

Success! Worked perfectly for me. Thanks for the follow-up!

Posts	33
Solutions	5
Karma Given	1
Karma Received	17
Member Since	‎06-25-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Has anyone created an Event Action for sessionid t...

Re: How can I execute two Netwitness query sentenc...

Re: Why are the Security App for NetWitness and Ad...

Re: How do you change how much to poll in a single...

Re: Splunk Netwitness Query App not working

Re: How to install the Security Query based App fo...

Re: Has anyone created an Event Action for session...

Re: NetWitness to Splunk integration

Re: Splunk for Netwitness Query

Re: Splunk for netwitness is not working.

Re: splunk for netwitness not working

Re: Does Splunk for NetWitness support SSL access ...

Join the Conversation