RSA NetWitness

摘要

RSA NetWitness is a network-monitoring system designed to handle a wide range of information. NetWitness comes in three parts: a Concentrator (a Linux-based network appliance), Decoder (a configurable network-recording appliance) and Investigator (an interactive threat analysis application). All three elements are critical to ensure that the product is working properly. Initially, we only had the Concentrator and Decoder activated. The Investigator was lost in the mail. Upon receiving all portions of NetWitness, and getting them to work together, we were finally able to dive into the product.