Content Library Tab

1

By default, 50 contents are displayed per page. To go to the next page, click . To go to the last page, click .

Toolbar

• Create Rule - Lets you create a rule.

• Clone Rule - Lets you clone an application rule or network rule. For more information, see Clone Application Rule or Clone Network Rule.

• Delete - Lets you delete an application rule or network rule. For more information, see Delete Application Rule or Delete Network Rule.

• Import - Lets you import an application rule or network rule. For more information, see Import Content to Content Library.

Rule List Pane

• Rule Name - Name of the rule.

• Rule Value - The rule value.

• Medium - Medium through which the rule is created.

• Last Updated - Displays the time when the rule is updated.

• Policies - Policies to which the rule is applied.

You can also sort on any column. If you mouse over a column header, a sort icon is displayed: . Click the  icon to sort by the selected column.

Rule Value

The rule value. While creating a new rule, the rule value is defaulted with the rule name. However, you can modify the same.

Condition for the new rule. You can apply two types of conditions for the rule.

Normal mode:

It gives suggestions for supported metas (ip, host and so on) and operators (“=”, “Not Equal To”, “Contains”, “Exists” and so on).

The entered condition will be enclosed in a ‘Pill’. When you enter multiple conditions, the conditions are automatically joined by an ‘AND’ operator. On clicking the ‘AND’ operator, you can toggle between ‘AND’ and ‘OR’ operators.

Advanced:

You can customize the conditions as a free form text.

Tactics associated with the rule.

For example: Credential Access.

For more information on MITRE ATT&CK Tactics, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

MITRE ATT&CK Techniques

Techniques associated with the rule.

For example: OS Credential Dumping.

For more information on MITRE ATT&CK Techniques, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

Rule Value

The rule value written to the alert meta.

Condition for the new rule. You can apply two types of conditions for the rule.

Normal mode:

It gives suggestions for supported metas (ip, host and so on) and operators (“=”, “Not Equal To”, “Contains”, “Exists” and so on).

The entered condition will be enclosed in a ‘Pill’. When you enter multiple conditions, the conditions are automatically joined by an ‘AND’ operator. On clicking the ‘AND’ operator, you can toggle between ‘AND’ and ‘OR’ operators.

Advanced:

You can customize the conditions as a free form text.

Medium

Medium through which the rule is created. For a network rule, the value of medium is selected as Packet as default and you cannot edit it.

Tactics associated with the rule.

For example: Credential Access.

For more information on MITRE ATT&CK Tactics, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

MITRE ATT&CK Techniques

Techniques associated with the rule.

For example: OS Credential Dumping.

For more information on MITRE ATT&CK Techniques, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

Session Data

Session data for the new rule. Indicates if the rule processing should stop, keep, filter or truncate when the session data is running.

Flag session with rule name in meta key

Conditions for which the alert should be turned on.

Clones the rule and closes the Cone Rule dialog.

Rule Value

The rule value.

Condition for the new rule. You can apply two types of conditions for the rule.

Normal mode:

It gives suggestions for supported metas (ip, host and so on) and operators (“=”, “Not Equal To”, “Contains”, “Exists” and so on).

The entered condition will be enclosed in a ‘Pill’. When you enter multiple conditions, the conditions are automatically joined by an ‘AND’ operator. On clicking the ‘AND’ operator, you can toggle between ‘AND’ and ‘OR’ operators.

Advanced:

You can customize the conditions as a free form text.

Tactics associated with the rule.

For example: Credential Access.

For more information on MITRE ATT&CK Tactics, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

MITRE ATT&CK Techniques

Techniques associated with the rule.

For example: OS Credential Dumping.

For more information on MITRE ATT&CK Techniques, see Use MITRE ATT&CK Framework topic in the NetWitness Respond User Guide for 12.4

Reset

Reset the fields.

Toolbar

• Create Rule - Allows you to create a search pattern rule.

• Clone Rule - Allows you to clone a search pattern rule. For more information, see Manage Search Pattern Rules

• Delete - Allows you to delete a search pattern rule. For more information, see Manage Search Pattern Rules

Rule List Pane

• Name - Name of the search pattern rule.

• Keywords - Displays the keywords associated for each search pattern rule.

• Ports - Displays the ports associated for each search pattern rule.

• Last Updated - Displays the time when the rule is updated.

• Policies - Policies to which the rule is applied.

You can also sort on any column. If you mouse over a column header, a sort icon is displayed: . Click the  icon to sort by the selected column.

Allows you to add one or more ports. Use semicolons (;) to separate multiple port numbers.For example, 20;21;23.

The port numbers must be between 1 and 65535.

Reset

Reset the fields.

Allows you to add one or more ports. Use semicolons (;) to separate multiple port numbers.For example, 20;21;23.

The port numbers must be between 1 and 65535.