Helpful information for developing ESA rules in NetWitness

Tasks

The attached document contains hints, use cases and FAQs related to the development of statements using Esper’s event processing language (EPL) with Security Analytics ESA.

For recommendations on deployment of rules, please see the ESA Enablement Guide.

Resolution

See the attached PDF for details.

Product Details

RSA Product Set: Security Analytics, NetWitness
RSA Product/Service Type: Event Stream Analysis (ESA)
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x, 11.x

Approval Reviewer Queue

Technical approval queue