Hosts and Services Basics

Hosts and Services Basics

This guide gives administrators the standard procedures for adding and configuring hosts and services in NetWitness. After introducing you to the basic purpose of hosts and services and how they function within the NetWitness network, this guide covers:

• Tasks you must complete to set up hosts and services in your network
• Additional procedures that you complete based on the long-term and daily, operational needs of your enterprise
• Reference topics that describe the user interface

Go to the NetWitness All Versions Documents page and find NetWitness Platform guides to troubleshoot issues.

What Is a Host?

A host is the machine on which a service runs and can be a physical or virtual machine. See the "NetWitness Detailed Host Deployment Diagram" in the NetWitness Deployment Guide for an illustration of how hosts are deployed.

What Is a Category?What Is a Category?

A category assigns a service or services to a host when you install a host from the Hosts view. You choose a host Category in the Install Services dialog which is displayed when you select a host in the Hosts view and click . The following table lists each category and the services it installs. See the "NetWitness Detailed Host Deployment Diagram" in the NetWitness Deployment Guide for an illustration of how hosts are deployed.

What Is a Service?

A service performs a unique function, such as collecting logs or archiving data. Each service runs on a dedicated port and is modeled as a plug-in to enable or disable, according to the function of the host.

You must configure the following Core services first:

• Network Decoder
• Concentrator
• Broker
• Log Decoder

All the services are listed below and each service except the Log Collector has its own guide or shares a guide in the Host and Services Configuration Guides section of the NetWitness documentation page on NetWitness Community at https://community.netwitness.com/s/netwitness-platform-documentation. The Log Collector has its own set of configuration guides to handle the configuration for all the supported event collection protocols. For Log Collector information, see Log Collection Guides.

You must configure hosts and services to communicate with the network and each other so they can perform their functions such as storing or capturing data. For information about ports and a comprehensive list of ports for all services, see "Network Architecture and Ports" in the Deployment Guide for NetWitness Platform. Go to the NetWitness All Versions Documents page and find NetWitness Platform guides to troubleshoot issues.

Setting Up a HostSetting Up a Host

You use the Hosts view to add a host to NetWitness. See Step 1. Deploy a Host for detailed instructions.

Maintaining HostsMaintaining Hosts

You use the main Hosts view ( (Admin) > Hosts) to add, edit, delete, and perform other maintenance tasks for the hosts in your deployment. You use the Host Task List dialog to perform tasks relating to a host and its communications with the network. See Hosts and Services Maintenance Procedures for detailed instructions.

After initial implementation of NetWitness, the major task you perform from the Hosts view is updating your NetWitness deployment to a new version.

Update Version Naming Convention

You use the Hosts view to apply the latest version updates from your Hosts and Services Maintenance Procedures. You must understand the update version naming convention to know which version you want to apply to the host. The naming convention is major-release.minor-release.service-pack.patch. For example, if you choose 11.6.1.2, you apply the following version to the host.

• 11 = major release
• 6 = minor release
• 1 = service pack
• 2 = patch

NetWitness supports multiple versions in your deployment. For more information, see Running in Mixed Mode. The NetWitness Server (NW Server Host) is updated first and all other hosts must have the same or earlier version as the NW Server Host.

The following example is a single version deployment with all hosts updated to 11.5.0.0.

Maintaining ServicesMaintaining Services

You use the Services view ( (Admin) > Services) to add, edit, delete, monitor, and perform other maintenance tasks for the services in your deployment. See Hosts and Services Procedures for detailed instructions.

Services Implemented with the NetWitness Server

The services in the following list are implemented when you deploy the NW Server to support:

• The expansion of physical and virtual deployment platforms and improvements to host and service maintenance.
• Content, Investigate, Respond, and Source functionality.

Caution: You do not need to configure these services to deploy NetWitness. recommends that you monitor the operating status of these services using Health-and-Wellness. Do not attempt to modify the parameters in the Explore view without contacting Customer Support (https://community.netwitness.com/t5/support-information/how-to-contact-netwitness-support/ta-p/563897).