Skip to content
  • There are no suggestions because the search field is empty.

How to manage customer requests for new Live accounts in RSA Security Analytics

Issue

This article explains how to manage customer requests for a new Live account for RSA Security Analytics, RSA NetWitness or RSA ECAT.


Resolution

Note: A Live Subscription is different from a maintenance contract and so an enhanced maintenance contract is not automatically entitled to a Live Enhanced Subscription.

There are three different tiers of Live Subscription:
  • Basic,
  • Enhanced, and
  • Premium.
If customer has a valid maintenance contract on at least one SA Appliance/Virtual Machine, then they are entitled to a Basic Subscription and Enhanced Subscription for free.
To obtain a Premium Live subscription, customer will need to purchase it.

For those customers who have purchased an appliance with either SA Malware Analysis service or NetWitness Spectrum service installed, their Live account needs to be added to the Spectrum group.

Note: This applies to all SA customers who have purchased an SA Broker Head Unit which includes the SA Malware CoLo Analysis service.

For those customers who have purchased an appliance which has a Log Decoder service, their Live account needs to be added to the Panorama group.
The name Panorama is from the earliest attempts to add Log collection to NetWitness. This component name later changed from Panorama to NetWitness For Logs (NWFL).  Reference the Log Decoder page on the NetWitness wiki. https://support.netwitness.local/wiki/index.php/NWFL
 

  1. For Premium requests, the SAP/Propel system will need to be checked to confirm if customer has purchased a subscription. Alternatively for new customers, the sales team can provide the SO/PO number which shows this.  Unfortunately Salesforce does reflect this information for customers.
  2. To create a new Live account, the TSE will first need to log into https://portal.viasso.rsa.com/WebPortal/ using their Windows credentials, then:
    1. Click the NW Live Alfresco Admin icon.
    2. The TSE will then be asked to enter the RSA SecurID passcode in order to access the Live Portal.
    3. The TSE will need to log into the Live Portal using their own Live account.  The Live Portal can be used to create accounts and change Live passwords.
    4. Select Manage Users and then Create User.
    5. Enter user name and password.
      • For customers leave User type as Customer.
      • For RSA support, change the User Type to Administrator.
      • For RSA developers, change the User type to Developer.
      • For RSA sales people and sales engineers, change the User type to Sales.
      • For POC, create the Customer as Company_POC ( for example, USDA_POC).
      • Employee user names can simply be first_name.last_name.
      • Generate a random password using a tool such as LastPass or Secure Password Generator.
    6. To ensure that the new Live account is pushed over to Alfresco immediately, the TSE will need to navigate into the RSA Security Analytics UI and select Admin / Administration > System > Live Services > Live Account panel at the top of the page.
    7. Once in the Live Account panel, click Modify, enter the new Live credentials, and press Test Connection.
    8. If the message Test connection successful appears, then the account has been pushed over to Alfresco, as well as can be used successfully in Live services.
    9. Add the correct groups to the Live account using Alfresco.  Alfresco can be used to associate email addresses and company names to the Live account and to add groups.
      1. The TSE will need to login using their own Live account (the link shows as Login (guest)).
      2. Click the Administration Console icon at the top of the screen.
      3. Select Manage User Groups.
      4. Select the Show All button to see all groups, or search for the group name
      5. For each group that needs to be added:
        • Either click the Add User icon under Group Name or click on group name and select Add User under More Actions.
        • Enter the new Live user name and press Search.
        • Select the proper value in the search results and click Add then select OK.
  1. The five groups that the account will need to be added into are: Spectrum, Panorama, Data Science Subscription, Basic Subscription and Enhanced Subscription.
  • For the Enhanced Subscription group, the TSE will need to search for the Basic Subscription group, click the group name, and then click Enhanced Subscription. The TSE should not directly search for Enhanced Subscription.
  1. For RSA content developer accounts, in addition to the above five groups, they will also need to be added into the following three groups: Content Creators, Content Viewers and ENVISION_CREATORS.
  2. It is safest to include each group even though Enhanced Subscription is a member of Basic Subscription.
  3. Enhanced Subscription does not have Premium Subscription as a member.
  4. Spectrum and Panorama are not automatically part of any subscription level, and so need to be added manually.
  5. The Premium Subscription formerly included premium content from Verisign, Spamhaus, NetWatchman and InternetID.
  1. Associate the Live account with an email address and company name (optional):
    1. Click the Administration Console icon at the top of the screen.
    2. Select Manage System Users.
    3. Enter live username and click Search.
    4. Under Actions, hit the first icon to enter the Edit User Wizard.
    5. Hit either Next or Finish when details have been entered.

Troubleshooting

  • Within Live, the easiest way to distinguish when the account has been added to the Enhanced subscription is the presence of RSA FirstWatch set of intelligence feeds.
  • Live accounts can also be tested by pointing a browser to https://cms.netwitness.com. This can be useful for distinguishing between account issues and internet connectivity issues in accessing CMS.

Note:  Sufficient login privilege to the Alfresco system is required.


Notes

Information about Live accounts is also available from the NetWitness internal Wiki.

The NetWitness Wiki also includes an older document on how to create Live accounts (URLs now changed)
https://support.netwitness.local/wiki/index.php/File:Creating-Live-Account-Subscription-Feeds.docx
 


Internal Comments

Ricky Burgess 04/30/2024
Submitting to Archive this KB due to age and outdated process, confirmed with Jay Kisner on Teams
In the process of creating a new KB

Product Details

RSA Product Set:  Security Analytics
RSA Product/Service Type: RSA NetWitness NextGen, RSA Live, RSA ECAT

Approval Reviewer Queue

Technical approval queue