How to reduce the customer throughput license usage.

Issue

Customer may face the alert when throughput license is nearing license usage limits. For this reason, Customer wants to reduce or optimize their throughput license usage.

Resolution

Normally Customer can use BPF rule. But also, Customer can use Application Rule and Network Rule filtered bytes are not counted against throughput license usage. Plus,  Capture Policies also can use for reducing the throughput license. 

In specific customer requirement, they need dropping of payload and retaining only SSL headers. This can be done using the "Truncate SSL/TLS After Handshake" which will drop the payload in case the rule matches with an SSL session, but preserves the SSL exchanges. See here for more information: https://community.netwitness.com/t5/netwitness-platform-threat/application-rules/ta-p/677914  see Session Data Actions.

Product Details

RSA Product Set: NetWitness Log and Network
RSA Product/Service Type: Licensing
RSA Version/Condition:11.x , 12.x

Approval Reviewer Queue

Technical approval queue