Physical Host Installation Guide for 12.5

Introduction

This section provides an overview of the Physical Host Installation Guide for NetWitness® Platform 12.5 and clarifies that the instructions apply exclusively to physical hosts. It distinguishes this guide from the virtual host installation documentation and directs users to the NetWitness® Community for troubleshooting resources and access to all available NetWitness® Platform guides.

Supported Hardware

This section covers the supported physical hardware platforms for NetWitness® Platform 12.5, including Series 6 and Series 7 appliances as well as approved third‑party server hardware. It explains the supported host types, processor configurations, memory requirements, storage layouts, network interfaces, power specifications, physical dimensions, throughput capabilities, and supported add‑on cards. The section emphasizes adherence to certified hardware specifications to ensure system performance, reliability, and supportability.

External Attached Storage

This section explains how to handle external attached storage, such as PowerVault devices, when deploying NetWitness® Platform on physical hosts. It directs administrators to the NetWitness® Hardware Setup Guides for detailed configuration instructions and highlights that proper storage configuration is required to support scalability and data retention requirements.

Physical Host Installation Workflow

This section explains the high‑level workflow for installing NetWitness® Platform 12.5 on physical hosts. It outlines the logical sequence from preparing the hardware and creating a base image, through platform installation, service deployment, licensing, and post‑installation tasks, providing a visual and conceptual roadmap for administrators to follow during deployment.

Self-Help Resources

This section provides information about available self‑help resources for installing and operating NetWitness®. It highlights the NetWitness® Community, official product documentation, knowledge base articles, troubleshooting guides, and blog posts as primary sources for resolving issues and learning best practices before engaging technical support.

Contact NetWitness® Support

This section explains how and when to contact NetWitness® Support for assistance. It outlines the information administrators should gather before opening a case, such as platform version and hardware details, and provides links to support portals, international contact information, and community‑based support channels.

Installation Tasks

This section covers all tasks required to install NetWitness® Platform 12.5 on physical hosts. It introduces the overall installation process, specifies prerequisites such as firewall port configuration, and defines the structured order in which installation activities must be completed to ensure a successful deployment.

Checklist

This section provides a structured installation checklist that summarizes the required steps, including installing the platform on hosts, setting up ESA hosts, installing component services, completing licensing requirements, and optionally deploying a warm standby NetWitness® Server. It emphasizes completing tasks in sequence to avoid configuration issues.

Install 12.5 on the NetWitness® Server Host and Other Component Hosts

This section explains how to install NetWitness® Platform 12.5 on the primary NetWitness® Server host and on additional component hosts. It describes the use of installation media, boot options, appliance type selection, disk formatting requirements, and reboot considerations, with separate guidance for RSA appliances and third‑party server hardware.

Create a Base Image on the RSA Appliance

This section covers the process of creating a base image on supported RSA appliances for Series 6 and Series 7 hardware. It explains how to boot from installation media, select the appropriate appliance type, clear drives, and initiate the automated imaging process while emphasizing critical cautions related to disk formatting and media removal.

Create a Base Image on the Third Party Server Hardware

This section explains how to create a base image on third‑party server hardware that meets the NetWitness® Platform requirements. It outlines prerequisites, installation media preparation, appliance selection, boot device configuration, and post‑installation boot considerations to ensure the system starts correctly after imaging.

Install NetWitness® Platform

This section explains how to complete the NetWitness® Platform installation using the interactive setup program. It covers password requirements, role selection, host designation, navigation of setup prompts, and acceptance of licensing terms, while highlighting critical cautions related to host role selection and credential management.

Network Configuration and Repository Setup

This section covers network configuration tasks performed during installation, including IP assignment, DNS configuration, NAT usage, firewall settings, and update repository selection. It explains the differences between local and external repositories and how these repositories support platform updates and component installations.

Set Up ESA Hosts

This section explains how to configure Event Stream Analysis (ESA) hosts after the core platform installation is complete. It describes installing primary and optional secondary ESA services and ensures that ESA hosts are properly integrated into the NetWitness® Platform through the administrative user interface.

Install Component Services on Hosts

This section explains how to install component services such as Decoders, Concentrators, and other NetWitness® services on prepared hosts. It describes discovering hosts, enabling them in the NetWitness® UI, selecting service categories, and completing service installation using the Hosts view.

Complete Licensing Requirements

This section covers the process of completing licensing requirements for installed NetWitness® services. It directs administrators to the appropriate licensing management documentation and emphasizes that services remain inactive or limited until valid licenses are applied.

Optional Install Warm Standby NetWitness® Server

This section explains the optional deployment of a warm standby NetWitness® Server to improve platform reliability and availability. It references detailed deployment procedures and highlights the need to synchronize credentials and configurations between the primary and standby servers.

Update or Install Windows Legacy Collection

This section covers upgrading or installing Windows Legacy Collection components. It explains where to find the applicable documentation and emphasizes the requirement to reboot systems after installation or upgrades to ensure proper log collection functionality.

Post Installation Tasks

This section provides an overview of tasks required after the initial installation is complete. It introduces additional configuration areas such as Event Stream Analysis, NetWitness® Endpoint, and NetWitness® UEBA and directs administrators to supporting documentation for further tuning and validation.

Event Stream Analysis (ESA)

This section explains post‑installation ESA tasks, including aligning meta key configurations across new and existing ESA hosts, refreshing meta references, and redeploying ESA rules to ensure consistent correlation behavior across the NetWitness® Platform environment.

NetWitness® Endpoint

This section covers post‑installation considerations for deployments using NetWitness® Endpoint. It explains high‑level responsibilities related to deploying endpoint hosts, configuring services, and integrating endpoint data into the NetWitness® Platform.

Install Endpoint Log Hybrid

This section explains how to deploy Endpoint Log Hybrid hosts, including single or multiple deployment scenarios. It covers host provisioning requirements, service installation, certificate handling, and scaling considerations for ESA when supporting larger endpoint deployments.

Optional Configure Endpoint Services on Existing Log Decoder Hosts

This section explains how to install Endpoint service categories on existing Log Decoder hosts, with or without a dedicated Endpoint Log Hybrid. It details certificate requirements and provides guidance on when to separate endpoint services onto dedicated hardware for performance and stability reasons.

NetWitness® UEBA

This section covers post‑installation tasks for deploying and configuring NetWitness® User and Entity Behavior Analytics (UEBA). It explains service installation, licensing considerations, role assignment, data source configuration, and command‑line setup required to activate UEBA analytics.

Deployment Options

This section explains the supported deployment options available in NetWitness® Platform, including Analyst UI distribution, group aggregation, health and wellness monitoring, hybrid service categories, deploying the NetWitness® Server on analytics hardware, adding secondary endpoint servers, and configuring warm standby servers for resilience.

Appendix A: Troubleshooting

This section provides troubleshooting guidance for common installation and upgrade issues. It includes examples related to command‑line errors, service communication issues, and ESA troubleshooting, and directs administrators to support resources when issues cannot be resolved internally.

Appendix B: Create an External Repository

This section explains how to create and configure an external update repository for NetWitness® Platform. It covers repository directory structure, unzip procedures, web server configuration, and repository URL usage during installation or upgrade operations.

Appendix C: Silent Installation Using CLI

This section covers automated installation using the command‑line interface. It explains how to run the setup program in silent mode, describes available arguments, and shows how to provision NetWitness® Server and component hosts without interactive prompts.

Appendix D: Third Party Server System Requirement

This section provides detailed hardware and configuration requirements for deploying NetWitness® Platform on third‑party servers. It outlines supported components, minimum compute and memory requirements, storage and RAID configurations, and network specifications required for a supported deployment.