.png?width=180&height=32&name=NW%20Logo%20(2).png){kind=small}
What is NetWitness UEBA?
NetWitness UEBA (User and Entity Behavior Analytics) is an advanced analytics solution for discovering, investigating, and monitoring risky behaviors across all users and entities in your network environment. NetWitness UEBA is used for following reasons:
- Detecting malicious and rogue users
- Pinpointing high-risk behaviors
- Discovering attacks
- Investigating emerging security threats
- Identify potential attacker activity
About this Guide
This guide provides end-to-end instructions to configure NetWitness UEBA and to use UEBA features.
Getting Started
The following tasks can be performed in any sequence.
- Description:
- Description:
View information about product updates, improvements, and known issues.
- References:
- Description:
Understand NetWitness UEBA
- References:
Setup and Installation
You can setup and install NetWitness UEBA by performing Standalone Installation and Fresh Installation.
Standalone Installation
The following tasks must be performed in the following sequence.
- Description:
- Description: Review the supported hardware.
- References: "System Requirement" topic in UEBA Standalone Installation Guide
- Description: Review the UEBA deployment.
- References: "NetWitness UEBA Standalone Installation " topic in UEBA Standalone Installation Guide
- Description: Configure the ports on your firewall.
- References: "NetWitness UEBA Standalone Installation " topic in UEBA Standalone Installation Guide
- Description:
Install NetWitness Server host.
- References: "Installation Tasks" topic in UEBA Standalone Installation Guide
- Description:
Install 12.5 Log Hybrid Host.
- References:
"Installation Tasks" topic in UEBA Standalone Installation Guide
- Description: Install and Configure NetWitness UEBA.
- References: "Installation Tasks" topic in UEBA Standalone Installation Guide
- Description:
Assign the UEBA_Analysts and Analysts roles to the UEBA users.
- References:
"Role Permissions" in the System Security and User Management Guide
Fresh Installation
The following tasks needs to be performed in the following sequence.
- Description:
- Description:
Review the supported hardware.
- References:
"Supported Hardware" in the Physical Host Installation Guide
- Description:
Review the UEBA architecture.
- References:
"NetWitness Platform Network Architecture Diagram" topic in the Deployment Guide
- Description:
Configure the ports on your firewall.
- References:
"Network Architecture and Ports" topic in the Deployment Guide
- Description:
Install NetWitness Server host and other components.
- References:
"Task 1 - Install 12.5 on the NetWitness Server (NW Server) Host" and "Task 2 - Install 12.5 on Other Component Hosts" in Physical Host Installation Guide
"Install NetWitness Platform Virtual Host in Virtual Environment" in the Virtual Host Installation Guide
- Description:
Install UEBA.
- References: "NetWitness® UEBA" in Physical Host Installation Guide
- Description:
Assign the UEBA_Analysts and Analysts roles to the UEBA users.
- References:
"Role Permissions" in the System Security and User Management Guide
Update
The following tasks must be performed in the following sequence.
- Description:
- Description:
Deploy the Endpoint Pack from Live, which contains
File Category Lua Parser for the UEBA integration with Endpoint.
- References:
During deployment, you must specify Endpoint Log Hybrid Log Decoder service. In case of multiple Endpoint servers, select all the Endpoint Log Hybrid Log Decoder services
- Description:
Enable Endpoint data sources such as Process and Registry to generate alerts in UEBA.
- References: "ueba-server-config script" in the UEBA Configuration Guide
- Description: Enable UEBA indicator forwarder to transfer the UEBA indicators to the NetWitness Respond server and to the correlation server to create an incidents.
- References:
"ueba-server-config script" in the UEBA Configuration Guide
- Description:
After you update to NetWitness Platform 12.4 the Broker or Concentrator UUID changes. You must update the NetWitness Platform core services, and update the Broker or Concentrator UUID.
- References:
"ueba-server-config script" in the UEBA Configuration Guide
- Description: Update Airflow Configuration.
- References:
"ueba-server-config script" in the UEBA Configuration Guide
- Description:
Restart the Airflow scheduler service after the presidio_upgrade DAG is successful.
- References:
"reset-presidio script" in the UEBA Configuration Guide
Investigation
The following tasks can be performed in any sequence.
- Description:
- Description: Investigate high risk users.
- References: "Investigate High-Risk Users" topic in the NetWitness UEBA User Guide
- Description: Investigate top alerts.
- References: "Investigate Top Alerts" topic in the NetWitness UEBA User Guide
Monitoring
The following tasks can be performed in any sequence.
- Description:
- Description: Review NetWitness UEBA metrics in Health and Wellness.
- References: "View NetWitness UEBA Metrics in Health and Wellness" topic in the NetWitness UEBA User Guide
- Description: Monitor Health and Wellness of UEBA.
- References: "Monitor Health and Wellness of UEBA" topic in the NetWitness UEBA User Guide
Getting Help with NetWitness Platform
There are several options that provide you with help as you need it for installing and using NetWitness:
- See the documentation for all aspects of NetWitness here: https://community.netwitness.com/s/netwitness-platform-documentation
- Use the Search and Create a Post fields in NetWitness Community portal to find specific information here: https://community.netwitness.com/t5/netwitness-discussions/bd-p/netwitness-discussions
- See the NetWitness Knowledge Base: https://community.netwitness.com/t5/netwitness-knowledge-base/tkb-p/netwitness-knowledge-base
- See Troubleshooting section in the guides.
- See also ®< sup> platform blog posts href=https://community.netwitness.com/t5/netwitness-community-blog/bg-p/netwitness-blog target=_blank>NetWitness® Platform Blog Posts.
- If you need further assistance, contact NetWitness Support.
Use these links to access documentation that is not related to a particular version of the software:
- Hardware setup guides: https://community.netwitness.com/t5/netwitness-platform-hardware/tkb-p/netwitness-hardware-documentation
- Documentation support for features such as feeds, parsers, application rules, and reports: https://community.netwitness.com/t5/threat-intelligence/ct-p/threat-intelligence.