Release Notes for 12.5.2

Summary of the NetWitness® Release Notes for 12.5.2

The NetWitness® 12.5.2 Release guide addresses several defects, delivers critical security patches for reported vulnerabilities, and provides details on upgrade paths, fixed issues, known issues, build numbers, and self-help resources. 

Updated: 3 April 2026

Enhancements

This section provides details around the new enhancements coming to 12.5.2.

NetWitness SASE Integration with Netskope

• Introducing a new Netskope plugin that is now integrated into the decoder.
• This plugin provides enhanced visibility into encrypted traffic, remote users, and cloud workloads.
• It enables organizations to leverage SASE flexibility while retaining threat detection and response visibility.

FirstWatch BforeAI Intelligence Feed

• Adds a new predictive domain intelligence feed to NetWitness FirstWatch.
• Uses AI models to help identify potential malicious domains before they can be weaponized.
• This feed helps to support early detection of potential phishing, malware, and credential theft

Security Updates

This section addresses critical, major, moderate, and minor vulnerabilities (CVE numbers listed in detail). For more information, see the NetWitness® Security Fixes article. 

Fixed Issues

This section details the resolving of several issues related to the following areas within NetWitness:

• ESA rule reload issues
• Certificate host resolution warnings
• Improved WebSocket origin validation and authentication
• RabbitMQ queue visibility issues related to parser errors
• Log Decoder crashes related to log forwarding
• Missing IPv6 metadata when traffic is encapsulated in GRE over IPv4
• Logstash and JDBC collection failures
• Incomplete parsing of Windows DNS debug logs
• Incident Rule order change preservation
• Publishing failures for custom parsers

Deprecated Components

This section provides a list of deprecated items that have been removed from this version of the NetWitness Platform.

• ODBC Collection Method - As of 12.5.2 the ODBC driver for connecting to database event sources is no longer a part of the NetWitness Platform. Instead, customers must manually migrate their ODBC events sources to utilize NetWitness Platform's JDBC collection method. This should be done before upgrading to 12.5.2. Contact NetWitness Support for more information and assistance.

Product Version Life Cycle

This section references a list of versions reaching End of Primary Support (EOPS). 

Build Numbers for 12.5.2 Components

This section provides a detailed table listing build numbers for all major NetWitness® components (Appliance, Archiver, Bootstrap, Broker, Cloud, Concentrator, Decoder, etc.). 

Getting Help with the NetWitness® Platform

This section lists release Information Important Links. Also, provides links to documentation, known issues, and previous release notes. 

Product Documentation

• Provides direct links to product documentation and analytics on cloud features. 

Self-Help Resources

• Includes documentation, community portal, knowledge base, troubleshooting guides, and blog.

Contact NetWitness® Support

• Explains how to contact support, including community portal, international contacts, NW update, and LiveUI.

NetWitness® Educational Services

• Includes training guides, course catalog, training schedule, and support contact.