Skip to content
  • There are no suggestions because the search field is empty.

Response Actions View

Tags: Documentation

Response Actions are the reactive operations performed on configured metadata using a third-party tool after triaging an event; the Response Actions feature (

ConfigureIcon_17x14.png(CONFIGURE) > More > Response Actions) allows you to integrate the supported third-party tools or connectors with the NetWitness platform and perform the following actions.

  • Create and manage Response Actions for metas displayed in Respond, Investigate, Hosts, and Users views that support context highlights.

  • Perform Quick Actions on the applicable meta and post the meta with additional information to the connector for taking further actions.

Workflow

The following figure is a high-level workflow illustrating the tasks you can do in the NetWitness Response Actions view.

124_flowchart_0224.png

What do you want to do?

  • User Role: Administrator
  • I want to ...: Create, edit, clone, enable, disable, delete, and view action history for Response Actions
  • Show me how: Create and Manage Response Actions

  • User Role: Administrator
  • I want to ...: Filter Response Actions
  • Show me how: See Response Actions Filters Panel in Quick Action History


Related Topics

Quick Look

To access the Response Actions view, go to the (ConfigureIcon_17x14.png(CONFIGURE) > More > Response Actions view.

124_ref_0224.png

  • Column 1: 1
  • Column 2:

    124_create_0224.png: Allows you to create a new Response Action. This option is grayed out if you have not integrated any connector with the NetWitness platform. If the connector is integrated with NetWitness Platform, you can select the same from the drop-down list.

    124_edit_0224: Allows you to edit the existing Response Action.

    124_cloneicon_0224.png: Allows you to clone the existing Response Action.

    124_enable_0224.png: Allows you to enable an already disabled Response Action.

    124_disable_0224.png: Allows you to disable the selected Response Action.

    124_delete_0224_70x24.png: Allows you to delete the required Response Action.


  • Column 1: 2
  • Column 2: 124_view:Allows you to view the history of the Response Actions.

  • Column 1: 3
  • Column 2: 124_filter: Allows you to filter and view the required Response Actions in the Response Actions List view.

  • Column 1: 4
  • Column 2: By default, 25 Response Actions are displayed per page. To go to the next page, click 124_greaterthan_0224_30x28.png. To go to the last page, click 124_greaterthann_0224_47x26.png

Response Actions List View

The Response Actions List displays all the Response Actions configured in the NetWitness Platform. You can filter this list to view only the Response Actions of interest.

124_respactionlw_0224.png

The following table describes the columns in the Response Actions List.

  • Columns: Name
  • Description: Displays the name of all the Response Actions in the Response Actions List view.

  • Columns: Description
  • Description: Displays the descriptions of the Response Actions.

  • Columns: Connector
  • Description: Displays the name of the third-party tool for which the particular Response Action is configured.

  • Columns: Meta Keys
  • Description: Displays the list of meta keys for which the Response Action is supported.

  • Columns: Status
  • Description: Displays the current status of the Response Action. For example: Enabled and Disabled.

  • Columns: Last Updated
  • Description: Displays the date and time when the Response Action was last updated.

  • Columns: Last Updated By
  • Description: Displays the name of the user who updated the Response Action last time.

Response Actions Filters Panel

The following figure shows the filters available in the Response Actions Filters panel.

124_Filterspanel_0224_311x460.png

You can filter the Response Actions based on the following parameters.

  • Response Action Name

  • Status of the Response Action

  • Supported Meta Keys

  • Last updated Date and Time

The following table lists all the fields displayed in the Response Actions List view Filters panel.

  • Fields: Name
  • Description: Allows you to enter the name of the required Response Action.

  • Fields: Status
  • Description: Allows you to filter the Response Action based on the status Enabled or Disabled.

  • Fields: Meta Keys
  • Description: Allows you to filter the Response Action based on the meta keys supported.

  • Fields: Last Updated
  • Description: Allows you to filter the Response Action based on the date and time when the action was last updated.

  • Fields: Reset
  • Description: Removes your existing filters.

Response Actions Overview panel

When you click any row in the Response Actions List, the Overview panel is displayed on the right side of the Response Actions List view, which shows the basic summary information about the particular Response Action.

124_blockIP_0224_339x486.png

The following table displays the fields and parameters associated with the Overview panel.