RSA NetWitness® Suite Unified Data Model Meta Entities

Meta Entities

In the RSA NetWitness® Platform, data is parsed into the most accurate meta key available based on the given context which is extremely important for analysts. However, this can present a challenge when analysts have use cases where they do not need the most granular context. If they need only the high level context, they do not want to have to query every possible key of relevance. For Example: To check if IP 1.1.1.1 showed up in the network, they would need to query 7 different keys namely: ip.src, ip.dst, alias.ip, stransaddr, dtransaddr, forward.ip, device.ip, etc. 

Meta Entities provide a way to link similar meta keys together. Once they are defined, an entity can be used the same way as a key, so that analysts use them as regular keys to get to multiple, similar concepts. For Example: We can link all the keys referenced above as "ip.all"

Note:

1. Meta Entities are only supported on RSA NetWitness 11.1 and above.
2. All Meta keys defined under a Meta Entity should have the same Data Type
3. All Meta keys defined under a Meta Entity should have the same Indexing Levels
4. Meta Entities nesting is not allowed: a Meta Entity can only reference Meta Keys and not another Meta Entity