RSA NetWitness Packets and Logs

Details
Content
Dependencies
Version History

RSA NetWitness Logs and Packets decoders are responsible for the real-time collection of network data. The decode captures data in real time and can normalize and reconstruct data for full session analysis. In addition, the decoder can collect flow and endpoint data.

RSA NetWitness Packets and Logs provides visibility of data related to packets and logs residing on Netwitness. The pack can provide crucial information by filtering through logs/packets on Netwitness and provide analysts with insights to potential threats.

What does this pack do?

Filter logs/packets based on sessions.
Stream packets based on sessions.
Perform value count query basd on field names.
Retrieve meta values for multiple sessions.
Filter logs and packets based on pattern matches.

Note: Support for this Pack moved to the partner on 04, 21, 2024.

Please contact the partner directly via the support link on the right.

What does this pack do?

Filter logs/packets based on sessions.
Stream packets based on sessions.
Perform value count query basd on field names.
Retrieve meta values for multiple sessions.
Filter logs and packets based on pattern matches.

Note: Support for this Pack moved to the partner on 04, 21, 2024.

Please contact the partner directly via the support link on the right.

Automations

Name	Description
NetwitnessQuery	Deprecated. No available replacement. Performs a query against the meta database
NetwitnessSearch	Deprecated. No available replacement. Searches for matches in session/packet content

Integrations

Name	Description
RSA NetWitness Packets and Logs (Partner Contribution)	RSA NetWitness Logs and Packets decoders are responsible for the real-time collection of network data. The decode captures data in real time and can normalize and reconstruct data for full session analysis. In addition, the decoder can collect flow and endpoint data.

Automations

Name	Description
NetwitnessQuery	Deprecated. No available replacement. Performs a query against the meta database
NetwitnessSearch	Deprecated. No available replacement. Searches for matches in session/packet content

Integrations

Name	Description
RSA NetWitness Packets and Logs (Partner Contribution)	RSA NetWitness Logs and Packets decoders are responsible for the real-time collection of network data. The decode captures data in real time and can normalize and reconstruct data for full session analysis. In addition, the decoder can collect flow and endpoint data.

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	December 7, 2020
Last Release	March 22, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.