Create an incident inside NetWitness SA from a set of NetWitness events.
RSA NetWitness Security Analytics
- Details
- Content
- Dependencies
- Version History
RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.
Automations
| Name | Description |
|---|---|
| NetwitnessSACreateIncident | |
NetwitnessSAGetEvents | Returns all the RSA NetWitness SA events in the defined time range. |
| NetwitnessSAAddEventsToIncident | This command will add new events to an existing NetWitness SA incident. |
| NetwitnessSAGetAvailableAssignees | Returns the available NetWitness SA users to be assigned to incidents. |
NetwitnessSAGetComponents | Get a list of components in the NetWitness architecture. |
NetwitnessSAListIncidents | List NetWitness SA incidents. Filtering and sorting the list is also supported (see optional arguments). |
Integrations
| Name | Description |
|---|---|
| RSA NetWitness Security Analytics | RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data. |
Automations
| Name | Description |
|---|---|
| NetwitnessSAGetAvailableAssignees | Returns the available NetWitness SA users to be assigned to incidents. |
NetwitnessSAListIncidents | List NetWitness SA incidents. Filtering and sorting the list is also supported (see optional arguments). |
NetwitnessSAGetEvents | Returns all the RSA NetWitness SA events in the defined time range. |
NetwitnessSAGetComponents | Get a list of components in the NetWitness architecture. |
| NetwitnessSAAddEventsToIncident | This command will add new events to an existing NetWitness SA incident. |
| NetwitnessSACreateIncident | Create an incident inside NetWitness SA from a set of NetWitness events. |
Integrations
| Name | Description |
|---|---|
| RSA NetWitness Security Analytics | RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data. |
Required Content Packs (1)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (1)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
1.0.18 - 11535554 (August 2, 2026)
- 45295
Download
Scripts
NetwitnessSAGetAvailableAssignees
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAGetComponents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSACreateIncident
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAListIncidents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAAddEventsToIncident
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAGetEvents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
- 45295
Download
1.0.15 - 4096037 (July 8, 2025)
- 40498
Download
Scripts
NetwitnessSAGetComponents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAAddEventsToIncident
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSACreateIncident
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAGetEvents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAListIncidents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAGetAvailableAssignees
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
- 40498
Download
1.0.18 - 11535554 (August 2, 2026)
- 45295
Download
Scripts
NetwitnessSAGetAvailableAssignees
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAGetComponents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSACreateIncident
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAListIncidents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAAddEventsToIncident
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
NetwitnessSAGetEvents
- Updated the Docker image to: demisto/python3:3.12.13.10116658.
- 45295
Download
1.0.15 - 4096037 (July 8, 2025)
- 40498
Download
Scripts
NetwitnessSAGetComponents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAAddEventsToIncident
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSACreateIncident
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAGetEvents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAListIncidents
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
NetwitnessSAGetAvailableAssignees
- Updated the Docker image to: demisto/python3:3.12.8.3296088.
- 40498
Download
PUBLISHER
PLATFORMS
Cortex XSOARCortex XSIAM
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | June 30, 2020 | |
| Last Release | August 27, 2026 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
