Rsa Netwitness Siem

The RSA NetWitness SIEM connector enables automated interaction with the RSA NetWitness SIEM platform, facilitating incident management and alert handling.

RSA NetWitness SIEM is a powerful security information and event management platform that provides real-time visibility into your security posture. This connector enables Swimlane Turbine users to automate incident response and management, fetch detailed alert and incident data, and maintain a comprehensive security event history. By integrating with RSA NetWitness SIEM, users can streamline their security operations, enhance incident tracking, and improve overall threat detection and response times within the Swimlane ecosystem.

Limitations

None to date.

Prerequisites

To effectively utilize the RSA NetWitness SIEM connector with Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: Endpoint for RSA NetWitness SIEM API access.

Username: Your RSA NetWitness SIEM account username.

Password: Your RSA NetWitness SIEM account password.

Capabilities

This RSA NetWitness SIEM Connector provides the following capabilities:

Add a Journal Entry

Fetch alerts based on the criteria

Fetch incidents based on fields of incident

Get Alerts by Date Range

Get Incident Stats

Get Incident History

Get Incident User Stats

Get Incidents by Date Range

Get a Single Incident

Get an Incident's Alerts

Persisting events in an alert

Persisting events in an incident

Remove an Incident

Suspending persist of events in an alert

Suspending persist of events in an incident ... and so on

Add a Journal Entry

A journal entry, or note, can be added to an existing incident.

Fetch alerts based on the criteria

The alerts can be fetched based on the specific fields of the alert by providing the name of the field,value of the field, the number of records and the fields of the alert that needs to be included in response.

Fetch incidents based on fields of incident

The incidents can be fetched based on the specific fields of the incident by providing the name ofthe field, value of the field and the number of records to be fetched as arguments.

Get Alerts by Date Range

Alerts can be retrieved by the date and time they were created.

Get Incident History

Fetch the entire history details of the incident using the incident's unique identifier.

Get Incident Stats

IncidentStats can be retrieved by the date and time they were created. It contains day wise detailsof the overall MTTA, MTTD and MTTR as well as the count associated with each metric for that day.

Get Incident User Stats

Incident User Stats can be retrieved by user and date range. It computes the MTTD values for therange of dates mentioned and responds with a consolidated list.

Get Incidents by Date Range

Incidents can be retrieved by the date and time they were created.

Get a Single Incident

A single incident can be retrieved using an incident's unique identifier.

Get an Incident's Alerts

All the alerts that are associated with an incident can be retrieved using the incident's uniqueidentifier.

Persisting events in an alert

Persist all the events present in the alert using the alert's unique identifier.

Persisting events in an incident

Persist all the events present in the incident using the incident's unique identifier.

Remove an Incident

A single incident can be removed using the incident's unique identifier.

Suspending persist of events in an alert

Suspend all the events present in persist alert using the alert's unique identifier.

Suspending persist of events in an incident

Suspend all the events present in persist incident using the incident's unique identifier.

Update an Incident

Currently an incident's status and assignee can be modified using the incidents endpoint.

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add a Journal Entry

Add a journal entry or note to an existing incident in RSA Netwitness SIEM using the incident's ID.

Endpoint

URL: /rest/api/incidents/{{id}}/journal

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the incident to which the journal entry will be added.
author	string	Optional	The NetWitness user id of the user creating the journal entry.
notes	string	Optional	Notes and observations about the incident.
milestone	string	Optional	The incident milestone classifier.

Input Example

{"json_body":{"author":"duke","notes":"This incident is contained.","milestone":"Containment"},"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{}}

Fetch alerts based on the criteria

Retrieve RSA Netwitness SIEM alerts filtered by field names, values, record count, and specified response fields.

Endpoint

URL: /rest/api/alert/fetch

Method: GET

Input

Argument Name	Type	Required	Description
meta_name	string	Optional	Field of the alert document based on which the incident query to be made.
meta_value	string	Optional	Value for the field of the alert document based on which the incident query to be made.
numberOfRecords	string	Optional	Number of alert records to be fetched for the selected meta_key and meta_value pair. Max 1000.
includeFields	string	Optional	The fields from the alert mongo document to be included in the output, if fetching the entire alert is not preferred (Comma separated list of fields).

Input Example

{"json_body":{"meta_name":"alert.source","meta_value":"Event Stream Analysis","numberOfRecords":"1","includeFields":"null"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Fetch incidents based on fields of incident

Retrieve RSA Netwitness SIEM incidents filtered by specific field values and control the number of records fetched.

Endpoint

URL: /rest/api/incident/fetch

Method: POST

Input

Argument Name	Type	Required	Description
meta_name	string	Optional	The name of the field to filter incidents.
meta_value	string	Optional	The value of the field to filter incidents.
numberOfRecords	string	Optional	The number of records to fetch.

Input Example

{"json_body":{"meta_name":"priority","meta_value":"MEDIUM","numberOfRecords":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"id":"INC-75831","name":"High Risk Alerts: ESA-Packet for 30.0","summary":"","priority":"MEDIUM","prioritySort":1,"riskScore":30,"status":"ASSIGNED","statusSort":1,"alertCount":7,"pinnedAlertCount":0,"containsPinnedAlerts":false,"averageAlertRiskScore":30,"sealed":true,"totalRemediationTaskCount":0,"openRemediationTaskCount":0}]}

Get a Single Incident

Retrieve a specific incident from RSA NetWitness SIEM using the unique incident identifier.

Endpoint

URL: /rest/api/incidents/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of the incident.

Input Example

{"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
summary	string	Output field: summary
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
alertCount	number	Count value
averageAlertRiskScore	number	Score value
sealed	boolean	Output field: sealed
totalRemediationTaskCount	number	Count value
openRemediationTaskCount	number	Count value
created	string	Output field: created
lastUpdated	string	Output field: lastUpdated
lastUpdatedBy	string	Output field: lastUpdatedBy
assignee	string	Output field: assignee
sources	array	Output field: sources
ruleId	string	Unique identifier
firstAlertTime	string	Time value
categories	array	Output field: categories
categories.id	string	Unique identifier
categories.parent	string	Output field: categories.parent
categories.name	string	Name of the resource
journalEntries	array	Output field: journalEntries

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2024-02-06T12:44:34.722Z","lastUpdatedBy":...

Get Alerts by Date Range

Retrieve alerts from RSA Netwitness SIEM based on a specified date and time range.

Endpoint

URL: /rest/api/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageNumber	number	Optional	The page number for pagination.
parameters.pageSize	number	Optional	The number of items per page for pagination.
parameters.since	string	Optional	A date format (e.g., 2022-01-01). Retrieve incidents stats created on and after this date.
parameters.until	string	Optional	A date format (e.g., 2022-01-31). Retrieve incident stats created on and before this date.

Input Example

{"parameters":{"pageNumber":0,"pageSize":100,"since":"2022-01-01","until":"2022-01-31"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.receivedTime	string	Time value
items.status	string	Status value
items.errorMessage	object	Response message
items.originalHeaders	object	HTTP headers for the request
items.originalHeaders.name	string	HTTP headers for the request
items.originalHeaders.description	string	HTTP headers for the request
items.originalHeaders.version	number	HTTP headers for the request
items.originalHeaders.severity	number	HTTP headers for the request
items.originalHeaders.timestamp	number	HTTP headers for the request
items.originalHeaders.signatureId	string	HTTP headers for the request
items.originalHeaders.deviceVendor	string	HTTP headers for the request
items.originalHeaders.deviceProduct	string	HTTP headers for the request
items.originalRawAlert	object	Output field: items.originalRawAlert
items.originalAlert	object	Output field: items.originalAlert
items.originalAlert.severity	number	Output field: items.originalAlert.severity
items.originalAlert.dataSourceHost	string	Response data
items.originalAlert.user_summary	string	Output field: items.originalAlert.user_summary
items.originalAlert.events	array	Output field: items.originalAlert.events
items.originalAlert.events.ip_proto	number	Output field: items.originalAlert.events.ip_proto
items.originalAlert.events.ip_src	string	Output field: items.originalAlert.events.ip_src
items.originalAlert.events.lifetime	number	Time value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}

Get an Incident's Alerts

Retrieve all alerts associated with a specific incident in RSA Netwitness SIEM using the incident's unique identifier.

Endpoint

URL: /rest/api/incidents/{{id}}/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageNumber	number	Optional	The page number to retrieve.
parameters.pageSize	number	Optional	The number of items to retrieve per page.
path_parameters.id	string	Required	The ID of the incident for which alerts are being retrieved.

Input Example

{"parameters":{"pageNumber":0,"pageSize":100},"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.title	string	Output field: items.title
items.detail	string	Output field: items.detail
items.created	string	Output field: items.created
items.source	string	Output field: items.source
items.riskScore	number	Score value
items.type	string	Type of the resource
items.events	array	Output field: items.events
items.events.source	object	Output field: items.events.source
items.events.source.device	object	Output field: items.events.source.device
items.events.source.device.ipAddress	string	Output field: items.events.source.device.ipAddress
items.events.source.device.port	number	Output field: items.events.source.device.port
items.events.source.device.macAddress	string	Output field: items.events.source.device.macAddress
items.events.source.device.dnsHostname	object	Name of the resource
items.events.source.device.dnsDomain	object	Output field: items.events.source.device.dnsDomain
items.events.source.user	object	Output field: items.events.source.user
items.events.source.user.username	string	Name of the resource
items.events.source.user.emailAddress	object	Output field: items.events.source.user.emailAddress
items.events.source.user.adUsername	object	Name of the resource
items.events.source.user.adDomain	object	Output field: items.events.source.user.adDomain
items.events.destination	object	Output field: items.events.destination
items.events.destination.device	object	Output field: items.events.destination.device

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":10,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}

Get Incident history

Retrieve the complete history of an incident in RSA NetWitness SIEM using the unique incident identifier.

Endpoint

URL: /rest/api/incidents/history/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the incident to fetch history for.

Input Example

{"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"type":"STATUS","date":"2022-05-11T09:24:43.025+00:00","changedBy":"admin","changedFrom":"IN_PROGRESS","changedTo":"REMEDIATION_REQUESTED"},{"type":"PRIORITY","date":"2022-05-11T09:25:18.767+00:00","changedBy":"admin","changedFrom":"HIGH","changedTo":"MEDIUM"},{"type":"ASSIGNEE","date":"2022-05-11T09:25:31.157+00:00","changedBy":"admin","changedFrom":"rolden","changedTo":"admin"}]}

Get Incident Stats

Retrieve day-wise incident statistics from RSA Netwitness SIEM, including MTTA, MTTD, MTTR, and associated counts.

Endpoint

URL: /rest/api/incidents/stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageNumber	number	Optional	The requested page number.
parameters.pageSize	number	Optional	The maximum number of items to return in a single page.
parameters.since	string	Optional	A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp.
parameters.until	string	Optional	A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp.

Input Example

{"parameters":{"pageNumber":0,"pageSize":100,"since":"2018-01-01T14:00:00.000Z","until":"2018-01-01T14:00:00.000Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.date	string	Date value
items.mtta	number	Output field: items.mtta
items.mttaCount	number	Count value
items.mttd	number	Output field: items.mttd
items.mttdCount	number	Count value
items.mttr	number	Output field: items.mttr
items.mttrCount	number	Count value
pageNumber	number	Output field: pageNumber
pageSize	number	Output field: pageSize
totalPages	number	Output field: totalPages
totalItems	number	Output field: totalItems
hasNext	boolean	Output field: hasNext
hasPrevious	boolean	Output field: hasPrevious

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}

Get Incident User Stats

Retrieve user-specific incident statistics and Mean Time To Detect (MTTD) values for a specified date range in RSA Netwitness SIEM.

Endpoint

URL: /rest/api/incidents/user-stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.username	string	Optional	The NetWitness user id of the user for whom the stats are being requested.
parameters.since	string	Optional	A date format (e.g., 2022-01-01). Retrieve incidents stats created on and after this date.
parameters.until	string	Optional	A date format (e.g., 2022-01-31). Retrieve incidents stats created on and before this date.

Input Example

{"parameters":{"username":"admin","since":"2022-01-01","until":"2022-01-31"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
userName	string	Name of the resource
overallClosedCount	number	Count value
mttd	number	Output field: mttd
mttdCount	number	Count value
incidentIds	array	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"userName":"admin","overallClosedCount":2,"mttd":12,"mttdCount":2,"incidentIds":["INC-1","INC-2"]}}

Get Incidents by Date Range

Retrieve incidents from RSA NetWitness SIEM based on the specified creation date and time range.

Endpoint

URL: /rest/api/incidents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageNumber	number	Optional	The requested page number.
parameters.pageSize	number	Optional	The maximum number of items to return in a single page.
parameters.since	string	Optional	A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp.
parameters.until	string	Optional	A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp.

Input Example

{"parameters":{"pageNumber":0,"pageSize":100,"since":"2018-01-01T14:00:00.000Z","until":"2018-01-01T14:00:00.000Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.title	string	Output field: items.title
items.summary	string	Output field: items.summary
items.priority	string	Output field: items.priority
items.riskScore	number	Score value
items.status	string	Status value
items.alertCount	number	Count value
items.averageAlertRiskScore	number	Score value
items.sealed	boolean	Output field: items.sealed
items.totalRemediationTaskCount	number	Count value
items.openRemediationTaskCount	number	Count value
items.created	string	Output field: items.created
items.lastUpdated	string	Output field: items.lastUpdated
items.lastUpdatedBy	string	Output field: items.lastUpdatedBy
items.assignee	string	Output field: items.assignee
items.sources	array	Output field: items.sources
items.ruleId	string	Unique identifier
items.firstAlertTime	string	Time value
items.categories	array	Output field: items.categories
items.categories.id	string	Unique identifier
items.categories.parent	string	Output field: items.categories.parent
items.categories.name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}

Persisting events in an alert

Persist all events in an alert identified by a unique ID within RSA Netwitness SIEM.

Endpoint

URL: /rest/api/alerts/persist/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the alert to persist events in.

Input Example

{"json_body":{},"path_parameters":{"id":"59440ad7e4b0ff674d2cd85e"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
message	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Persisted alert id 59440ad7e4b0ff674d2cd85e"}}

Persisting events in an incident

Permanently store all events associated with a specific incident in RSA Netwitness SIEM using the incident's unique ID.

Endpoint

URL: /rest/api/incidents/persist/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the incident to persist events in.

Input Example

{"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
message	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Task successfully submitted to persist incident id - INC-75287"}}

Remove an Incident

Removes a specified incident from RSA NetWitness SIEM using the unique incident identifier.

Endpoint

URL: /rest/api/incidents/{{id}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the incident to remove.

Input Example

{"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}

Suspending persist of events in an alert

Suspend all events within a persistent alert on RSA Netwitness SIEM using the alert's unique ID.

Endpoint

URL: /rest/api/alerts/suspend-persist/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the alert to suspend persist events in.

Input Example

{"path_parameters":{"id":"59440ad7e4b0ff674d2cd85e"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
message	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Suspended persist for alert id 59440ad7e4b0ff674d2cd85e"}}

Suspending persist of events in an incident

Suspend all events within a persistent incident in RSA Netwitness SIEM using the incident's unique ID.

Endpoint

URL: /rest/api/incidents/suspend-persist/{{id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier for the incident.

Input Example

{"path_parameters":{"id":"INC-75287"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
status	string	Status value
message	string	Response message

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Suspended persist for incident id INC-75287"}}

Update an Incident

Modify an incident's status in RSA Netwitness SIEM using the incident ID and status provided in the JSON body.

Endpoint

URL: /rest/api/incidents/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the incident to update.
status	string	Optional	The new status of the incident.
assignee	string	Optional	The new assignee for the incident.

Input Example

{"json_body":{"status":"InProgress","assignee":"tony"},"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
summary	string	Output field: summary
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
alertCount	number	Count value
averageAlertRiskScore	number	Score value
sealed	boolean	Output field: sealed
totalRemediationTaskCount	number	Count value
openRemediationTaskCount	number	Count value
created	string	Output field: created
lastUpdated	string	Output field: lastUpdated
lastUpdatedBy	string	Output field: lastUpdatedBy
assignee	string	Output field: assignee
sources	array	Output field: sources
ruleId	string	Unique identifier
firstAlertTime	string	Time value
categories	array	Output field: categories
categories.id	string	Unique identifier
categories.parent	string	Output field: categories.parent
categories.name	string	Name of the resource
journalEntries	array	Output field: journalEntries

Output Example

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT