Rsa Netwitness Xdr

The RSA NetWitness XDR connector enables seamless integration with Swimlane Turbine, allowing for automated threat detection and response workflows.

RSA NetWitness XDR is a comprehensive threat detection and response solution that empowers security teams to quickly identify and remediate cyber threats. This connector enables Swimlane Turbine users to integrate RSA NetWitness XDR's capabilities directly into their security workflows. Users can fetch alerts and incidents based on specific criteria, retrieve all alerts for an incident, and update incident details, all within the Swimlane platform. This integration enhances incident response efficiency and ensures a proactive security posture by leveraging RSA NetWitness XDR's rich telemetry and analytics.

Limitations

None to date.

Supported Versions

This RSA NetWitness XDR connector uses the latest version API.

Configuration

Prerequisites

To effectively utilize the RSA NetWitness XDR connector with Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with these parameters:

URL: Endpoint for RSA NetWitness XDR API access

Username: Your RSA NetWitness XDR account username

Password: Your RSA NetWitness XDR account password

HTTP Bearer Token Authentication with these parameters:

URL: Endpoint for RSA NetWitness XDR API access

Token: A valid JWT token for authenticating API requests

Authentication Methods

HTTP Basic Authentication:

URL: The endpoint URL for the RSA NetWitness XDR API.

Username: Your RSA NetWitness XDR account username.

Password: Your RSA NetWitness XDR account password.

HTTP JWT Authentication:

URL: The endpoint URL for the RSA NetWitness XDR API.

Token: A valid JWT token for authenticating API requests.

Capabilities

This RSA NetWitness XDR connector provides the following capabilities:

Fetch Alerts Based on the Criteria

Fetch Incidents Based on Fields of the Incident

Get an Incidents Alerts

Get Incident

Get Incidents by Date Range

Update Incident

Fetch Alerts Based on the Criteria

The alerts can be fetched based on the specific fields of the alert by providing the name of the field, value of the field, the number of records and the fields of the alert that needs to be included in response.

Fetch Incidents Based on Fields of the Incident

The incidents can be fetched based on the specific fields of the incident by providing the name of the field, value of the field and the number of records to be fetched as arguments.

Get an Incidents Alerts

Retrieve all alerts linked to a specific incident in RSA NetWitness XDR by providing the incident's unique ID.

Get Incident

Retrieve detailed information for a specified incident in RSA NetWitness XDR using the unique incident ID.

Get Incidents by Date Range

Retrieve incidents within a specific date range from RSA NetWitness XDR, supporting both bounded and unbounded queries.

Update Incident

Updates an existing incident in RSA NetWitness XDR using a specified ID and provided data body.

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

HTTP JWT Authentication

Authenticates using JWT

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API key, token, etc.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Fetch Alerts Based on the Criteria

Retrieve RSA NetWitness XDR alerts filtered by field name, value, and record count, including specified alert details in the response.

Endpoint

URL: /rest/api/alert/fetch

Method: GET

Input

Argument Name	Type	Required	Description
meta_name	string	Optional	Field of the alert document based on which the incident query to be made.
meta_value	string	Optional	Value for the field of the alert document based on which the incident query to be made.
numberOfRecords	string	Optional	Number of alert records to be fetched for the selected meta_key and meta_value pair.
includeFields	string	Optional	The fields from the alert document to be included for the selected meta_key and meta_value pair in case if fetching the entire alert is not preferred. By default, to fetch the entire alert, the includeFields will be having the value "null".

Input Example

{"json_body":{"meta_name":"alert.source","meta_value":"Event Stream Analysis","numberOfRecords":"1","includeFields":"null"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

[]

Fetch Incidents Based on Fields of the Incident

Retrieve incidents from RSA NetWitness XDR by specifying field names, their values, and the desired number of records.

Endpoint

URL: /rest/api/incident/fetch

Method: GET

Input

Argument Name	Type	Required	Description
meta_name	string	Optional	Field of the incident document based on which the incident query to be made.
meta_value	string	Optional	Value for the field of the incident document based on which the incident query to be made.
numberOfRecords	string	Optional	Number of incident records to be fetched for the selected meta_key and meta_value pair.

Input Example

{"json_body":{"meta_name":"priority","meta_value":"MEDIUM","numberOfRecords":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Date":"Mon, 10 Apr 2023 06:10:25 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive","Content-Length":"1523"},"reason":"OK","json_body":[{"id":"INC-75831","name":"High Risk Alerts: ESA-Packet for 30.0","summary":"","priority":"MEDIUM","prioritySort":1,"riskScore":30,"status":"ASSIGNED","statusSort":1,"alertCount":7,"pinnedAlertCount":0,"containsPinnedAlerts":false,"averageAl...

Get an Incidents Alerts

Retrieve all alerts associated with a specific incident in RSA NetWitness XDR using the incident's unique ID.

Endpoint

URL: /rest/api/incidents/{{id}}/alerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of the incident.
parameters.pageNumber	number	Optional	The requested page number.
parameters.pageSize	number	Optional	The maximum number of items to return in a single page.

Input Example

{"parameters":{"pageNumber":0,"pageSize":10},"path_parameters":{"id":"NC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.title	string	Output field: items.title
items.detail	string	Output field: items.detail
items.created	string	Output field: items.created
items.source	string	Output field: items.source
items.riskScore	number	Score value
items.type	string	Type of the resource
items.events	array	Output field: items.events
items.events.source	object	Output field: items.events.source
items.events.source.device	object	Output field: items.events.source.device
items.events.source.device.ipAddress	string	Output field: items.events.source.device.ipAddress
items.events.source.device.port	number	Output field: items.events.source.device.port
items.events.source.device.macAddress	string	Output field: items.events.source.device.macAddress
items.events.source.device.dnsHostname	string	Name of the resource
items.events.source.device.dnsDomain	string	Output field: items.events.source.device.dnsDomain
items.events.source.user	object	Output field: items.events.source.user
items.events.source.user.username	string	Name of the resource
items.events.source.user.emailAddress	string	Output field: items.events.source.user.emailAddress
items.events.source.user.adUsername	string	Name of the resource
items.events.source.user.adDomain	string	Output field: items.events.source.user.adDomain
items.events.destination	object	Output field: items.events.destination
items.events.destination.device	object	Output field: items.events.destination.device

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 12 Mar 2025 20:37:23 GMT","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Keep-Alive":"timeout=60","Connection":"keep-alive","Content-Length":"1607"},"reason":"OK","json_body":{"...

Get Incident

Retrieve detailed information for a specified incident in RSA NetWitness XDR using the unique incident ID.

Endpoint

URL: /rest/api/incidents/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Incident action

Input Example

{"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
summary	string	Output field: summary
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
alertCount	number	Count value
averageAlertRiskScore	number	Score value
sealed	boolean	Output field: sealed
totalRemediationTaskCount	number	Count value
openRemediationTaskCount	number	Count value
created	string	Output field: created
lastUpdated	string	Output field: lastUpdated
lastUpdatedBy	string	Output field: lastUpdatedBy
assignee	string	Output field: assignee
sources	array	Output field: sources
ruleId	string	Unique identifier
firstAlertTime	string	Time value
categories	array	Output field: categories
categories.id	string	Unique identifier
categories.parent	string	Output field: categories.parent
categories.name	string	Name of the resource
journalEntries	array	Output field: journalEntries

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2023-05-31T12:00:35.289Z","lastUpdatedBy":...

Get Incidents by Date Range

Retrieve incidents from RSA NetWitness XDR within a specified date range, accommodating both bounded and open-ended queries.

Endpoint

URL: /rest/api/incidents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.pageNumber	number	Optional	The requested page number.
parameters.pageSize	number	Optional	The maximum number of items to return in a single page.
parameters.since	string	Optional	A timestamp in ISO 8601 format (e.g., 1018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp.
parameters.until	string	Optional	A timestamp in ISO 8601 format (e.g., 1018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp.

Input Example

{"parameters":{"pageNumber":0,"pageSize":100,"since":"1018-01-01T14:00:00.000Z","until":"1018-01-01T14:00:00.000Z"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
items	array	Output field: items
items.id	string	Unique identifier
items.title	string	Output field: items.title
items.summary	string	Output field: items.summary
items.priority	string	Output field: items.priority
items.riskScore	number	Score value
items.status	string	Status value
items.alertCount	number	Count value
items.averageAlertRiskScore	number	Score value
items.sealed	boolean	Output field: items.sealed
items.totalRemediationTaskCount	number	Count value
items.openRemediationTaskCount	number	Count value
items.created	string	Output field: items.created
items.lastUpdated	string	Output field: items.lastUpdated
items.lastUpdatedBy	string	Output field: items.lastUpdatedBy
items.assignee	string	Output field: items.assignee
items.sources	array	Output field: items.sources
items.ruleId	string	Unique identifier
items.firstAlertTime	string	Time value
items.categories	array	Output field: items.categories
items.categories.id	string	Unique identifier
items.categories.parent	string	Output field: items.categories.parent
items.categories.name	string	Name of the resource

Output Example

Update Incident

Updates an existing incident in RSA NetWitness XDR using the provided ID and data body.

Endpoint

URL: /rest/api/incidents/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The unique identifier of the incident.
status	string	Optional	The status of the incident.
assignee	string	Optional	The NetWitness user identifier of the user.

Input Example

{"json_body":{"status":"InProgress","assignee":"user"},"path_parameters":{"id":"INC-100"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
title	string	Output field: title
summary	string	Output field: summary
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
alertCount	number	Count value
averageAlertRiskScore	number	Score value
sealed	boolean	Output field: sealed
totalRemediationTaskCount	number	Count value
openRemediationTaskCount	number	Count value
created	string	Output field: created
lastUpdated	string	Output field: lastUpdated
lastUpdatedBy	string	Output field: lastUpdatedBy
assignee	string	Output field: assignee
sources	array	Output field: sources
ruleId	string	Unique identifier
firstAlertTime	string	Time value
categories	array	Output field: categories
categories.id	string	Unique identifier
categories.parent	string	Output field: categories.parent
categories.name	string	Name of the resource
journalEntries	array	Output field: journalEntries

Output Example

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
Connection	HTTP response header: Connection	keep-alive
content-length	The length of the response body in bytes	140
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
Expires	The date/time after which the response is considered stale	0
Keep-Alive	HTTP response header: Keep-Alive	timeout=60
Pragma	HTTP response header: Pragma	no-cache
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	DENY
X-XSS-Protection	HTTP response header: X-XSS-Protection	0