--- title: Rsa Netwitness Xdr slug: connectors/rsa-netwitness-xdr docTags: createdAt: 2026-06-09T16:30:27.748Z --- The RSA NetWitness XDR connector enables seamless integration with Swimlane Turbine, allowing for automated threat detection and response workflows. RSA NetWitness XDR is a comprehensive threat detection and response solution that empowers security teams to quickly identify and remediate cyber threats. This connector enables Swimlane Turbine users to integrate RSA NetWitness XDR's capabilities directly into their security workflows. Users can fetch alerts and incidents based on specific criteria, retrieve all alerts for an incident, and update incident details, all within the Swimlane platform. This integration enhances incident response efficiency and ensures a proactive security posture by leveraging RSA NetWitness XDR's rich telemetry and analytics. ### Limitations None to date. ### Supported Versions This RSA NetWitness XDR connector uses the latest version API. ## Configuration ### Prerequisites To effectively utilize the RSA NetWitness XDR connector with Swimlane Turbine, ensure you have the following prerequisites: - HTTP Basic Authentication with these parameters: - URL: Endpoint for RSA NetWitness XDR API access - Username: Your RSA NetWitness XDR account username - Password: Your RSA NetWitness XDR account password - HTTP Bearer Token Authentication with these parameters: - URL: Endpoint for RSA NetWitness XDR API access - Token: A valid JWT token for authenticating API requests ## Authentication Methods ### HTTP Basic Authentication: - URL: The endpoint URL for the RSA NetWitness XDR API. - Username: Your RSA NetWitness XDR account username. - Password: Your RSA NetWitness XDR account password. ### HTTP JWT Authentication: - URL: The endpoint URL for the RSA NetWitness XDR API. - Token: A valid JWT token for authenticating API requests. ## Capabilities This RSA NetWitness XDR connector provides the following capabilities: - Fetch Alerts Based on the Criteria - Fetch Incidents Based on Fields of the Incident - Get an Incidents Alerts - Get Incident - Get Incidents by Date Range - Update Incident ### Fetch Alerts Based on the Criteria - The alerts can be fetched based on the specific fields of the alert by providing the name of the field, value of the field, the number of records and the fields of the alert that needs to be included in response. ### Fetch Incidents Based on Fields of the Incident - The incidents can be fetched based on the specific fields of the incident by providing the name of the field, value of the field and the number of records to be fetched as arguments. ### Get an Incidents Alerts - Retrieve all alerts linked to a specific incident in RSA NetWitness XDR by providing the incident's unique ID. ### Get Incident - Retrieve detailed information for a specified incident in RSA NetWitness XDR using the unique incident ID. ### Get Incidents by Date Range - Retrieve incidents within a specific date range from RSA NetWitness XDR, supporting both bounded and unbounded queries. ### Update Incident - Updates an existing incident in RSA NetWitness XDR using a specified ID and provided data body. # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP JWT Authentication Authenticates using JWT ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API key, token, etc. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Fetch Alerts Based on the Criteria Retrieve RSA NetWitness XDR alerts filtered by field name, value, and record count, including specified alert details in the response. ### Endpoint - **URL:** `/rest/api/alert/fetch` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `meta_name` | string | Optional | Field of the alert document based on which the incident query to be made. | | `meta_value` | string | Optional | Value for the field of the alert document based on which the incident query to be made. | | `numberOfRecords` | string | Optional | Number of alert records to be fetched for the selected meta\_key and meta\_value pair. | | `includeFields` | string | Optional | The fields from the alert document to be included for the selected meta\_key and meta\_value pair in case if fetching the entire alert is not preferred. By default, to fetch the entire alert, the includeFields will be having the value "null". | ### Input Example `{"json_body":{"meta_name":"alert.source","meta_value":"Event Stream Analysis","numberOfRecords":"1","includeFields":"null"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `[]` ## Fetch Incidents Based on Fields of the Incident Retrieve incidents from RSA NetWitness XDR by specifying field names, their values, and the desired number of records. ### Endpoint - **URL:** `/rest/api/incident/fetch` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `meta_name` | string | Optional | Field of the incident document based on which the incident query to be made. | | `meta_value` | string | Optional | Value for the field of the incident document based on which the incident query to be made. | | `numberOfRecords` | string | Optional | Number of incident records to be fetched for the selected meta\_key and meta\_value pair. | ### Input Example `{"json_body":{"meta_name":"priority","meta_value":"MEDIUM","numberOfRecords":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Date":"Mon, 10 Apr 2023 06:10:25 GMT","Keep-Alive":"timeout=60","Connection":"keep-alive","Content-Length":"1523"},"reason":"OK","json_body":[{"id":"INC-75831","name":"High Risk Alerts: ESA-Packet for 30.0","summary":"","priority":"MEDIUM","prioritySort":1,"riskScore":30,"status":"ASSIGNED","statusSort":1,"alertCount":7,"pinnedAlertCount":0,"containsPinnedAlerts":false,"averageAl...` ## Get an Incidents Alerts Retrieve all alerts associated with a specific incident in RSA NetWitness XDR using the incident's unique ID. ### Endpoint - **URL:** `/rest/api/incidents/{{id}}/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the incident. | | `parameters.pageNumber` | number | Optional | The requested page number. | | `parameters.pageSize` | number | Optional | The maximum number of items to return in a single page. | ### Input Example `{"parameters":{"pageNumber":0,"pageSize":10},"path_parameters":{"id":"NC-100"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | --------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.title` | string | Output field: items.title | | `items.detail` | string | Output field: items.detail | | `items.created` | string | Output field: items.created | | `items.source` | string | Output field: items.source | | `items.riskScore` | number | Score value | | `items.type` | string | Type of the resource | | `items.events` | array | Output field: items.events | | `items.events.source` | object | Output field: items.events.source | | `items.events.source.device` | object | Output field: items.events.source.device | | `items.events.source.device.ipAddress` | string | Output field: items.events.source.device.ipAddress | | `items.events.source.device.port` | number | Output field: items.events.source.device.port | | `items.events.source.device.macAddress` | string | Output field: items.events.source.device.macAddress | | `items.events.source.device.dnsHostname` | string | Name of the resource | | `items.events.source.device.dnsDomain` | string | Output field: items.events.source.device.dnsDomain | | `items.events.source.user` | object | Output field: items.events.source.user | | `items.events.source.user.username` | string | Name of the resource | | `items.events.source.user.emailAddress` | string | Output field: items.events.source.user.emailAddress | | `items.events.source.user.adUsername` | string | Name of the resource | | `items.events.source.user.adDomain` | string | Output field: items.events.source.user.adDomain | | `items.events.destination` | object | Output field: items.events.destination | | `items.events.destination.device` | object | Output field: items.events.destination.device | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 12 Mar 2025 20:37:23 GMT","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Keep-Alive":"timeout=60","Connection":"keep-alive","Content-Length":"1607"},"reason":"OK","json_body":{"...` ## Get Incident Retrieve detailed information for a specified incident in RSA NetWitness XDR using the unique incident ID. ### Endpoint - **URL:** `/rest/api/incidents/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Incident action | ### Input Example `{"path_parameters":{"id":"INC-100"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `title` | string | Output field: title | | `summary` | string | Output field: summary | | `priority` | string | Output field: priority | | `riskScore` | number | Score value | | `status` | string | Status value | | `alertCount` | number | Count value | | `averageAlertRiskScore` | number | Score value | | `sealed` | boolean | Output field: sealed | | `totalRemediationTaskCount` | number | Count value | | `openRemediationTaskCount` | number | Count value | | `created` | string | Output field: created | | `lastUpdated` | string | Output field: lastUpdated | | `lastUpdatedBy` | string | Output field: lastUpdatedBy | | `assignee` | string | Output field: assignee | | `sources` | array | Output field: sources | | `ruleId` | string | Unique identifier | | `firstAlertTime` | string | Time value | | `categories` | array | Output field: categories | | `categories.id` | string | Unique identifier | | `categories.parent` | string | Output field: categories.parent | | `categories.name` | string | Name of the resource | | `journalEntries` | array | Output field: journalEntries | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2023-05-31T12:00:35.289Z","lastUpdatedBy":...` ## Get Incidents by Date Range Retrieve incidents from RSA NetWitness XDR within a specified date range, accommodating both bounded and open-ended queries. ### Endpoint - **URL:** `/rest/api/incidents` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------- | | `parameters.pageNumber` | number | Optional | The requested page number. | | `parameters.pageSize` | number | Optional | The maximum number of items to return in a single page. | | `parameters.since` | string | Optional | A timestamp in ISO 8601 format (e.g., 1018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp. | | `parameters.until` | string | Optional | A timestamp in ISO 8601 format (e.g., 1018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp. | ### Input Example `{"parameters":{"pageNumber":0,"pageSize":100,"since":"1018-01-01T14:00:00.000Z","until":"1018-01-01T14:00:00.000Z"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.title` | string | Output field: items.title | | `items.summary` | string | Output field: items.summary | | `items.priority` | string | Output field: items.priority | | `items.riskScore` | number | Score value | | `items.status` | string | Status value | | `items.alertCount` | number | Count value | | `items.averageAlertRiskScore` | number | Score value | | `items.sealed` | boolean | Output field: items.sealed | | `items.totalRemediationTaskCount` | number | Count value | | `items.openRemediationTaskCount` | number | Count value | | `items.created` | string | Output field: items.created | | `items.lastUpdated` | string | Output field: items.lastUpdated | | `items.lastUpdatedBy` | string | Output field: items.lastUpdatedBy | | `items.assignee` | string | Output field: items.assignee | | `items.sources` | array | Output field: items.sources | | `items.ruleId` | string | Unique identifier | | `items.firstAlertTime` | string | Time value | | `items.categories` | array | Output field: items.categories | | `items.categories.id` | string | Unique identifier | | `items.categories.parent` | string | Output field: items.categories.parent | | `items.categories.name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Wed, 12 Mar 2025 20:37:23 GMT","X-Content-Type-Options":"nosniff","X-XSS-Protection":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DENY","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Keep-Alive":"timeout=60","Connection":"keep-alive","Content-Length":"1607"},"reason":"OK","json_body":{"...` ## Update Incident Updates an existing incident in RSA NetWitness XDR using the provided ID and data body. ### Endpoint - **URL:** `/rest/api/incidents/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the incident. | | `status` | string | Optional | The status of the incident. | | `assignee` | string | Optional | The NetWitness user identifier of the user. | ### Input Example `{"json_body":{"status":"InProgress","assignee":"user"},"path_parameters":{"id":"INC-100"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `title` | string | Output field: title | | `summary` | string | Output field: summary | | `priority` | string | Output field: priority | | `riskScore` | number | Score value | | `status` | string | Status value | | `alertCount` | number | Count value | | `averageAlertRiskScore` | number | Score value | | `sealed` | boolean | Output field: sealed | | `totalRemediationTaskCount` | number | Count value | | `openRemediationTaskCount` | number | Count value | | `created` | string | Output field: created | | `lastUpdated` | string | Output field: lastUpdated | | `lastUpdatedBy` | string | Output field: lastUpdatedBy | | `assignee` | string | Output field: assignee | | `sources` | array | Output field: sources | | `ruleId` | string | Unique identifier | | `firstAlertTime` | string | Time value | | `categories` | array | Output field: categories | | `categories.id` | string | Unique identifier | | `categories.parent` | string | Output field: categories.parent | | `categories.name` | string | Name of the resource | | `journalEntries` | array | Output field: journalEntries | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2023-05-31T12:00:34.500Z","lastUpdatedBy":...` # Response Headers | **Header** | **Description** | **Example** | | ---------------------- | ---------------------------------------------------------- | ---------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | content-length | The length of the response body in bytes | 140 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | Expires | The date/time after which the response is considered stale | 0 | | Keep-Alive | HTTP response header: Keep-Alive | timeout=60 | | Pragma | HTTP response header: Pragma | no-cache | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | DENY | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 0 |