NetWitness Network

We use RSA Security Analytics (previously Netwitness) as a network DVR for look back at events. It does full packet capture and reconstruction. For forensic analysis this is invaluable. It has some threat detection capability. The new GUI is significantly better and actually makes menus usable and reduces confusion for new users.

Netwitness is an industry leading tool. If you can figure out how to use it, the data is crucial to investigations. The support is improving, but has some distance to cover before they are up to standard for an enterprise level.

I worked for HCL technologies and was deployed at SBI IT headquarters for implementing their security operations center which involved implementing the tool. They used this tool to manage the security for their entire organizations web gateway . It had a capacity of close to 500000 events per second and had approximately 37000 various security devices linked to the tool .

It is perfectly suited for large organizations aiming for providing web security to the customers or also if they are interested to setup their own security perations center . It is one of the leading security tools in the market and offers comprehensive capability in dealing with web attacks.