Install Insight Sensor

You must install the Insight sensor on every Packet Decoder host to capture the network metadata and transfer them to the NetWitness Cloud. If you have multiple hosts, you need to install and configure the Insight sensor on every Packet Decoder host.

Supported Hosts

  • Packet Decoder
  • Packet Hybrid

Prerequisities

  • Ensure that the NetWitness Platform and the host (Packet Decoder) are on version 12.3 or later.
  • Ensure to consider proxy and decryption requirements when setting up an Insight Sensor. For more information, see Planning Requirements.

Note

You need a separate Insight Sensor to be installed for each Packet Decoder host.

Step 1. Install the Insight Sensor on Packet Decoder
Step 2. Download the Activation Package
Step 3. Register the Insight Sensor

Step 1: Install the Insight Sensor on Packet Decoder

  1. Log in to the NetWitness Platform as an administrator and go to admin icon Admin > Hosts.

    The Hosts view is displayed.

  2. Select the Packet Hybrid and click install button.

    A dialog listing all the services already installed on this host is displayed and seeks your confirmation if you want to install a new service.

  3. Click Yes.

    The Install Services dialog is displayed.

  4. Select NetWitness Insight from the Category drop-down menu, and click Install.

    how to install Insight sensor on Packet Decoder

  5. Go to admin icon Admin > Services to verify successful Insight installation.

Step 2: Download the Activation Package

The activation package contains the credentials and configurations for the Insight sensor to register with NetWitness.

  1. Log in to the NetWitness Cloud Portal.

  2. Go to admin icon Admin > Sensors > Downloads.

  3. Click the Insight tab.

    how to download activation package for registering sensors

  4. Under Activation Package, click download icon to download the activation package.

Step 3: Register the Insight Sensor

Note

  • The same activation package can be used to register multiple sensors.
  • Ensure you use the most recently downloaded activation package.
  • If the activation package is not available, generate a new one.
  • The activation package contains sensitive information, you must handle it carefully and don’t share it with anyone.

  1. SSH to the Packet Decoder Host.
  2. Copy the device-activation-package.json file downloaded from the NetWitness Cloud Portal to the /etc/netwitness/ng directory on the Packet Decoder host.
  3. Navigate to the following directory by running the command: 
    cd /etc/netwitness/ng
  4. Change the user and group of the device-activation-package.json file to netwitness by executing the following command: 
    chown netwitness:netwitness device-activation-package.json
  5. To verify if the Insight Sensor is installed successfully, log in to the NetWitness Cloud Portal, and go to Sensor List and check if the sensor type appears as Insight with status Connected.

Important

There could be 10 minutes delay before the sensor status is updated correctly. For example, Registered to Connected or Connected to Disconnected.

  1. Log in to the NetWitness Platform.

  2. Navigate to admin icon Admin > Services view.

  3. In the Services list, select the decoder containing the NetWitness Insight service and then click Admin icon > View > System and check if the decoder is capturing the data:

    • If the decoder is not capturing data, you must start data capture if you want data collected by this decoder to be part of Insight.

  4. Navigate to the Explore view of the decoder containing the NetWitness Insight service. In the left panel, click cloud > config, set the parameter Aggregate Hours (aggregate.hours) from 0 to 24, and restart the NetWitness Insight service.

    This step ensures that only the latest network traffic from the past 24 hours is uploaded to NetWitness Cloud, avoiding unnecessary analytics processing delays.

    View network behavior panel for assets

Important

  • Asset information is collected throughout the day and uploaded every hour.
  • NetWitness recommends that you do not change the configuration for daily data upload intervals. Changing this setting can affect the performance of your system.

See also