Investigate

• 1: View Assets Data on Springboard
• 2: View Contextual Information for an Asset
• 3: View Insight Alerts from Respond View
• 4: View Insight Incidents Details
• 5: Whitelist Insight Alerts from Respond View

1 - View Assets Data on Springboard

NetWitness Springboard provides analysts with visibility into all the behavior details of an asset in the form of asset data. These behavior details are based on cloud analytics performed by NetWitness Insight on uploaded network metadata by the Insight sensor.

The Springboard retrieves NetWitness Insight data results from the cloud leveraging the Cloud Connector sensor. With this data, analysts can create a new panel with data type Assets to monitor and identify risky assets in their environment, which helps in further investigation of an asset.

The assets IP are categorized based on the Network Exposure. The critical ones are highlighted with red with a severity ranging from 76 to 100 and 100 is the maximum, which requires immediate attention.

Analysts can perform the following actions on the Assets Panel:

• Click an asset IP in the assets panel to view or investigate the assets details with relevant filters applied in the Investigate > Events view.

• Click at the top of the assets panel to view all the results in the Investigate > Events view.

• Click a row in the table to view details or to investigate.

• Change the time range for some panels namely Assets and Alerts panels. To change the time range, select the time range selection box from the drop-down menu in the top left corner of the Springboard view.

• Scroll to view the different panels using the scroll bar available below the panels.

• Click to refresh and load the latest data into the panel.

To add the Assets panel

1. Log in to the NetWitness Platform.

2. Click either on the top or on the right side of the view or click at the bottom of the view to add a panel.

   The Create New Panel dialog is displayed. The following figure is an example of the Assets panel configuration.

   

3. In the Input Settings section:

   • Name: Enter a unique name for the panel. The name can include letters, numbers, spaces, and special characters, such as _ - ( ) [ ].

   • Number of Results: By default, the number of results is 25. Specify the number of results that range from 25 to 100.

   • Data Type: Select the data type as Assets.

   • Data Source: Select the source of the data to use for the panel. You can use Broker or Concentrator to filter the query results on the Investigate > Events page for further investigation.

4. In the Output Settings section, select the appropriate settings based on the data type.

5. Click Add Panel.

6. Click Save Board once you have added all the panels.

   For more information, see topic Managing the Springboard.

See also

• Install Insight Sensor
• Install the Cloud Connector Sensor
• View Contextual Information for an Asset

2 - View Contextual Information for an Asset

NetWitness empowers analysts with the capability to perform context lookups for assets, accessible through the Investigate > Events and Respond pages. By leveraging Context Lookup, analysts can examine an asset’s Network Behavior and determine its criticality. Contextual information plays a pivotal role in enabling analysts to comprehend the asset’s value, evolving categorization, and associated behaviors. This information enables analysts to make informed decisions and take timely, appropriate actions throughout their analysis. The Context Lookup panel showcases contextual information related to the selected asset, with the available data based on the configured sources within the Context Hub.

To perform a Context Lookup for an Asset from the Events view

1. Log in to the NetWitness Platform.

2. Go to Investigate > Events.

3. On the Query search bar, enter the IP address of the asset you want to view the context data and click to load events in the Events panel.

   A query is executed in the Events panel, and matching events are listed.

4. In the Events panel, left or right-click the IP address.

   A Context Highlights dialog is displayed.

   

5. Click Network Exposure.

   The Network Behavior panel of the asset is displayed.

   

   The Network Behavior panel offers a comprehensive overview of an asset’s network activity, providing valuable insights for analysts seeking to understand its communication with other network assets. Using sparklines, analysts can quickly understand recent changes in network behavior over time. In addition, the panel provides contextual information, including exposure rank, categorization, and behavioral patterns, which serve as powerful tools for in-depth analysis, enabling the identification of potential risks and vulnerabilities associated with the asset.

The Network Behavior panel provides the following information about the asset:

Enterprise Network Exposure

The enterprise network exposure helps analysts determine asset criticality in relation to all other assets within the enterprise. It is determined by an in-built algorithm that calculates a rank for each asset, taking into account multiple factors, such as the number of services exported by the asset, as well as the quantity of internal and external IP addresses that connect to it. This enables the analysts to gain a comprehensive understanding of an asset’s significance within the enterprise network, allowing them to prioritize resources and make informed decisions accordingly.

The Enterprise Network Exposure has two values:

• Exposure Rank Highlights

  An asset’s rank is established by evaluating its exposure value, a metric derived from the combined analysis of the services it exposes and the volume of internal and external traffic it handles. This evaluation results in a rank that serves as an indicator of the asset’s criticality relative to all other assets within the network. Sparkline offers a concise overview of asset trends, enabling analysts to quickly identify whether rank is increasing, decreasing, or maintaining a consistent level. A lower rank indicates a higher level of criticality, highlighting the asset’s importance. For example,

  • An asset with a rank of 10 / 200 means that the asset ranks 10th among 200 total assets, where 9 assets have a higher exposure than this asset, and 190 have lower exposure. This determination is influenced by a combination of the following factors:

    • The asset might expose a lot of services compared to other assets.
    • The asset might be handling a lot of traffic compared to other assets.

  • An asset with a rank of 190 / 200 means that the asset ranks 190th among 200 total assets, where 189 assets have a higher exposure than this asset, and 10 have lower exposure. This determination is influenced by a combination of the following factors:

    • The asset might not expose a lot of services compared to other assets.
    • The asset might not handle a lot of traffic compared to other assets.

• Exposure Rank (Percentile)

  The exposure rank percentile provides a valuable measure of an asset’s significance, represented as a percentile. This percentile reflects the asset’s level of criticality within the network. A higher percentile indicates a greater degree of criticality, highlighting the asset’s importance. For example,

  • An asset with an exposure value in the 90th percentile is regarded as having a high level of criticality. This means that the asset’s exposure is higher than 90% of all other assets and only 10% of assets have a higher exposure than this asset. This determination is influenced by a combination of the following factors:

    • The asset might expose a lot of services compared to other assets.
    • The asset might be handling a lot of traffic compared to other assets.

  • An asset with an exposure value in the 10th percentile is regarded as having a lower level of criticality. This means that the asset’s exposure is higher than only 10% of all other assets and that 90% of assets have a higher exposure than this asset. This determination is influenced by a combination of the following factors:

    • The asset might not expose a lot of services compared to other assets.
    • The asset might not handle a lot of traffic compared to other assets.

Peer Network Exposure

The peer network exposure helps analysts in assessing asset criticality, similar to the Enterprise Network Exposure, but with a focus on assets within the asset peer group. A dedicated in-built algorithm is used to determine the peer network exposure rank for each asset, taking into consideration its relation to assets of the same type and category. The rank calculation is based on factors such as the number of services exported by the asset and the count of internal and external IP addresses that connect to these services. By leveraging this indicator, analysts gain insights into an asset’s relative criticality within its peer group, enabling them to prioritize resources and make informed decisions accordingly. The peer network exposure has two values:

• Exposure Rank Highlights

  The rank of an asset within a group of assets sharing the same type and category is determined by evaluating the asset’s level of exposure in comparison to all other asset IPs within the peer group. Sparkline offers a concise overview of asset trends, enabling analysts to quickly identify whether rank is increasing, decreasing, or maintaining a consistent level. A lower rank signifies a higher level of importance within the peer group, indicating that the asset has a more significant presence and impact compared to others in the same category. For example,

  • An asset with a rank of 10 / 200 means that the asset ranks 10th among 200 peer assets, where 9 assets have a higher exposure than this asset, and 190 have lower exposure. This determination is influenced by a combination of the following factors:

    • The asset might expose a lot of services compared to other assets within its peer group.
    • The asset might be handling a lot of traffic compared to other assets in its peer group.

  • An asset with a rank of 190 / 200 means that the asset ranks 190th among 200 peer assets, where 189 assets have a higher exposure than this asset, and 10 have lower exposure. This determination is influenced by a combination of the following factors:

    • The asset might not expose a lot of services compared to other assets within its peer group.
    • The asset might not handle a lot of traffic compared to other assets in its peer group.
      

• Exposure Rank (Percentile)

  The exposure rank percentile provides a means to evaluate the criticality of an asset by comparing it to other assets within its peer group that share the same type and category. Expressed as a percentile, it reflects the asset’s level of criticality relative to other assets. A higher percentile indicates that the asset is more critical compared to other assets in the same group. For example,

  • An asset with an exposure value in the 90th percentile is regarded as having a high level of criticality. This means that the asset’s exposure is higher than 90% of all other peer assets and only 10% of assets have a higher exposure than this asset. This determination is influenced by a combination of the following factors:

    • Asset might expose a lot of services compared to other assets in its peer group.
    • Asset might be handling a lot of traffic compared to other assets in its peer group.

  • An asset with an exposure value in the 10th percentile is regarded as having a lower level of criticality. This means that the asset’s exposure is higher than only 10% of all other peer assets and that 90% of assets have a higher exposure than this asset. This determination is influenced by a combination of the following factors:

    • The asset might not expose a lot of services compared to other assets in its peer group.
    • The asset might not handle a lot of traffic compared to other assets in its peer group.

Peer Network Activity

The peer network activity rank evaluates the level of asset popularity within its peer group. Asset activity is determined using a dedicated in-built algorithm that takes into account the total number of unique IP addresses connecting to the asset in relation to its peers. The peer network activity has two values:

• Activity Rank Highlights

  The activity rank of an asset is determined by its popularity among its peer group. Sparkline offers a concise overview of asset trends, enabling analysts to quickly identify whether rank is increasing, decreasing, or maintaining a consistent level. Rank is calculated using the in-built algorithm that considers the total number of unique client IPs making requests for services associated with the peer group that the asset belongs to. For example,

  • An asset with a rank of 10 / 200 means that the asset ranks 10th among 200 peer assets, where 9 peer assets have higher activity levels than this asset, and 190 have lower activity levels. This determination is influenced by the following factor:

    • The total number of unique IP addresses connecting to the asset.

  • An asset with a rank of 190 / 200 means that the asset ranks 190th among 200 peer assets, where 189 peer assets have higher activity levels than this asset, and 10 have lower activity levels. This determination is influenced by the following factor:

    • The total number of unique IP addresses connecting to the asset.

• Activity Rank (Percentile)

  The activity rank percentile provides a percentile-based measure to evaluate the level of activity displayed by an asset within its peer group. It serves as a valuable tool for understanding the importance of an asset within its peer group. A high activity rank percentile indicates that the asset is more active in comparison to other assets in the same peer group. For example:

  • An asset with a value in the 90th percentile indicates a high level of activity. This means that the asset’s activity is higher than 90% of all other peer assets and only 10% of assets have a higher activity than this asset.

  • An asset with a value in the 10th percentile indicates a relatively low level of activity. This means that the asset’s activity is higher than only 10% of all other peer assets and that 90% of assets have a higher activity than this asset.

Severity level for Asset

The asset severity is computed for Enterprise Network Exposure, Peer Network Exposure, and Peer Network Activity. The Asset Severity relates to the critical, high, medium, and low scores. Following is a summary of asset severity scores.

Overview

The Overview section provides the following parameters:

Asset Type: Indicates the device type associated with the asset, determined based on the number of exported services and the volume of network traffic it handles. An asset can be categorized as one of the following types: Client, Server, FewClients, Many Services Few Clients (MSFC), Many Services Some Clients (MSSC), Many Services Many Clients (MSMC), or Undefined.

Asset Types

The type of asset is determined by evaluating the network profile that has been calculated for the asset.

Asset Category: The asset category is determined by the distribution of traffic reaching the asset. An asset can expose many port numbers identifying specific services. The IANA Service Name and Transport Protocol Port Number Registry provide a list of well-known port numbers and their associated services.

For example, an asset that exports services to traffic on ports 80 and 443 could have a category value of HTTP and HTTPS.

First Time Seen: Displays the timestamp when the analytics first observed an asset.

Last Time Seen: Displays the timestamp when the analytics last observed an asset.

Highlights

The Highlights section provides a quick high-level overview of the last observed asset changes on the network.

Exposed Services: Displays the current number of active services for an asset. An asset can expose multiple services, such as HTTPS and SSH. The number of services exposed by an asset can change over time. The sparkline is a trend of the recently observed number of exposed services by the asset. If you hover over the sparkline, you can view the trending numbers. For example, NetWitness Insight detected the following exposed services for the asset 10.0.0.0 over the past four days:

• January 1, 2023: 1 service (FTP)
• January 2, 2023: 1 service (FTP)
• January 3, 2023: 1 service (FTP)
• January 4, 2023: 2 services (FTP, SMTP)

In this example, the sparkline will show a slight increase in trend. The number 2 next to the sparkline chart is the last observed number of exposed services for this asset. In this case, the asset exposed FTP for a duration of 3 days, and then NetWitness Insight detected that SMTP was added to list of exposed services.

External Connections: Displays the number of external clients that request services from the asset. The sparkline is a trend of the observed number of external clients that requested services exported by the asset. If you hover over the sparkline, you can view the trending numbers.

For example, NetWitness Insight detected the following number of external connections established with the asset 10.0.0.0 over the past three days:

• January 1, 2023: 0 connections
• January 2, 2023: 2 connections
• January 3, 2023: 5 connections

In this example, the sparkline will show an increasing trend. The number 5 next to the sparkline chart is the last observed number of external connections for this asset.

Connection Types: Displays the number of services used by external clients. The sparkline displays a trend of the recently observed total number of services used by external clients. If you hover over the sparkline, you can view the trending numbers.

For example, NetWitness Insight detected the following number of services provided by asset 10.0.0.0 used by external clients over the past three days:

• January 1, 2023: 3 services (HTTP, HTTPS, SSH)
• January 2, 2023: 3 services (HTTP, HTTPS, SSH)
• January 3, 2023: 5 services (HTTP, HTTPS, SSH, FTP, SFTP)

In this example, the sparkline will show an increasing trend. The number 5 next to the sparkline chart is the last observed number of services used by external clients.

Connection Anomalies: Displays the total number of connections to external IPs using unrecognized TCP/UDP traffic. Unrecognized traffic does not match any of the known protocols. The sparkline displays a trend of the recently observed total number of external sources and destinations for unrecognized TCP/UDP traffic. If you hover over the sparkline, you can view the trending numbers.

For example, NetWitness Insight detected the following number of unrecognized connections from 10.0.0.0 over the past five days:

• January 1, 2023: 3 connections
• January 2, 2023: 3 connections
• January 3, 2023: 7 connections
• January 4, 2023: 5 connections
• January 5, 2023: 4 connections

In this example, the sparkline shows an initially increasing trend that peaked at 7 connections and is now decreasing. The number 4 next to the sparkline chart is the last observed number of connections to external IPs using unrecognized TCP/UDP traffic.

Historical Service Trend

The Historical Service Trend displays how much traffic the asset serves out of the total traffic that is captured per service over time. The Historical Service Trend can help analysts understand why an asset is defined as a certain category type. By examining the percentage of services shared by the asset, analysts can better understand its role and purpose. Observing how the service percentages evolve over time provides perspective on any shifts in the asset category. This information empowers analysts to make informed decisions without the need for extensive additional research, enhancing their analytical efficiency.

For example, if a server receives 60% of the total DNS traffic, this value plays a significant role in determining the asset category for that server.

To better understand the traffic volume of different services, services in the chart legend are sorted from highest enterprise traffic to lowest enterprise traffic using the latest date data. In cases where services have the same percentage value, the services are sorted alphabetically as a secondary sort. The chart legend makes it easy to identify which services have the highest and lowest traffic volume.

Analysts can perform the following actions on the Historical Service Trend chart:

• Hover over a data point on the chart to reveal the shared services percentage.

• Click to navigate to the next page to view the other services available.

• Analysts can use the service filter feature with the searchable drop-down menu to filter services by multiple values at once. This allows you to compare different services and gain valuable insights from your data. For example, you can filter HTTP and DNS services and easily understand your data.

• Analysts can navigate seamlessly between the first and last pages using the pagination option. To go to the last page, click .

See also

• Install Insight Sensor
• Install the Cloud Connector Sensor
• Configure Insight as a Data Source

3 - View Insight Alerts from Respond View

Analysts can view NetWitness Insight’s alerts based on Asset category change over time and New asset discovered in the environment. The alerts are listed on the Respond > Alerts page.

By default, NetWitness Insight generates alerts based on two priority levels. However, the priority level can be changed by using the incident rule:

• Low-priority alerts for asset change for clients
• Medium priority alerts for asset change for servers

This provides valuable insights to analysts when considering the asset’s profile. By observing such changes, analysts can better understand the potential implications and take appropriate actions to protect the network.

View Insight Alerts Details

In the Alerts List view, you can browse the Insight alerts from the NetWitness Insight source, filter them, and group them to create incidents. This procedure shows you how to access the Insight alerts list.

To View Insight Alert Details

1. Log in to the NetWitness Platform.

2. Go to Respond > Alerts. The Alerts List view displays a list of all NetWitness alerts.

3. In the Filters panel, under the Source options, select NetWitness Insight.

   

   All the alerts related to NetWitness Insight are listed.

   Clicking on the Alert Name takes you to the Overview page with the following details. The following figure represents Asset category change over time alert.

The following figure represents New asset discovered in environment alert.

For more information on managing alerts, see Reviewing Alerts topic in NetWitness Respond User Guide.

See also

• Enable Insight Incident Rules
• View Insight Incidents Details

4 - View Insight Incidents Details

You can view and access extensive incidents in the Respond > Incidents view. This procedure shows you how to access the Insight Incidents list. You can filter this list to view only the Incidents of interest.

To View Insight Incidents Details

1. Log in to the NetWitness Platform.

2. Go to Respond > Incidents.

   

The following table describes the columns in the Incidents List.

For more information on Incidents, see NetWitness Respond User Guide.

See also

• Enable Insight Incident Rules
• View Insight Alerts from Respond View

5 - Whitelist Insight Alerts from Respond View

From NetWitness Platform version 12.4 or later, administrators and analysts can whitelist unwanted and recurring Insight alerts generated in the Respond > Alerts view. This enhancement allows administrators and analysts to select values such as IP Address and Asset Type and define a Whitelist condition to prevent unwanted alerts from being generated for these values.

For example, an administrator may choose to whitelist all alerts generated from a specific IP address or asset type that is known to be secure or non-malicious. Once the whitelist condition is configured correctly, these alerts will no longer be generated, thus reducing traffic on the Respond > Alerts view.

To whitelist an Insight alert from the Respond View

1. Log in to the NetWitness Platform.

2. Go to Respond > Alerts.

   The Alerts view is displayed.

3. Select an Insight alert and click More Actions > Whitelist Alert.

The Alert Whitelisting dialog for Insight is displayed.

4. Enter the name of the Whitelist.

5. Select the required values, such as IP Address, Asset Type, or a combination of both.

6. Specify the reason for whitelisting in the Comments section.

7. Click Whitelist.

   The Confirm Alert Whitelisting confirmation dialog is displayed.

   

8. Click Confirm Whitelist.

Manage the Whitelists

The Whitelist tab allows you to manage alerts you have chosen to whitelist. Both administrators and analysts can view, filter, and delete the whitelisted items from the Whitelist tab. Removing a whitelisted item will resume the generation of new matched alerts for previously excluded values, such as IP addresses or asset types, under the Respond > Alerts view.

You can do the following operations with the Whitelist tab:

• View whitelisted alerts: View a list of all the alerts you have whitelisted from generating alerts.

• Delete whitelisted alerts: Remove specific alerts from the whitelist, enabling them to generate alerts again. This can be helpful if you no longer need to exclude those alerts.

• Filter whitelisted alerts: Quickly find specific whitelisted alerts by using the filtering options.

To delete the whitelisted items

1. Go to Respond > Whitelists.

   The Whitelists view is displayed.

   

2. Select the Whitelist item and click Delete.

   A confirmation pop-up is displayed.

3. Click Delete Whitelist.

   The Whitelist item is deleted.

For more information on the Whitelists tab, see the topic Whitelists List View in the NetWitness Respond User Guide for 12.4.

See also

• View Insight Alerts from Respond View
• View Insight Incidents Details