Skip to main content
NetWitness Endpoint app icon

NetWitness Endpoint

This app supports executing various endpoint-based investigative and containment actions on RSA NetWitness EndpointBuilt by Splunk LLC
soar product badge
Default Version 2.0.4

September 17, 2021

Compatibility

SOAR On-Prem, SOAR Cloud

Platform Version: 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9

Rating
0
(0)

Log in to rate this app

Support
Splunk Supported
Ranking

#3 in Endpoint

This app supports executing various endpoint-based investigative and containment actions on RSA NetWitness Endpoint

Supported actions

  • test connectivity: Validate credentials provided for connectivity
  • blocklist domain: Blocklist the domain
  • blocklist ip: Blocklist the IP
  • list endpoints: Lists all the windows endpoints configured on NetWitness Endpoint
  • get system info: Get information about an endpoint
  • scan endpoint: Scan an endpoint
  • get scan data: Get scan data of an endpoint
  • on poll: Action to ingest endpoint related information
  • list ioc: List the IOC
  • get ioc: Get the IOC