050-11-CARSANWLN01 RSA NetWitness Logs & Network Administrator Exam Questions and Answers

disable the parser for the Meta key in the device configuration

add the value /eve/= indexNone to the key in the custom index file

remove the Meta key from the Manage Default Meta Keys interface

add the value valueMax= ‘’000000’’ to the key in the custom index file

Who is Lookup Service

Incident Rules

ESA Analytics Mappings

Context Hub

packet level drill

meta value view

session reconstruction view

decoder analysis view

Right-click action

Profile

Context Hub List

Context Menu Action

static and/or dynamic analysis

alerts, reports and charts

community and/or sandbox analysis

ad hoc, schedules, and/or auto-run features

The rule filters, truncates, keeps or otherwise flags data analyzed by RSA NetWitness

The rule is used primarily to distribute content among RSA NetWitness appliances

The rule uses external intelligence based on IP addresses or domains to add contextual content to network traffic

The rule is an open programming language for customizing logic into the RSA NetWitness processing engine to identify new protocols or extract data to be indexed

new traffic cannot be ingested

the decoder leverages capacity in the concentrator, and collection continues

the decoder leverages capacity in the broker, and collection continues

the oldest stored sessions are deleted and collection continues