From the course: Complete Guide to Open Source Security

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Taking NetWitness for a spin

Taking NetWitness for a spin

From the course: Complete Guide to Open Source Security

Start my 1-month free trial Buy for my team

Taking NetWitness for a spin

“

- [Instructor] Okay, so the first thing we'll do with NetWitness is to run the demo investigation. We can drill down into any part of our analysis by clicking on it. For example, if we click on the number to the right of the creditcards.txt link, we'll get the session details for this item. In this case, just one. We can see that this is a POP3 session, and we have all the fields that were transferred in the session, including the attachment field. At the left is the view of the email which was transferred, and we can now scroll down to see the contents. And here we find social security number details. To go back to the session view, we can just close the pane. Back in the Collection Details tab, if we scroll further down, we can see the network addressing details. And following that, the source location, which in this case is Atlanta. Now we've got some experience with NetWitness. Let's take a look at our Unit42 PCAP file. We'll create a new collection, and we'll call it Unit42…

Contents