NetWitness

Download 25
Last updated May 19, 2022

netwitness-events

Fetch events from Netwitness Decoder

netwitness-events profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [ip=IP] [ip2=IP2]
profile=PROFILE
The identifier of NetWitness connect profile
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
First IP address for search
ip2=IP2
Second IP address for search

Output Fields

FieldTypeNameDescription
_timeDateTimeSession time
profileStringConnect profileThe identifier of NetWitness connect profile
sessionLongSession ID
directionStringDirectione.g. lateral, outbound
src_ipIP addressSource IP
src_portIntegerSource port
dst_ipStringDestination IP
dst_portIntegerDestination port
protocolStringProtocol
serviceStringService
src_macStringSource MAC
dst_macStringDestination MAC
streamsIntegerStreams
bytesLongBytes
pktsLongPackets
payloadLongPayload
durationIntegerDuration
netnameStringNet namee.g. private src, other src
tcp_flagsStringTCP flagse.g. syn, fin
alias.hostStringHostname
alias.ipStringIP alias
src_countryStringSource country
dst_countryStringDestination country
src_domainStringSource domain
dst_domainStringDestination domain
src_orgStringSource organization
dst_orgStringDestination organization
actionStringActionSeparated by new line. e.g. Query Info, Tree Connect, PUT, POST
directoryStringDirectorye.g. \IPC$, /css/
filenameStringFile name
queryStringQuery
contentStringContente.g. text/plain, image/gif
clientStringCliente.g. HTTPS, Mozilla/4.0