NetWitness

Download 25
Last updated May 19, 2022

netwitness-meta

Fetch meta records from Netwitness Decoder

netwitness-meta profile=PROFILE [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [ip=IP] [ip2=IP2] [query=QUERY]
profile=PROFILE
The identifier of NetWitness connect profile
duration=NUM{mon|w|d|h|m|s}
Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss
Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss
End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
ip=IP
First IP address for search
ip2=IP2
Second IP address for search
query=QUERY
Meta query string

Output Fields

FieldTypeNameDescription
profileStringConnect profileThe identifier of NetWitness connect profile
id1LongID1Start ID of the range
id2LongID2Last ID of the range
groupLongGroupSession ID
typeStringTypeMeta name. e.g. sessionid, ip.src, ip.dst, ip.proto
valueMixedValue
countIntegerCount
formatIntegerFormate.g. 4 for int32, 128 for IPv4 address, 130 for MAC address