Menu Icon

Available Training Rooms


Course Details

  • Course Overview
  • Skills Gained
  • Who Can Benefit
  • Prerequisites
  • Syllabus

In this course, you will focus on administration of the RSA NetWitness product. You will learn to install and configure RSA Net Witness components, including a Log Decoder, managing users, and creating filters and rules. You will also cover integration with other products, monitoring capabilities, and troubleshooting of common issues.

RSA NetWitness component and data flows
Install RSA NetWitness software
Configure RSA NetWitness components
Set up packet and log capture
Set up LIVE feeds
Manage users
Create rules and filters
Integrate NetWitness with other products
Monitor RSA NetWitness
Troubleshoot RSA NetWitness
Who Can Benefit
RSA NetWitness administrators
Familiarity with networking fundamentals and general information security concepts

1. RSA NetWitness

  • RSA NetWitness Architecture
  • RSA NetWitness Components
  • Data Flow between Components

2. Appliance Setup and Software Installation

  • RSA NetWitness Appliance Setup
  • RSA NetWitness Software Components

3. Configuring RSA NetWitness

  • Managing Services
  • Configuring and Managing Devices
  • Setting Up Data Collection of Packets and Logs
  • Viewing Packets and Logs in Investigator

4. RSA NetWitness Live

  • Configuring NetWitness Live Subscriptions
  • Managing a Live Feed

5. Managing Users

  • User Management Interface
  • User Groups and Roles
  • Creating Users and Groups
  • Viewing Groups and Roles
  • Configuring External Authentication
  • Editing User Settings
  • Informer Roles
  • Creating Informer Users

6. Creating Rules and Filters

  • Rules, Filters, Feeds and Parsers
  • Decoder Filters and Informer Rules
  • Best Practices for Creating Filters and Rules
  • Creating Decoder Filters
  • Creating Informer Rules and Alerts
  • Creating a Feed
  • Pushing a Rule to the Decoder
  • Reprocessing a Collection

7. Integrating RSA NetWitness with Other Products

  • NetWitness SIEM Link
  • Setting Up Informer to Communicate with SIEM Products
  • Connecting to HP ArcSight
  • RSA enVision Connector

8. Monitoring RSA NetWitness

  • Tools Used to Monitor RSA NetWitness Components
  • Configuring SNMP
  • Monitoring NetWitness Components for Performance and Efficiency
  • Tips and Best Practices for Tuning the Decoder, Concentrator, Broker, and Informer
  • Methods for Viewing and Modifying Logs

9. Troubleshooting RSA NetWitness

In addition to lecture and demonstrations, this course includes hands-on exercises which are designed to give you practical experience.


  • Administrators

Public Program Schedule

Course Name Duration Brochure Location Schedule Enroll
There is no upcoming Public Batch Schedule, you can ask for Private Batch or for On-Demand Learning

Download the syllabus


The highest standard, The happiest learners

Our Enterprise Clients


  • Why should I choose RPS?
  • I am working, is it possible to arrange the classes on weekends?
  • Please confirm if your office is open on weekends?
  • Can I get the courseware in advance before start of training?
  • What are the timings (class hours)?
  • How can I make the payment?
  • What is the mode of payment?
  • Candidate authorized RPS to charge $200. But the bank has charged $208. Why is this?
  • If we need training on one of the modules only how does that work?
  • How long before do we need to book the exams?
  • Where are your training centers available?
  • Can I pay the fee in installments?
  • What are the refund policies? Can i get my money back in case i am unable to attend the training?
  • Do you provide a bank loan facility?
  • 10+ years of Training Expertise
  • Certified instructors with industry standard experience
  • Tailor made training available
  • 6+ training Locations
  • 100000 + professional trained
  • Customer Satisfaction
  • Reliable and Most cost effective Training

Yes, we do offer weekend classes for professionals in group or 1-to-1 Training depending upon the technology.

The administrative and sales staff works on weekdays (Monday - Friday). System Admins and Operation team are available on all days.

Yes, after you have paid the booking amount (which will be non–refundable in this case). Booking amount depends on the technology selected.

Training timings are from 9 am to 5 pm.

You can send the deposit by any of the following methods:-

  • PayPal
  • Credit Card
  • Bank Transfer
  • Demand Draft
  • Cash
  • Purchase Order (in case of Corporates / Government).
  • If you are an International student, the registration amount of USD 200 can be paid by Bank Transfer or PayPal/PayUMoney . The balance amount has to be paid by traveler's cheque or cash after arrival in India. You can also pay the balance by PayPal. There is a surcharge of 4% in this case.
  • For Indian Resident students, the course fees including registration can be paid by Cash, Cheque, Demand Draft or Bank transfer.To Know more Please call +919883305050 or Email us at for any of your queries.

Overseas credit card payments through PayPal involve a mark-up of up to 4% as surcharge.

We can provide customized 1-to-1 training for a technology as per your requirement.

Most exams can be booked once you are on the course (e.g. Microsoft, ITIL, VEEAM, EC-Council). Red Hat and some other exams have to be booked in advance.

Our training centers are available in Bangalore, Chennai, Hyderabad, Pune and Delhi.

We do not have facility to pay in installments

If the course fee has been paid for and RPS cancels the Course, a refund will be provided, else the courses are non-refundable.

We do not provide loan facility.

Other Related Courses

Related courses will be updated soon...