How to Export and Review Logs in NetWitness
Summary
A practical guide to exporting NetWitness logs through Investigate or REST, choosing formats, handling session limits and background jobs, and uploading files to LogTotal for sanitizing and review.
Key points
- In Investigate, select the service and time range, query events, then choose the logs download option.
- Text exports raw log lines; JSON includes parsed event data. The default format is set in Profile → Preferences → Investigation.
- Large exports run as background jobs; retrieve the completed file from the Jobs tray.
- Exports are capped at 100,000 sessions by default; split larger time ranges or ask an administrator to raise the limit.
- Concentrators and Brokers provide a REST interface for scripted queries and log retrieval.
- Available history depends on Log Decoder storage; older logs may be available in an archiver.
Article Details
- Defense Focus
- Export, sanitize, and review NetWitness logs for investigation.
- Detection Methods
- Query events in Investigate using metadata keys and a selected time range; check the result count before exporting.
- Download raw log lines as Text or parsed event data as JSON; use the event details Text tab for a single event.
- Use the Concentrator or Broker REST interface to run queries and retrieve log content for scripted exports.
- Upload exported logs to LogTotal for sanitization and review.
- Data Sources
- Logs stored on Log Decoders and searchable through Concentrators and Brokers.
- NetWitness Investigate events, including Linux logs using device.type = 'rhlinux' and Windows logs using the winevent_nic parser.
- Raw log lines and parsed event metadata.
- Defensive Actions
- Confirm the user has a role that can investigate the service holding the logs.
- Choose the intended export format in Profile → Preferences → Investigation, or select Text or JSON during export.
- Choose the logs download option rather than meta or PCAP when exporting logs.
- Collect completed background exports from the Jobs tray.
- For exports exceeding the 100,000-session default limit, split the time range or ask an administrator to raise Max Session Export.
- Check the selected service and metadata key values if a query returns no results.