Creating and viewing alerts

This section describes how you can create alerts in RSA NetWitness.

To create a new alert in RSA NetWitness:

1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

   The Manage tab is displayed.

2. Select the rule on the basis of which you will create a report (for example, CyberTrace Detect Botnet).
3. For the selected rule, click the Settings split button () and then select Create Alert.
4. In the Create/Modify Alert form, specify the following data:
   • Data source
   • Description of the alert
   • Severity of the alert
   • Notification type (for example, you can send notifications by email)

   

   Create/Modify Alert form

5. Click the Create button.

Viewing alerts

To view an alert:

1. On the RSA NetWitness menu, select Dashboard > Reports. (In RSA NetWitness 11, you select Monitor > Reports.)

   The Manage tab is displayed.

2. Click Alerts.

   The Alert view is displayed.

3. On the Alert toolbar, click View Alerts.

   The View Alerts view tab is displayed.