RSA enVISION

RSA, The Security Division of EMC, releases Patch 7 for RSA enVision® 4.0 Service Pack 4. Note Updated April 17, 2012 Description: This RSA enVision patch provides a roll-up of hot fixes. Please read the release notes for more information. https://knowledge.rsasecurity.com. Platforms: This patch can be installed...

LCD screen on enVision Appliance displays a message Fact enVision Core 3.7.1 60 series Symptom "e1211 ROMB Batt" seen on LCD Change The appliance unit may have been turned off for a period of time, perhaps during shipment. Cause The battery power is low for the SCSI controller and this does not effect the operation...

Nuggets found on E drive Goal How to recover nuggets on E drive from alternate nugget directory? Fact nuggets tmp directory %_enVision%\tmp\nuggets directory Cause Nuggets  (.nug files) can be written to the e:\ drive if the storage location has run out of space.  When space is freed up, these nuggets...

Web Management is working but the Java Analysis applet fails Goal Be able to view the Java Analysis applet Fact Envision is behind firewall & its ip address is translated (NAT) enVision Core 3.7.0 Symptom Normal web-management is ok but the Analysis applet (requiring Java) fails with the following error:...

enVision: Log Record Change: Log index above newest record collecting Windows logs Fact RSA enVision 4.0 SP2 Symptom Log Record Change: Log index above newest record Cause Three are three known reasons for getting this error. Fix The event log on the device was disabled enVision has become out of sync with...

Event Explorer Lab: Run a Command  Enable an analyst with the power to quickly launch an external application from within Event Explorer. Targets could include custom in house scripts or NetWitness integration.  In this exercise you will create a custom run command that will initiate a geolocation IP...

Event Explorer Lab: Advanced Tables and Watchlists  Use Case: The ability to include Watchlists in Charts or Tables is a powerful tool. Embedding Watchlists enables analysts to update the contents of Charts and Tables without editing the View Properties. This is especially useful when working with Advanced...

Advanced Correlation Lab: Build a Correlation Rule for VM Relocation (Part 1) Part I: Overview and Framing The Problem In this lab exercise we will show you how to create a correlation rule in RSA enVision that can be used to issue an alert when a VM is relocated away from a PCI scope ESX server. Why is this...

Advanced Correlation Lab: Build a Correlation Rule for VM Relocation (Part 2) Part II: Getting Started: The Device Group and Watchlist In this lab exercise we will show you how to create a correlation rule in RSA enVision that can be used to issue an alert when a VM is relocated away from a PCI scope ESX server. Before...

Advanced Correlatio​n Lab: Build a Correlatio​n Rule for VM Relocation (Part 3) Part III: Circuit #1, Statement #1: The vCenter Event In this lab exercise we will show you how to create a correlation rule in RSA enVision that can be used to issue an alert when a VM is relocated away from a PCI scope ESX server. The...