RSA NetWitness® Suite

RSA is a Bedford, Massachusetts–based security company founded in 1982 by Ron Rivest, Adi Shamir, and Len Adleman, and is widely known for RSA SecurID, a popular hardware token–based two-factor authentication method. Acquired by EMC in 2006 and later becoming a direct subsidiary of Dell Technologies after the Dell–EMC deal in September 2016, RSA continues operating with significant autonomy. With more than 1,300 employees, offices in over 70 countries, and more than 30,000 customers across sectors such as government, defense, finance, and utilities, RSA also runs the RSA Conference, positioned as a leading information security event. Its broader portfolio spans identity assurance, governance/risk/compliance (GRC), fraud detection, information protection, and security analytics and operations, complemented by consulting services.

As mobile and cloud adoption erodes the traditional corporate perimeter, organizations face attackers who can mimic normal user behavior, including potential malicious insiders. This drives a shift from perimeter defense to real-time internal monitoring and detection. Modern security intelligence platforms apply machine learning and Big Data analytics to correlate diverse security telemetry, enrich it with context and threat intelligence, and reduce analyst overload by prioritizing incidents with forensic detail.

RSA’s response is the RSA NetWitness Suite (rebranded from RSA Security Analytics), a distributed, modular threat detection and response platform unifying log, packet, NetFlow, and endpoint analytics, now including RSA NetWitness Endpoint (formerly ECAT) and RSA NetWitness SecOps Manager for SOC orchestration and incident-response workflows. NetWitness integrates threat intelligence through RSA Live and the community-driven RSA Live Connect, supports extensive scaling via appliance or virtual deployments, provides automated compliance reporting across multiple frameworks, and integrates bi-directionally with RSA Archer GRC. Its main tradeoffs are architectural complexity, lack of a cloud-managed offering (so far), and limited localization.

• RSA is headquartered in Bedford, Massachusetts, USA.
• RSA was founded in 1982 by Ron Rivest, Adi Shamir, and Len Adleman.
• RSA is probably best known for RSA SecurID, a hardware token–based two-factor authentication method.
• EMC acquired RSA in 2006.
• After the EMC acquisition by Dell was finalized in September 2016, RSA became a direct subsidiary of Dell Technologies.
• RSA has over 1,300 employees and regional offices in over 70 countries.
• RSA serves more than 30,000 customers worldwide across major industry verticals.
• RSA Conference is an annual event organized by the company and is recognized as a leading information security conference.
• RSA NetWitness Suite was formerly branded as RSA Security Analytics.
• Localization support is limited to English and Japanese.

• “As the very notion of the corporate perimeter has almost eroded, traditional security controls are no longer able to detect the increasingly sophisticated methods cyber criminals are using to mimic normal user behavior and to infiltrate corporate networks.”
• “Even worse, many of those criminals may, in fact, be malicious insiders.”
• “All this has led to a massive paradigm shift in information security from perimeter protection towards monitoring and detecting malicious activities within networks in real time.”
• “A new generation of security analytics tools has emerged recently, utilizing machine learning and Big Data analytics to correlate large amounts of security data collected across the corporate infrastructure and enrich them with additional context data and external threat intelligence.”
• “In the end, a security researcher can deal with a manageable number of relevant security incidents, ranked by severity and enriched with valuable forensic information.”
• “RSA NetWitness Suite (formerly RSA Security Analytics) is a threat detection and response solution that helps analysts detect and investigate threats which are too sophisticated to be detected by traditional security tools.”
• “RSA Live ensures that customers receive actionable threat intelligence in the form of consolidated rules, which are directly fed into the analytics platform.”
• “Unfortunately, this modularity also means that the solution can be complicated to set up.”
• “As opposed to traditional SIEM tools, RSA NetWitness Suite utilizes Big Data analytics, behavioral analysis, and machine learning algorithms to correlate log, network, endpoint and external threat intelligence data in real time and thus detect suspicious activities without relying on predefined rules.”
• “The modern HTML5-based GUI is notable for its rich visualization capabilities and high degree of customization.”