RSA NetWitness Platform is a threat defense platform that combines network detection and response (NDR), endpoint detection and response (EDR), security orchestration and automation, and user and entity behavior analytics (UEBA) under a single platform. The platform addresses advanced persistent threats (APTs) — sophisticated cyberattacks designed to evade signature-based security tools and persist undetected in an environment for extended periods. It applies network traffic analysis, behavioral analysis, endpoint analysis, data science techniques, and threat intelligence to detect APTs and other targeted attacks. Key capabilities include: - Rapid and automated investigation of network attacks and data exfiltration attempts, with visual reconstruction of incidents across on-premises and cloud infrastructure. - Integrated threat intelligence and business context woven into the incident management lifecycle for threat prioritization. - Automated UEBA that correlates data across full network packets and endpoints to identify potentially malicious activity. - Network detection and response with combined threat detection analytics and automated response, providing visibility beyond log-centric SIEM tools. - Raw network data parsed into metadata and sessionized at capture time to support security analytics and event reconstruction. The platform provides visibility across internal and external network traffic down to individual endpoint processes, identifies indicators of compromise, and enables detailed reconstruction of attack campaigns to support remediation and response planning.