Follow In NetWitness Investigate, run your query in the Events view, select the events (or all of them), and download the logs. Pick Text to get the raw log lines, or JSON for structured events. Large downloads run as jobs; you collect the file from the Jobs tray when it’s ready. By default, one export can include up to 100,000 sessions.
NetWitness, formerly RSA NetWitness, stores logs on Log Decoders and makes them searchable through Concentrators and Brokers. Prime Core has 18,461 detection rules for NetWitness, mapped to 631 MITRE ATT&CK techniques. Below is how to get logs out, sanitize them, and investigate them for free in LogTotal.
Before you start
Access to Investigate. You need a role that can investigate the service (Broker or Concentrator) holding the logs.
Set the export format once. In Profile → Preferences → Investigation, the Export Log Format preference decides the default format for downloads: Text, XML, CSV or JSON. Choose Text for raw logs. If it’s left empty, NetWitness asks every time.
Retention. How far back you can go depends on Log Decoder storage. Older logs may only exist in an archiver, if you have one.
Export from Investigate
- Open Investigate → Events, pick the service, and set the time range.
- Query with meta keys (example below).
- Run the query and check the count.
- Select the events you want, or none to take all of them, and choose the download option for logs (Text or JSON).
- Open the Jobs tray (the stopwatch icon) and download the file when the job finishes.
A query for one Linux host looks like this. For Windows logs, device.type = ‘winevent_nic’ is the common log parser.
device.type = 'rhlinux' && alias.host = 'web-03'
For a single event, the Text tab of the event details has its own download options for the raw log.
The Max Session Export setting caps how many sessions one export can include (100,000 by default). For bigger windows, split by time.
Option 2: REST API on the services
Concentrators and Brokers expose a REST interface that can run queries and return log content. That suits scripted exports.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
What this looks like on real data.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| The download contains network sessions or meta, not logs | Wrong download option | Choose the logs download, not meta or PCAP |
| Export stops at 100,000 sessions | Max Session Export limit | Split by time, or ask an admin to raise the limit |
| No file appears | It’s a background job | Collect it from the Jobs tray |
| Query returns nothing | Wrong service or meta key values | Check device.type values in the meta panel |
FAQ
Text or JSON?
Text when you want the original log lines, which suits syslog-style sources. JSON when you want NetWitness’s parsed meta alongside each event.
Can I export packets too?
Yes, as PCAP, but that’s network traffic, not logs. LogTotal works with the logs.
