RSA NetWitness Endpoint

RSA NetWitness Endpoint is the endpoint detection and response module of the NetWitness Platform, which also covers network detection, SIEM and SOAR. It targets large, complex enterprises whose security teams need to see what runs on every device, on or off the corporate network.

What RSA NetWitness Endpoint offers

• Activity recording: tracks files, processes, registry changes, user actions and network connections.
• Process context: shows parent-child relationships and command lines so investigators can rebuild a process tree.
• Behavioural analytics: learns normal user and device behaviour on the endpoint and flags deviations such as compromised accounts.
• Response actions: ends processes, isolates hosts, quarantines files and captures forensic data.
• Light agent: a tamper-resistant agent the vendor says uses under 1% of system resources.

Who it serves

Security operations teams in large organisations, with coverage of physical, virtual and cloud-hosted endpoints.

Key facts

• Integrations: SIEM, SOAR, cloud and identity tools
• Product generations: sales of the earlier version ended on 1 March 2025, and a next-generation EDR was announced for early 2026