Find the Right Meta Keys. Follow the Evidence.
Every network session carries clues, but the challenge is knowing which ones deserve a closer look.
When you’re investigating suspicious activity, the right meta key can help narrow thousands of sessions to a handful worth reviewing. But with different fields across DNS, HTTP, TLS, SMB, Kerberos, and other protocols, knowing where to start isn’t always straightforward.
The NetWitness Threat Hunting Meta Key Cheat Sheet gives SOC analysts, threat hunters, and incident responders a practical reference for finding the right fields, identifying suspicious patterns, and making informed investigative pivots in NetWitness Investigate.
What’s Inside the Cheat Sheet?
- A practical hunting workflow: Learn how to narrow investigations using traffic direction, service, anomalies, and supporting evidence.
- Protocol-specific meta key references: Know which fields to examine across DNS, HTTP, TLS, SSH, RDP, LDAP, Kerberos, SMB, and other protocols.
- Ready-to-use hunting queries: Get five practical queries to help you start investigating suspicious network activity.
- Investigation and validation tips: Know what to check next, which legitimate activities can resemble threats, and when to dig deeper.
Make Every Hunt More Focused
Whether you’re investigating unusual outbound connections, credential abuse, lateral movement, or possible data exfiltration, keep this cheat sheet handy to find relevant meta keys and follow the evidence.