RSA

Use RSA Archer and NetWitness data in Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

RSA connectors integrate RSA security products with Cortex. The RSA Archer GRC platform provides a common foundation for managing policies, controls, risks, assessments, and deficiencies across lines of business. RSA NetWitness Endpoint provides deep visibility beyond basic endpoint security solutions by monitoring and collecting activity across all of your endpoints, on and off your network. RSA NetWitness Security Analytics is a distributed and modular system that collects packet data and log data from the network infrastructure.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• RSA Archer v2:
• RSA NetWitness Endpoint: RSA NetWitness Endpoint provides deep visibility beyond basic endpoint security solutions by monitoring and collecting activity across all of your endpoints on and off your network. The RSA Demisto integration provides access to information about endpoints, modules and indicators.
• RSA NetWitness Security Analytics: RSA Security Analytics, compatible with prior to v11. A distributed and modular system that enables highly flexible deployment architectures that scale with the needs of the organization. Security Analytics allows administrators to collect two types of data from the network infrastructure, packet data and log data.

To configure this connector, follow the steps outlined in the configuration wizard.