What is Cloud Link Service

NetWitness Cloud Link Service enables you to use the NetWitness Detect AI solution and its features by providing a secure transportation mechanism between existing RSA NetWitness Platform hosts (Log Decoders) and the NetWitness Detect AI service. Example: to perform analytics on the NetWitness Detect AI, you must install and register the Cloud Link Service on at least one Log Decoder host.

Cloud Link service is a sensor that you must install and register on your on-premise host to:

  • Transfers metadata from the host (such as Log Decoders) in your on-premise deployment to the NetWitness Detect AI for analysis and investigation
  • Transfer alerts generated in NetWitness Detect AI to your on-premise NetWitness Platform Respond server for incident management

You can install Cloud Link Service on the following host types:

  • Log Decoder
  • Log Hybrid
  • Endpoint Log Hybrid
  • Log Hybrid Retention


  • Cloud Link Service and the hosts must be on version 11.5.2 or later.
  • You need a separate Cloud Link Service to be installed for each host.

This section provides information on how data is transferred using Cloud Link Service:

Single Deployment: Data Transfer Data transfer

  1. Cloud Link Service fetches all the metadata from the host. Example: Log Decoder.
  2. The Cloud Link Service filters these metadata based on queries and collects only matching metadata.
  3. Cloud Link Service compresses the matching metadata, and transfers it to NetWitness Detect AI through a secure channel.

Note: Cloud Link Service ensures that no data is lost during temporary network issues or outages. If the outage lasts for more than 7 days, then the data older than 7 days will be discarded.

Multiple Deployment: Data Transfer

flow 2

Data Transfer from NetWitness Detect AI

NetWitness Detect AI transfers the alerts generated to the on-premise NetWitness Platform Respond server which can be viewed on the user interface for incident management.

flow 3

Submit Feedback
© 2020 RSA Security LLC or its affiliates. All Rights Reserved.