Atomic Fishbowl

Frequently Asked Questions


Q: What packet forensics products does Atomic Fishbowl work with?

A: Atomic Fishbowl supports both NetWitness for Packets and Symantec Security Analytics.


Q: Does Atomic Fishbowl require any browser plugins?

A: Not at all.


Q: What web browsers does Atomic Fishbowl support?

A: Atomic Fishbowl is tested with the latest releases of Google Chrome and Mozilla Firefox.  Internet Explorer, Microsoft Edge, and Safari are use at your own risk and not officially supported.


Q: Will Atomic Fishbowl run on mobile devices, such as iOS and Android?

A: Not at present.


Q: Can I drill from SA or NetWitness into Atomic Fishbowl?

A: Yes. We provide context menu actions which can easily be installed.


Q: Does Atomic Fishbowl integrate with NetWitness for Logs?

A: Not at this time.  NetWitness for Packets is required if using NetWitness.


Q: How does Atomic Fishbowl identify content types with NetWitness?

A: Through the use of RSA's own Forensic Fingerprint parsers which are available through RSA Live.  These must be installed and enabled on your packet Decoders in order for Atomic Fishbowl to work properly.


Q: Do I have to wait for an entire collection to finish building before I can work with it?

A: No.  You can start working with a collection as soon as it starts to build.  New results will be added to the collection on-the-fly.


Q: Will the file hashing feature work with my hash threat intelligence feeds?

A: Yes!  Atomic Fishbowl can import your hash feeds.  It can also refresh them on a schedule.


Q: Am I required to buy an Atomic Fishbowl appliance to run Atomic Fishbowl?

A: No.  Atomic Fishbowl is BYOH (bring your own hardware).


Q: What platform does Atomic Fishbowl run on?

A: Atomic Fishbowl runs on CentOS 7 Atomic Host.  The application is packaged as a set of containers which can be easily swapped-out by administrators, and is not prone to some of the more troublesome aspects of supporting enterprise applications.


Q: Will Atomic Fishbowl run in a Virtual Machine?

A: Yes, Atomic Fishbowl will run perfectly well in a VM.


Q: How do I install Atomic Fishbowl?

A: Simply run the installation ISO that we provide, and the product will be installed along with the OS and dependencies.  Watch the video for installation instructions with NetWitness.



Q: What are some performance considerations for Atomic Fishbowl?

A: In terms of the server component, Atomic Fishbowl is mainly CPU and disk-bound. Memory is not a large consideration for the server, unless you have very large hash feeds, but the more CPU cores you throw it, the faster it will run. NetWitness or SA may themselves also be a bottleneck, particularly if it is already under heavy load. If a capture service is just on the edge of dropping packets, Atomic Fishbowl could send it over the edge.

The client PC should have a good amount of RAM (at least 8 Gigabytes), a strong 3D graphics card, and a fast multi-core CPU (we recommend at least four cores). It is not well-suited for RDP or terminal sessions, which should be avoided.


Q: What type of screen should I view Atomic Fishbowl with?

A: Atomic Fishbowl looks best on a 4K monitor.  We don't recommend using less than 1080p.


Q: Does Atomic Fishbowl still provide a pan/zoom interface like the old NetWitness Visualize?

A: Yes, but some features available in other views may not be available using the Pan/Zoom view.


Q: Does Atomic Fishbowl integrate with Active Directory?

A: It does in terms of AD Identity feeds which can be injected into NetWitness, and its metadata displayed by Atomic Fishbowl, such as Active Directory Computer and Username.  It does not yet integrate with AD for authentication but this is being considered for a future release.


Q: How is Atomic Fishbowl licensed?

A: Atomic Fishbowl is sold as an annual subscription, and won't need to be scoped as a capital expenditure by most companies.


Q: Does Atomic Fishbowl provide active alerting via syslog or another method?

A: No, but this is on the product roadmap, estimated for delivery in the first half of 2018.


Q: What else do you have planned for Atomic Fishbowl?

A: Ssh, it's a secret.


Q: Can I suggest a feature that I think would make Atomic Fishbowl more useful?

A: We'd be very happy to listen to your suggestions.


Q: Is Atomic Fishbowl RSA Ready certified?

A: Yes, indeed!


Q: Will Kensington Technology Associates install and configure Atomic Fishbowl for me?

A: We'd be happy to install and configure Atomic Fishbowl for you.


Q: How do I get a trial of the product?

A: You can sign up here.