Atomic Fishbowl

Frequently Asked Questions


Q: Does Atomic Fishbowl require any browser plugins?

A: Not at all.


Q: What web browsers does Atomic Fishbowl support?

A: Atomic Fishbowl is tested with the latest releases of Google Chrome and Mozilla Firefox.  Internet Explorer, Microsoft Edge, and Safari are use at your own risk and not officially supported.


Q: Will Atomic Fishbowl run on mobile devices, such as iOS and Android?

A: Not at present.


Q: Can I drill from NetWitness into Atomic Fishbowl?

A: Yes. We provide context menu actions which can easily be installed.


Q: Can I run Atomic Fishbowl without NetWitness?

A: No, Atomic Fishbowl requires a functioning installation of NetWitness for Packets.


Q: Does Atomic Fishbowl integrate with NetWitness for Logs?

A: Not at this time.  NetWitness for Packets is required.


Q: How does Atomic Fishbowl identify content types?

A: Through the use of RSA's own Forensic Fingerprint parsers which are available through RSA Live.  These must be installed and enabled on your packet Decoders in order for Atomic Fishbowl to work properly.


Q: Do I have to wait for an entire collection to finish building before I can work with it?

A: No.  You can start working with a collection as soon as it starts to build.  New results will be added to the collection on-the-fly.


Q: Will the file hashing feature work with my hash threat intelligence feeds?

A: Yes!  Atomic Fishbowl can import your hash feeds.  It can also refresh them on a schedule.


Q: Am I required to buy an Atomic Fishbowl appliance to run Atomic Fishbowl?

A: No.  Atomic Fishbowl is BYOH (bring your own hardware).


Q: What platform does Atomic Fishbowl run on?

A: Atomic Fishbowl runs on CentOS 7 Atomic Host.  The application is packaged as a set of containers which can be easily swapped-out by administrators, and is not prone to some of the more troublesome aspects of supporting enterprise applications.


Q: Will Atomic Fishbowl run in a Virtual Machine?

A: Yes, Atomic Fishbowl will run perfectly well in a VM.


Q: How do I install Atomic Fishbowl?

A: Simply run the installation ISO that we provide, and the product will be installed along with the OS and dependencies.


Q: What are some performance considerations for Atomic Fishbowl?

A: In terms of the server component, Atomic Fishbowl is mainly CPU and disk-bound. Memory is not a large consideration for the server, unless you have very large hash feeds, but the more CPU cores you throw it, the faster it will run. NetWitness itself may also be a bottleneck, particularly if it is already under heavy load. If a Decoder is just on the edge of dropping packets, Atomic Fishbowl could send it over the edge.

The client PC should have a good amount of RAM, a strong 3D graphics card, and a fast multi-core CPU. It is not well-suited for terminal sessions, which should be avoided.


Q: What type of screen should I view Atomic Fishbowl with?

A: Atomic Fishbowl looks best on a 4K monitor.


Q: Does Atomic Fishbowl still provide a pan/zoom interface like the old NetWitness Visualize?

A: It does, but mainly as an "Easter Egg" for users of the older Visualize product.  Not all features may be available using the Pan/Zoom view, and this feature may be discontinued in the future.


Q: Does Atomic Fishbowl integrate with Active Directory?

A: It does in terms of AD Identity feeds which can be injected into NetWitness, and its metadata displayed by Atomic Fishbowl, such as Active Directory Computer and Username.  It does not yet integrate with AD for authentication but this is being considered for a future release.


Q: How is Atomic Fishbowl licensed?

A: Atomic Fishbowl is sold as an annual subscription, and won't need to be scoped as a capital expenditure by most companies.


Q: Does Atomic Fishbowl provide active alerting via syslog or another method?

A: No, but this is on the product roadmap, estimated for delivery in the first half of 2018.


Q: What else do you have planned for Atomic Fishbowl?

A: Ssh, it's a secret.


Q: Can I suggest a feature that I think would make Atomic Fishbowl more useful?

A: We'd be very happy to listen to your suggestions.


Q: Is Atomic Fishbowl RSA Ready certified?

A: Yes, indeed!


Q: Will Kensington Technology Associates install and configure Atomic Fishbowl for me?

A: We'd be happy to install and configure Atomic Fishbowl for you.


Q: How do I get a trial of the product?

A: You can sign up here.