Normally they come up in interview with 4-5 guys, they were asking to start scenario based one by one person, question starting from infrastructure of organization, architecture of RSA Netwitness, describe each & every components of RSA Netwitness, How to create custom parser, Howto create rules, how to search perform to generate report, how to troubleshoot if any attack is happening, how to install & configure RSA Netwitness Server & it's components, then they will give you the scenario of questions, then they will ask you command to perform any activity, if any false positive comes after 3 months of retention period what would be the step to troubleshoot & rca,