#!/bin/sh

# Author: Guy Bruneau, gbruneau@ipss.ca gbruneau@isc.sans.edu
# Version: 1.1
# Date: 27 June 2017
# Title: netwitness_sdk.sh

# Source code put in public domain by Guy Bruneau, no Copyright
# Use at your own risk

# This software is provided "as is" without express or implied warranty or support

# Version 2.0
# Date: 28 November 2018
# Added Options 6-8 to get packets, files, String and Regex searches

# Version 2.1
# Date: 28 January 2022
# Fixed filename for option 2 & 3

# Description:
# This script is used to provide interface to the nwsdk_csv.py script supplied
# by Rui Ataide (available at: https://community.rsa.com/message/883219) from RSA.

# The command  sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' is used
# to reorder the output by date and time as well as move the metadata output
# field queried back to the top with sed to provide a clean report.

# Set Broker default IP
MYIP='192.168.25.30:56003'
NWLOGIN='192.168.25.30:50103'

# Set Concentrator default IP
#MYIP='192.168.25.34:56005'
#NWLOGIN='192.168.25.3:50105'


# Set Concentrator default IP for packet extraction (login)
#MYLOGINIP='192.168.25.34:ssl'
# Set Broker default IP for packet extraction (login)
MYLOGINIP='192.168.25.30:50003'

# Set default username for queries
USERNAME='admin'

# Set default password for queries
PASSWORD='netwitness'

# Set the default URL and login with username/password variables

BROKERSDK="sdk open nws://$USERNAME:$PASSWORD@$MYIP"
BROKERLOGIN="login $MYLOGINIP $USERNAME $PASSWORD"
NWSDK="/usr/local/bin/nwsdk_csv.py -c http://$NWLOGIN -u $USERNAME -p $PASSWORD"

# Default NetWitness directory

OUTPUTDIR="$HOME/NWdata"

if [[ ! -d $OUTPUTDIR ]]; then
	mkdir -p $OUTPUTDIR
fi

# Global variable
USER=`/usr/bin/whoami`
DATE="`/bin/date '+%Y-%m-%d_%H:%M'`"

RED='\033[0;31m'    # Red
DGRAY='\033[0;30m'  # Dark Gray
GREEN='\033[0;32m'  # Green
YELLOW='\033[0;33m'  # Yellow
BLUE='\033[0;34m'  # Blue
LGREEN='\033[1;32m' # Light Green
NC='\033[0m'        # No color

NOW=$(date "+%Y-%m-%d %H:%M:%S")

# ============= Beginning of Script =============

fin=n
while [ $fin=n ]
do

   clear
   echo
   echo
   echo -e "                    All Meta, PCAP and Files are Saved in ${GREEN}$OUTPUTDIR${NC}"
   echo -e "                    Use the ${BLUE}Single${NC} and ${BLUE}Double${NC} ${GREEN}Quotes${NC} as per examples"
   echo
   echo -e "                         ${LGREEN}NetWitness Database Search Menu${NC}" 
   echo
   echo "                    1. Process a single query"
   echo "                    2. Process a list contained in a file (ip or ports only)"
   echo "                    3. Process a list contained in a file (everything else)"
   echo "                    4. Web Traffic Analysis (Service=80)"
   echo "                    5. DNS Traffic Analysis Summary (Service=53)"
   echo "                    6. Extract packets to a pcap file"
   echo "                    7. Process String or Regex Search"
   echo "                    8. Dump Session ID data as a PCAP or Files"
   echo
   echo "                    e. Exit script"
   echo
   read -p "                             What is your choice? " option
      case "$option" in

# ============= Option 1: Process a Single Query =============

      1) clear

   # Process a single query

   echo "Ready to process a single search query"
   echo
   echo "i.e. ip.dst=192.168.2.5 && service=80"
   echo -n "What meta fields should be part of this query? "
   read META

   read -p "What do you want to call this file? " FILE
   # Add meta information the the top of the file
   echo
   echo "Meta query: $META" > $OUTPUTDIR/$USER-$FILE-$DATE.csv
   echo "" >> $OUTPUTDIR/$USER-$FILE-$DATE.csv
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   echo
   echo "What would you like to see in the output? "
   echo "Example: ip.src,alias.host"
   echo "Example: time,ip.src,alias.host --no-count --gmtime"
   echo "Example TCP: time,ip.src,ip.dst,direction,service,tcp.srcport,tcp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo "Example UDP: time,ip.src,ip.dst,direction,service,udp.srcport,udp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo
   read OUTPUT

      $NWSDK -k $OUTPUT -w "$TIME && $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' >> $OUTPUTDIR/$USER-$FILE-$DATE.csv

   echo
   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.csv..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 2: Process a list of IPs or Ports =============

      2) clear

   # Process a list contained in a file

   echo "Ready to process a file list search"
   echo
   echo -n "What is the name of the file used as input? "
   read FILENAME

   echo
   echo "What is your NetWitness query for the input file? "
   echo "Example The list to input is search IP (=, !=, contains, etc). The entry looks like: ip.src = "
   echo
   read METAFILE

   echo
   echo "What additional meta fields should be part of this query? "
   echo "Example: service=80,443"
   echo
   read META

   echo
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   echo
   echo "What would you like to see in the output? "
   echo "Example: ip.src,alias.host"
   echo "Example: time,ip.src,alias.host --no-count --gmtime"
   echo "Example TCP: time,ip.src,ip.dst,direction,service,tcp.srcport,tcp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo "Example UDP: time,ip.src,ip.dst,direction,service,udp.srcport,udp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo
   read OUTPUT

   i=0

   cat $FILENAME | while read line
      do
         array[ $i ]="$line"
         (( $i ))

#   $NWSDK -k $OUTPUT -w "$TIME && $METAFILE ${array[$i]} $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' > ${array[$i]}_$OUTPUTDIR/$USER-$FILE-$DATE.csv
   $NWSDK -k $OUTPUT -w "$TIME && $METAFILE ${array[$i]} $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' > $OUTPUTDIR/$USER-${array[$i]}-$DATE.csv

   DATE=`date -u +%d-%b-%Y_%H-%M-%S`

      done

   echo
   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.csv..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 3: Process a List of all other than IPs and Ports =============

      3) clear

   # Process a list contained in a file

   echo "Ready to process a file list search"
   echo
   echo -n "What is the name of the file used as input? "
   read FILENAME

   echo
   echo "What is your NetWitness query for the input file? "
   echo "Example The list to input is search alias.host (=, !=, contains, etc). The entry looks like: alias.host = "
   echo
   read METAFILE

   echo
   echo "What additional meta fields should be part of this query? "
   echo "Example: alias.host='www.googlle.cc'"
   echo
   read META

   echo
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   echo
   echo "What would you like to see in the output? "
   echo "Example: ip.src,alias.host"
   echo "Example: time,ip.src,alias.host --no-count --gmtime"
   echo "Example TCP: time,ip.src,ip.dst,direction,service,tcp.srcport,tcp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo "Example UDP: time,ip.src,ip.dst,direction,service,udp.srcport,udp.dstport,alias.host,filename,payload.req,payload.res --no-count --gmtime"
   echo
   read OUTPUT

   i=0

   cat $FILENAME | while read line
      do
         array[ $i ]="$line"
         (( $i ))

   $NWSDK -k $OUTPUT -w "$TIME && $METAFILE '${array[$i]}' $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' > $OUTPUTDIR/$USER-${array[$i]}-$DATE.csv

   DATE=`date -u +%d-%b-%Y_%H-%M-%S`

      done

   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.csv..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 4: Output Web Traffic Meta  =============

      4) clear

   # Process Web Traffic Analysis

   echo "Web Traffic Analysis (Service=80)"
   echo
   echo -n "What meta fields should be part of this query? "
   read META

   read -p "What do you want to call this file? " FILE
   echo
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   # Static service to 80
   META="service=80 && $META"

   OUTPUT="time,ip.src,ip.dst,direction,tcp.srcport,tcp.dstport,alias.host,filename,payload.req,payload.res,result.code,server,country.dst --no-count --gmtime"

      $NWSDK -k $OUTPUT -w "$TIME && $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' > $OUTPUTDIR/$USER-$FILE-$DATE.csv

   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.csv..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 5: Output DNS Traffic Meta =============

      5) clear

   # Process a DNS Query for analysis

   echo "DNS Traffic Analysis Summary (Service=53)"
   echo
   echo -n "What meta fields should be part of this query? "
   read META

   read -p "What do you want to call this file? " FILE
   echo
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   # Static service to 80
   META="service=53 && $META"

   OUTPUT="ip.src,ip.dst,direction,alias.host,country.dst"

      $NWSDK -k $OUTPUT -w "$TIME && $META" | sort -t "-" -k 1,1d -k 2,2M | sed '1h;1d;$!H;$!d;G' > $OUTPUTDIR/$USER-$FILE-$DATE.csv

   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.csv..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 6: Process and Save PCAP Traffic =============

      6) clear

   # Process and save a PCAP file

   QUOTE='"'

   echo "Process NW query output into a pcap file..."
   echo
   echo "What meta fields should be part of this query? "
   echo "i.e. ip.dst=192.168.2.5 && service=80"
   echo
   read -p "Meta: " META
   echo
   read -p "What do you want to call this pcap file? " FILE
   echo
   echo "What is the time range of your query? "
   echo "Options are: Starting from now to some previous hours/days/months or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options

   echo "Processing..."

   echo "$BROKERLOGIN" >$HOME/query.txt
   echo "cd /sdk" >>$HOME/query.txt
   echo "packets where=$QUOTE$META && $TIME$QUOTE pathname=$OUTPUTDIR/$USER-$FILE-$DATE.pcap append=1" >>$HOME/query.txt

   NwConsole -f $HOME/query.txt
   /bin/rm $HOME/query.txt

   echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.pcap..."
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 7: Process and Save SessionID of Discovered String or Regex Search Results =============

      7) clear
   # Process a String or Regex query and save the result to a file

   QUOTE='"'

   echo "What meta fields should be part of this query? "
   echo
   read -p "Meta: " META
   echo
   read -p "What do you want to call this file? " FILE
   echo
   echo "What is the time range of your query? "
   echo "Options are: From Now to some hours/days/months range or a date/time range. What is your choice? "
   echo
   read -p "(N)ow to some previous point in time or (D)ate/time range: " OPTIONS
  
   OPTIONS=`echo $OPTIONS | sed 's/./\U&/'`

      if [ $OPTIONS == 'N' ]; then

         echo -e "Options are: by ${GREEN}hour${NC} (i.e. 12 hour), by ${GREEN}day${NC} (i.e. 3 day) and by ${GREEN}month${NC} (i.e. 1 month) "
         echo
         read -p "Time range: " TIME
         TIME=$(date -d "$TIME ago" "+%Y-%m-%d %H:%M:%S")
         TIME="time='$TIME'-'$NOW'"

      elif [ $OPTIONS == 'D' ]; then

         echo -e "Options is: ${GREEN} date range${NC} ('2018-11-30'-'2018-12-01')"
         read -p "Start time (i.e 2018-11-30 00:00:00): " STARTTIME
         read -p "End time (i.e 2018-12-01 00:00:00): " ENDTIME
         TIME="time='$STARTTIME'-'$ENDTIME'"
      fi # End of time options


   echo "What type of search do you want to perform, (S)tring or (R)egex? "
   echo
   read -p "(S)tring or (R)egex? " CHOICE
   # Convert to upper case the CHOICE variable
      CHOICE=`echo $CHOICE | sed 's/./\U&/'`

   clear
   echo -e "${LGREEN} Search Specifiers:${NC}"
   echo
   echo "  Search specifiers:"
   echo "     sp  = Search packets"
   echo "     nsp = Do not search packets"
   echo "     ci  = Case insensitive"
   echo "     cs  = Case sensitive"
   echo "     sm  = Search meta"
   echo "     nsm = Do not search meta"
   echo "     ds  = Decode session then search (e.g., HTTP, Email - search email attachments, much slower search)"
   echo "     nds = Do not decode session when searching"
   echo

   if [ $CHOICE == 'S' ]; then
      echo
      echo "What string do you want to search in the traffic? "
      echo "i.e. SSH-2.0-PUTTY"
      echo
      read -p "String to search: " STRING
      echo
      echo "What search specifiers would you like to use? "
      echo "Examples: sp ci, sm nsp, sp nsm ci"
      echo
      read -p "Enter search specifiers: " OPTIONS

   echo "Processing..."


   echo $BROKERSDK >$HOME/query.txt
   echo "sdk output $HOME" >>$HOME/query.txt
   echo "sdk search session=l-now where=$QUOTE$META && $TIME$QUOTE search=$QUOTE keyword ='$STRING' $OPTIONS $QUOTE pathname=$OUTPUTDIR/$FILE.txt" >>$HOME/query.txt

   elif [ $CHOICE == 'R' ]; then

      echo
      echo "What regular expression do you want to search in the traffic? "
      echo
      read -p "Regular Expression to search: " REGEX
      echo
      echo "What search specifiers would you like to use? "
      echo "Examples: sp ci, sm nsp, sp nsm ci"
      echo
      read -p "Enter search specifiers: " OPTIONS

   echo "Processing..."


   echo $BROKERSDK >$HOME/query.txt
   echo "sdk output $HOME" >>$HOME/query.txt
   echo "sdk search session=l-now where=$QUOTE$META && $TIME$QUOTE search=$QUOTE keyword ='$REGEX' $OPTIONS $QUOTE pathname=$OUTPUTDIR/$FILE.txt" >>$HOME/query.txt

   fi

   NwConsole -f $HOME/query.txt
   /bin/rm $HOME/query.txt

   echo "Done processing, output in $OUTPUTDIR/$FILE.txt..."
   echo
   echo
   echo -n "Press ENTER to continue..."
   echo
   echo
   read;;

# ============= Option 8: Dump Session ID data as a PCAP or Files =============

   8)

   # Overwrite the date variable to change each time it is used
   DATE=`date -u +%d-%b-%Y_%H-%M-%S`

   echo "Option 1: Do you want to extract a Session or multiple sessions in (P)cap? "
   echo "Extract a session ID (i.e. 1) or Multiple sessions ID in this format: (i.e. 1,6,25-30)"
   echo "Option 2: Extract all the (F)iles from a session ID? "
   echo
      read -p "Choice (P)cap or (F)iles: " CHOICE
   # Convert to uppercase the CHOICE variable
   CHOICE=`echo $CHOICE | sed 's/./\U&/'`

   if [ $CHOICE == 'P' ]; then
      echo
      read -p "What do you want to call this pcap file? " FILE
      echo
      read -p "Enter pcap SessionID or list of SessionID: " SESSIONID
      echo $BROKERLOGIN >$HOME/query.txt
      echo "cd /sdk" >>$HOME/query.txt
      echo "packets sessions=$SESSIONID pathname=$OUTPUTDIR/$USER-$FILE-$DATE.pcap append=1" >>$HOME/query.txt
      NwConsole -f $HOME/query.txt
      echo "Done processing, output in $OUTPUTDIR/$USER-$FILE-$DATE.pcap..."
   elif [ $CHOICE == 'F' ]; then
      read -p "Enter file SessionID: " SESSIONID
         if [[ ! -d $OUTPUTDIR ]]; then
          mkdir -p $OUTPUTDIR/files
   fi # End if CHOICE

   echo $BROKERSDK >$HOME/query.txt
   echo "sdk output $OUTPUTDIR/files" >>$HOME/query.txt
   echo "sdk content session=$SESSIONID render=files" >>$HOME/query.txt
   NwConsole -f $HOME/query.txt
   /bin/rm $HOME/query.txt
   echo "Done processing, output in $OUTPUTDIR/files..."

# Encrypting the files with infected

   if [[ -d $OUTPUTDIR/files ]]; then
           cd $OUTPUTDIR
           zip -P infected files.zip files/*
           echo
           echo -e "Files have been zipped and password protected with ${GREEN}infected${NC} and saved in $OUTPUTDIR"
           echo
           rm -fr $OUTPUTDIR/files
   fi


fi # End of loop global menu

   echo
   echo -n "Press ENTER to continue..."
   echo
   echo

   read;;

      e|E|q|Q) echo "                  Done with NetWitness search"
           exit;;
      *) echo "                    Invalid entry, try again"
         sleep 2;;
   esac
done
echo "done"

