ESA Alerts and Incidents Failure

[RenatoGoncalves]

Hello,

Im experiencing some difficulties with NW 11.

Im noticing that the incidents and the alerts are not being created for some days. Can anyone have a clue whats happening?

Regards

[JohnKisner]

Renato,

What is generating the alert, (ESA, Reporting Engine, or both)? Are you seeing the alert fire in whatever is producing the alert but not seeing it show up in Respond until some days later? Or are you seeing the alerts not appear for a few days and then once the alert arrives the incident is created in the correct amount of time? How much time appears to pass between when the alert should have fired and when it actually appears?

Thank you,

Jay Kisner

RSA Netwitness Support Manager

[RenatoGoncalves]

Hello John,

Almost an hour betweetn the happening and the appearance. 

But we were having some issues with the health of our NW, due to a failure in update, and we decided to do a reversion to 11..1. Since then we did not noticed anything similar. 

[JohnKisner]

That is good to hear. If you start to see the issue again I highly suggest opening a Support case so that we can take a closer look at what may be happening.