ESA was unable to deploy one or more rules- Logins across multiple servers esa000168

[OrnaldoNaqellar]

Hello i tried to deploy the following rule today:Logins across multiple servers esa000168  in our environment RSA NetWitness Logs v 10.6.4.1 but i have error:  ESA was unable to deploy one or more rules, and these rules were disabled. Common issues include: missing metadata, invalid rule syntax, and unavailable external connections at the time of deployment.

Please any idea ?

[NaushadKasu1]

1. SSH to the ESA appliance

2. Run: tail -f /opt/rsa/esa/logs/esa.log

3. Try to Deploy the rule again

4. Check the logs for the error

Based on the error, it may be apparently what is exactly the issue. If you cannot identify the issue, then post the error (with any sensitive info redacted) and we can move forward with root cause analysis.

[OrnaldoNaqellar]

Thank You for your replay. Below the log:

2018-11-01 15:49:58,982 [Carlos@6065f052-206] INFO  com.rsa.netwitness.carlos.notification.listener.NotificationConfigurationService - API Invocation Audit: identity=XXXXXX_USER, action=SetT                                                emplateDefinition, object=smtp.ftl;syslog.ftl;59de1b67e4b013b2ca156ce8, success=true
2018-11-01 15:49:58,991 [Carlos@55067df8-207(run(GetAvailableJdbcDrivers))(XXXXXX_USER)] INFO  com.rsa.netwitness.carlos.transport.RequestChannelListener - API Invocation Audit: identity=ona                                                qellari, action=GetAvailableJdbcDrivers, object=<all>, success=true
2018-11-01 15:49:58,998 [Carlos@1855f222-208(run(GetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.carlos.transport.RequestChannelListener - API Invocation Audit: identity=XXXXXX_USER, ac                                                tion=GetEplModule, object=all, success=true
2018-11-01 15:49:59,266 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 59de08eae4b013b2ca156ce7(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,267 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000035(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,267 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000091(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,267 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 59e09419e4b080811cfb2023(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,267 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 59e0c941e4b080811cfb2026(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,268 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 59faeb4be4b0da193dc47f21(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,268 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000014(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,268 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000006(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,269 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000029(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,269 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module esa000065(default) with an unchanged                                                 definition.
2018-11-01 15:49:59,269 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 5ba2276ce4b08b1f7f58b66d(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,269 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Ignored set for module 5ba24553e4b08b1f7f58b66e(default) wi                                                th an unchanged definition.
2018-11-01 15:49:59,334 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.espertech.esper.core.service.StatementLifecycleSvcImpl - Failed to compile statement: Failed to resolv                                                e event type: Event type or class named 'User_Whitelist' was not found
com.espertech.esper.epl.expression.core.ExprValidationException: Failed to resolve event type: Event type or class named 'User_Whitelist' was not found
        at com.espertech.esper.epl.spec.FilterStreamSpecRaw.resolveType(FilterStreamSpecRaw.java:211)
        at com.espertech.esper.epl.spec.FilterStreamSpecRaw.compile(FilterStreamSpecRaw.java:121)
        at com.espertech.esper.core.service.StatementLifecycleSvcImpl.compile(StatementLifecycleSvcImpl.java:1139)
        at com.espertech.esper.core.service.StatementLifecycleSvcImpl.compile(StatementLifecycleSvcImpl.java:1126)
        at com.espertech.esper.core.service.StatementLifecycleSvcImpl.createStopped(StatementLifecycleSvcImpl.java:277)
        at com.espertech.esper.core.service.StatementLifecycleSvcImpl.createStoppedAssignName(StatementLifecycleSvcImpl.java:199)
        at com.espertech.esper.core.service.StatementLifecycleSvcImpl.createAndStart(StatementLifecycleSvcImpl.java:153)
        at com.espertech.esper.core.service.EPAdministratorImpl.createEPLStmt(EPAdministratorImpl.java:118)
        at com.espertech.esper.core.service.EPAdministratorImpl.createEPL(EPAdministratorImpl.java:92)
        at com.espertech.esper.core.deploy.EPDeploymentAdminImpl.deployInternal(EPDeploymentAdminImpl.java:176)
        at com.espertech.esper.core.deploy.EPDeploymentAdminImpl.deploy(EPDeploymentAdminImpl.java:98)
        at com.rsa.netwitness.core.cep.ESPEREngine.deployModule(ESPEREngine.java:571)
        at com.rsa.netwitness.core.cep.RoutingESPEREngine.deployModule(RoutingESPEREngine.java:448)
        at com.rsa.netwitness.core.epl.EplModuleManager.deployModule(EplModuleManager.java:705)
        at com.rsa.netwitness.core.epl.EplModuleManager.setModules(EplModuleManager.java:385)
        at com.rsa.netwitness.core.api.epl.EplModuleListener.SetEplModule(EplModuleListener.java:120)
        at sun.reflect.GeneratedMethodAccessor458.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at com.rsa.netwitness.common.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:459)
        at com.rsa.netwitness.common.util.ReflectionUtils.invoke(ReflectionUtils.java:477)
        at com.rsa.netwitness.common.listener.AbstractRequestHandler.onRequest(AbstractRequestHandler.java:110)
        at sun.reflect.GeneratedMethodAccessor319.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:198)
        at com.sun.proxy.$Proxy70.onRequest(Unknown Source)
        at com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel$5.run(AbstractMessageChannel.java:633)
        at com.rsa.netwitness.carlos.common.SharedThreadPoolExecutor$TagExclusiveRunnable.run(SharedThreadPoolExecutor.java:100)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
2018-11-01 15:49:59,335 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] WARN  com.rsa.netwitness.core.epl.EplModuleManager - Esper deployment of module "Logins across Multiple Servers"                                                 (id=esa000168(default)) failed. Reason: Deployment failed in module 'Module_esa000168' in module url 'esa000168' in expression '@Name('Module_esa000168_Alert')  @RSAAlert(identif...(504 ch                                                ars)' : Failed to resolve event type: Event type or class named 'User_Whitelist' was not found [@Name('Module_esa000168_Alert')
@RSAAlert(identifiers={"user_dst"})
@UsesEnrichment(name="User_Whitelist")
SELECT * FROM Event(
                ec_activity='Logon'
                AND ip_dst IS NOT NULL
                AND user_dst IS NOT NULL
                AND     NOT EXISTS (SELECT * FROM User_Whitelist WHERE (LIST = Event.user_dst.toLowerCase()))
                AND     NOT EXISTS (SELECT * FROM User_Whitelist WHERE (LIST = Event.user_dst))
        ).std:groupwin(user_dst).win:time_length_batch(300 seconds, 3).std:unique(ip_dst) group by user_dst having count(*) = 3]
2018-11-01 15:49:59,337 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.core.epl.EplModuleManager - Registered a module with identifier esa000168(default)
2018-11-01 15:49:59,341 [Carlos@2f510013-209(run(SetEplModule))(XXXXXX_USER)] INFO  com.rsa.netwitness.carlos.config.ConfigurationMXBean - EplModuleManager changed by XXXXXX_USER

[OrnaldoNaqellar]

I think is because of the Event type or class ?

Event type or class named 'User_Whitelist' was not found

[NaushadKasu1]

There is a list in Context Hub called "User_Whitelist" that this ESA rule is using. By default, that list is empty but that's not the problem here... you need to add this list to your ESA so it can be referenced in the rule. Here's how you do that:

Assuming you are on NW v11...

1. Log into UI

2. Configure -> ESA Rules

3. Settings (tab) on the left

4. Enrichment Sources

5. Click the + drop-down and select Context Hub

6. Add the "User_Whitelist" list to your ESA enrichment sources

7. Save/Apply

8. Re-deploy the rule

Now keep in mind, the list itself is empty. So if you have users that you want to whitelist and have the rule ignore those users, you need to edit the list:

1. In UI

2. Find Context Hub Server (under Services)

3. Click View -> Config

4. Find the User_Whitelist on the "List" tab

5. Edit/Modify the list with a list of your users (one entry per line) and Save/Apply

The rule does not need to be then modified as it will reference the list each time the rule is executed. 

[OrnaldoNaqellar]

We are using RSA Netwitness Logs & Network 10.6.4.1. Will it work ? In the Enrichment Sources we have only :

Thank You

[NaushadKasu1]

It will not work as-is. You will need to make a copy of the Live rule you have, then edit it and remove the Enrichment whitelist as you do not have access to that functionality. You can still use the rule without the list, but again, you will need to modify the rule to remove all entries, so it will look like this:

Please note the rule itself below is not that useful and may trigger a great deal of false positives. You will need to monitor and tune it to suit your environments needs.

@RSAAlert(identifiers={"user_dst"})
SELECT * FROM Event(
                ec_activity='Logon'
                AND ip_dst IS NOT NULL
                AND user_dst IS NOT NULL
        ).std:groupwin(user_dst).win:time_length_batch(300 seconds, 3).std:unique(ip_dst) group by user_dst having count(*) = 3;

[OrnaldoNaqellar]

Yes you are right about false-positive. I will try and i will let you know. Thank You

[OrnaldoNaqellar]

Hello Naushad is there a way to adds User_Whitelist in the enrichments at these point  ?