2019-10-19 05:58 AM
Netwitness was upgraded from 11.2.0.1 to 11.3.1.1. All incident rules disappeared from the UI. It cannot create any new rule, as it is not showing up after saving.
Although the list of rules is empty I can find all existing rules in Mongodb including the test one I created after the upgrade.
I am not sure but it seems the rules are still firing as I can see new incidents being created.
2019-10-21 09:15 AM
Maxim, I might suggest you open a case with RSA Support for this.
My immediate thought that this is either the respond service or the jetty service at fault, but more towards Respond. What I would look at it is the /var/log/netwitness/respond-server/respond-server.log either when accessing this page or on service restart. I'm wondering, if, perhaps a json element is not being parsed correctly or a type conversion is failing as I have seen that before in the past.