Unable to perform Malware Analysis On-Demand scans using trusted connections in RSA Security Analytics 10.4.

[RSAAdmin]

Hello every body,

I try to perform Malware Analysis On-Demand scans but i got the error.

The following error message is displayed in the Security Analytics UI when attempting to utilize the Scan for Malware feature:  There is communication failure.  Please try again later.

I check message in /var/lib/netwitness/rsamalware/spectrum/logs/spectrum.log, i got the message as below:

2015-01-22 07:34:09,266 [main] INFO  com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX connector server started: javax.management.remote.rmi.RMIConnectorServer@66efb253

2015-01-22 07:34:09,268 [main] INFO  com.rsa.netwitness.carlos.jmx.DefaultConnectorServerFactoryBean - JMX consoles can connect to service:jmx:rmi://NWAPPLIANCE11972:0/jndi/rmi://NWAPPLIANCE11972:60008/carlos

2015-01-22 07:35:49,318 [main] WARN  com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel - New message channel for 'class com.rsa.malware.cloud.FileProtocol' is a non-CARLOS protocol. Caching is unavailable

2015-01-22 07:35:49,868 [main] WARN  com.netwitness.malware.core.services.carlos.CommunityProtocolClient - Subscribing to Maintenance Notification...

2015-01-22 07:35:50,690 [main] WARN  com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel - New message channel for 'class com.rsa.malware.cloud.CommunityProtocol' is a non-CARLOS protocol. Caching is unavailable

2015-01-22 07:35:51,772 [CARLOS Message Dispatch 2095867488] ERROR com.netwitness.malware.core.services.carlos.CommunityProtocolClient - Error in CommunityProtocolClient - listener org.springframework.security.core.userdetails.UsernameNotFoundException: The credentials supplied have either expired or are invalid

2015-01-22 07:35:52,259 [main] WARN  com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel - New message channel for 'class com.rsa.malware.cloud.CommunityProtocol' is a non-CARLOS protocol. Caching is unavailable

2015-01-22 07:35:53,540 [main] WARN  com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel - New message channel for 'class com.rsa.malware.cloud.SandboxProtocol' is a non-CARLOS protocol. Caching is unavailable

Pls kindly advise me to reslove this issue.

Br,

Ducpv

[RSAAdmin]

Hello and thank you for reaching out with this error.  To resolve this, the computer ID (CID) of the MA appliance must be registered with customer support.  Please contact customer support, give them the CID for your appliance and the community will respond without the credentials error:

...

2015-01-22 07:35:51,772 [CARLOS Message Dispatch 2095867488] ERROR com.netwitness.malware.core.services.carlos.CommunityProtocolClient - Error in CommunityProtocolClient - listener org.springframework.security.core.userdetails.UsernameNotFoundException: The credentials supplied have either expired or are invalid

[Anonymous]

Hi Ducpv

The issue you have described is related to the trust model introduced with SA 10.4. Please open an issue with support and they can provide the steps to get this working.

Regards,
CT