RSA NetWitness Endpoint error message: Unexpected condition while processing modules to post to server

[#1]

Article Number

000037232

Applies To

RSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.x
Platform: Windows

Issue

Reviewing the RSA NetWitness Endpoint log file, ConsoleServer-Error.log (default directory, C:\Program Files\RSA\ECAT\Server\) and see the error message for, Unexpected condition while preparing download request from server.
 

2018-07-17 13:38:02,634 [Auto Restart (?)] ERROR - [14] System.ComponentModel.WarningException:LiveConnect: Unexpected condition while processing modules to post to server
Inner-Exception:
[14] System.ComponentModel.WarningException:The operation has timed out
at System.Net.HttpWebRequest.GetResponse()
at a.b.c.X?.?(MemoryStream A_0)
at a.b.c.X?.?()
2018-07-17 13:39:42,650 [Auto Restart (?)] ERROR - [14] System.ComponentModel.WarningException:LiveConnect: Unexpected condition while preparing download request from server

2019-03-06 11:03:34,891 [Auto Restart (?)] ERROR - [13] System.ComponentModel.WarningException:LiveConnect: Unexpected condition while preparing download request from server

2019-03-06 11:03:34,891 [Auto Restart (?)] ERROR - [13] System.ComponentModel.WarningException:LiveConnect: Unexpected condition while preparing download request from server
Inner-Exception:
[13] System.ComponentModel.WarningException:The underlying connection was closed: The connection was closed unexpectedly.
   at System.Net.HttpWebRequest.GetResponse()
   at a.b.c.X?.?(MemoryStream A_0, List`1 A_1)
   at a.b.c.X?.?()

 

Cause

This error relates to the Live Connect Threat Intelligence Service (Beta) feature having an issue receiving data.

As this is a beta feature the receiving server can become unavailable for periods of time.

The current recommendation is to disable this feature in the NetWitness Endpoint UI to stop the error message appearing.

Workaround

In the NetWitness Endpoint UI, Configure > Monitoring and External Components
Edit the RSA Live configuration

Image description

Choose Edit and turn off the Live Connect Threat Intelligence Service (Beta) feature, and Save.

Image description