Article Number
000001867
Applies To
RSA Product Set: RSA NetWitness Endpoint
RSA Product/Service Type: RSA NetWitness Endpoint Agent
RSA Version/Condition: 11.3.2.1
Issue
Agent mode of policy is 'Advanced', but linux agents are 'Insights' mode.
In RSA NetWitness UI - Investigate - Hosts, the agent mode of hosts should be 'Advanced'. Followings are example screenshot of Hosts page and policy detail tab of the hosts.
Cause
If we do not specify the transportDestination/Endpoint Server Settings in the policy page, the Linux agents run into an issue where they cannot load the received the policy file. And hence they remain in insights (default) mode until they get a policy with the values in it.
May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850
May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: {"errorCode":8003,"errorDescription":"Invalid udp port in transport policy","errorDetails":{"policyRevision":1555279495267442018},"errorType":"POLICY_ERROR","timestamp":"2020-05-15T20:23:20.000Z"}
Workaround
A workaround is to add the Endpoint Server Settings in the policy which is applicable to these Linux agents, and they switch immediately to advanced mode when they load the received policy.
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Policy downloaded and loaded.
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Updated schedular settings
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Agent mode has changed
May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Agent missed scan schedule Fri May 15 09:00:00 2020
May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Schedule scan in 10 mins
Notes
This issue will not be applicable to v11.4 as it has a slightly different way of constructing the applicable policy.
