Article Number
000035719
Applies To
RSA Product Set: NetWitness Endpoint, NetWitness Platform
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.3.x., 4.4.x
Issue
Configuring the Data Source NW Endpoint for NetWitness Logs and Packets ESA.
The test connection fails.
Cause
The two most likely causes would be the REST API interface is not reachable from the ESA node, or the account that is used does not have sufficient permissions.
Resolution
The Context Hub connection handled by the NW Endpoint REST API.
The REST API, will get the data from the ECAT database. Each component has to be working and the account that is used by the Content Hub has to read rights to the database.
The first step is to logon to the NW Endpoint UI then from the menu.
Configure -> Monitoring and External Components.
In the upper right-hand corner, there should be green check mark and if you hover over the box, a green check mark text will appear "API server is running correctly".
You can move on to next step.
(repair of API server is out of scope for this KB article)
Logon to the machine that is hosting the NW Endpoint Console Server.
Open up web browser and insert into address bar:
https://localhost/:9443/api/v2/swagger-ui
This will bring up the API server UI.
Next step is to enter the credentials of the account that is used and run a test by scrolling down to health: API Server Health click show/hide option and scroll down to "Try it out"
Scroll down to the Response Body panel, and if the account displays message "Invalid Username or Password" create an SQL account via the NW Endpoint UI
(Configure -> Manage Users and Roles)
The account is given read-only which should suffice.
Test again and this time the Response Body will contain details about the API server health.
If this step passes, next step is to verify that the API Interface is available from the Net Witness Logs and Packets ESA server.
From the console or putty session to on the ESA server to the host running the Console server use curl to verify if connection can be made:
curl -v -k https://<FQDN or IP of ECAT server>:9443
If the commend times out, you need to contact the network team investigate why the host cannot reach the NW Endpoint Console Server.
