CPU utilization greatly increases when Context Lookup is performed with lists having more than 5K values in RSA Security Analytics 10.6

[#1]

Article Number

000033046

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Event Stream Analysis
RSA Version/Condition: 10.6.0.0
Platform: CentOS
O/S Version: EL6

Issue

If large custom lists are created, the context hub service can consume a large percentage (e.g. 70%) of processing cycles on Event Stream Analysis causing the lookup results for lists to be much slower than normal.

Resolution

This issue has been addressed in Security Analytics 10.6.0.1.

Workaround

To minimize potential resource load, it is recommended that the number of entries in a list must be less than 5,000.