ESA deployment shows "unknown error" and deleted rule still triggers alerts in RSA Security Analytics

[#1]

Article Number

000001709

Applies To

RSA Product Set: NetWitness Logs & Packets
RSA Product/Service Type: SA Security Analytics Server, Event Stream Analysis.
RSA Version/Condition: 10.5.1, 10.5.2, 10.5.3, 10.6.x
Platform: CentOS
O/S Version: EL6

Issue

If an ESA rule is deleted, that rule still stays in the Alerts->Configure->Services page as enabled which leads to the below 'Unknown error' while deploying changes to ESA service.

Cause

This is due to additional unused ESA deployment services under ESA Deployments tab.

Resolution

Please follow the below steps to resolve this issue.

1. Login to SA GUI as admin.
2. Navigate to Alerts->Configure->Deployments.
3. Delete additional ESA Deployments which are unused.
4. Verify "Deploy Now" will not show any error when changes deployed.