How to troubleshoot blocking issues in RSA NetWitness Endpoint

[#1]

Article Number

000001541

Applies To

RSA Product Set: ECAT, NetWitness Endpoint
RSA Version/Condition: 4.3.0.4
Platform: Windows

Issue

This article solves the need to have a common source of links to other articles specifically related to blocking in the RSA NetWitness Endpoint product.

Cause

There are several possible issues related to blocking that can affect a specific endpoint, with factors including:

• disable blocking in the agent driver during reboot
• blocking occurs when agent is present on more than X number of systems when it should be disabled
• Blocking inconsistently fails to initiate in a multi-server architecture for agents on secondary servers

Resolution

1. Blocking is disabled following reboot of the target machine.
   1. This has to do with a driver setting in the agent, and was fixed in both the 4.1.2 update, and also in 4.2.0.2 and later versions.
2. Blocking occurs when agent is present on more than X number of systems when it should be disabled based on the option set in the Machines panel of the UI.
   1. This is split into two parts. The first is that if you have blocking enabled under Configure>Global Parameters and select a value that is lower than the number of modules present in the environment(so you have say 51 modules on 51 systems that need blocking but only allow for 50 before its ignored) the files will still be blocked anyways. This is fixed in 4.2.0.2
   2. In the second scenario, the file will not actually be blocked but the option to block may still be available in the UI but should be greyed out. This is fixed in 4.2.0.2
3. Blocking inconsistently fails to initiate in a multi-server architecture for agents on secondary servers.
   1. This is due to the secondary not getting the list of updated blocking hashes correctly. This was fixed in a code release for 4.3.0.0.