Article Number
000029125
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 10.3.x and 10.4.x
Platform: Platform (Other): CentOS
Issue
The hyperlink in the email reports does not work.
Cause
This may be due to an invalid URL where the hostname/IP address of the SA Server is missing or the hostname of the SA Server is not resolvable to the correct IP address.
For example:
When the hostname or IP address is missing in the Reporting Engine output action tab, then the generated URL in the email report will look something like the following:
https:///investigation/2/navigate/event/DETAILS/20143899 (note the hostname/IP missing in the URL)
When the IP is added, new reports will have the corrected URL as follows:
https://10.10.10.101/investigation/2/navigate/event/DETAILS/20143902 (now the IP address is added to the URL)
Resolution
Add the hostname or IP address of the SA Server under the "Output Actions" tab of the Reporting Engine, following the appropriate steps below.
10.4.x:
1. In the Security Analytics menu, select Dashboard > Administration > Services.
2. In the Services Grid, select the Reporting Engine service.
3. Navigate to View > Config. The Services Config View of Reporting Engine is displayed.
4. In the Output Actions tab, add the IP address or Hostname of the SA Server in the "Host Name" field under "SA Configuration" section.
5. Click Apply and save the settings.
10.3.x:
1. In the Security Analytics menu, select Administration > Devices.
2. In the Devices Grid, select the Reporting Engine device.
3. In the toolbar, select View > Config.
4. Select the Output Actions tab. The Device Config view is displayed with the Reporting Engine Output Actions Tab open.
5. Add the IP address or Hostname of the SA Server in the Host Name field under "SA Configuration" section.
6. Click Apply and save the settings
Note: If you are using the hostname of the SA Server instead of the IP address, please make sure the hostname is resolvable to the corresponding IP address of the SA Server.
Notes
The "Host Name" name field must be specified with the IP Address or Hostname of the Security Analytics server. This is required for all kind of deployments so that you can refer to this address to create investigation links to Security Analytics from Reports, Alerts, and so on. You specify the Security Analytics HostName with the ${LinkToSA} variable in the Body field in the Output Actions when you Schedule a Report. The Security Analytics uses this parameter to correctly generate:
SMTP Output Action
SNMP Output Action
Syslog Output Action
SFTP Output Action
URL Output Action
Network Share Output Action
Hyperlinks for meta values in Report PDFs
