Article Number
000001594
Applies To
RSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.0.0-4.4.0.8
Platform: Windows
Issue
In the UI, there are 3 monitors that are not listed in columns for review of agents by monitor type. These include the blocking monitors, and the WFP monitor which is new to 4.4.x
Without these monitors, it becomes difficult to exactly confirm agents using the No network monitoring setting, as this should disable WFP and TDI, or some of the other monitoring settings possible.
Cause
Both blocking and WFP monitors were late features that were introduced as enhancements for the agent. The UI was not given column options to show these monitors, which makes verifying their disablement or enablement impossible in the UI and difficult in the SQL database due to the way the WFP monitor is updated there.
Resolution
There are ways to determine the monitor status from the SQL database but this is not a perfect solution due to the way WFP is updated there. The direct solution is inclusion of the missing columns which will make filtering of machines in the UI an accurate process.
A permanent fix is slated for 4.4.0.9, although it may be pushed to the next release cycle.
