Article Number
000001768
Applies To
RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: NetWitness UI
RSA Version/Condition: 11.3.x
Platform: CentOS
O/S Version: 7
Issue
When attempting to run a query in Investigate > Navigate within the RSA NetWitness UI and pressing "Apply," the query is automatically modified to a different query that was not originally entered and provides different data.
Workaround
This workaround is due to whenever a query is executed that is automatically modified, it fetches the incorrect ID for that query from the list within the URL Integrations page, which is why the query is modified.
- On node zero, log into mongo.
mongo admin -u deploy_admin -p <password>
- Display the list of databases and choose the investigate-server database.
> show dbs
> use investigate-server
- Run the following command, which will retain any old queries previously ran in Investigation. However, if you have previously bookmarked any URL's from Investigation, such as "https://<sa_ip>/investigation/18/navigate/values/1284", the bookmarks will no longer be valid, as the ID's associated with the old queries (in this example: 1284) will not work.
> db.getCollection('predicate').updateMany({}, {$unset: {"legacyId": ""}})
Notes
If this does not solve your issue, please
open a case with RSA Technical Support and reference this article so that we may better assist you.