Mechanism does not change when switching from Automated Threat Detection for Logs (Using Query-Based Aggregation) to Packets in RSA Security Analytics 10.6

[#1]

Article Number

000035768

Applies To

RSA Product Set: NetWitness Logs & Network, Security Analytics
RSA Product/Service Type: Event Stream Analysis (ESA), Advanced Threat Detection
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: EL6

Issue

When you switch from Automated Threat Detection for Logs (Using Query-Based Aggregation) to Packets, the mechanism does not change.

Resolution

This issue is currently being investigated by the Engineering team in order to resolve it in a future release.

Workaround

Manually change the value. To change the value:

1. Go to the RSA NetWitness UI > Administration > Services > Event Stream Analysis > View > Explore
2. From there, go into the Workflow directory > Source > nextgenAggregationSource and change the Mechanism field from QUERY to AGGREGATION.