Out-of-the-box Aggregation Rules in Incident Management are duplicated after upgrading to RSA Security Analytics 10.6

[#1]

Article Number

000033049

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Incident Management
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: EL6

Issue

After updating to Security Analytics 10.6, there are two sets of the same out-of-the-box aggregation rules for Incident Management. This can lead to ambiguity if you enable both sets of these rules.

Image description

Workaround

When enabling rules, be careful not to enable duplicate out-of-the-box Incident Management aggregation rules.