This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
NetWitness Knowledge Base Archive
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- NetWitness Community
- NetWitness Knowledge Base Archive
- RSA NetWitness Platform 11.3 Known Issues Master List
-
Options
- Subscribe to RSS Feed
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
RSA NetWitness Platform 11.3 Known Issues Master List
Article Number
000037719
Applies To
RSA Product Set: NetWitness Platform and NetWitness Endpoint
RSA Version/Condition: 11.3
Platform: CentOS
O/S Version: EL7
RSA Version/Condition: 11.3
Platform: CentOS
O/S Version: EL7
Issue
Below is a list of known issues in RSA NetWitness Logs & Network and NetWitness Endpoint, including those listed in the Release Notes.
Please click on the links to go directly to the articles.
General Platform
General Host
General UI
Security
Core Services
Log Collector
ESA
SMS
Health & Wellness
Correlation Server
ESM
Respond
Investigation
Endpoint
Reporting Engine
Licensing
Content
Please click on the links to go directly to the articles.
General Platform
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-8941 SACE-9616 ASOC-39414 | Changing Hostname in NW 11.x procedures/steps not documented | RFE in progress | https://community.rsa.com/thread/194990 |
| SACE-11175 | MegaCli providing misleading disk size information for 8 TB disks on Series 6 Packet Hybrids (affects nwraidutil.pl and nwraidutil.py used by H&W) | 11.3.1 | Internal KB, 37404 |
| SACE-11213 ASOC-79350 | REST API- SAN LVS partitioning. | 11.3.1 | |
| SACE-11250 | /boot partition full after updating to 11.3 | 11.3.0.1 | https://community.rsa.com/docs/DOC-103219 |
| SACE-11592 | After RMAing concentrator cannot add Powervault with SED using 11.3 nwarrycfg utility | 11.3.1 |
General Host
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11406 ASOC-77296 | RSA NetWitness Logs and Network 11.3 Chef run fails with "nw_pki_openssl_hashed_cert" error in chef-solo.log | Under Investigation Workaround available | https://community.rsa.com/docs/DOC-105950 |
| ASOC-48707 | RSA NetWitness Logs & Network 11.x ssh login fails with error "no hostkey alg" | Workaround available | https://community.rsa.com/docs/DOC-106143 |
General UI
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11539 | Unable to delete dashboards and charts created by deleted users | Awaiting QE Test |
Security
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11287 | Security Vulnerabilities on Host OS | 11.4 | |
| ASOC-75957 | Python Security Update https://access.redhat.com/errata/RHSA-2019:0710. | 11.3.1 |
Core Services
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11468 | Decoder Crash due to Core Files post upgrade to NW 11.3 | 11.3.1 | |
| SACE-11554 | Unable to export app rules in NW 11 | 11.4 | |
| ASOC-75007 | Previously, if the Log Decoder was sent bad data that appeared to consist of a certain number of bytes, but the message contained fewer bytes, the Log Decoder waited indefinitely for data that never arrived. The number of bytes allowed for length-prefixed transmissions is now limited to address this issue. | 11.3.1 | |
| SACE-12047 | nwbroker.service is unable to start in NW 11.3.1 | 11.3.1 HF | |
| SACE-11110 | Upgrade 11.2.0.1 issue WebUI | 11.3 | |
| SACE-11737 | UI getting the "Invalid CSRF Token was found on the request parameter 'ctoken' or header 'ctoken'" error | 11.4 | |
| SACE-12068 | NW 11.3.1.0: Network decoder and concentrator missing some 'Physical Drives' and all 'Logical Drives' in Service Stats page | 11.3.2 | |
| SACE-11762 | NW 11.3: UI becomes unresponsive and you must kill the page via chrome until jetty restart | 11.3.1.1 | |
| SACE-11917 | Clone for another customer: NW 11.3: UI becomes unresponsive and you must kill the page via chrome until jetty restart | 11.3.1.1 | |
| SACE-11064 | Snapshots of rules applied to a Decoder service are not generated in NW v11.2 | 11.4 | |
| SACE-11837 | Archiver's Collection is filling with all the logs | 11.3.1.1 | |
| SACE-11837 | Archiver collection stores more data than expected | 11.3.1.1 |
Log Collector
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11434 ASOC-78604 | Office365 plugin issue with disabled SSL | Fix in progress |
ESA
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-10542 SMC-15477 | ESA falls behind when User Baseline is enabled | Awaiting content update | |
| SACE-11407 ASOC-77776 | ESA Alert time stamp mismatch post migration | Fix in progress | |
| SACE-11449 | Existing ESA Rule Builder rules that contain array fields won't deploy after upgrading to NW 11.3 | 11.3.1 | |
| SACE-11542 ASOC-80165 | Event type "Correlation" in the Event Analysis page cannot be retrieved | Fix in progress | |
| SACE-11561 | rsa-nw-esa-server was started after upgrade to 11.3 (causing issues with esa alerts) | 11.3.1 | |
| SACE-11668 ASOC-79640 | disabled rules Getting re-enabled after deploy and esa correlation service restart | 11.3.1 | |
| SACE-11755 | After upgrade from 10.6.6 > 11.3, jetty is unable to load or manage ESA deployments | 11.3.0 HF 11.3.1.0 may have the issue | |
| SACE-11768 | NW 11.3.0 - ESA alerts not triggering after fixing issues under SACE-11444 | Under Investigation | |
| SACE-11782 | Unable to edit Correlation-server data source attributes (pw/compression/ssl) without removing and readding datasource | 11.3.0 HF | |
| SACE-11856 | ESA UI should provide capability to manage Correlation-server->Stream->lowercase meta keys and use them in ESA Rules | 11.3.0.2 | |
| SACE-11938 | ESA Correlation Server in Unhealthy State | 11.3.0.2 11.3.2 | |
| SACE-11944 | ESA Rule Builder Description field getting syntax validation errors | 11.3.2 | |
| SACE-12039 | NW admin unhealthy "Partially Working" | Under Investigation | |
| SACE-11363 SACE11444 | ESA Rule deployment failing after updating to RSA NetWitness Logs & Network 11.3.x | Workaround available | https://community.rsa.com/docs/DOC-106460 |
| SACE-11827 | Exporting ESA rules from 11.3 UI does not allow you to reimport them back into 11.3.0 | 11.3.2 | |
| SACE-11699 | Customer getting "ESA Analytics Server in Unhealthy State" alerts yet again in 11.2.1.1 | 11.3.1.0 |
SMS
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11165 | Global Notification syslog messages displaying 'localhost' instead of server hostname | 11.4 |
Health & Wellness
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11474 | Customer is seeing high usage on Rabbitmq message broker filesystem alert in Health & Wellness at 62% | 11.4 | |
| SACE-11986 | Some H&W stats not available for one of two ESA devices | 11.4 |
Correlation Server
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-12021 | Correlation Server in Unhealthy State | 11.3.1.1 | |
| SACE-11955 | Correlation Server in Unhealthy State post-OS upgrade | 11.3.0.2 |
ESM
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11252 | ESM does not send notifications email on event source down. | 11.3.2 |
Respond
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-10843 | Incident creation: Rule Detail page polling local Windows box's time zone info instead of User Preferences in NetWitness settings | 11.3.1 | |
| ASOC-75674 | When you update to 11.3, Respond's primary host property (/rsa/primary/host) was set to false by default, which had an adverse effect on some of the critical functionality. This is now set as true. | 11.3.0.1 | |
| ASOC-52428 | Incidents are not flagged when a user manually adds the alerts to existing incidents in RSA Security Analytics 10.6.x and NetWitness 11.x. | Will not fix | https://community.rsa.com/docs/DOC-47378 |
| ASOC-73743 | Deleting an alert in Respond is not updating the High-Risk User List in Threat Aware Authentication. | 11.3.1 | |
| ASOC-72759 | Respond statistics reset after update. This is fixed for updates from 11.3 to 11.3.x, but is still an issue for updates from 11.2.x to 11.3.x. | 11.3.1 | |
| ASOC-60463 | Proper message is not displayed when Event Analysis is not loading in a mixed-mode environment. | 11.3.1 | |
| SACE-11907 | Respond Server Unhealthy - rsa.notification.back-pressure, status=Unhealthy | 11.3.0.2, 11.3.1.1 11.3.2 |
Investigation
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11301 | Extension, doc, is added to an xls file when extracting file from a session | 11.3.1 | |
| SACE-11661 | Nw 11.3 - Investigation: Unexpected Query Exception of type St9bad_alloc: std::bad_alloc | 11.3.1 | |
| ASOC-73894 | In Print Mode, raw meta key and descriptive names are missing. | 11.3.1 | |
| ASOC-73826 | In the Event Analysis view, the query console does not replace the information icon with an error icon when a service is offline. | 11.3.1 | |
| ASOC-73660 | Context Sensitive Help for Add Event to Incident and Create Incident dialogs does not open the correct topic. | 11.3.1 | |
| ASOC-73224 | When retrieval of events for a query is in progress in the Event Analysis view, events that are already displayed disappear if the query takes more than 5 minutes to finish. | 11.3.1 | |
| ASOC-60464 | The error message displayed when a download from the user interface times out needs clarification. | 11.3.1 | |
| SACE-11895 | Failed to retrieve meta keys | 11.3.0.2 | |
| SACE-11945 | Investigative Searches intermittently not working after upgrade from 11.2.1.1 to 11.3.1 | 11.3.1 HF 11.3.1.1 | |
| SACE-11951 | Customer upgrade issue 11.3.0.1. Failed to retrieve meta keys. Visualization cannot load. | 11.3.0.2 | |
| SACE-11164 | 11.2.1 - Investigation GUI Issue when loading values | 11.3.1 | |
| SACE-11862 | "Recent" queries do not show in Investigate > Navigate in RSA NetWitness version 11.3.0.1 | 11.3.1.1 | https://community.rsa.com/docs/DOC-106662 |
| SACE-11029 | Drilling into Query meta containing reserved/special characters results in inconsistent behavior in Navigate or Events view on 10.6.x & 11.x | 11.3 | |
| SACE-11752 | "Download File" button does not download files in investigation for external account | 11.3.2 | |
| SACE-11365 | Broker Timeline does not render if Concentrator is Offline | 11.3.2 | |
| SACE-11362 | SDK Values call from Navigate page interchanges User credentials while querying (Core Query Prefix) | 11.3.1.1 |
Endpoint
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11390 | Agent does not generate log meta when more than 23 EventID's are configured in the Agent config log filter. | 11.4 | |
| SACE-11413 ASOC-80227 | "Unsigned Reserved Name Rule" firing on signed module | Fix in progress | |
| ASOC-73120 ASOC-74872 | Issues with the Powershell console events in Windows 10 1809 have been fixed in 11.3.1. | 11.3.1 | |
| SACE-12077 | Registry Monitor may cause BSOD on 32bit agents | Under QE Testing | |
| ASOC-80796 | Agent does not send Windows events when more than 23 EventIDs are configured in log filter | 11.3.1.1 | Internal KB, 37812 |
Reporting Engine
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11534 ASOC-78847 | Charts are not deleted in 11.3.0.1 | 11.4 | |
| SACE-11873 | When multiple rules are merged into a single report and export to PDF, data is getting overlapped in PDF | 11.3.0.1 HF 11.3.1.1 | |
| SACE-11892 | SFTP output action does not work for one device for hunting | 11.3.1 HF | |
| SACE-11954 | NW - std::bad_alloc error in Reports after upgrading to 11.3.1.0 | 11.3.1 HF 11.3.1.1 | |
| SACE-11973 | Reports result in small font | 11.3.1.1 | |
| SACE-11324 | 11.2.1.0 - Can't open PDF generated Report | 11.3.1.1 | |
| SACE-11549 | Large Reports result in PDFs with overlapping and shrunken text | 11.3.0.1 HF | |
| SACE-11974 | (11.3.0.1): Reports result in small font | 11.3.1.1 | |
| SACE-11897 | Reports on Alerts/Incidents from ESA alerts not generating | 11.3.1 HF |
Licensing
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11947 | Post upgrade 11.3 Licensing blank ; flexnetls using non-management interface MAC as selected hostid | 11.3.0.0 HF | |
| SACE-11999 | UEBA license usage keeps exceeding compliance threshold | 11.3.0.1 HF | |
| SACE-11356 | Licensed Services turned to Trial License after RSA NetWitness Logs & Network 11.3 upgrade | 11.4 Workaround Available | https://community.rsa.com/docs/DOC-106062 |
| SACE-11735 | Licensing on the Log Decoder not being applied | 11.3 | |
| SACE-12053 | Licenses show no expiry date and OOB expired license notification went off after HW refresh | 11.3 |
Content
| Issue ID | Issue Title | Fix version or Status | Related article |
| SACE-11361 | STIX Version 1.2 xml not showing some of the Observables in the custom feed. | 11.3.1 HF | |
| SACE-11272 | Some STIX fields are not there when converted to CSV | 11.3.1 HF | |
| SACE-11658 | Snort rule not generating metadata | Under Investigation |
Tags (64)
- 11.3
- 11.3.x
- 11.x
- Appliance
- Archiver
- Archiver Appliance
- Break Fix
- Break Fix Issue
- Broken
- Broker
- Broker Appliance
- Concentrator
- Concentrator Appliance
- Core Appliance
- Customer Support Article
- Decoder
- Decoder Appliance
- Decoder Service
- Investigate
- Investigation
- Investigation Module
- Issue
- Issues
- KB Article
- Knowledge Article
- Knowledge Base
- Log Archiver
- Log Collection
- Log Collector
- Log Decoder
- Log Storage
- Navigate
- NetWitness
- NetWitness Appliance
- NetWitness Broker
- NetWitness CConcentrator
- NetWitness Platform
- NetWitness UI
- NW
- NW Appliance
- NwArchiver
- NwBroker
- NwConcentrator
- NwDecoder
- NwLogCollector
- NwLogDecoder
- Packet Capture
- Packet Decoder
- Problem
- RSA NetWitness
- RSA NetWitness Platform
- RSA NetWitness UI
- RSA Security Analytics
- RSA Security Analytics UI
- Security Analytics
- Security Analytics UI
- SIEM
- UI
- User Interface
- Version 11
- Version 11.3
- Version 11.3.x
- Version 11.x
- Web Interface
No ratings
