RSA Security Analytics 10.6.0.0 Known Issues Master List

[#1]

Article Number

000032703

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: Core Appliance, Event Stream Analysis (ESA), Malware Analysis, Warehouse (SAW), Archiver, Security Analytics Server, Security Analytics UI
RSA Version/Condition: 10.6.0.0
Platform: CentOS
O/S Version: EL6

Issue

Below is a list of known issues in RSA Security Analytics 10.6, including those listed in the Release Notes.  
Please click on the links to go directly to the articles.

Installation and Upgrade

Article Number	Article Title	Tracking Number
32712	Updating RSA Security Analytics from 10.4.1 to 10.5.2 or 10.6.x may fail	ASOC-13369
32709	FIPS is disabled after upgrading RSA Security Analytics from 10.4.x to 10.5.x or 10.6.x	ASOC-13748
32837	The RSA Security Analytics UI does not update python-backports-ssl_match_hostname.noarch	ASOC-9062
32777	Malware Service is not up when deployed using fresh install ISO for RSA Security Analytics 10.6	ASOC-15732
33044	Aggregation does not start if Correlation Rules are written in deprecated syntax after upgrading to RSA Security Analytics 10.6	ASOC-15695
32753	Upgrading to RSA Security Analytics 10.6 may take a long time to complete when utilizing SMCUpdate	N/A

General Application Issues

Article Number	Article Title	Tracking Number
30481	"This page can't be displayed" error when attempting to login into the RSA Security Analytics UI with Internet Explorer 10	ASOC-9225

General Platform Issues

Article Number	Article Title	Tracking Number
30363	No cancel option is available for Warehouse Analytics jobs in RSA Security Analytics	SAENG-4706, SAENG-5755

Entitlements and Licensing

Article Number	Article Title	Tracking Number
30511	Metered license does not flip back to in compliance immediately when there are no services attached to that Metered license in Security Analytics	ASOC-9078
30832	Aggregate usage report is generated incorrectly in RSA Security Analytics 10.5.0.1 and above	ASOC-10079
30833	Incorrect statistics shown when a service is moved between license types in RSA Security Analytics 10.5.0.1 and above	ASOC-10685

Security Analytics Log Collection

Article Number	Article Title	Tracking Number
30374	Repeated errors are seen when a domain name is not resolvable from a Windows Legacy Collector server in RSA Security Analytics	SAENG-2476
30517	The Data Privacy Officer role is missing on Log Collectors in RSA Security Analytics	ASOC-7937
30519	Checkpoint collection not working and reports the error "peer ended the session" in RSA Security Analytics	ASOC-8351
30520	Inaccurate message generated for AWS collection error in RSA Security Analytics	ASOC-9586
32747	Throttling Remote Collector to Local Collector bandwidth is not persistent after rebooting in RSA Security Analytics 10.6	ASOC-16717

Security Analytics Investigations

Article Number	Article Title	Tracking Number
30549	Event reconstruction View Email option with Top to Bottom view doesn't show response information.	ASOC-5690
30550	Extracting PCAP can fill up the Scheduler folder and cause the Security Analytics server to shutdown	ASOC-6874
30551	Drill down to Investigation view from Report results in error when meta value contains quotes at the end	ASOC-7053
30552	Next button is not disabled for the last event in the Event Reconstruction view in RSA Security Analytics	ASOC-7577
30553	Meta keys fail to update correctly when navigating between multiple profiles in RSA Security Analytics	ASOC-7743, SACE-2881
30497	Parallel Coordinate visualization is not displaying special characters correctly on Security Analytics	ASOC-9346
33045	Context lookup on list values shows the same list twice in the lookup panel after upgrading to RSA Security Analytics 10.6	ASOC-16573
33046	CPU utilization greatly increases when Context Lookup is performed with lists having more than 5K values in RSA Security Analytics 10.6	ASOC-16460
32748	Incidents are not flagged when a user manually adds the alerts to existing incidents in RSA Security Analytics 10.6	ASOC-16640

Security Analytics Workbench

Article Number	Article Title	Tracking Number
30504	Empty collection is created if restoration fails because workbench service is stopped or restarted on RSA Security Analytics	ASOC-6859
30506	Collections created on a 10.4 Workbench do not appear in the RSA Security Analytics UI when running version 10.5.x or above	ASOC-8368
30507	All restoration collections created at version 10.4.x will have blank date values after upgrading to RSA Security Analytics 10.5 or above	ASOC-9035, ASOC-9087
30508	The Date Range is not displayed for collections if services are restarted while a restoration is in progress in RSA Security Analytics	ASOC-6822

Security Analytics Malware Analysis

Article Number	Article Title	Tracking Number
16980	Unable to perform Malware Analysis On-Demand scans using trusted connections in RSA Security Analytics 10.4.x and above	SAENG-5485
30500	Users with the Analyst role are not able to run the on-demand malware scan in RSA Security Analytics	ASOC-5425
30501	The View Network Session option is disabled for Malware Analysis events if the core device is not configured correctly in RSA Security Analytics	ASOC-5571
30502	Malware Analysis Summary of Events doesn't load all the dashlets unless user refreshes the page again in RSA Security Analytics	ASOC-5959
32750	Upload Scan Job does not get submitted to Colo Malware if standalone Malware is also present in RSA Security Analytics environment	ASOC-9821
33047	Attempting to enable or disable all Indicators of Compromise (IOC) is not functioning properly in RSA Security Analytics 10.6	ASOC-13857

Security Analytics Incident Management

Article Number	Article Title	Tracking Number
30375	After configuring MongoDB for Incident Management in RSA Security Analytics 10.4.x and above the rsa-im service must be restarted manually	SAIM-355, ASOC-9411
32758	The Java version resets to 1.7 when upgrading to RSA Security Analytics 10.6	ASOC-12411
32740	View Original Event returns stack trace when no concentrator is available in RSA Security Analytics 10.6	ASOC-14266
33049	Out-of-the-box Aggregation Rules in Incident Management are duplicated after upgrading to RSA Security Analytics 10.6	ASOC-15031

Security Analytics Event Stream Analysis (ESA)

Article Number	Article Title	Tracking Number
30359	Synchronization / Deployment fails for the ESA rule “No Log Traffic detected from device in given time frame” deployed from Live in RSA Security Analytics	SAENG-5888
30360	Case-sensitive sorting is not working properly in the ESA All Rules grid in RSA Security Analytics	SAENG-3605
30554	ESA rule deployment fails if the server that hosts an external database goes down in RSA Security Analytics	ASOC-9011
31334	ESA Alerts Summary page is blank or displays "Error getting data" in the RSA Security Analytics UI	ASOC-9016, ASOC-9026
32752	Forwarding rule name is not updated when the advanced rule name changes in RSA Security Analytics	ASOC-9585
32746	Rules containing a group-by statement with a multi-valued meta fail in RSA Security Analytics 10.6	ASOC-15802
32775	RSA Security Analytics ESA rule is not triggering an alert for updated content of in-memory enrichment used in rule	ASOC-16396
32743	WhoIsHTTPSProxy setting is not saved if incorrect syntax is used in RSA Security Analytics 10.6	ASOC-16494
32786	Deployed Rule Memory Utilization shows 0 in Health and Wellness when Capture Time Ordering is enabled in RSA Security Analytics	ASOC-16613

Security Analytics Reporting Engine

Article Number	Article Title	Tracking Number
30386	Live deployment of Reporting Engine rules and reports fail due to missing dependencies in RSA Security Analytics	SAENG-1334
30390	Reporting Engine may become blocked in RSA Security Analytics when RabbitMQ connections have a blocked state	SAENG-5329
30564	Updates to connection parameters on the Service page do not reflect on the Reporting Data sources in RSA Security Analytics	ASOC-8149
30569	Cannot Navigate to Investigation from the NWDB reports if the connection parameters on the Service page are updated in RSA Security Analytics	ASOC-8575
30388	Internet Explorer 10 is unable to display the result for a Test Rule that is clicked on more than once in RSA Security Analytics	SAENG-3926
30389	Adding a dynamic list while editing a report schedule from the View All Schedules page does not work in RSA Security Analytics	SAENG-5837
33050	"Error occurred while fetching data from source" is displayed when running rules with empty lists in RSA Security Analytics	ASOC-16271

Security Analytics Administration and Auditing

Article Number	Article Title	Tracking Number
30546	Icons may appear cluttered when navigating from the Core Services Config to the Stats tab in RSA Security Analytics	ASOC-8803
30576	Configuration audit events captured by RSA Security Analytics lack the context of which service was changed	ASOC-8889
30577	Excessive audit logs are generated when accessing the UI pages for importing/exporting/login/logout in RSA Security Analytics	ASOC-8916
30565	The RSA Security Analytics Server is not capturing the value for queryString in the audit logs	ASOC-8994
30571	Password expiration email notification does not provide source information in RSA Security Analytics	ASOC-9187
30575	Audit logs are not reporting pages accessed where users do not have permissions in RSA Security Analytics	ASOC-9323
31282	Labels do not display correctly when PKI is enabled for the first time in the RSA Security Analytics UI	ASOC-12619
32751	RSA Security Analytics does not honor the CRL expiry date (Next Update on) and then fails to invalidate the CRL	ASOC-12992

Security Analytics Event Source Monitoring (ESM)

Article Number	Article Title	Tracking Number
30589	Renaming the Log Collector or Log Decoder hostname is not reflected on the Event Sources Manage page in RSA Security Analytics	ASOC-9235
32745	ESM Automatic Alarms do not work on All-in-One (AIO) appliances running RSA Security Analytics 10.6	ASOC-16588

Security Analytics Core Services

Article Number	Article Title	Tracking Number
30831	Incorrect syntax in core appliance custom index file causes initialization errors in RSA Security Analytics 10.5.0.1 and above	ASOC-4195
30582	Broker role permissions do not show custom meta keys defined in concentrator during Data Privacy setup in RSA Security Analytics	ASOC-6749

Notes

This article was last modified on May 4, 2016.