Article Number
000039697
Applies To
RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.4, 11.5
Platform: CentOS 7
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.4, 11.5
Platform: CentOS 7
Issue
User exported all ESA rules before RMA(or reimage) NetWitness Admin node.
After import, the ESA rules, 'Syntax error in module. null' error occurred with only ESA LIVE rules.
Image description
After import, the ESA rules, 'Syntax error in module. null' error occurred with only ESA LIVE rules.
Image descriptionResolution
RSA NetWitness doesn't support importing ESA LIVE rules.
ESA LIVE rules should be deployed again from RSA LIVE.
ESA LIVE rules should be deployed again from RSA LIVE.
In this article
