This section lists issues fixed after the last major release. For additional information on fixed issues, see the Fixed Version column in the NetWitness® Platform Known Issues list ( on NetWitness Community Portal

SMS Fixes

Tracking Number Description

After upgrading or installing 11.6, 11.6.1 and 11.7 versions, the logs are not written to sms.log and instead written to wrapper.log. This is because multiple libraries were updated in these versions. In 12.1.1 version, the logs are written to sms.log file.

Endpoint Fixes

Tracking Number Description

Process Tree is not displayed in the Respond Service for high and critical Endpoint alerts (Host> Event Details > View alert Details). This issue occurs when the session ID of the event exceeds the integer limit of 32 bits. As a result, you cannot investigate the events.

ASOC-125221 The Cancel and Reset options in the Reset Risk Score window (Files > select a file > More Actions > Reset Risk Score) cannot be accessed. As a result, you can neither cancel the Risk score reset operation nor you can reset the Risk score of the selected file.

CCM Fixes

Tracking Number Description

Automatic rule name assignment for clone rule is getting wrong value after filtering. When you clone a rule after filtering, the rule name is assigned according to the filtered list. Hence, the error occurs while validating the rule name. In 12.1.1 version, the rule name is assigned according to the content present in the Content Library.

ASOC-125838 Alert meta are not populating while editing Application or Network Rules for the first time. But, the alert meta are populating after creating a rule. The issue occurs as the API was being called only for creating the rule. In 12.1.1 version, API is called for both creating and editing the rule.


Explicit message is not displayed on deletion of content when the first policy is published to a service. In 12.1.1 version, the warning message is displayed to the user.

ASOC-125808 No proper visual notification in the Live content UI regarding the services managed by CCM. In 12.1.1 version, there is a notification banner added in the Live page, Subscription page and Content Deployment wizard with a CCM link. The link will redirect the user to CCM page.


The user cannot remove or toggle off Log Decoder from central policy. THe issue occurs due to the settings in the NTP server and Global audit log server. In 12.1.1 version, the user is able to remove or toggle off Log Decoder with the settings.

ASOC-125321 When the user filters the policy using Unpublished filter and then publishes the policy and removes the Unpublished filter, the policy status changes to In-progress state. The issue occurs due to state calculation. In 12.1.1 version, the state calculation is done even after filtering the policy. Hence, the issue is fixed.


Error while importing zip file in Log Devices. The issue occurs due to zip file structure. In 12.1.1 version, the user is able to import or deploy all content without any issues.

ASOC-125735 Importing content with same zip file name does not display correct error message. The issue occurs when the recent file name does not get validated if the file names are same and importing happens in the same session. In 12.1.1 version, correct number of error messages are displayed for any Log Device .zip file with duplicate contents since the recent file is also validated even if the names are same.

Source-server cannot load up the basic meta information when it is unable to connect to Live. The issue occurs when the source-server cannot connect to Live CMS, event though the Live is configured. As a result, the source-server cannot fetch the content-related information such as resource types and mediums on the first start up and the user cannot view the Content Library and the migrated policy details information. From 12.1.1 onwards, the user can download or deploy content from CCM when:

  • HTTP proxy configured with SSL disabled, Localhost DNS disabled

  • HTTP proxy configured with SSL disabled, Localhost DNS enabled

  • HTTP proxy configured with SSL enabled, localhost DNS disabled

  • HTTP proxy configured with SSL enabled, Localhost DNS enabled

  • HTTP proxy not configured, Localhost DNS enabled

ASOC-124429 In Content Library, custom content tag is not visible in light theme. This issue occurs due to light theme color issue. In 12.1.1 version, the light theme color is changed to make the custom content visible in light theme.


Content deployment fails for all the Live contents from Legacy Live content UI and CCM. In 12.1.1 version, a KB article is created and published which provides detailed steps on the resolution. For details on the KB article, click here.

ASOC-124402 The user is able to upload duplicate Log Device contents in the zip file without selecting the Overwrite option. The issue occurs since the duplicate content is not validated inside zip. In 12.1.1 version, the duplicate content inside zip is validated before it is uploaded.