Troubleshoot Archer Integration

This section provides resolutions to common problems that you may encounter while configuring Archer Cyber Incident & Breach Response with NetWitness Respond.

Problem Solutions

After adding the endpoint for NetWitness Respond, the Certificate Authority truststore fails to set.


  1. Make sure that the SSH credentials for the NetWitness host are valid.
  2. If the credentials are correct, but the error still occurs, manually copy certificates.
Remediation Tasks being pushed to the operations queue through the UCF are not appearing in Archer Cyber Incident & Breach Response as Findings.
  1. Open the Connection Manager using the command prompt:
    • Change directories to <install_dir>\SA IM integration service\data-collector.
    • Type: runConnectionManager.bat
  1. Enter 2 to edit endpoint.
  2. Enter 3 to NetWitness Respond.
  3. Make sure the Target Queue is set to All or Operations.
In the <install_dir>\SA IM integration service\logs\collector.log, there are SSL errors between NetWitness and RSA Unified Collector Framework.
  1. Verify that the SSL certificates are valid.
  2. NetWitness Respond certificates are valid for two years.

  3. If your certificates are expired, regenerate and copy the expired certificates.
  4. To regenerate and copy the certificates:

    1. In the Command Prompt, go to <install_dir>\SA IM integration service\data-collector.
    2. Enter runConnectionManager.bat
    3. Enter the number for Regenerate NetWitness RespondIntegration Service Certificate.

    4. In the NetWitness Respond endpoint, in Connection Manager, enter the number for Edit Endpoint.
    5. Enter Yes to copy the certificates automatically to the NetWitness trust store.

    If certificates fail to copy, manually copy the certificates.

NetWitness unable to forward incidents to UCF.
  1. In the collector config (C:\PROGRAM FILES\RSA\SA IM INTEGRATION SERVICE\CONFIG\collector-config), change the following:
  2. Restart UCF. For more information on restarting UCF, see Start the Unified Collector Framework.
  3. In the data collector (C:\PROGRAM FILES\RSA\SA IM INTEGRATION SERVICE\data-collector), double click on the following file to run it.