Troubleshooting NetWitness EndpointTroubleshooting NetWitness Endpoint
This section provides information about possible issues when using NetWitness Endpoint.
General IssuesGeneral Issues
Issue |
Some of the hosts or files data are not displayed when Endpoint Broker is selected for querying. |
Solution |
The Endpoint Broker aggregates data from all Endpoint Servers, which responds within 10 seconds. You must increase the query timeout value to see the result of Endpoint server that is online. Perform the following:
|
Issue |
The Endpoint Agent is unable to communicate with the Endpoint Server. The connection may not be established due to any of the following issues:
|
Solution |
|
Issue |
The Endpoint Agent is unable to communicate with the Log Decoder. The connection may not be established due to any of the following issues:
|
Solution |
|
Multi-server IssueMulti-server Issue
Issue |
Agent is not communicating with the Endpoint Server after migration. |
Solution |
Check the Nginx logs of the Endpoint Server to which the agent has migrated, and if the agent is communicating with error code 403, that means the certificate of the first Endpoint Server and second Endpoint Server are different. This is because during the installation of second Endpoint Server, the certificate of first Endpoint Server is not copied to the second Endpoint Server. Reinstall the second Endpoint Server by copying the certificate of first Endpoint Server, and reinstall the agent. For more information, see the Physical Host Installation Guide. |
Hosts View IssuesHosts View Issues
Message | An error has occurred. The Endpoint Server may be offline or inaccessible. |
Issue | When attempting to access the Hosts or Files view, the view opens with the message. |
Explanation |
Endpoint Server or Nginx Server is not running. Check the status of the Endpoint Server under |
Issue |
Hosts view shows 'No Results Found.' error in the following scenario:
|
Explanation |
This is expected behavior. The Endpoint server that is selected first is considered to be current /active throughout the session. |
Workaround |
Ensure the correct Endpoint server is selected, and Pivot to Investigate > Hosts/Files will behave normally. |
Issue |
For MFT download:
|
Solution | Make sure that the agent version is 11.6 or later. |
Files View IssuesFiles View Issues
Issue | Unable to analyze events from Hosts and Files view. |
Explanation |
Other than Broker or Concentrator, if any aggregation service, such as Archiver, is aggregating data from the Log Decoder that is configured for metadata forwarding from any Endpoint server, clicking Analyze Events from Hosts and Files view for this Endpoint server may not work. To resolve this issue: Note: To get the investigate-service-id:
|
Policy IssuePolicy Issue
Issue | Policy status in the Policy Details panel is not updated or shows Policy Unavailable/Permission Required. |
Explanation |
Policy Unavailable - Hosts belong to previous versions, such as NetWitness Platform 11.1 or 11.2, where a policy is not applied. Permission Required - If you do not have permissions, see the "Role Permissions" topic in the System Security and User Management Guide. |
Issue | Policy Status shows error. |
Explanation |
Policy may have wrong configurations. Check the error description, logs in Endpoint server, and audit logs for details. Contact your system administrator with the error details. |
Driver IssueDriver Issue
Issue | While loading the driver on the host, an error is encountered. |
Explanation |
Check the driver error code in the Agent-Driver Error Code column under Hosts view. Contact your system administrator with the error code. |
Download IssueDownload Issue
Issue |
Downloads (Files, MFT, System/Process dumps, etc.) fail at times. |
Explanation |
Downloads fail when there is not sufficient disk space on the Endpoint Server. |
Workaround |
Clean up some disk space and try downloading again. We recommend you keep sufficient disk space before initiating any download. |
File Reputation Service IssueFile Reputation Service Issue
Issue | When you configure RSA Live for the first time and the File Reputation service is not connected. |
Solution |
You must manually enable the File Reputation service. To enable the File Reputation service:
|
Risk Scoring for Hosts or Files IssueRisk Scoring for Hosts or Files Issue
Issue | NetWitness Endpoint takes a long time to process risk scoring for Hosts or Files. |
Solution |
Check the backlog of alerts for risk scoring.
|
Endpoint Broker/Server IssueEndpoint Broker/Server Issue
Issue | User have access to one Endpoint server and unable to access the other. |
Explanation |
Reach out to the administrator and check if you have access to that endpoint servers. Request for access if required. |
Issue | In the Endpoint Server Broker view, the user can scan hosts that belong to a particular Endpoint server but cannot scan hosts that belong to another Endpoint server. |
Explanation |
User may not have access to that endpoint server. Check with the Administrator to see if the user has access. |