Summary:
RSA has found an issue in the RSA NetWitness Endpoint 4.3 Windows Agent, which can cause agents to send superfluous tracking events. A hot fix is currently available to address this issue and the fix will also be implemented in RSA NetWitness Endpoint 4.3.0.4.
Affected Products:
RSA NetWitness Endpoint 4.3.0.2 and 4.3.0.3, on all supported Windows versions.
Impact:
There is no impact on the business operations as this error is invisible to the end user. However, the analyst will see erroneous reports of files having been blocked and deleted, when viewing an agent’s tracking data. These events will eventually be deleted automatically after the event retention period has expired. This issue does not impact detection.
Recommendations:
Please contact the Customer Support team to receive the hotfix installation instructions for versions 4.3.0.2 and 4.3.0.3.
For additional documentation, downloads, and more, visit theRSA NetWitness Endpoint page on RSA Link..
EOPS Policy:
RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.
