Issue:
Customers are reporting difficulty upgrading on prem UEBA from version 11.7.1 to 12.1. Specifically, we are seeing the upgraded UEBA DAGs being unable to process events. We believe that customers upgrading from 11.x to 12.1.0.0 or 12.1.1.0 will experience the same issue.
Remediation Actions:
Engineering has identified the cause and has developed the resolution. Hotfixes have been issued for v12.1 and v12.1.1. The fix will be merged into the next NetWitness XDR Platform release (v12.2) such that v11.x customers who upgrade to v12.2 should not experience the issue.
Customer Guidance:
UEBA customers should apply the hotfix 12.1.0.0 HF or 12.1.1.0 HF after upgrading to 12.1.0.0 or 12.1.1.0.
Customers beginning an 11.x to 12.1.x upgrade should contact Customer Support to obtain the hotfix.
