This section lists issues fixed since the last major release.
|ASOC-79110||After you upgrade to 11.3.1, the default CEF and Human readable format, audit templates are not updated.|
|ASOC-82880||Registry Monitor may cause Blue Screen Error on 32-bit agents.|
|ASOC-82891||In the policy, the Windows Log Setting, Send Test Log is not working.|
Core Services (Broker, Concentrator, Decoder, Archiver)
|SACE-12285||Log Decoder is not receiving data over UDP.|
The Physical Drives and Logical Drives for all core appliances is missing in the Service Stats view.
|SACE-11752||Unable to download file for external account from the Event Analysis view.|
|SACE-11365||When a Broker is connected to any offline Concentrator, the timeline will not render results in the Investigation.|
“Score” custom meta key is not displaying correct results.
|SACE-12189||After upgrade, unable to export all the existing application rules from the Decoder due to huge size.|
Event Stream Analysis
|SACE-11827||When you export ESA rules from the NetWitness Platform UI, you are unable to import due to the Endpoint bundle file in it.|
|SACE-11857||If you have an ESA rule in more than one ESA rule deployment and that rule has notifications, if you delete the rule from one deployment, then the notifications in the other deployments break and you have to redeploy the other deployments.|
|SACE-12089||When redeploying ESA rules, aggregation would sometimes resume from data sources at the wrong position in time.|
|SACE-12182||Adjusted the timestamp format in notifications to match previous NetWitness Platform versions for compatibility.|
If a Concentrator is added to the available data sources for ESA rule deployments and then the host is removed from the NetWitness server, you can still see that host in the available data sources list.