000038401 - Investigate > Users page data does not load in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Feb 11, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038401
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Investigate, UEBA
RSA Version/Condition: 11.x
Platform: CentOS 7
IssueWhen going to Investigate -> Users, the UEBA data does not load, i.e: the status wheel spins indefinitely:

User-added image
CauseThe issue is likely due to the NetWitness Server (UI Server) not being able to reach the UEBA Server on TCP port 443.
ResolutionFrom the NetWitness Server (UI Server) appliance, check if it can reach the UEBA Server on TCP port 443:

curl --connect-timeout 5 -vk <IP address of UEBA Server>:443

Replace <IP address of UEBA Server> above accordingly.

If the curl command times out, on the UEBA Server appliance, ensure that:

  1.  nginx is running:

    systemctl status nginx

    If it is not running for some reason, start it:

    systemctl start nginx

  2. The firewall (if any) between the NetWitness Server (UI Server) and the UEBA Server has been configured to allow bi-directional communication for port TCP/443, especially if the 2 hosts are in different subnets.
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.