This section lists issues fixed after the last major release. For additional information on fixed issues, see the Fixed Version column in the RSA NetWitness Platform Known Issues list on RSA Link:
|In NetWitness Platform 126.96.36.199, Single Sign-On does not work even after implementing it.|
|NwLogPlayer time stamp converted into milliseconds for LogDecoder processing.|
|PAM is not enabled, but the PAM displays a warning message.|
Core Services (Broker, Concentrator, Decoder, Archiver) Fixes
|Unable to query on the content of the emails in the network (packets) data.|
|The Broker service is not able to retrieve the meta keys and the user interface hangs when a query is run.|
Issue with deployment of Non-IP feeds with IPv6 values (non CIDR) on Decoders or Log Decoders. The first entry on the feed fails to load.
|Issue with logging UUID's or obsolete IP addresses in core services system log files.|
Log Decoder Fixes
|In the Investigate > Explore view, the capture.appfilter.bytes parameters does not display the correct count.|
Index customizations for Retention Log Hybrid service not reflecting on updating entities from Index definition files on Decoder.
Log Decoder service crashes if changes are done to the log forwarding configuration fields logs.forwarding.enabled and logs.forwarding.destination.
|ASOC-95972||Log Decoder service crashes if changes are done to the log forwarding configuration fields logs.forwarding.enabled and logs.forwarding.destination.|
Log Collection Fixes
|SACE-13403||The bookmarking file failed to update the correct bookmark time as the NwVmwareCollector PERL script execution failed because of linefeeds and exception (starttime and userName field) errors.|
|Unable to export the PCAP files from the ADMIN > System > Jobs panel.|
|ASOC-100133||Filter Events Panel Shows Unexpected Results for Query Containing an Unwrapped OR.|
Permissions to manage meta groups and column groups in Investigate do not apply in Investigate.
Event Stream Analysis (ESA) Fixes
|SACE-12773||While creating a Rule with subquery using is OneOfIgnoreCase/isNotOneOfIgnoreCase functions for array comparison with context hub list, the functions OneOfIgnoreCase/isNotOneOfIgnoreCase are not called by Esper.|
|ASOC-101423||Position tracking does not get migrated for data sources with a deployment name that contains @ or _ characters at the end of the deployment name.|
When multiple users make changes (adding or removing rules) to ESA Deployment groups, the user who clicks "deploy" first will overwrite the changes of other users.
|ASOC-103097||After upgrading to version 11.5, the ESA correlation server does not aggregate events from the configured data sources.|
Health and Wellness Fixes
|SACE-13666||The Historical Graph does not show the graph, instead it shows only the tooltip when checking for data other than current day.|
|The MD5SUM hash value and the file in spectrum/repository/files directory does not match.|
Context Hub Fixes
|RSA NetWitness Platform Admin server is not stable because the RabbitMQ service is overloaded.|
|ASOC-102780||The User Profile view displays data for inactive users.|
|ASOC-101686||When performing a rerun, UEBA deployments with the TLS schema will not trigger alerts for two weeks.|
After upgrading UEBA from 11.3 to 11.5, the saved filters in the UI do not work.
|ASOC-100310||After upgrade from 11.2 or 11.3 to 11.5, adapter logs are not written.|