000032702 - RSA Security Analytics 10.5.2 Known Issues Master List

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000032702
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Core Appliance, Event Stream Analysis (ESA), Malware Analysis, Warehouse (SAW), Archiver, Security Analytics Server, Security Analytics UI
RSA Version/Condition: 10.5.2.0
Platform: CentOS
O/S Version: EL6
IssueBelow is a list of known issues in RSA Security Analytics 10.5.2.0, including those listed in the Release Notes.  
Please click on the links to go directly to the articles.
Installation and Upgrade
Article NumberArticle TitleTracking Number
30380Duplicate services with a localhost address are present in RSA Security Analytics 10.4.x or aboveSAENG-5240
30352Secondary RSA Security Analytics UI reports upgraded appliances as "Reboot Required" or "Upgrade to 10.4"SAENG-5730
30381RBAC fails if the role names do not match or contain spaces after upgrading to RSA Security Analytics 10.4.x or aboveSAENG-5878
32712Updating RSA Security Analytics from 10.4.1 to 10.5.2 or 10.6.x may failASOC-13369
32709FIPS is disabled after upgrading RSA Security Analytics from 10.4.x to 10.5.x or 10.6.xASOC-13748
32837The RSA Security Analytics UI does not update python-backports-ssl_match_hostname.noarchASOC-9062

General Application Issues
Article NumberArticle TitleTracking Number
30481"This page can't be displayed" error when attempting to login into the RSA Security Analytics UI with Internet Explorer 10ASOC-9225
32707Some pages do not load properly when accessing RSA Security Analytics using Internet Explorer 10ASOC-11521

General Platform Issues
Article NumberArticle TitleTracking Number
30363No cancel option is available for Warehouse Analytics jobs in RSA Security AnalyticsSAENG-4706, SAENG-5755

Entitlements and Licensing
Article NumberArticle TitleTracking Number
30511Metered license does not flip back to in compliance immediately when there are no services attached to that Metered license in Security AnalyticsASOC-9078
30832Aggregate usage report is generated incorrectly in RSA Security Analytics 10.5.0.1 and aboveASOC-10079
30833Incorrect statistics shown when a service is moved between license types in RSA Security Analytics 10.5.0.1 and aboveASOC-10685

Security Analytics Log Collection
Article NumberArticle TitleTracking Number
30374Repeated errors are seen when a domain name is not resolvable from a Windows Legacy Collector server in RSA Security AnalyticsSAENG-2476
30517The Data Privacy Officer role is missing on Log Collectors in RSA Security AnalyticsASOC-7937
30519Checkpoint collection not working and reports the error "peer ended the session" in RSA Security AnalyticsASOC-8351
30520Inaccurate message generated for AWS collection error in RSA Security AnalyticsASOC-9586

Security Analytics Investigations
Article NumberArticle TitleTracking Number
30549Event reconstruction View Email option with Top to Bottom view doesn't show response information.ASOC-5690
30550Extracting PCAP can fill up the Scheduler folder and cause the Security Analytics server to shutdownASOC-6874
30551Drill down to Investigation view from Report results in error when meta value contains quotes at the endASOC-7053
30552Next button is not disabled for the last event in the Event Reconstruction view in RSA Security AnalyticsASOC-7577
30497Parallel Coordinate visualization is not displaying special characters correctly on Security AnalyticsASOC-9346

Security Analytics Workbench
Article NumberArticle TitleTracking Number
30504Empty collection is created if restoration fails because workbench service is stopped or restarted on RSA Security AnalyticsASOC-6859
30506Collections created on a 10.4 Workbench do not appear in the RSA Security Analytics UI when running version 10.5.x or aboveASOC-8368
30507All restoration collections created at version 10.4.x will have blank date values after upgrading to RSA Security Analytics 10.5 or aboveASOC-9035, ASOC-9087
30508The Date Range is not displayed for collections if services are restarted while a restoration is in progress in RSA Security AnalyticsASOC-6822

Security Analytics Malware Analysis
Article NumberArticle TitleTracking Number
16980Unable to perform Malware Analysis On-Demand scans using trusted connections in RSA Security Analytics 10.4.x and aboveSAENG-5485
30500Users with the Analyst role are not able to run the on-demand malware scan in RSA Security AnalyticsASOC-5425
30501The View Network Session option is disabled for Malware Analysis events if the core device is not configured correctly in RSA Security AnalyticsASOC-5571
30502Malware Analysis Summary of Events doesn't load all the dashlets unless user refreshes the page again in RSA Security AnalyticsASOC-5959
30820Standalone Malware Analysis virtual machines may take a longer amount of time to complete startup after enabling FIPS in RSA Security Analytics 10.5ASOC-10478

Security Analytics Incident Management
Article NumberArticle TitleTracking Number
30375After configuring MongoDB for Incident Management in RSA Security Analytics 10.4.x and above the rsa-im service must be restarted manuallySAIM-355, ASOC-9411
30485Manually created Incidents cannot be sent to Archer when the incident summary field is blank in RSA Security Analytics 10.5ASOC-7263
32723Incident Management becomes unresponsive while loading large number of alerts in RSA Security AnalyticsASOC-16900

Security Analytics Event Stream Analysis (ESA)
Article NumberArticle TitleTracking Number
30359Synchronization / Deployment fails for the ESA rule “No Log Traffic detected from device in given time frame” deployed from Live in RSA Security AnalyticsSAENG-5888
30360Case-sensitive sorting is not working properly in the ESA All Rules grid in RSA Security AnalyticsSAENG-3605
30554ESA rule deployment fails if the server that hosts an external database goes down in RSA Security AnalyticsASOC-9011
31334ESA Alerts Summary page is blank or displays "Error getting data" in the RSA Security Analytics UIASOC-9016, ASOC-9026
32752Forwarding rule name is not updated when the advanced rule name changes in RSA Security AnalyticsASOC-9585
32775RSA Security Analytics ESA rule is not triggering an alert for updated content of in-memory enrichment used in ruleASOC-16396

Security Analytics Reporting Engine
Article NumberArticle TitleTracking Number
30386Live deployment of Reporting Engine rules and reports fail due to missing dependencies in RSA Security AnalyticsSAENG-1334
30390Reporting Engine may become blocked in RSA Security Analytics when RabbitMQ connections have a blocked stateSAENG-5329
30561Some rule executions against SA Core/NWDB data sources can fail in RSA Security Analytics 10.5ASOC-7647
30564Updates to connection parameters on the Service page do not reflect on the Reporting Data sources in RSA Security AnalyticsASOC-8149
30569Cannot Navigate to Investigation from the NWDB reports if the connection parameters on the Service page are updated in RSA Security AnalyticsASOC-8575
30388Internet Explorer 10 is unable to display the result for a Test Rule that is clicked on more than once in RSA Security AnalyticsSAENG-3926
30389Adding a dynamic list while editing a report schedule from the View All Schedules page does not work in RSA Security AnalyticsSAENG-5837

Security Analytics Administration and Auditing
Article NumberArticle TitleTracking Number
30546Icons may appear cluttered when navigating from the Core Services Config to the Stats tab in RSA Security AnalyticsASOC-8803
30576Configuration audit events captured by RSA Security Analytics lack the context of which service was changedASOC-8889
30577Excessive audit logs are generated when accessing the UI pages for importing/exporting/login/logout in RSA Security AnalyticsASOC-8916
30565The RSA Security Analytics Server is not capturing the value for queryString in the audit logsASOC-8994
30571Password expiration email notification does not provide source information in RSA Security AnalyticsASOC-9187
30575Audit logs are not reporting pages accessed where users do not have permissions in RSA Security AnalyticsASOC-9323
31282Labels do not display correctly when PKI is enabled for the first time in the RSA Security Analytics UIASOC-12619
32751RSA Security Analytics does not honor the CRL expiry date (Next Update on) and then fails to invalidate the CRLASOC-12992

Security Analytics Event Source Monitoring (ESM)
Article NumberArticle TitleTracking Number
30589Renaming the Log Collector or Log Decoder hostname is not reflected on the Event Sources Manage page in RSA Security AnalyticsASOC-9235

Security Analytics Core Services
Article NumberArticle TitleTracking Number
30831Incorrect syntax in core appliance custom index file causes initialization errors in RSA Security Analytics 10.5.0.1 and aboveASOC-4195
30582Broker role permissions do not show custom meta keys defined in concentrator during Data Privacy setup in RSA Security AnalyticsASOC-6749
NotesThis article was last modified on March 30, 2016.

Attachments

    Outcomes