000032748 - Incidents are not flagged when a user manually adds the alerts to existing incidents in RSA Security Analytics 10.6.x and NetWitness 11.x.

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Apr 17, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000032748
Applies ToRSA Product Set: Security Analytics, NetWitness Logs & Network
Product/Service Type: Incident Management, Respond Server
RSA Version/Condition: 10.6.x, 11.0.x, 11.1.x, 11.2.x, 11.3.x.
IssueInvestigation values are not highlighted when alerts in Incident Management (SA 10.6.x) or RESPOND(NW 11.x) have manually been added to an incident. Alerts that are dynamically added to an incident will get highlighted.
CauseThis happens only when an alert is manually added to an incident beyond 30 minutes of flag construction schedule.
ResolutionThis issue is being investigated by the Engineering team in order to provide a permanent resolution in a future release.