000017700 - App Rule alert named with parentheses displays no detailed information in custom drill in RSA NetWitness Investigator

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017700
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.3
RSA NetWitness Investigator
IssueApp Rule alert named with parenthesis displays no detailed information in custom drill in RSA NetWitness Investigator.
When an app rule name has parentheses ( being ( or ) ), no detailed information is displayed in a custom drill within the Investigator thick client.
In the RSA Security Analytics UI, the app rule alert in detail page shows normally, but the output in RSA NetWitness Investigator shows nothing.
Custom drill output which has the same conditions as the app rule shows correct output in RSA NetWitness Investigator.
ResolutionIn order to  resolve the issue, remove the brackets in the app rule name on the Decoder.
Legacy Article IDa67314

Attachments

    Outcomes