000012141 - Alerts sent by the Reporting Engine contain invalid 'details' links in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012141
Applies ToRSA Security Analytics
RSA Security Analytics 10.2
RSA Security Analytics 10.3
RSA Security Analytics 10.4
RSA Security Analytics Reporting Engine
IssueAlerts sent by the Reporting Engine contain invalid "details" links in RSA Security Analytics.
When clicking on a "details" link in an emailed alert from the RSA Security Analytics Reporting Engine service, you are taken to a page with the error "Could not retrieve list of system devices!"
CauseWhen devices are removed from the master device list in the RSA Security Analytics UI, their original device IDs may left behind in Reporting Engine rules. Adding the devices back to the master device list creates a new device ID, even if the device being added back is given the original name. The Reporting Engine rules will not be updated to remove the obsolete device ID.
Resolution

In order to resolve the issue, follow the steps below.

  1. Click the far upper left navigation button in the RSA Security Analytics UI.
  2. Select Administration, then Devices.  This is the master device list.
  3. Select the Reporting Engine service.
  4. Select the drop-down list above and choose Config.
  5. Select the Sources tab.
  6. Click to select the Broker or Concentrator data source that acted as the aggregator for the restored (removed, then re-added) appliance originally.
  7. Delete this data source with the Remove ( - ) button.
  8. Add the data source back with the Add ( + ) button.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Notes

If you are not certain which data source was the aggregator for the original device, you may need to remove and re-add all Reporting Engine data sources to correct the inconsistent device IDs.

Be aware that the steps above for navigating to the Config page for the Reporting Engine service varies slightly in RSA Security Analytics 10.4.

Legacy Article IDa68094

Attachments

    Outcomes