000029820 - Live feed download fails with "Could not find any resource matching Url" in ECAT 4.X

Document created by RSA Customer Support Employee on Jun 14, 2016
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000029820
Applies ToRSA Product Set: ECAT
RSA Version/Condition: 4.0.0.x
IssueThe ECAT Live feed download fails with "Could not find any resource matching Url".
Observe this error, and other symptoms in the following locations.

1. From c:\ECAT\Server\ConsoleServer-Error.log  you see 11 occurrences of "Could not find any resource matching Url" like,


3/15/2015 9:58:33 AM
[37] System.IO.FileNotFoundException:
Could not find any resource matching Url =
at a.a.Xᝤ.ᜀ(Xᝍ A_0, String A_1, String A_2, UInt16 A_3, NetworkCredential A_4, Boolean A_5)
at a.b.Xᜪ.ᜀ(Xᝍ A_0)



2. From ConsoleServerServivceOutput.exe you see 11 occurrences of "Could not find any resource matching Url" like,


15 09:58:33:9573 ERROR: System.IO.FileNotFoundException: Could not find any resource matching Url =
 


3. From ECAT UI, Tools -> Import/Export -> RSA Live, the Status tab shows a number value for the first 3 feeds (Malware Domain List, Malware Domains, and Malware IP List) in the dropdown and 0 for the next 11 feeds (FirstWatch*, FraudAction*, Zeus*).

4. Running a manual Offline download of Live feeds using the ConsoleCertificateSynch.exe program, gets the below response.
User-added image
CauseThe SA Live account that has been configured for use in ECAT only has a Basic subscription access.
For a Basic subscription Live account, the only feeds available for ECAT to download are Malware Domain List, Malware Domains, and Malware IP List.
The other 11 Live feeds (FirstWatch*, FraudAction*, Zeus*) are only available to Customers who have paid for Enhanced or Premium Live subscriptions.
The Enhanced and Premium Live subscriptions can be subscribed to at an additional cost, which can be discussed with the Customer's RSA Reseller, or RSA Sales contact.
Should you wish to see further information about the differences between Basic/Enhanced/Premium subscriptions see the RSA NetWitness Live Sales document.
ResolutionIn the ECAT UI, Tools -> Import/Export -> RSA Live, the Subscriptions tab.
The only options are to Select All, or Deselect All, you can't select only some of the Feeds.
For a Customer with a Basic Live subscription this error message can be ignored, after confirming the first 3 feeds (Malware Domain List, Malware Domains, and Malware IP List) shows a non-zero value in the ECAT UI, Tools -> Import/Export -> RSA Live, the Status tab.
User-added image
Contact RSA Customer Support if you have paid for an Enhanced or Premium Live subscription, and getting this error.

Attachments

    Outcomes