|Applies To||RSA Product Set: ECAT|
RSA Version/Condition: 4.0.0.x
|Issue||The ECAT Live feed download fails with "Could not find any resource matching Url".|
Observe this error, and other symptoms in the following locations.
1. From c:\ECAT\Server\ConsoleServer-Error.log you see 11 occurrences of "Could not find any resource matching Url" like,
3/15/2015 9:58:33 AM
15 09:58:33:9573 ERROR: System.IO.FileNotFoundException: Could not find any resource matching Url =
3. From ECAT UI, Tools -> Import/Export -> RSA Live, the Status tab shows a number value for the first 3 feeds (Malware Domain List, Malware Domains, and Malware IP List) in the dropdown and 0 for the next 11 feeds (FirstWatch*, FraudAction*, Zeus*).
4. Running a manual Offline download of Live feeds using the ConsoleCertificateSynch.exe program, gets the below response.
|Cause||The SA Live account that has been configured for use in ECAT only has a Basic subscription access.|
For a Basic subscription Live account, the only feeds available for ECAT to download are Malware Domain List, Malware Domains, and Malware IP List.
The other 11 Live feeds (FirstWatch*, FraudAction*, Zeus*) are only available to Customers who have paid for Enhanced or Premium Live subscriptions.
The Enhanced and Premium Live subscriptions can be subscribed to at an additional cost, which can be discussed with the Customer's RSA Reseller, or RSA Sales contact.
Should you wish to see further information about the differences between Basic/Enhanced/Premium subscriptions see the RSA NetWitness Live Sales document.
|Resolution||In the ECAT UI, Tools -> Import/Export -> RSA Live, the Subscriptions tab.|
The only options are to Select All, or Deselect All, you can't select only some of the Feeds.
For a Customer with a Basic Live subscription this error message can be ignored, after confirming the first 3 feeds (Malware Domain List, Malware Domains, and Malware IP List) shows a non-zero value in the ECAT UI, Tools -> Import/Export -> RSA Live, the Status tab.
Contact RSA Customer Support if you have paid for an Enhanced or Premium Live subscription, and getting this error.