000030391 - Reporting Engine rules with aggregate functions cannot be executed against 10.3 data sources in RSA Security Analytics 10.4.x and above

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000030391
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine, Concentrator, Broker, Security Analytics UI
RSA Version/Condition: 10.4.x,10.5.x
Platform: CentOS
IssueUnexpected results are seen when Reporting Engine NWDB rules with aggregate functions are executed against a data source running version 10.3.x or older.
CauseThis issue occurs because the aggregate functions were introduced with Security Analytics 10.4 and were not intended to be used against data sources running earlier versions.
ResolutionIn order to see appropriate results, only execute the rules against appropriate data sources running version 10.4.x or above.