000030475 - Deleting job notifications causes custom feeds to disappear in the RSA Security Analytics 10.3 or higher UI

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000030475
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Decoder, Log Decoder
RSA Version/Condition: 10.3.x, 10.4.0.x, 10.4.1.0, 10.4.1.1, 10.5.0.0
Platform: CentOS
O/S Version: EL6
IssueDeleting jobs labeled "Upload Custom Feed" from the Profile -> Jobs view ,or from the Jobs notification pop-up in the RSA Security Analytics UI may result in the corresponding feed disappearing from the Live -> Feeds view.
Screenshot of the Upload Custom Feed job.
Although the feed file will still exist on the Decoder appliance(s) where the feed was pushed, the issue may prevent any recurring feeds from properly updating.
The administrator at this point will need to recreate the feed in the Security Analytics UI to continue to manage it from the Live -> Feeds view.
CauseThis issue occurs when the Upload Custom Feed job is directly tied to the custom feed entry in the back-end database for the Security Analytics 10.3 or higher UI.
ResolutionSafeguards have been included in Security Analytics versions 10.4.1.2 and 10.5.0.1 that will prevent the Upload Custom Feed jobs from getting inadvertently deleted by users, which in turn will prevent this issue from occurring.
WorkaroundIn order to avoid this issue, exercise particular caution when deleting job notifications.  This will ensure that the Upload Custom Feed jobs are not deleted.

Attachments

    Outcomes