|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: Security Analytics UI, Decoder, Log Decoder
RSA Version/Condition: 10.3.x, 10.4.0.x, 10.4.1.0, 10.4.1.1, 10.5.0.0
O/S Version: EL6
|Issue||Deleting jobs labeled "Upload Custom Feed" from the Profile -> Jobs view ,or from the Jobs notification pop-up in the RSA Security Analytics UI may result in the corresponding feed disappearing from the Live -> Feeds view.|
Although the feed file will still exist on the Decoder appliance(s) where the feed was pushed, the issue may prevent any recurring feeds from properly updating.
The administrator at this point will need to recreate the feed in the Security Analytics UI to continue to manage it from the Live -> Feeds view.
|Cause||This issue occurs when the Upload Custom Feed job is directly tied to the custom feed entry in the back-end database for the Security Analytics 10.3 or higher UI.|
|Resolution||Safeguards have been included in Security Analytics versions 10.4.1.2 and 10.5.0.1 that will prevent the Upload Custom Feed jobs from getting inadvertently deleted by users, which in turn will prevent this issue from occurring.|
|Workaround||In order to avoid this issue, exercise particular caution when deleting job notifications. This will ensure that the Upload Custom Feed jobs are not deleted.|