000016431 - Cannot investigate meta values containing a backslash character in RSA Security Analytics 10.3 SP2

Document created by RSA Customer Support Employee on Jun 15, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000016431
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.2
IssueCannot investigate meta values containing a backslash character in RSA Security Analytics 10.3 SP2.
No results are returned when performing a custom drill for a value with a backslash ( \ ) character in Security Analytics 10.3.2.
Custom drills including a backslash (i.e. group = 'my company\wellington\citrix' or user.dst = domain\username') yield no results.
Resolution

This issue has been resolved in RSA Security Analytics 10.3 SP3.

As a workaround for this issue, it is possible to edit the query from within the Investigation UI, modify the query to be surrounded by ticks ('user.dst = domain\username'), and click OK, which should then populate the custom drill.

Legacy Article IDa65720

Attachments

    Outcomes