000016658 - RSA Security Incident Management (SIM) Solution - RSA Connector Framework (RCF) is unable to create cross reference records into related RSA Archer applications

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000016658
Issue


RSA Connector Framework (RCF) is unable to create cross reference records into the 'Incidents' and the 'Involved Parties', RSA Archer applications. Records in the parent application, 'Incident Events' are created without any problem. APIUser used for RCF communication has permissions to all the involved RSA Archer applications. UUIDs / GUIDs match between the Mapping XML file and the RSA Archer application fields.



The hierarchy of configured cross references used on this situation is below:



 



Application# 1



 



Incident Events - has a cross reference to 'Incident' application.



 



Application# 2



 



Incidents - has a cross reference to 'Involved Parties' application.



 



Application# 3



 



Involved Parties application.



 



Errors observed in 'rsa_connector_0.log' file - located on the server running RCF (on the server running RSA enVision):



 



Jun 21, 2012 11:39:01 AM com.rsa.connector.framework.components.datastore.archer.ArcherDataStore SEVERE: Unable to locate field ID for uuid 34E1EDC5-9F46-41CD-908E-FE948B628488Jun 21, 2012 11:39:01 AM com.rsa.connector.framework.components.datastore.archer.ArcherDataStore SEVERE: Exception occurred while processing the record dataJun 21, 2012 11:39:01 AM com.rsa.connector.framework-ACS SEVERE: incident_escalate - Error occured while storing data into archer. java.lang.NullPointerExceptionat com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.createArcherRecordForApplication(ArcherDataStore.java:334)at com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.putData(ArcherDataStore.java:289)at com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.handleData(ArcherDataStore.java:255)at com.rsa.connector.plugin.incident.IncidentManagementService.onApplicationDataReceived(IncidentManagementService.java:112)at com.rsa.connector.plugin.service.AbstractRsaConnectorService.processDataHandlingRequest(AbstractRsaConnectorService.java:99)at com.rsa.connector.framework.plugin.ApplicationRequestHandler.execute(ApplicationRequestHandler.java:84)at com.rsa.connector.framework.plugin.ApplicationRequestHandler.access$400(ApplicationRequestHandler.java:25)at com.rsa.connector.framework.plugin.ApplicationRequestHandler$QueueWork.run(ApplicationRequestHandler.java:129)
Jun 21, 2012 11:39:01 AM com.rsa.connector.framework.components.datastore.archer.ArcherDataStore



SEVERE: Unable to locate field ID for uuid 34E1EDC5-9F46-41CD-908E-FE948B628488



Jun 21, 2012 11:39:01 AM com.rsa.connector.framework.components.datastore.archer.ArcherDataStore



SEVERE: Exception occurred while processing the record data



Jun 21, 2012 11:39:01 AM com.rsa.connector.framework-ACS



SEVERE: incident_escalate - Error occured while storing data into archer. java.lang.NullPointerExceptionat



com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.createArcherRecordForApplication(ArcherDataStore.java:334)at com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.putData(ArcherDataStore.java:289)at com.rsa.connector.framework.components.datastore.archer.ArcherDataStore.handleData(ArcherDataStore.java:255)at com.rsa.connector.plugin.incident.IncidentManagementService.onApplicationDataReceived(IncidentManagementService.java:112)at com.rsa.connector.plugin.service.AbstractRsaConnectorService.processDataHandlingRequest(AbstractRsaConnectorService.java:99)at com.rsa.connector.framework.plugin.ApplicationRequestHandler.execute(ApplicationRequestHandler.java:84)at com.rsa.connector.framework.plugin.ApplicationRequestHandler.access$400(ApplicationRequestHandler.java:25)at com.rsa.connector.framework.plugin.ApplicationRequestHandler$QueueWork.run(ApplicationRequestHandler.java:129)



 

Cause


Cause of this issue is found to be the incorrect 'CRUDOptions' used for 'Involved Parties' application in the mapping XML file.

Resolution


To fix the issue, please follow the steps below:




1. Browse and open the mapping XML file located on the RCF / envision server - on the install directory (\EMC\RSA Connector Framework\plugins\im-escalate).



2. Locate the section of the mapping XML file that outlines the 'Involved Parties' application settings and change the CRUDOptions tag value as below:



 



Before



 



<application CRUDOptions="IGNORE" name="Involved_Parties">   
<applicationUUID>B2E510FC-DF58-4DC4-BB0F-E74168A58CFA</applicationUUID><!-- Search details for finding unique record in the application. FieldName: Name--><searchField><UUID>236C9F22-80D3-4672-ADBA-8E943B4CB7B4</UUID><type>TEXT</type><keyName>Site</keyName></searchField></application>
<application CRUDOptions="IGNORE" name="Involved_Parties">  



 



***Note: CRUDOptions="IGNORE" means 'Read-Only' access to the application.***



 



After



 



<application CRUDOptions="UPDATE_IF_EXISTS" name="Involved_Parties">



 



***Note: CRUDOptions="UPDATE_IF_EXISTS" means 'Update existing record with a new related record' with in the application.***



 



3. Save the mapping XML file. Restart the RCF Services or login to the RCF console and execute this command: 'refresh-app <ApplicationName i-e im-escalate>'



 



4. Test alert generation in RSA enVision. RCF should be able to store alerts into RSA Archer without any problem.



 

Legacy Article IDa60447

Attachments

    Outcomes