|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: SA Event Stream Analysis
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x
|Issue||After upgrading from 10.3, some ESA rules are shown in the UI but it is not possible to enable, disable or delete the rules. When attempting to perform any of these tasks, a pop-up appears that the rule has been deleted but it is still present in the UI. |
The rules are not present in the Rule Library as well.
|Tasks||This occurs because in 10.3, the rules are saved under /opt/rsa/esa/modules. From 10.4 and above, this location is not used for saving the rules.|
|Resolution||SSH to the ESA and rename the modules directory|
[root@ESA /]# service rsa-esa stop