000034291 - Drill down in the reporting enginer not functioning within generated weekly reports in RSA NetWitness 10.6.1.1

Document created by RSA Customer Support Employee on Feb 23, 2017•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000034291
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.6.1.1
Platform: Windows
Product Name: SA-HYBRID-L
Product Description: SecAnlytcs Hybrd Dplymnt Logs
IssueAfter a weekly report has been created and opened, the ability to drill down into the findings via provided Hyperlinks produces following error in the pop-out screen.
"Bad Request"
 
Cause- The reporting engine source was hybrid concentrator which was down and disappeared from the GUI
- So when we try to drill down and looking for the service id we got error and the service id no longer exist
https://10.148.130.80/investigation/24/navigate/values 
 
Resolution1. Add the hyper appliance back to the GUI in the hosts tab
2. Go the Reporting engine config page and remove the service and add it back to reflect the correct id 
3. Restart the reporting engine service " stop rsasoc-re / start rsasoc-re"
4. Go the the reports and add the sources back to customer reports.
 

Attachments

    Outcomes