RSA NetWitness Endpoint 4.3 Introduces Superfluous Events

Document created by RSA Product Team Employee on May 23, 2017Last modified by RSA Product Team Employee on May 23, 2017
Version 2Show Document
  • View in full screen mode


RSA has found an issue in the RSA NetWitness Endpoint 4.3 Windows Agent, which can cause agents to send superfluous tracking events. A hot fix is currently available to address this issue and the fix will also be implemented in RSA NetWitness Endpoint


Affected Products:

RSA NetWitness Endpoint and, on all supported Windows versions.



There is no impact on the business operations as this error is invisible to the end user. However, the analyst will see erroneous reports of files having been blocked and deleted, when viewing an agent’s tracking data. These events will eventually be deleted automatically after the event retention period has expired. This issue does not impact detection.



Please contact the Customer Support team to receive the hotfix installation instructions for versions and


For additional documentation, downloads, and more, visit theRSA NetWitness Endpoint page on RSA Link..


EOPS Policy:

RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.