RSA has found an issue in the RSA NetWitness Endpoint 4.3 Windows Agent, which can cause agents to send superfluous tracking events. A hot fix is currently available to address this issue and the fix will also be implemented in RSA NetWitness Endpoint 126.96.36.199.
RSA NetWitness Endpoint 188.8.131.52 and 184.108.40.206, on all supported Windows versions.
There is no impact on the business operations as this error is invisible to the end user. However, the analyst will see erroneous reports of files having been blocked and deleted, when viewing an agent’s tracking data. These events will eventually be deleted automatically after the event retention period has expired. This issue does not impact detection.
Please contact the Customer Support team to receive the hotfix installation instructions for versions 220.127.116.11 and 18.104.22.168.
For additional documentation, downloads, and more, visit the page on RSA Link..
RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.