RSA has found an issue in the RSA NetWitness Endpoint 4.3 Windows Agent, which can cause agents to send superfluous tracking events. A hot fix is currently available to address this issue and the fix will also be implemented in RSA NetWitness Endpoint 184.108.40.206.
RSA NetWitness Endpoint 220.127.116.11 and 18.104.22.168, on all supported Windows versions.
There is no impact on the business operations as this error is invisible to the end user. However, the analyst will see erroneous reports of files having been blocked and deleted, when viewing an agent’s tracking data. These events will eventually be deleted automatically after the event retention period has expired. This issue does not impact detection.
Please contact the Customer Support team to receive the hotfix installation instructions for versions 22.214.171.124 and 126.96.36.199.
For additional documentation, downloads, and more, visit theRSA NetWitness Endpoint page on RSA Link..
RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.