000035767 - Warm-up duration is retained when changing from Packet to Log Automated Threat Detection and vice-versa in RSA Security Analytics 10.6

Document created by RSA Customer Support Employee on Nov 23, 2017Last modified by RSA Customer Support Employee on Mar 25, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000035767
Applies ToRSA Product Set: NetWitness Logs & Packets, Security Analytics
RSA Product/Service Type: Event Stream Analysis (ESA)
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: EL6
IssueThe warm-up duration period is retained when switching between packet and log Automated Threat Detection (ATD) modules.

CauseWhen you switch from Automated Threat Detection for Logs (Using Query-Based Aggregation) to Packets, the mechanism does not change.
ResolutionThis issue is currently being investigated by the Engineering team in order to resolve it in a future release.
WorkaroundManually reset the value for the warm-up duration.