|Applies To||RSA Product Set: NetWitness Logs and Network|
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.X.X.X
O/S Version: 6
|Issue||If the Incident Manager isn't set up properly, then the IM Database may automatically generate incidents on the Netwitness UI Server, which is not a supported configuration. When this happens, it is necessary to move the database from the Netwitness UI Server to the ESA Server. When the IM Database is moved from the UI, it is also necessary to move the 'incident increment.' Otherwise, the numbers for the Incident IDs will start overwriting the previous incident ID's (i.e, INC-1...INC4). The steps to move the database can be found in the following article: https://community.rsa.com/docs/DOC-45376 .|
We have moved the Mongo IM Database from the Netwitness UI Server to the ESA server. The Incident ID's are starting from (INC-1...INC-4) when there are already incidents created using that ID. The next Incident ID should be 71. What is needed to fix this issue?
In this example, to update the value so that it enumerates correctly, starting with the last incident, we need to update the value to 70. Your specific incident number will vary.