000036104 - How are the ECATSYNC, ECATUI,and ECATIOC built-in SQL accounts used in RSA NetWitness Endpoint

Document created by RSA Customer Support Employee on Mar 24, 2018
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000036104
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: Database
RSA Version/Condition: 4.4.x, 4.3.x, 4.2.x
IssueWhat are the ECATIIOC , ECATSYNC, ECATUI, and ECATMASTERSYNC accounts and what is their purpose?
ResolutionThe ECATIIOC, ECATSYNC, and ECATUI accounts are installed when the RSA NetWitness Endpoint database is created.
The ECATMASTERSYNC account is created when multi-server is configured in the user interface.
These accounts are SA type. Listed below is brief description of how they are used.
 
Account NameDescription
ECATSYNCOwner of the various RSA NetWitness Endpoint agent jobs
ECATUIUsed to communicate actions between the UI and the the SQL Server. Also used as go-between the API server, UI, Console Server and database
ECATMASTERSYNCUsed to manage synchronization of database tables between primary and secondary servers and jobs that are related to updating data between the primary and secondary servers
ECATIOCPlaceholder for managing IOC evaluation jobs


These accounts are internal and they cannot be deleted. It is also not possible to delete them and turn them over to Windows Authentication accounts. (Not supported by RSA Customer Support)

Attachments

    Outcomes