Cannot See Rules in the Admin Console Rules List of RSA Web Threat Detection

2 years ago

Originally Published: 2018-01-17

Article Number

000041412

Applies To

RSA Product Set: Web Threat Detection
RSA Product/Service Type: Forensics
RSA Version/Condition: 5.1, 6.x

Issue

There is an issue with Real Time Rule where the behavior after a rule edit is that some or none of the rules work. Additionally, rules cannot be seen in the admin GUI Rules section to be edited. This often occurs after a rule has been edited.

Cause

Corruption of the mitigator.rules file in /var/opt/silvertail/etc may be caused by the introduction of a non US character. This can happen when cutting and pasting from a section in a rule or from a source of text outside of the WTD Admin Rule edit function.

Note: The Customer is advised to do frequent backups of this directory (/var/opt/silvertail/etc).

Resolution

The mitigator.rules file is in an xml format which can be opened and edited.

Note: Best practice is to create a backup copy before editing.

Putting the file through a JSON or XML format parser could help determine syntax and structure issues, e.g., missing brackets and incorrect indents.

To create a new rule it is best to duplicate an existing rule and edit it.

Do not add text from non-WTD GUI sources, hand typing rule modifications in the editor, is considered a best practice.

Don't see what you're looking for?

Related Articles

Trending Articles