This section lists issues fixed after the last major release. For additional information on fixed issues, see the Fixed Version column in the RSA NetWitness Platform Known Issues list on RSA Link: 
https://community.rsa.com/community/products/netwitness/documentation/known-issues

Administration Fixes

Tracking NumberDescription
SACE-13731/
ASOC-101328
In NetWitness Platform 11.4.0.1, Single Sign-On does not work even after implementing it.
SACE-13668/
ASOC-98036
NwLogPlayer time stamp converted into milliseconds for LogDecoder processing.
SACE-13256/
ASOC-91953
PAM is not enabled, but the PAM displays a warning message.

Core Services (Broker, Concentrator, Decoder, Archiver) Fixes

Tracking NumberDescription
SACE-13400/
ASOC-102074
Unable to query on the content of the emails in the network (packets) data.
SACE-14165/
ASOC-102072
The Broker service is not able to retrieve the meta keys and the user interface hangs when a query is run.
SACE-14051/
ASOC-101846

Issue with deployment of Non-IP feeds with IPv6 values (non CIDR) on Decoders or Log Decoders. The first entry on the feed fails to load.

ASOC-101087/
ASOC-101107
Issue with logging UUID's or obsolete IP addresses in core services system log files.

Log Decoder Fixes

Tracking NumberDescription
SACE-13928/
ASOC-101847
In the Investigate > Explore view, the capture.appfilter.bytes parameters does not display the correct count.
SACE-13985/
ASOC-101191

Index customizations for Retention Log Hybrid service not reflecting on updating entities from Index definition files on Decoder.

SACE-13350/
ASOC-95972

Log Decoder service crashes if changes are done to the log forwarding configuration fields logs.forwarding.enabled and logs.forwarding.destination.

ASOC-95972Log Decoder service crashes if changes are done to the log forwarding configuration fields logs.forwarding.enabled and logs.forwarding.destination.

Log Collection Fixes

Tracking NumberDescription
SACE-13403The bookmarking file failed to update the correct bookmark time as the NwVmwareCollector PERL script execution failed because of linefeeds and exception (starttime and userName field) errors.

Investigate Fixes

Tracking NumberDescription
SACE-13887/
ASOC-101526
Unable to export the PCAP files from the ADMIN > System > Jobs panel.
ASOC-100133Filter Events Panel Shows Unexpected Results for Query Containing an Unwrapped OR.

ASOC-97975

Permissions to manage meta groups and column groups in Investigate do not apply in Investigate.

Event Stream Analysis (ESA) Fixes

Tracking NumberDescription
SACE-12773While creating a Rule with subquery using is OneOfIgnoreCase/isNotOneOfIgnoreCase functions for array comparison with context hub list, the functions OneOfIgnoreCase/isNotOneOfIgnoreCase are not called by Esper.
ASOC-101423Position tracking does not get migrated for data sources with a deployment name that contains @ or _ characters at the end of the deployment name.
SACE-12736/
ASOC-102521

When multiple users make changes (adding or removing rules) to ESA Deployment groups, the user who clicks "deploy" first will overwrite the changes of other users.

ASOC-103097After upgrading to version 11.5, the ESA correlation server does not aggregate events from the configured data sources.

Health and Wellness Fixes

Tracking NumberDescription
SACE-13666The Historical Graph does not show the graph, instead it shows only the tooltip when checking for data other than current day.

Malware Fixes

Tracking NumberDescription
SACE-14144/
ASOC-101768
The MD5SUM hash value and the file in spectrum/repository/files directory does not match.

Context Hub Fixes

Tracking NumberDescription
SACE-12733/
ASOC-93550
RSA NetWitness Platform Admin server is not stable because the RabbitMQ service is overloaded.

UEBA Fixes

Tracking NumberDescription
ASOC-102780The User Profile view displays data for inactive users.
ASOC-101686When performing a rerun, UEBA deployments with the TLS schema will not trigger alerts for two weeks.

ASOC-100389

After upgrading UEBA from 11.3 to 11.5, the saved filters in the UI do not work.

ASOC-100310After upgrade from 11.2 or 11.3 to 11.5, adapter logs are not written.