Skip to content
  • There are no suggestions because the search field is empty.

Drill down in the reporting enginer not functioning within generated weekly reports in RSA NetWitness

Issue

After a weekly report has been created and opened, the ability to drill down into the findings via provided Hyperlinks produces following error in the pop-out screen.

"Bad Request"

Cause

- The reporting engine source was hybrid concentrator which was down and disappeared from the GUI
- So when we try to drill down and looking for the service id we got error and the service id no longer exist
https://10.148.130.80/investigation/24/navigate/values 

Resolution

1. Add the hyper appliance back to the GUI in the hosts tab
2. Go the Reporting engine config page and remove the service and add it back to reflect the correct id 
3. Restart the reporting engine service " stop rsasoc-re / start rsasoc-re"
4. Go the the reports and add the sources back to customer reports.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 12.x
Platform: Windows
Product Name: SA-HYBRID-L
Product Description: SecAnlytcs Hybrd Dplymnt Logs

Approval Reviewer Queue

ASOC Approval Group