Skip to content
  • There are no suggestions because the search field is empty.

Investigate > Users page data does not load in RSA NetWitness Platform

Issue

When going to Investigate -> Users, the UEBA data does not load, i.e: the status wheel spins indefinitely:

User-added

Cause

The issue is likely due to the NetWitness Server (UI Server) not being able to reach the UEBA Server on TCP port 443.


Resolution

From the NetWitness Server (UI Server) appliance, check if it can reach the UEBA Server on TCP port 443:
curl --connect-timeout 5 -vk <IP address of UEBA Server>:443
Replace  above accordingly.

If the curl command times out, on the UEBA Server appliance, ensure that:
  1.  nginx is running:
    systemctl status nginx
    If it is not running for some reason, start it:
    systemctl start nginx
  2. The firewall (if any) between the NetWitness Server (UI Server) and the UEBA Server has been configured to allow bi-directional communication for port TCP/443, especially if the 2 hosts are in different subnets.
If you are unsure of any of the steps above or experience any issues, contact  RSA Support and quote this article number for further assistance.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Investigate, UEBA
RSA Version/Condition: 11.x
Platform: CentOS 7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue