'Syntax error in module. null' error occurs with imported ESA LIVE rules

Issue

User exported all ESA rules before RMA(or reimage) NetWitness Admin node.
After import, the ESA rules, 'Syntax error in module. null' error occurred with only ESA LIVE rules.

Resolution

RSA NetWitness doesn't support importing ESA LIVE rules.
ESA LIVE rules should be deployed again from RSA LIVE.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.4, 11.5
Platform: CentOS 7

Approval Reviewer Queue

Technical approval queue