000029820 - RSA Live Subscribed Feeds download fails with "Could not find any resource matching Url" in NetWitness Endpoint

Document created by RSA Customer Support Employee on Dec 24, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000029820
Applies ToRSA Product Set: NetWitness Endpoint formerly ECAT
RSA Version/Condition: 4.4.x
IssueThe NetWitness Endpoint RSA Live Subscribed Feeds download fails with "Could not find any resource matching Url."

Observe this error log in the following locations:
  1. In the ConsoleServer-Error.log file (default directory  C:\Program Files\RSA\ECAT\Server) see 11 occurrences of "Could not find any resource matching Url" log-like,

    3/15/2019 9:58:33 AM
    [37] System.IO.FileNotFoundException:
    Could not find any resource matching Url =
    at a.a.Xᝤ.ᜀ(Xᝍ A_0, String A_1, String A_2, UInt16 A_3, NetworkCredential A_4, Boolean A_5)
    at a.b.Xᜪ.ᜀ(Xᝍ A_0)

     
  2. When running the NWE ServerOutput program (ConsoleServerServiceOutput.exe) see 11 occurrences of "Could not find any resource matching Url" like,

    15 09:58:33:9573 ERROR: System.IO.FileNotFoundException: Could not find any resource matching Url =


    Other symptoms of this error are:
     
  3. From the NWE UI, Configure > Monitoring and External Components > RSA Live, Edit the Configuration by clicking the gear icon.
    Under RSA Live Subscribed Feeds a non-zero number shows for the first 3 feeds (Malware Domain List, Malware Domains, and Malware IP List) and then 0 for the next 11 feeds (RSA FirstWatch*, RSA FraudAction*, Zeus*).
     
  4. Running a manual Offline download of the RSA Live Feeds using the ConsoleServerSync.exe program, gets the below error response.
    User-added image
CauseThe RSA Live account configured in NWE UI, Configure > Monitoring and External Components > RSA Live, only has Basic subscription access.

A Basic subscription Live account, only has permission to download the following feeds: Malware Domain List, Malware Domains, and Malware IP List.

The other 11 Live feeds (FirstWatch*, FraudAction*, Zeus*) are only available to RSA Live accounts that also have the Enhanced subscription.
ResolutionThe Basic and Enhanced subscriptions are now available free to all NetWitness customers with a valid NetWitness maintenance contract.

Contact RSA Customer Support to add the Enhanced subscription to the RSA Live account that is configured in NWE UI, Configure > Monitoring and External Components > RSA Live

Provide RSA Customer Support the RSA Live Username to check.

How can I contact Customer Support for issues or questions relating to RSA Link?

Attachments

    Outcomes