Install and Setup

• 1: Cloud Link Service Overview
• 2: Plan your Considerations to Install Cloud Link Service
• 3: Install Cloud Link Service
• 4: Monitor the Health of the Cloud Link Service
• 5: Understand Cloud Link Overview Dashboard Visualizations
• 6: Configure Email or Syslog Notifications to Monitor the Service
• 7: Uninstall the Cloud Link Service
• 8: Update the Cloud Link Service Automatically
• 9: Enable or Disable the Cloud Link Service
• 10: Use Sensor Filters
• 11: Install NetWitness UEBA (Cloud) with an Existing UEBA (On-premises)
• 12: Change the Default Service for Investigation
• 13: Configure the Proxy for Cloud Link Service
• 14: Configure Domains required to be Whitelisted for NetWitness UEBA
• 15: Troubleshoot the Cloud Link Service

1 - Cloud Link Service Overview

NetWitness Cloud Link Service enables you to use the NetWitness UEBA solution and its features by providing a secure transportation mechanism between existing NetWitness Platform hosts (Decoders) and the NetWitness UEBA service. Example: to perform analytics on the NetWitness UEBA, you must install and register the Cloud Link Service on at least one Decoder host.

Cloud Link service is a sensor that you must install and register on your on-premise host to:

• Transfers metadata from the host (such as Decoders) in your on-premises deployment to the NetWitness UEBA for analysis and investigation.
• Transfer alerts generated in NetWitness UEBA to your on-premises NetWitness Platform Respond server for incident management.

You can install Cloud Link Service on the following host types:

• Log Decoder
• Log Hybrid
• Endpoint Log Hybrid
• Log Hybrid Retention

Cloud Link Service Architecture

This section provides information on how data is transferred using Cloud Link Service:

Single Deployment: Data Transfer

1. Cloud Link Service fetches all the metadata from the host. For example: Log Decoder.
2. The Cloud Link Service filters metadata from the following data sources:
   • Active Directory
   • Authentication
   • File
   • Process
   • Registry
3. Cloud Link Service collects only matching metadata, compresses the matching metadata, and transfers it to NetWitness UEBA through a secure channel.

Multiple Deployment: Data Transfer

Data Transfer from NetWitness UEBA

NetWitness platform transfers the alerts generated to the on-premises NetWitness Platform Respond server which can be viewed on the user interface for incident management.

See also

• Install Cloud Link Service
• Plan your Considerations to Install Cloud Link Service

2 - Plan your Considerations to Install Cloud Link Service

Before you install the Cloud Link Service, you must plan for the following:

• The NetWitness Platform (Decoder Host) is on version 11.5.2 or later.
• Ensure you have at least 8 GB of memory on your host.
• Ensure that the system clock is accurate. To fix the system clock, configure the NTP server on the Admin server. For more information on how to configure NTP server, see Configure NTP Servers.
• Ensure that you have the administrator access to the NetWitness Cloud Portal user interface.
• If you have an existing UEBA (On-premises) host deployed in your environment and you plan to move to NetWitness UEBA (Cloud), you need to remove the host from the Admin server and stop the airflow-scheduler service on the UEBA (On-premises) host. If you plan to run UEBA (Cloud) and UEBA (On-premises) simultaneously, see Install NetWitness UEBA (Cloud) with an Existing UEBA (On-premises).
• The host on which the Cloud Link Service will be installed needs to be connected to Amazon Web Services(AWS). This might require changes to your existing firewall rules. Hosts will need to connect to the IP ranges for the chosen deployment region. For more information on the current list of AWS IPs by region, see AWS IP address ranges.
• Open TCP port 443 to allow outbound network traffic.
• Ensure you have configured the Azure Monitor plugin in your deployment. This enables UEBA to run a query for Azure AD log events for monitoring purposes in the correct format. For more information on how to configure the Azure Monitor plugin, see the Azure Monitor Event Source Configuration Guide.
• (Optional) Ensure that you configure the proxy settings from NetWitness Platform version 11.5.3 or later, before installing the Cloud link Service. For more information, see Configure the Proxy for the Cloud Link Service.

To understand the deployment of the Cloud Link Service, see Cloud Link Service Architecture.

You can install Cloud Link Service on the following hosts:

See also

• Install Cloud Link Service
• Cloud Link Service Overview

3 - Install Cloud Link Service

The administrators can perform the following tasks to install the Cloud Link Service successfully:

Step 1. Install Cloud Link Service
Step 2. Download the Activation Package
Step 3. Register the Cloud Link Service
Step 4. Verify if the Cloud Link Service is working
Step 5. Transfer UEBA (Cloud) data to NetWitness Platform

Step 1: Install the Cloud Link Service

You can install the Cloud Link Service on the following host types:

• Log Decoder
• Log Hybrid
• Endpoint Log Hybrid
• Log Hybrid Retention

Prerequisites

Ensure that the NetWitness Platform and the host (Decoder) are on version 11.5.2.0 or later.

To install the Cloud Link Service

1. Log in to the NetWitness Platform as an administrator and go to Admin > Hosts.

   The Hosts view is displayed.

2. Select a host (Example: Log Decoder) and click .

   A dialog listing all the services already installed on this host is displayed and seeks your confirmation if you want to install a new service.

3. Click Yes.

   The Install Services dialog is displayed.

4. Select the Cloud Link Service from the Category drop-down menu, and click Install.

   

5. Go to Admin > Services to verify successful Cloud Link Service installation.

Step 2: Download the Activation Package

You need the activation package to register Cloud Link Service with the NetWitness UEBA. The activation package can be used on all hosts containing Cloud Link Service, which you want to register and you can download it from the NetWitness Cloud Portal.

To download the activation package

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors > Downloads.

3. Click the Cloud Link tab.

   

4. Under Activation Package, click to generate the activation package.

5. Click to download the activation package.

Step 3: Register the Cloud Link Service

Registration of Cloud Link Service requires copying the activation package to the Cloud Link Service directory, and setting up the required permissions. Once this is completed, the Cloud Link Service will be registered automatically.

Prerequisites

Ensure that the system clock is accurate. To fix the system clock, configure the NTP server on Admin server. For more information on how to configure NTP Sever, see Configure NTP Servers.

To register the Cloud Link Service

1. SSH to the host on which the Cloud Link Service is installed.

2. Copy the device-activation-package.json file downloaded from the NetWitness Cloud Portal to the /root or /temp directory on the Cloud Link Service host.

3. Change the user and group of the device-activation-package.json file to netwitness by executing the following command:

   chown netwitness:netwitness device-activation-package.json
   

4. Move the device-activation-package.json file to the Cloud Link Service directory by executing the following command:

   mv device-activation-package.json /var/lib/netwitness/cloud-link-server/
   

5. To verify if Cloud Link Service is registered successfully, log in to the NetWitness Cloud Portal, and check the status of the Cloud Link Service. For more information, see Verify if the Cloud Link Service is working.

Step 4: Verify if the Cloud Link Service is Working

You can check the status on NetWitness Cloud Portal Sensor List to verify the successful registration of Cloud Link Service. The status must reflect as Connected for the Cloud Link Service to start transferring data. You can use this status to monitor the Cloud Link Service and troubleshoot registration failures.

To verify the status of the Cloud Link Service

1. Log in to the NetWitness Cloud Portal.
2. Go to Admin > Sensors > Sensor List.
   The following information is displayed for every Cloud Link Service registered in your deployment:

Step 5: Transfer UEBA (Cloud) data to NetWitness Platform

If you want to view the UEBA data on your NetWitness Platform user interface you must configure the data transfer from the cloud to the Admin server. Perform the following steps:

1. SSH to the Admin server.

2. Execute the following command:

   nw-manage --enable-cba
   

See also

• Cloud Link Service Overview
• Plan your Considerations to Install Cloud Link Service

4 - Monitor the Health of the Cloud Link Service

NetWitness Platform enables you to visualize the health of the Cloud Link Service similar to other NetWitness Platform services deployed in your environment. It helps you troubleshoot the problematic spikes, identify high resource usage, and gives a deep visibility into the source of problems before the service goes down.

Monitoring the health of the Cloud Link Service at all times enables you to keep track of the following parameters:

• Status of all the Cloud Link Services in your deployment (offline and online).
• For each Cloud Link Service, the sessions aggregation rate, sessions behind, and sessions collected.
• Status of the uploads such as the count of sessions uploaded, the rate at which upload took place, and outstanding sessions to be uploaded.
• CPU and memory usage of each service.

Prerequisites

• You must install the New Health and Wellness. For more information, see New Health and Wellness
• You must ensure to download the Cloud Link Service dashboard from RSA Live and monitor the data transfer. For more information, see Advanced Configurations.

The Cloud Link Service Dashboard provides key metrics as described in Understand Cloud Link Overview Dashboard Visualizations.

To access the Cloud Link Overview Dashboard

1. Log in to the NetWitness Platform.

2. Go to Admin > Health & Wellness.

3. Click New Health & Wellness.

4. Click Pivot to Dashboard.

   The Deployment Health Overview dashboard is displayed.

5. Click and then click Dashboard.

   The Dashboards dialog is displayed.

6. Select the Cloud Link Overview Dashboard.

   You can look at the visualizations (charts, tables, and so on) to view current CPU and memory of Cloud Link Service, Sessions behind and Upload rate per Cloud Link Service, and so on.

7. You can adjust the time range on the top right corner and also use the host filter to view the visualizations on each host.

   

   

   

   

See also

• Plan your Considerations to Install Cloud Link Service
• Install Cloud Link Service
• Understand Cloud Link Overview Dashboard Visualizations

5 - Understand Cloud Link Overview Dashboard Visualizations

This topic provides information on the Cloud Link Overview dashboard. The dashboard contains information on Cloud Link Service key metrics such as the hosts the Cloud Link Service is running on, outstanding sessions to be uploaded, CPU, memory usage, and so on.

Cloud Link Overview Dashboard

See also

• Install Cloud Link Service
• Monitor the Health of the Cloud Link Service

6 - Configure Email or Syslog Notifications to Monitor the Service

Notifications such as email or syslog can be configured to monitor the Cloud Link Service. You will be notified when the following events occur:

• Cloud Link Service goes offline.
• Offline Cloud Link Service is back online.
• Cloud Link Service CPU, memory, or disk storage thresholds are exceeded.

Notifications can be set up on the NetWitness Platform user interface by configuring the output, server settings, and notification. This is the notification type, namely email and syslog. When you set up a notification, you must specify the notification output for an alert.

Configure email or syslog as a notification

1. Go to Admin > System.

2. In the options panel, select Global Notifications.

   The Notifications configuration panel is displayed with the Output tab open.

   

3. On the Output tab, from the drop-down menu, select Email or Syslog.

   The following is an example of email notification:

   

4. In the Define Email Notification dialog, provide the required information and click Save.

Configure email or syslog settings as a notification server

This is the source of the notifications and must be configured to specify the email server or syslog server settings.

1. Go to Admin > System.

2. In the options panel, select Global Notifications.

   The Notifications configuration panel is displayed with the Output tab open.

3. Click the Servers tab.

   

4. From the drop-down menu, select Email or Syslog.

   The following is an example for email server:

   

5. In the Define Email Notification Server dialog, provide the required information and click Save.

Add a email or syslog notification

1. Go to Admin > Health & Wellness.

2. Click New Health & Wellness.

3. Click View Notifications Settings.

4. Specify the following:

   • Output Type: Select the Notification type as Email or Syslog.
   • Recipient: Select the recipient based on the output type selected.
   • Notification Server: Select the notification server that will send the notification.
   • Template: Notification template as Email or Syslog.

5. If you want to add another notification, click Add Condition and repeat step 4.

6. Click Save.

See also

• Monitor the Health of the Cloud Link Service
• Understand Cloud Link Overview Dashboard Visualizations

7 - Uninstall the Cloud Link Service

If you have Cloud Link Service installed and no longer want to use it, perform the following steps to delete the Cloud Link Service.

To uninstall the Cloud Link Service completely, first remove the Cloud Link Service from NetWitness Cloud Portal, and then uninstall the Cloud Link Service on the NetWitness Platform.

Step 1: Remove the Cloud Link Service from the NetWitness Cloud Portal

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors > Sensor List.

3. Select the Cloud Link Service that you want to delete, and click Remove Sensor.

Step 2: Uninstall the Cloud Link Service on the NetWitness Platform

1. SSH to the host on which the Cloud Link Service is installed.

2. Execute the following command:

   /var/lib/netwitness/cloud-link-server/nwtools/uninstall-cloud-link.sh
   

3. Log in to the NetWitness Platform and go to Admin > Services to verify if the Cloud Link Service is removed.

See also

• Install Cloud Link Service
• Cloud Link Service Overview

8 - Update the Cloud Link Service Automatically

You can now easily keep all your Cloud Link Service up-to-date with the latest version. You can set up automatic updates or scheduled updates to save time and avoid manual tracking of the Cloud Link Service.

You can set up update options on the Configuration tab:

• Automatic update: Select to allow auto-update of sensors as and when a new version is available.
• Custom update: Select to schedule auto-update of the sensor for a specific day and time.

Prerequisites

• The NetWitness Platform (host) is on version 11.6.1 or later.
• Ensure that the Cloud Link Service is in a connected state in the UI to start the update.

To update the Cloud Link Service automatically

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors > Configuration.

3. Do one of the following:

   • To setup the Automatic update: select the option Automatic and click Save.
   • To setup the Schedule update: Select the option Custom.
     
     • Specify the day from the Day field.
     • Specify the time in Time field. For example, 07:03.
     • Click Save.

Update the Cloud Link Service Manually

You can update the Cloud Link Service manually on selected hosts.

To update the Cloud Link Service manually

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors > Configuration.

3. Select the option Manual and click Save.

4. Click the Sensor List tab.

5. Select the Cloud Link Service that needs to be updated and click Update Sensor.

   A pop-up message is displayed to confirm the update.

6. Click Update.

Limitations for sensor update

Limitations associated with this version of the sensor are included below:

1. When a new version of the sensor update is available, for example, 11.6.1, the Sensor Update button is enabled and ready to update the sensor. When you click Sensor Update, the sensor update starts. However, at the same time if a new rpm for the sensor update is uploaded, for example, 11.7, there are high chances the sensor update will not be overridden, causing the sensor to not be updated with the latest version.

2. When a new version of sensor update is available, and you have configured for manual updates, the sensor update will not be triggered automatically. In this scenario, you need to update to the new version manually. However, if a new version of the sensor update is released after changing the setting to automatic, all sensor updates will be performed automatically from that moment.

See also

• Cloud Link Service Overview
• Install Cloud Link Service
• Uninstall the Cloud Link Service

9 - Enable or Disable the Cloud Link Service

Sensors (Cloud Link Service) are installed on a host and are enabled by default to transfer data to the UEBA. However, you can temporarily disable a sensor, if the data exceeds the processing capacity or perform a maintenance activity on the sensor. If you disable a sensor,the sensor will not be able to collect the data.

To disable a sensor

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors List.

3. Select the sensor and click Disable Sensor.

   A confirmation pop-up is displayed.

4. Click Disable Sensor.

To enable a sensor

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > Sensors List.

3. Select the sensor and click Enable Sensor. A confirmation pop-up is displayed.

4. Click Enable Sensor.

See also

• Install Cloud Link Service
• Uninstall the Cloud Link Service

10 - Use Sensor Filters

To better manage a large number of sensors, you can search and filter for specific sensors by any criteria in the list of sensors from the Admin > Sensor List page in the NetWitness Cloud Portal UI.

To filter the sensors

1. Log in to NetWitness Cloud Portal.

2. Go to Admin > Sensors > Sensor List.

3. Click Filter.

   The Filter panel is displayed.

4. In the above panel, utilize one or more of the following options to filter the sensors:

   • Host Name: Specify the sensor’s host name to filter the sensor list. You can start typing the name of the host. Type one character and a list of sensors that contain that character is displayed, as you continue to type the list is filtered to match.

   • Status: Select one or more statuses from the drop-down menu. The available options are Connected, Disconnected, and Disabled.

   • Sensor Type: Select the type of sensor from the drop-down menu. For example, Cloud Link Sensor.

     Only one sensor can be selected at a time for filtering.

   • Sensor Version: Select one or more versions from the drop-down menu. For example, when you type the two characters (12 versions), and a list of sensors that contain those characters are displayed.

5. Click Apply Filter.

   The sensors are displayed in the right panel according to the filter you selected. To clear filters, at the bottom of the left panel, click Clear.

See also

• Install Cloud Link Service
• Uninstall the Cloud Link Service

11 - Install NetWitness UEBA (Cloud) with an Existing UEBA (On-premises)

If you have UEBA (On-premises) deployed on your NetWitness Platform, you can install NetWitness UEBA (Cloud) and can run them simultaneously. This is because they are independent of each other. However, the User Interface can be connected to only one source at a time.

When you have both UEBA (On-premises) and UEBA (Cloud) running simultaneously, it can impact the performance as both consume data from the NetWitness Platform. UEBA (Cloud) receives data from the Cloud Link Service installed on the Decoder hosts, and the UEBA (On-premises) receives the data from the Concentrator or Broker.

Install and Setup NetWitness UEBA (Cloud)

1. Install the Cloud Link Service. For more information, see Install Cloud Link Service.

2. Download the Activation Package. For more information, see Download the Activation package.

3. Register the Cloud Link Service. For more information, see Register the Cloud Link Service.

4. Verify the Cloud Link Service is working. For more information, see Verify if the Cloud Link Service is working.

5. Enable UEBA (Cloud) data transfer by running the following command:

   nw-manage --enable-cba
   

   This command connects the UEBA (Cloud) to the Admin Server, and the data in the Users page is fetched from the UEBA (Cloud). For more information, see Transfer UEBA (Cloud) data to NetWitness platform.

6. Enable the UEBA (Cloud) incident rules. For more information, see Step 1. Configure Alert Sources to Display Alerts in the Respond View.

Uninstall NetWitness UEBA (Cloud)

1. Uninstall the Cloud Link Services from the Decoders. For more information, see Uninstall the Cloud Link Service.

2. Contact the NetWitness Customer Support to uninstall all the related tenants and entitlements.

   If you want to reconnect to the UEBA (On-premises), run the following command:

   nw-manage --disable-cba
   

   This command connects the UEBA (On-premises) to the Admin Server and fetch the data in the Users page from the UEBA (On-premises).

See also

• Install Cloud Link Service
• Uninstall the Cloud Link Service

12 - Change the Default Service for Investigation

By default, if you have a Broker installed on an Admin Server, then the service ID of a Broker will be automatically updated in Cloud Link Service as default service for investigation on the NetWitness Platform user interface for UEBA (Cloud). However, if there are no Brokers installed on an Admin server, then any one of the service ID of a Broker installed on another node will be automatically updated in Cloud Link Service. If you want to set a specific service ID for a Broker, you can configure in the Explore view of the Cloud Link Service on the NetWitness Platform user interface.

To locate the service ID for a Broker

1. Log in to the NetWitness Platform.

2. Go to Admin > Services.

3. In the Services list, search Broker in the Filter field.

4. Select a Broker, and click > View > Explore.

   The Explore view for the Broker is displayed.

   

5. On the left panel, click sys > stats.

   The service ID is displayed on the right panel.

   

To set the service ID for a Broker

1. Log in to the NetWitness Platform.

2. Go to Admin > Services.

3. In the Services list, search Cloud Link Server in the Filter field.

4. Select the Cloud Link Server and click > View > Explore.

   The Explore view for the service is displayed.

   

5. On the left panel, click cloudlink/sync.

6. Edit and enter the required service ID of a broker in the default-service-for-investigation parameter field.

   

See also

• Install Cloud Link Service
• Update the Cloud Link Service Automatically

13 - Configure the Proxy for Cloud Link Service

If you are using a proxy network, you can configure the proxy for the Cloud Link Service under the NetWitness Platform, System > HTTP Proxy Settings page. This allows the Cloud Link Service to connect using a proxy and transfers data to the NetWitness Platform.

To configure proxy for Cloud Link Service

1. Log in to the NetWitness Cloud Portal.

2. Go to Admin > System.

3. In the options panel, select HTTP Proxy Settings.

   The HTTP Proxy Settings panel is displayed.

   

4. Click the Enable checkbox.

   The fields where you configure the proxy settings are activated.

5. Type the hostname for the proxy server and the port used for communications on the proxy server.

6. (Optional) Type the username and password that serve as credentials to access the proxy server if authentication is required.

7. (Optional) Enable Use NTLM Authentication and type the NTLM domain name.

8. (Optional) Enable Use SSL if communications use Secure Socket Layer.

9. To save and apply the configuration, click Apply.

   The proxy is immediately available for use for the Cloud Link Service.

See also

• Install Cloud Link Service
• Troubleshoot the Cloud Link Service

14 - Configure Domains required to be Whitelisted for NetWitness UEBA

In case your organization uses a firewall to restrict network access to only specific websites or software, you need to whitelist the following domains to ensure that Cloud Link Service can communicate with AWS-related services and transfer the required metadata to UEBA for analytics.

• These Domains/URLs will be region-specific for the deployment. The region can be found in the device activation package from the region section.

  • sts.us-(region).amazonaws.com
  • s3.us-(region).amazonaws.com
  • kinesis.(region).amazonaws.com
  • monitoring.us-(region).amazonaws.com
  • ssm.us-(region).amazonaws.com

• Besides the common domains you need to whitelist specific domains based on your deployment and are provided in the device activation package. Following are the names of domains/URLs:

  • deviceApi
  • controlApi
  • iotApi
  • iotHost
  • detectaiApiGatewayUrl

In the following example, with this device activation package, the given deployment is in us-east-1 region, and the highlighted domains are the ones that must be whitelisted for this deployment.

The following table shows the list of domains/URLs that are whitelisted for the deployment in the above example:

See also

• Plan your Considerations to Install Cloud Link Service
• Install Cloud Link Service

15 - Troubleshoot the Cloud Link Service

Problem	Cause	Solution
Cloud Link Service fails to register when you use an older activation package.	If you have generated a new activation package but used an older activation package to register the Cloud Link Service, the registration fails and no error message is logged.	To resolve the issue, perform the following steps: 1. Generate and download the new activation package from NetWitness Platform on the cloud. For more information, see Download the Activation Package. 2. Register the Cloud Link Service using the new activation package. For more information, see Register the Cloud Link Service.
Cloud Link Service fails to register when the date and time are not in sync with NTP Server.	If the date and time on the host containing the Cloud Link Service are not in sync with the NTP server, then invalid certificate exceptions are logged.	Update the date and time to be in sync with the NTP Server. Execute the following commands to resolve the issue: 1. To display the default date and time on your system, execute the following command: timedatectl status 2. Execute the following command to turn off the NTP Server: timedatectl set-ntp 0 3. Execute the following command to correct the date and time: timedatectl set-time ‘date time’ Replace the default date and time with current date and time. Example: timedatectl set-time '2020-02-02 16:14:50' 4. Execute the following command to turn on the NTP Server: timedatectl set-ntp 1 5. Register the Cloud Link Service by using the recently downloaded activation package. For more information, see Register the Cloud Link Service.
Deletion of the Cloud Link Service sensor failed	If you have removed the Cloud Link Service sensor when the Cloud Link Service is offline, the logs show the Cloud Link Service sensor is deleted, however the Cloud Link service is not deleted and is back online.	Ensure that you uninstall the Cloud Link Service on the NetWitness Platform soon after you remove it from the NetWitness Cloud Portal UI to delete the Cloud Link Service completely. For more information, see Uninstall the Cloud Link Service.
Unable to update the Cloud Link Service due to RPM file download failure.	During network outage, the RPM file download fails because there is no access to the RPM file URL.	Check your network connection and try again. If the problem persists, try after some time.
Unable to update the Cloud Link Service.	One of the services might be down or offline.	Ensure that all the services are up and running. For more details, check the following services log: - Check the orchestration log on the Admin server: /var/log/netwitness/orchestration-server/orchestration-server.log - Check the chef-solo.log on the Cloud Link servers: /var/log/netwitness/config-management/chef-solo.log
Unable to update the Cloud Link Service due to RPM checksum validation failure.	The checksum validation of the RPM file fails because of the following reasons: - The RPM file downloaded is corrupted. - The RPM file downloaded is incomplete or incorrect.	Check your network connection and try again. If the problem persists, try after some time.
Unable to update the Cloud Link Sensor due to a Timeout.	If the sensor fails to update within a predefined 60-minute timeframe, an email notification will be sent to the administrators regarding the sensor update timeout failure. The timeout could occur due to network connectivity issues.	If encountering an update timeout failure, try the following steps: 1. Wait for 30 minutes and then retry the sensor update. 2. Check the following services log: - Orchestration log on the admin server: /var/log/netwitness/orchestration-server/orchestration-server.log - Chef-solo.log on the Cloud Link Servers: /var/log/netwitness/config-management/chef-solo.log - Cloud Link service logs on the Cloud Link Servers: /var/log/netwitness/cloud-link-server/cloud-link-server.log For more information, refer to the Orchestration section in the Troubleshooting Installation and Upgrade Issues topic of the NetWitness Upgrade Guide for 12.4.2 version.
Unable to update the Cloud Link Sensor due to Canceled operation.	If the sensor fails to communicate for more than 24 hours after the sensor update is initiated, the system will automatically cancel the sensor update process and an email notification will be sent to the administrator.	To address the issue, check if the Cloud Link Server is offline. Then try restarting the Cloud Link Server service from the Services page using the following steps: 1. Log in to the NetWitness Platform. 2. Go to (Admin) > Services. 3. In the Services list, select the Cloud Link Server service. 4. Click > Start. 5. Additionally, ensure that the internet connection on the Cloud Link Sensor is functioning properly by checking the firewall and network settings.

See also

• Install Cloud Link Service
• Update the Cloud Link Service Automatically