Known Issues

June 25, 2024

Components Title, Problem and Workaround Fixed Date
Cloud Link Service Title: Cloud Link Sensor upgrade from version 12.4 to 12.4.1 cannot be performed using the NetWitness Cloud Portal UI.
Issue: Users cannot upgrade the Cloud Link Sensor from the 12.4 to the 12.4.1 version using the UI due to the AlmaOS change of the NetWitness Platform from 12.4 or later.
Workaround: Do one of the following to resolve the issue:
1. You must download and manually install the Cloud Link Sensor RPM for version 12.4.1 from the NetWitness Community or NetWitness Live. Follow these steps:
    a. Download the Cloud Link Sensor RPM for version 12.4.1 from the NetWitness Community or NetWitness Live.
    b. Install the RPM on the Cloud Link Sensor host manually using the command rpm -Uvh .
    c. To verify if the Cloud Link Sensor was upgraded successfully, navigate to Admin > Sensor List and view the updated sensor      version number 12.4.1 in the Sensor Version column of the NetWitness Cloud Portal.
2. Upgrade all NetWitness Platform services to version 12.4.1 to ensure a successful upgrade for sensors.

March 14, 2024

Components Title, Problem and Workaround Fixed Date
Cloud Link Service Title: No email notifications are received when sensor updates are completed or failed.
Issue: UEBA Cloud users are not receiving email notifications for sensor update success or failure after the Cloud Link Sensor update.
Workaround: Perform the following steps to verify if the sensor updates are successful or failed:
For Success: When the sensor updates are completed (for example, 12.3 to 12.3.1), you can navigate to the Sensor List tab and view the updated sensor version number 12.3.1 in the Sensor Version column of the NetWitness Cloud Portal.
For Failed: If the sensor update fails, navigate to the Sensor List tab and see the warning icon next to the sensor version number in the Sensor Version column of the NetWitness Cloud Portal.

Note

If you hover over the warning icon, it displays that the sensor update has failed, and the sensor version is reverted to the previously installed version.
Components Title, Problem and Workaround Fixed Date
Cloud Link Service Title: UEBA Cloud users with Cloud Link Sensor on 12.3.0.0 or lower may experience frequent sensor status updates, resulting in excessive sensor status notifications.
Issue: UEBA Cloud users with Cloud Link Sensor on 12.3 0 0 or lower versions may experience frequent sensor status updates, resulting in a large number of notification emails regarding the connection and disconnection of Cloud Link Sensor.
Workaround: Upgrade all NetWitness Platform services to 12.3.1.0 or a later version to resolve the issue. For more information on the upgrade, see NetWitness Upgrade Guide 12.3.1.0.

Note

Email notifications can be enabled or disabled based on the user’s preference. For more information, see topic Configure Email Notification Preferences for UEBA.
Components Title, Problem and Workaround Fixed Date
UEBA Cloud Title: No Juniper VPN events are generated in the NetWitness Platform UI for UEBA Cloud.
Issue: In version 12.3.1, the Cloud Link Sensor query expects the user.src metadata to be present, but the decoder does not parse that metadata. As a result, the system is unable to receive Juniper VPN events. In version 12.4, the query has been corrected to use user.dst metadata.
Workaround: To resolve this issue, you must upgrade the NetWitness Platform to the 12.4 version.

March 16, 2021

Components Title, Problem and Workaround Fixed Date
Cloud Link Service Title: Intermittent data loss was observed during data upload, after changing proxy configurations.
Issue: If you change the proxy configurations after registering the Cloud Link Service, you may experience intermittent data loss.
Workaround: Ensure that the proxy settings are applied before the Cloud Link Service is deployed. Data transfer resumes automatically once the new proxy configuration takes effect.		 June 2, 2021