Cannot See Rules in the Admin Console Rules List of RSA Web Threat Detection
3 years ago
Originally Published: 2018-01-17
Article Number
000041412
Applies To
RSA Product Set: Web Threat Detection
RSA Product/Service Type: Forensics
RSA Version/Condition: 5.1, 6.x
Issue
There is an issue with Real Time Rule where the behavior after a rule edit is that some or none of the rules work. Additionally, rules cannot be seen in the admin GUI Rules section to be edited. This often occurs after a rule has been edited. 
Cause
Corruption of the mitigator.rules file in /var/opt/silvertail/etc may be caused by the introduction of a non US character. This can happen when cutting and pasting from a section in a rule or from a source of text outside of the WTD Admin Rule edit function. 

Note: The Customer is advised to do frequent backups of this directory (/var/opt/silvertail/etc). 
Resolution
  • The mitigator.rules file is in an xml format which can be opened and edited.
Note: Best practice is to create a backup copy before editing.
  • Putting the file through a JSON or XML format parser could help determine syntax and structure issues, e.g., missing brackets and incorrect indents.
 
  • To create a new rule it is best to duplicate an existing rule and edit it. 
 
  • Do not add text from non-WTD GUI sources, hand typing rule modifications in the editor, is considered a  best practice. 

Related Articles

Trending Articles

Don't see what you're looking for?