sk181800 - Forensics report cannot be downloaded from the Threat Hunting Event tab

Forensics report cannot be downloaded from the Threat Hunting Event tab

Product

Endpoint Security - Server, Harmony Endpoint

Version

R81 (EOS), R81.10 (EOS), R81.20

OS

Windows

Last Modified

2024-10-22

Symptoms

Cause

The system replaces rfl_mgmt.jar that included two fixes for two errors seen in server_messsages:

  1. Some of Forensic logs coming from Kusto come with the time field entry as follows: "2022-11-20T13:08:10.000001Z". RFL parses ISO 8601 dates, which look like this: "2023-02-14T09:49:24Z" (NO MILLISECONDS).

Pack capture time field includes milliseconds which causes the following:

</response>] java.text.ParseException: Unparseable date: "2023-10-16T16:05:26.000001Z"

   at java.text.DateFormat.parse(DateFormat.java:377)
   at com.checkpoint.management.rfl.fetchingLogUtils.LogsUtils.getAttachmentRelatedFieldsMapFromRFLResponse(LogsUtils.java:20)
   at com.checkpoint.management.rfl.handlers.FetchingLogHandler.handleRFLResponse(FetchingLogHandler.java:9)
   at com.checkpoint.rfl_sic.rflConnector.RFLClientConnector.onMessage(RFLClientConnector.java:24)
   at org.apache.activemq.ActiveMQMessageConsumer.dispatch(ActiveMQMessageConsumer.java:1361)
   at org.apache.activemq.ActiveMQSessionExecutor.dispatch(ActiveMQSessionExecutor.java:131)
   at org.apache.activemq.ActiveMQSessionExecutor.iterate(ActiveMQSessionExecutor.java:202)
   at org.apache.activemq.thread.PooledTaskRunner.runTask(PooledTaskRunner.java:129)
   at org.apache.activemq.thread.PooledTaskRunner$1.run(PooledTaskRunner.java:47)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
   at java.lang.Thread.run(Thread.java:825)
  1. The field module_name is written as Check Point SmartConsole, which includes white spaces. Packet capture request includes spaces, which causes the following:

2023-11-07 05:32:46,300 ERROR [pool-1-thread-2171] com.checkpoint.rfl.exceptions.RFLExceptionUtils.getRFLErrorResponseFromRFLException:20 -

java.lang.IllegalArgumentException: Illegal character in query at index 87: http://127.0.0.1:18244//packet_capture?session_id=0&product=Forensics&module_name=Check Point SmartConsole&incident_uid=5c792d24-2bfd-4e76-a31e-caceda2ec718&date=07Nov2023&service=ignore&storage_log_server=164.100.1.8&admin_name=nogae%40checkpoint_com_EpMaaS_Only&machine=127.0.0.1&application=WEB_API

at java.net.URI.create(URI.java:863)
at org.apache.http.client.methods.HttpPost.<init>(HttpPost.java:73)
at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest_aroundBody4(PacketCaptureGetter.java:102)
at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter$AjcClosure5.run(PacketCaptureGetter.java:1)
at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:149)
at com.checkpoint.aspects.TraceMethodLoggerAspect.aroundMethodLoggerTest(TraceMethodLoggerAspect.java:2)
at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest(PacketCaptureGetter.java:85)
at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.performHttpPostRequest(Pack`

Solution

This problem was fixed. The fix is included in:

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions: Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties