# Forensics report cannot be downloaded from the Threat Hunting Event tab

## Product
Endpoint Security - Server, Harmony Endpoint

## Version
R81 (EOS), R81.10 (EOS), R81.20

## OS
Windows

## Last Modified
2024-10-22

## Symptoms
- Attempts to download Forensics report from Threat Hunting Event ended with error message "Unable to load report. Cannot read properties of null (reading 'base64Contents')"

## Cause
The system replaces `rfl_mgmt.jar` that included two fixes for two errors seen in `server_messsages`:

1. Some of Forensic logs coming from Kusto come with the **time** field entry as follows: "2022-11-20T13:08:10.000001Z". RFL parses ISO 8601 dates, which look like this: "2023-02-14T09:49:24Z" (NO MILLISECONDS).

Pack capture time field includes milliseconds which causes the following:
   
   `</response>] java.text.ParseException: Unparseable date: "2023-10-16T16:05:26.000001Z"`

```java
   at java.text.DateFormat.parse(DateFormat.java:377)
   at com.checkpoint.management.rfl.fetchingLogUtils.LogsUtils.getAttachmentRelatedFieldsMapFromRFLResponse(LogsUtils.java:20)
   at com.checkpoint.management.rfl.handlers.FetchingLogHandler.handleRFLResponse(FetchingLogHandler.java:9)
   at com.checkpoint.rfl_sic.rflConnector.RFLClientConnector.onMessage(RFLClientConnector.java:24)
   at org.apache.activemq.ActiveMQMessageConsumer.dispatch(ActiveMQMessageConsumer.java:1361)
   at org.apache.activemq.ActiveMQSessionExecutor.dispatch(ActiveMQSessionExecutor.java:131)
   at org.apache.activemq.ActiveMQSessionExecutor.iterate(ActiveMQSessionExecutor.java:202)
   at org.apache.activemq.thread.PooledTaskRunner.runTask(PooledTaskRunner.java:129)
   at org.apache.activemq.thread.PooledTaskRunner$1.run(PooledTaskRunner.java:47)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
   at java.lang.Thread.run(Thread.java:825)
   ```

2. The field `module_name` is written as Check Point SmartConsole, which includes white spaces. Packet capture request includes spaces, which causes the following:

`2023-11-07 05:32:46,300 ERROR [pool-1-thread-2171] com.checkpoint.rfl.exceptions.RFLExceptionUtils.getRFLErrorResponseFromRFLException:20 -`
   
   `java.lang.IllegalArgumentException: Illegal character in query at index 87: http://127.0.0.1:18244//packet_capture?session_id=0&product=Forensics&module_name=Check Point SmartConsole&incident_uid=5c792d24-2bfd-4e76-a31e-caceda2ec718&date=07Nov2023&service=ignore&storage_log_server=164.100.1.8&admin_name=nogae%40checkpoint_com_EpMaaS_Only&machine=127.0.0.1&application=WEB_API`
   
   ```java
   at java.net.URI.create(URI.java:863)
   at org.apache.http.client.methods.HttpPost.<init>(HttpPost.java:73)
   at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest_aroundBody4(PacketCaptureGetter.java:102)
   at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter$AjcClosure5.run(PacketCaptureGetter.java:1)
   at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:149)
   at com.checkpoint.aspects.TraceMethodLoggerAspect.aroundMethodLoggerTest(TraceMethodLoggerAspect.java:2)
   at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest(PacketCaptureGetter.java:85)
   at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.performHttpPostRequest(Pack`
   ```

## Solution
This problem was fixed. The fix is included in:

- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 79
- [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 158
- [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 106

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

#### NOTE
This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties
- **Access Level**: General
- **Status**: Approved by TAC
- **Date Created**: 2023-12-13
- **Last Modified**: 2024-10-22