Error when uploading UBA SSO metadata xml file in ADFS

Workaround:

Removing <#list> entries from the SP MetaData File.

Upgrading to version 5.4.1 breaks data sources

Workaround:

1. Ask customer to generate new health check to get datasource information so that we may need to manually recreate datasource.

2. Have customer upgrade to UBA 5.4.1 following our public docs.

3. IF customer encounters the issue with the datasources page inaccessible, continue with the steps below.

4. Run the following script on the command line on the postgres node to identify datasource(s) that have corrupted connectString:

#!/bin/bash
result=$(psql -d caspidadb -t  -c "select id, name, connectString from datasources")

while read -r result_line; do
  IFS="|" read -r salt name value <<< "$result_line"
  if  [ ! -z "$salt" ]  && [ ! -z "$name" ] && [ ! -z "$value" ]; then
    saltValue=$(echo "$salt" | xargs)
    value=$(echo "$value" | xargs)
    name=$(echo "$name" | xargs)
    decryptedValue=$(java -cp /opt/caspida/lib/CaspidaSecurity.jar com.caspida.common.tools.CryptoUtil -d "$saltValue" "$value" )
    echo $saltValue  $name $decryptedValue
  fi
done <<< "$result"

5. From the output, find and take note of the dataSourceId that have the corrupted connectString, as shown in the following example: https://docs.splunk.com/File:UBA-19440_workaround_image.png

6. Delete the datasource(s) using API call from UBA management node by replacing "XXXXXXXXXXX" with what was found in step 2:

curl -Ssk -X DELETE https://localhost:9002/datasources/delete?id=XXXXXXXXXXX -H "Authorization: Bearer $(grep '^\s*jobmanager.restServer.auth.user.token=' /opt/caspida/conf/uba-default.properties | cut -d'=' -f2)"

7. Manually recreate datasource that was deleted.

Error Encountered When Cloning Splunk Datasource and Selecting Source Types

Workaround:

Re-enter the password on the Connection page for the Splunk endpoint.

UBA identifies end user/service account are accessing hard disk volumes instead of built-in computer account

Workaround:

Disable the augmented_access rule.

Steps to disable rule:

1. remove (or move to some other location outside of UBA as a backup) the file /etc/caspida/conf/rules/user/ad/augmented_access.rule

2. sync-cluster (/opt/caspida/bin/Caspida sync-cluster /etc/caspida/conf/rules/user/ad/)

3. restart uba (/opt/caspida/bin/Caspida stop & /opt/caspida/bin/Caspida start)

Kubernetes certificates expire after one year

Workaround:

Run the following commands on the Splunk UBA master node:

/opt/caspida/bin/Caspida remove-containerization
/opt/caspida/bin/Caspida setup-containerization
/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all