Known issues for RiskVision v2.0.0

52082 | Release Notes | TRITON RiskVision | 24-Sep-2015

As a best practice, TRITON RiskVision administrators are encouraged to update their deployment as soon as possible after setting up the system. Use the System > Updates tab of the Local Manager to keep the operating system and RiskVision software current with the latest hotfixes, patches, and upgrades.

As fixes are found for these known issues, the Updates tab will display a notification that system updates are available.

Transaction Viewer

In the Transaction Viewer, a threat level of No threat detected indicates that no local or cloud analytics found characteristics indicating malicious, suspicious, or data loss activity.

This is true in either of the following cases:

All analytics successfully analyzed the transaction and found no threat.

No analytic returned a threat score due to errors or timeouts.

The Transaction Viewer does not currently indicate whether a threat level of "no threat detected" is based on completed or failed analysis.

This issue is being tracked as TRV-1893 and 1894.

The Excel button above the Transaction Viewer is intended to generate a CSV file containing all incident records in the database. Currently, clicking the button has no effect. No file is generated.

This issue is being tracked as TRV-1918.

Analysis

In rare cases, the Data Analysis Plugin does not return results before the RiskVision timeout period ends. When this occurs, the Transaction Viewer simply does not show any Data Analysis results for a transaction.

If you encounter this problem, it will be reflected in the Data Analysis Plugin > Total failed analysis statistic on the Local Manager Diagnostics > Performance page.

This issue is being tracked as TRV-1683.

In some cases, the File Sandbox Processor plugin incorrectly reports that File Sandboxing is not available. When this occurs:

Files are not submitted for sandboxing.

File Sandbox Processor does not poll for sandboxing results.

If this problem occurs, administrators can resolve it by restarting the File Sandbox Processor service on the System > Services page in the Local Manager.

This issue is being tracked as TRV-1912.

Rules

On the Rules page, the description of the default internal network rules are incorrect. Internal network rules are used to distinguish between internal and external traffic in order to determine traffic direction (inbound or outbound), and do not have anything to do with whitelisting.

This issue is being tracked as TRV-1915.