Unable to export filtered event list.

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform
• Endpoint Protection with Endpoint Detection and Response

Issue/Introduction

In Endpoint Detection and Response(EDR), unable to export a list of filtered events in Symantec EDR. Failed to export grid.INVALID_REPORT_TITLE is the error displayed.

 

Steps to reproduce:

1. In EDR UI, navigate to Search> Database> Events
2. Then the Export option is selected. 
   
   Result: The error "Failed to export grid INVALID_REPORT_TITLE" is produced no matter what you type in the Report Name field.
   
   

 

PLEASE NOTE: You may filter the events differently and for a different period of time, but the error is the same.

Cause

There are two possible causes of this issue.

• The default ReportRequest entity is in PDF format.  The entity is executed before the correct CSV value is set.
• There is a logical error in the javascript type script when the error response is generated.

Resolution

Use, Indexed-based search with field_name:value while searching for events. Instead of direct search in the search bar which was causing frequent time-outs on the EDR UI. It will help further in generating the report. 

Workaround:

Do one of the following:

• The current user should log out and then log back in.  A new session context is generated on each login.
• Logout and then use a different browser to log in.

Note: Ensure the browser you are using meets the requirements for the EDR console.  See - Browser requirements for the EDR appliance console in the latest SEDR 4.x documentation.