Several data enrichment provider health tests are failing in Security Analytics

Products

• Security Analytics

Issue/Introduction

In order for the Security Analytics appliance to successfully PASS several of the data enrichment tests, certain URLs must be accessible through the firewall.  If the SA appliance cannot reach these provider URLs, you will see the following tests fail on the System Health page:

• FRS
• Symantec STARGate File Analysis
• Symantec STARGate Service
• FRS Reputation Service
• Rule Engine

Environment

Security Analytics version 8.2.8 and greater

Cause

The firewall is blocking communication to these services on the Internet.  

Resolution

Allow the following URLs to be accessible over port 443 on your firewall:

ent-shasta-rrs.symantec.com
liveupdate.symantec.com
shasta-clt.symantec.com
subscription.es.bluecoat.com
subscription-ipv6.es.bluecoat.com
webpulse.es.bluecoat.com
webpulse-ipv6.es.bluecoat.com

Additional Information