ATA download activities failed

%3CLINGO-SUB%20id%3D%22lingo-sub-218902%22%20slang%3D%22en-US%22%3EATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218902%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20searched%20on%20a%20user%20and%20would%20like%20to%20download%20a%20report%20of%20their%20activity%2C%20but%20when%20I%20click%20on%20the%20Download%20activities%20button%20I%20just%20get%20an%20error%20message%20%22Failed%20to%20download%22.%20I%20can%20download%20the%20pre-defined%20reports%20successfully%2C%20just%20not%20user%20activities.%20I've%20tried%20both%20from%20a%20workstation%20and%20on%20the%20ATA%20Center%20server%20itself%2C%20as%20well%20as%20with%20different%20browsers.%20Not%20sure%20how%20to%20go%20about%20troubleshooting%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-218902%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdvanced%20Threat%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220254%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220254%22%20slang%3D%22en-US%22%3E%3CP%3EThanks!%3C%2FP%3E%0A%3CP%3EIt's%20a%20new%20bug.%3C%2FP%3E%0A%3CP%3EIt%20happens%20when%20the%20report%20contains%20a%20logical%20activity%20of%20%22failed%20logon%22%20where%20the%26nbsp%3B%20user%20is%20unknown.%3C%2FP%3E%0A%3CP%3EYou%20managed%20to%20generate%20the%20report%20by%20%22missing%22%20this%20specific%20activity%20using%20the%20filter.%3C%2FP%3E%0A%3CP%3EI%20opened%20a%20bug%20to%20track%20it%20down%20for%20a%26nbsp%3B%20future%20version.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220036%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220036%22%20slang%3D%22en-US%22%3E%3CP%3E2018-07-30%2013%3A36%3A53.9187%208648%2032%20Error%20%5BStringExtension%5D%20%5Bmessage%3DWebApi%20action%20failed%20%5BActionArguments%3D%7B%3CBR%20%2F%3E%22id%22%3A%20%220389f57d-fff4-461d-b992-4b5a5840f665%22%2C%3CBR%20%2F%3E%22endDate%22%3A%20%222018-07-30T00%3A00%3A00Z%22%2C%3CBR%20%2F%3E%22startDate%22%3A%20%222018-07-16T00%3A00%3A00Z%22%2C%3CBR%20%2F%3E%22localeId%22%3A%20%22en-us%22%2C%3CBR%20%2F%3E%22types%22%3A%20%5B%3CBR%20%2F%3E%22AbnormalBehaviorSuspiciousActivity%22%2C%3CBR%20%2F%3E%22AbnormalProtocolSuspiciousActivity%22%2C%3CBR%20%2F%3E%22AbnormalSensitiveGroupMembershipChangeSuspiciousActivity%22%2C%3CBR%20%2F%3E%22AbnormalVpnSuspiciousActivity%22%2C%3CBR%20%2F%3E%22AccountEnumerationSuspiciousActivity%22%2C%3CBR%20%2F%3E%22BruteForceSuspiciousActivity%22%2C%3CBR%20%2F%3E%22DirectoryServicesReplicationSuspiciousActivity%22%2C%3CBR%20%2F%3E%22DnsReconnaissanceSuspiciousActivity%22%2C%3CBR%20%2F%3E%22EncryptionDowngradeSuspiciousActivity%22%2C%3CBR%20%2F%3E%22EnumerateSessionsSuspiciousActivity%22%2C%3CBR%20%2F%3E%22ForgedPacSuspiciousActivity%22%2C%3CBR%20%2F%3E%22GoldenTicketSuspiciousActivity%22%2C%3CBR%20%2F%3E%22HoneytokenActivitySuspiciousActivity%22%2C%3CBR%20%2F%3E%22LdapBruteForceSuspiciousActivity%22%2C%3CBR%20%2F%3E%22MaliciousServiceCreationSuspiciousActivity%22%2C%3CBR%20%2F%3E%22MassiveObjectDeletionSuspiciousActivity%22%2C%3CBR%20%2F%3E%22PassTheHashSuspiciousActivity%22%2C%3CBR%20%2F%3E%22PassTheTicketSuspiciousActivity%22%2C%3CBR%20%2F%3E%22RemoteExecutionSuspiciousActivity%22%2C%3CBR%20%2F%3E%22RetrieveDataProtectionBackupKeySuspiciousActivity%22%2C%3CBR%20%2F%3E%22SamrReconnaissanceSuspiciousActivity%22%2C%3CBR%20%2F%3E%22CredentialsValidation%22%2C%3CBR%20%2F%3E%22DirectoryServicesReplication%22%2C%3CBR%20%2F%3E%22DnsQuery%22%2C%3CBR%20%2F%3E%22FailedLogon%22%2C%3CBR%20%2F%3E%22InteractiveLogon%22%2C%3CBR%20%2F%3E%22LdapCleartext%22%2C%3CBR%20%2F%3E%22PrivateDataRetrieval%22%2C%3CBR%20%2F%3E%22RemoteDesktop%22%2C%3CBR%20%2F%3E%22ResourceAccess%22%2C%3CBR%20%2F%3E%22SamrQuery%22%2C%3CBR%20%2F%3E%22ServiceCreation%22%2C%3CBR%20%2F%3E%22SmbSessionEnumeration%22%2C%3CBR%20%2F%3E%22TaskScheduling%22%2C%3CBR%20%2F%3E%22VpnConnection%22%2C%3CBR%20%2F%3E%22WmiExecution%22%2C%3CBR%20%2F%3E%22DirectoryServicesChange%22%3CBR%20%2F%3E%5D%3CBR%20%2F%3E%7D%5D%5D%20System.ArgumentNullException%3A%20Value%20cannot%20be%20null.%3CBR%20%2F%3EParameter%20name%3A%20format%3CBR%20%2F%3Eat%20Microsoft.Tri.Infrastructure.Extensions.StringExtension.FormatWithCulture(String%20format%2C%20CultureInfo%20cultureInfo%2C%20Object%5B%5D%20arguments)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Translation.LogicalActivities.FailedLogon.GetDescriptionAsync(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Data.EntityExporter.%26lt%3B%26gt%3Bc__DisplayClass13_0%601.%3CCREATELOGICALACTIVITIESTABLEASYNC%3Eb__0%5B%5D(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Infrastructure.Extensions.EnumerableExtension.SelectAsync%5B%5D(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Data.EntityExporter.CreateLogicalActivitiesTableAsync%5B%5D(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Reports.LogicalActivitiesReport.CreateFileContentAsync(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Data.Excel.CreateFileDataAsync(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Reports.Reporter.CreateAsync(%3F)%3CBR%20%2F%3Eat%20async%20Microsoft.Tri.Center.Management.Controllers.UniqueEntityController.DownloadLogicalActivitiesReportAsync(%3F)%3CBR%20%2F%3Eat%20async%20System.Threading.Tasks.TaskHelpersExtensions.CastToObject%5B%5D(%3F)%3CBR%20%2F%3Eat%20async%20System.Web.Http.Controllers.ApiControllerActionInvoker.InvokeActionAsyncCore(%3F)%3CBR%20%2F%3Eat%20async%20System.Web.Http.Controllers.ActionFilterResult.ExecuteAsync(%3F)%3CBR%20%2F%3Eat%20async%20System.Web.Http.Filters.AuthorizationFilterAttribute.ExecuteAuthorizationFilterAsyncCore(%3F)%3CBR%20%2F%3Eat%20async%20System.Web.Http.Filters.AuthorizationFilterAttribute.ExecuteAuthorizationFilterAsyncCore(%3F)%3CBR%20%2F%3Eat%20async%20System.Web.Http.Controllers.ExceptionFilterResult.ExecuteAsync(%3F)%3C%2FCREATELOGICALACTIVITIESTABLEASYNC%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220026%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220026%22%20slang%3D%22en-US%22%3E%3CP%3ECan%20yo%20share%20the%20error%20details%20from%20the%20log%20including%20the%20call%20stack%20(from%20the%20latest%20failure%20on%201.9.1)%20%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220024%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220024%22%20slang%3D%22en-US%22%3E%3CP%3EI%20installed%20Update%201%20this%20morning%20and%20I%20still%20got%20the%20Failed%20to%20download%20error.%20However%2C%20in%20looking%20at%20the%20Microsoft.Tri.Center.log%20file%26nbsp%3BI%20noticed%20an%20error%20that%20made%20me%20try%20filtering%20my%20results.%20After%20I%20did%20that%20the%20report%20downloaded%20fine.%20It%20seems%20that%20leaving%20the%20filter%20a%20the%20default%20of%20all%20activities%20resulted%20in%20the%20error%20when%20attempting%20to%20download.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-219709%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-219709%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20fixed%20an%20issue%20that%20looks%20very%20similar%20to%20what%20you%20describe%20in%201.9%20update%201.%3C%2FP%3E%0A%3CP%3EPlease%20upgrade%20and%20see%20if%20it%20resolves%20the%20problem%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D56725%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D56725%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-219626%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-219626%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20on%20version%201.9.7312.32791%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218974%22%20slang%3D%22en-US%22%3ERe%3A%20ATA%20download%20activities%20failed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218974%22%20slang%3D%22en-US%22%3E%3CP%3EOn%20which%20ATA%20version%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

I've searched on a user and would like to download a report of their activity, but when I click on the Download activities button I just get an error message "Failed to download". I can download the pre-defined reports successfully, just not user activities. I've tried both from a workstation and on the ATA Center server itself, as well as with different browsers. Not sure how to go about troubleshooting this.

7 Replies
Highlighted

On which ATA version?

Highlighted

We are on version 1.9.7312.32791

Highlighted

We fixed an issue that looks very similar to what you describe in 1.9 update 1.

Please upgrade and see if it resolves the problem:

https://www.microsoft.com/en-us/download/details.aspx?id=56725

Highlighted

I installed Update 1 this morning and I still got the Failed to download error. However, in looking at the Microsoft.Tri.Center.log file I noticed an error that made me try filtering my results. After I did that the report downloaded fine. It seems that leaving the filter a the default of all activities resulted in the error when attempting to download.

 

Highlighted

Can yo share the error details from the log including the call stack (from the latest failure on 1.9.1) ?

Highlighted

2018-07-30 13:36:53.9187 8648 32 Error [StringExtension] [message=WebApi action failed [ActionArguments={
"id": "0389f57d-fff4-461d-b992-4b5a5840f665",
"endDate": "2018-07-30T00:00:00Z",
"startDate": "2018-07-16T00:00:00Z",
"localeId": "en-us",
"types": [
"AbnormalBehaviorSuspiciousActivity",
"AbnormalProtocolSuspiciousActivity",
"AbnormalSensitiveGroupMembershipChangeSuspiciousActivity",
"AbnormalVpnSuspiciousActivity",
"AccountEnumerationSuspiciousActivity",
"BruteForceSuspiciousActivity",
"DirectoryServicesReplicationSuspiciousActivity",
"DnsReconnaissanceSuspiciousActivity",
"EncryptionDowngradeSuspiciousActivity",
"EnumerateSessionsSuspiciousActivity",
"ForgedPacSuspiciousActivity",
"GoldenTicketSuspiciousActivity",
"HoneytokenActivitySuspiciousActivity",
"LdapBruteForceSuspiciousActivity",
"MaliciousServiceCreationSuspiciousActivity",
"MassiveObjectDeletionSuspiciousActivity",
"PassTheHashSuspiciousActivity",
"PassTheTicketSuspiciousActivity",
"RemoteExecutionSuspiciousActivity",
"RetrieveDataProtectionBackupKeySuspiciousActivity",
"SamrReconnaissanceSuspiciousActivity",
"CredentialsValidation",
"DirectoryServicesReplication",
"DnsQuery",
"FailedLogon",
"InteractiveLogon",
"LdapCleartext",
"PrivateDataRetrieval",
"RemoteDesktop",
"ResourceAccess",
"SamrQuery",
"ServiceCreation",
"SmbSessionEnumeration",
"TaskScheduling",
"VpnConnection",
"WmiExecution",
"DirectoryServicesChange"
]
}]] System.ArgumentNullException: Value cannot be null.
Parameter name: format
at Microsoft.Tri.Infrastructure.Extensions.StringExtension.FormatWithCulture(String format, CultureInfo cultureInfo, Object[] arguments)
at async Microsoft.Tri.Center.Translation.LogicalActivities.FailedLogon.GetDescriptionAsync(?)
at async Microsoft.Tri.Center.Data.EntityExporter.<>c__DisplayClass13_0`1.<CreateLogicalActivitiesTableAsync>b__0[](?)
at async Microsoft.Tri.Infrastructure.Extensions.EnumerableExtension.SelectAsync[](?)
at async Microsoft.Tri.Center.Data.EntityExporter.CreateLogicalActivitiesTableAsync[](?)
at async Microsoft.Tri.Center.Reports.LogicalActivitiesReport.CreateFileContentAsync(?)
at async Microsoft.Tri.Center.Data.Excel.CreateFileDataAsync(?)
at async Microsoft.Tri.Center.Reports.Reporter.CreateAsync(?)
at async Microsoft.Tri.Center.Management.Controllers.UniqueEntityController.DownloadLogicalActivitiesReportAsync(?)
at async System.Threading.Tasks.TaskHelpersExtensions.CastToObject[](?)
at async System.Web.Http.Controllers.ApiControllerActionInvoker.InvokeActionAsyncCore(?)
at async System.Web.Http.Controllers.ActionFilterResult.ExecuteAsync(?)
at async System.Web.Http.Filters.AuthorizationFilterAttribute.ExecuteAuthorizationFilterAsyncCore(?)
at async System.Web.Http.Filters.AuthorizationFilterAttribute.ExecuteAuthorizationFilterAsyncCore(?)
at async System.Web.Http.Controllers.ExceptionFilterResult.ExecuteAsync(?)

Highlighted

Thanks!

It's a new bug.

It happens when the report contains a logical activity of "failed logon" where the  user is unknown.

You managed to generate the report by "missing" this specific activity using the filter.

I opened a bug to track it down for a  future version.