> Source: [sk181800](https://support.checkpoint.com/results/sk/sk181800)

# sk181800 - Forensics report cannot be downloaded from the Threat Hunting Event tab

| Property | Value |
|----------|-------|
| Solution ID | sk181800 |
| Date Created | 2023-12-13 |
| Last Modified | 2024-10-22 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Windows |

## Symptoms

- Attempts to download Forensics report from Threat Hunting Event ended with error message "Unable to load report. Cannot read properties of null (reading 'base64Contents')"

## Cause

The system replaces `rfl_mgmt.jar` that included two fixes for two errors seen in `server_messsages`:  

1. Some of Forensic logs coming from Kusto come with the **time** field entry as follow: `"2022-11-20T13:08:10.000001Z"`. RFL parses ISO 8601 dates, which look like this : `"2023-02-14T09:49:24Z" (NO MILLISECONDS)`.  
   Pack capture time field include milliseconds which causes the following:  
   `</response>] java.text.ParseException: Unparseable date: "2023-10-16T16:05:26.000001Z"`  
   ` at java.text.DateFormat.parse(DateFormat.java:377)`  
   ` at com.checkpoint.management.rfl.fetchingLogUtils.LogsUtils.getAttachmentRelatedFieldsMapFromRFLResponse(LogsUtils.java:20)`  
   ` at com.checkpoint.management.rfl.handlers.FetchingLogHandler.handleRFLResponse(FetchingLogHandler.java:9)`  
   ` at com.checkpoint.rfl_sic.rflConnector.RFLClientConnector.onMessage(RFLClientConnector.java:24)`  
   ` at org.apache.activemq.ActiveMQMessageConsumer.dispatch(ActiveMQMessageConsumer.java:1361)`  
   ` at org.apache.activemq.ActiveMQSessionExecutor.dispatch(ActiveMQSessionExecutor.java:131)`  
   ` at org.apache.activemq.ActiveMQSessionExecutor.iterate(ActiveMQSessionExecutor.java:202)`  
   ` at org.apache.activemq.thread.PooledTaskRunner.runTask(PooledTaskRunner.java:129)`  
   ` at org.apache.activemq.thread.PooledTaskRunner$1.run(PooledTaskRunner.java:47)`  
   ` at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)`  
   ` at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)`  
   ` at java.lang.Thread.run(Thread.java:825)`
2. The field `module_name` is written as Check Point SmartConsole, which includes white spaces. Packet capture request includes spaces, which causes the following:  
   `2023-11-07 05:32:46,300 ERROR [pool-1-thread-2171] com.checkpoint.rfl.exceptions.RFLExceptionUtils.getRFLErrorResponseFromRFLException:20 - `  
   `java.lang.IllegalArgumentException: Illegal character in query at index 87: http://127.0.0.1:18244//packet_capture?session_id=0&product=Forensics&module_name=Check Point SmartConsole&incident_uid=5c792d24-2bfd-4e76-a31e-caceda2ec718&date=07Nov2023&service=ignore&storage_log_server=164.100.1.8&admin_name=nogae%40checkpoint_com_EpMaaS_Only&machine=127.0.0.1&application=WEB_API`  
   ` at java.net.URI.create(URI.java:863)`  
   ` at org.apache.http.client.methods.HttpPost.<init>(HttpPost.java:73)`  
   ` at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest_aroundBody4(PacketCaptureGetter.java:102)`  
   ` at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter$AjcClosure5.run(PacketCaptureGetter.java:1)`  
   ` at org.aspectj.runtime.reflect.JoinPointImpl.proceed(JoinPointImpl.java:149)`  
   ` at com.checkpoint.aspects.TraceMethodLoggerAspect.aroundMethodLoggerTest(TraceMethodLoggerAspect.java:2)`  
   ` at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.createRequest(PacketCaptureGetter.java:85)`  
   ` at com.checkpoint.requestInfra.packetCapture.PacketCaptureGetter.performHttpPostRequest(Pack`

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 79
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 158
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 106

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content