Event subscription is unable to connect to SIEM software when Change Auditor is upgraded to version 7.0 (4237504)

When a Change Auditor Coordinator is upgraded from a prior Change Auditor version to 7.0, the Event Subscription may not be able to connect to the SIEM software (Splunk, QRadar, ArcSight). The following status is displayed by the Event Subscription:

"LastEventResponse  { statusCode = NotFound }"

The following is recorded in the Change Auditor Coordinator log:

"[WARN][Quest.ChangeAuditor.WebServices.ManagedEventWebhookSubscription.SendEvents(0)] AggregateException attempting to send event notification, retry in 300 seconds."

Exception:

"System.AggregateException: One or more errors occurred. ---> System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:9000"

WORKAROUND

1. Open the ChangeAuditor.Service.exe.Config file typically located under "C:\Program Files\Quest\ChangeAuditor\Service"
2. Find <add key="ApiEnabled" value="False" /> and change it to <add key="ApiEnabled" value="true" />
3. Save the config file and restart the Coordinator

STATUS:

Waiting for fix in a future release of Change Auditor.