FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
aebadi
Staff
Staff
Article Id 377152
Description This article describes the reasons for the 'non-finite numbers' JSON error and how to remediate it.
Scope FortiSIEM Version 7.3.0.
Solution

This error is observed when upgrading to version 7.3.0 and then going to the Incidents tab and seeing the following error:

 

Error JSONExeption: JSON does not allow non-finite numbers 

 

json error.jpg

 

This Bug has already been identified and has a current fix Schedule of 7.3.1, 7.4.0.

This error has been observed in a case with a customer upgrading to 7.3.0, where the JSON object it trying forcefully convert data types: double to a float. The Exceptions happens because the JSON object it is trying forcefully convert the two data types, which can cause overflow or underflow if the value is too large or small.

 

To bypass this error, it is advised to upgrade the version where this is already fixed.

 

In the event that the customer does not want to upgrade, they can perform the following workaround to identify the issue:

 

  1. Run the following query SQL to determine if you have NaN entries on the table:


[root@SUPERVISOR ~]# psql -U phoenix phoenixdb -c "select id, delta_score, bucket_score_total, weight, last_score, apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) as current_score from ph_risk_score where apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) = 'Infinity'::FLOAT OR apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) ='-Infinity'::FLOAT OR apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) = 'NaN'::FLOAT8;"
id | delta_score | bucket_score_total | weight | last_score | current_score
-------+-------------+--------------------+--------+------------+---------------
30654 | 0 | NaN | 1 | NaN | NaN
28140 | 0 | NaN | 5 | NaN | NaN
515 | 0 | NaN | 1 | NaN | NaN
30810 | 0 | NaN | 5 | NaN | NaN
28439 | 0 | NaN | 5 | NaN | NaN
28249 | 0 | NaN | 1 | NaN | NaN
28779 | 0 | NaN | 5 | NaN | NaN
32425 | 0 | NaN | 5 | NaN | NaN
37191 | 0 | NaN | 5 | NaN | NaN
36991 | 0 | NaN | 5 | NaN | NaN
(10 rows)

NaN is a special value typically used to represent undefined or unrepresentable values in numeric calculations.

 

  1. To clear the error, you can remove those NaN entries by running the following statement:

 

[root@SUPERVISOR ~]# psql -U phoenix phoenixdb -c "delete from ph_risk_score where apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) = 'Infinity'::FLOAT OR apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) = '-Infinity'::FLOAT OR apply_risk_score_momentum_effect( apply_risk_score_entity_importance( delta_score + bucket_score_total, weight ), last_score) = 'NaN'::FLOAT8;"

Deleted 10

 

Contributors