The resolution is simple once you determine the adapter number from lsi-show. The adapter number is either a0, a1, a2, or a3. It is found by running lsi-show and looking under the Id in the "Controller Information" section. You will need to run lsi-show to find the failed JBOD and then megacli -cfgforeign -import -a1. Change the 1 to the Adapter number in your case.
For example, this is for Controller for Adapter a1:
Controller Information
Id Serial No Firmware Encl LD PD Product Name
a1 38T012N 3.130.05-2086 2 2 24 PERC H810 Adapter
Look for the Physical Drive Information that contains the "Unconfigured(good), Spun Up" drive. For example,
Physical Drive Information
Id E:S Status FC Size Inquiry
9 12:0 Unconfigured(good), Spun Up Foreign 1.819 TB SEAGATE ST2000NM0023 SERIAL_NUMBER
8 12:1 Unconfigured(good), Spun Up Foreign 1.819 TB SEAGATE ST2000NM0023 SERIAL_NUMBER
Look a few lines above these to the first occurrence of "Controller Information" and find the Controller Id. If it says "a1" then it is Adapter 1.
Then run:
megacli -cfgforeign -import -a1
If it works properly, run lsi-show and you should see:
Physical Drive Information
Id E:S Status FC Size Inquiry
9 12:0 Online, Spun Up Foreign 1.819 TB SEAGATE ST2000NM0023 SERIAL_NUMBER
8 12:1 Online, Spun Up Foreign 1.819 TB SEAGATE ST2000NM0023 SERIAL_NUMBER
If there were multiple drives, you will need to run "reboot" to restart Security Analytics with the corrected Capture filesystem.
You may want to silence the audible alarm coming from the hardware with megacli -adpsetprop alarmsilence -aX, replacing X with the adapter/controller number. Or do 0, 1, and 2 to cover them all.
If you get an error that importing the configuration will create an inconsistent state in the RAID, please call Blue Coat technical support for further assistance.