McAfee Enterprise Security Manager 11.1.x Release Notes

Transcription

1 McAfee Enterprise Security Manager 11.1.x Release Notes Contents Installation information What's new in the update Resolved issues in update Flash to HTML migration Installation information Upgrading to this release requires preparation and an understanding of how the upgrade process works. Before beginning the upgrade: Systems running some kernel versions may stall during the upgrade process, requiring manual intervention. See McAfee Enterprise Security Manager 11.1.x Known Issues (KB90422). Review the upgrade information in the McAfee Enterprise Security Manager 11.1.x Installation Guide. Verify that your current McAfee ESM version is (or later). If you are upgrading from version 10.x, you make sure all required ports are open on your network (see the ESM Installation Guide for a list of required ports). Update the Data Streaming Bus When updating devices as part of a McAfee ESM upgrade, update the Data Streaming Bus first. 1 From the navigation menu, select Data Streaming Bus. 2 Right click the node you want to update and select Settings. 3 Click Update Software File. 1

2 4 Select an update from the table or browse to the update file. 5 Click Update. After completing the upgrade Before logging on for the first time, clear your browser cache. Not doing so might cause issues when you log on. What's new in the update This update includes performance enhancements and issue resolution. What's new in update Features and enhancements in this version. You can now update the Data Streaming Bus (in the HTML interface). Issue resolution and performance enhancements. What's new in update New and updated features Improved Generic Web API (GWAPI) data collection integration. Issue resolution and performance improvements. What's new in the release Releases can introduce new features and enhancements or update platform support. New features This release introduces new features or improves existing features: Message Forwarding/Data Routing - raw logs are now available to third party products to be consumed with an external consumer application. External third party applications can consume raw events directly (without sending them to an ELS or ESM). Distributed ESM - use the newer version features without losing the benefits of data segregation or replacing hardware. Data Streaming Bus - ingest SIEM data through the data streaming bus, saving time and simplifying data integrations with McAfee Behavioral Analytics and third-party products. It is a virtual device that facilitates device interconnection and provides a streaming data platform for external integrations. Required for Distributed ESM and data sharing features. Data source diagnostics - identify and fix data source problems with this new tool (Data Source Properties Health). Dark mode user interface - reintroduces the dark mode option in the user interface to improve usability and viewing experience in dim security operation center environments. Added support for Linux KVM as a supported VM platform. Expanded GWAPI data source collection. 2

3 Updated features On new installations, the default configuration of the McAfee ESM is to not insert events that occurred more than 24 hours in the past. You can change this setting in <device> Properties Events, Flows, and Logs. Updated platform, environment, or operating system support This release extends support to additional platforms, environments, or operating systems: Upgrade to kernel Linux McAfee ns to support the Data Streaming Bus. Extended the Dark mode user interface to include new components introduced in version (Data Streaming Bus, Message Forwarding/Data Routing, Watchlists). HTML5 Dark Mode improves usability and viewing experience in dim security operation center environments. Support for SIEM cloud deployment on Azure now provides more flexible deployment options. Resolved issues in update This update resolves known issues. For a list of current known issues, see McAfee Enterprise Security Manager 11.1.x Known Issues (KB90422). Table 3-1 McAfee ACE Fixed an XML parsing error that occurred when clicking on the Correlation Details tab , , , On ESM/ELM combo box, Domain Policy correlation from UBA content pack now triggers when using Domain Policy - Security Group watchlist as an object Corrected an issue the prevented McAfee ACE from correlating events due to high memory and CPU usage Fixed an issue that prevented McAfee ACE from getting events from the combo's databus and creating correlated events. Table 3-2 ASP Rules Resolved an issue that kept Cisco FMC IPS estreamer from showing all data. Table 3-3 McAfee Enterprise Log Manager The interface now shows the correct data storage device for the MGTDB Fixed an issue that prevented raw logs from being displayed on the McAfee Enterprise Log Manager tab Healthmon was unable to determine the life left on Micron SSD Resolved an issue that could cause Send2ELM to send data to the wrong ELM after failover. Table 3-4 ELS Corrected an issue that prevented ELS from formatting SAN storage. 3

4 Table 3-5 ESM , You no longer need to restart the database to get the custom type names to display correctly Fixed an issue that prevented device passwords from being changed in some circumstances Corrected an issue that caused cpservice to restart frequently without user action , , , , , Resolved an issue that prevented Geosource ID/ASN data from being pulled during an upgrade. Corrected an issue that caused an EC38 error while upgrading Fixed an issue that caused an error: "An Internal server error has occurred; High ESM Load" Corrected an issue that prevented Geosource ID/ASN data from being pulled after upgrading Data allocation no longer reverts to 50/50 for events and flows during an upgrade , , , Physical Display device status icon no longer shows a question mark for ESM and McAfee Enterprise Log Manager after upgrading Fixed an issue that caused ESM data export to return and error in some instances Fixed "GetReportRec: ERROR - report hash not found." error in /var/log/messages Corrected an issue with Event distribution data loading Added OS options to the Microsoft Adiscon Windows Events data source Opening a dashboard that has Current Month as the time range no longer results in "Error: Invalid Parameters (ER71)" Resolved an issue that kept Baseline Deviation alarms from triggering after upgrading Fixed an issue that prevented Last Event times from appearing in Device Summary Reports Fixed an error that precluded ELS from being used with a combination ESM/ELM Fixed an issue that prevented a SAN volume from mounting after upgrading Fixed an issue that prevented historical correlation from passing records to ACE Resolved an issue that resulted in error "The drive configuration is incorrect (NotOk Unsupported drive configuration. ( ATA:-1 - HWRAID:-1)" when upgrading from to in Azure Corrected an issue that kept ESM from sending logs to ELM Fixed an issue that prevented Reports using fields with hebrew content from displaying correctly Fixed an issue that caused a "GetReportRec: ERROR - report hash not found." error in /var/log/messages Resolved an issue that allowed a disabled CAC account to log in Corrected an issue that caused event forwarding to add characters after upgrading Corrected an issue that prevented an ELM and a device not at same version from sending data to the ELM Data allocation no longer reverts to 50/50 for events and flows during an upgrade. 4

5 Table 3-6 ESM: Alarms Resolved an issue that kept Field Match Alarms from triggering Fixed an issue with Specified Event Rate alarms Fixed an issue that prevented Field Match alarms from triggering because of the name of the alarm Fixed an issue that prevented Device Status Change Alarms for individual data sources from being triggered after upgrading ESM. Table 3-7 ESM: Backup/Restore Corrected an issue that prevented restoring an incremental backup when multiple files are selected The "Data Backup Complete" message no longer appears before the backup is complete. Table 3-8 ESM: Distributed ESM Flows no longer appear on a parent ESM data source that should show only events. Table 3-9 ESM: Policy Resolved an issue that required rolling out policy to all receivers in order to roll out filter rules to the receiver. Table 3-10 ESM: Redundant ESM Resolved an issue that could cause Redundant ESM to use the incorrect key to send data to McAfee Enterprise Log Manager Fixed an issue that made ESM Redundancy show Status OK when Redundant ESM was missing events. Table 3-11 ESM: Reports Fixed an issue that caused random characters to be displayed in Distribution chart with "reason" field usage in reports A report using the "Query CSV" format and the "NewReport" pre-defined query displayed the wrong Source User. Table 3-12 ESM: Views Fixed an issue Event Distribution data loading When creating views, the Query Wizard Select field is now case sensitive Enhanced query performance. Table 3-13 ESM: Watchlists Resolved an issue that could keep IP address from being appended to watchlists. 5

6 Table 3-14 Other Upgrade no longer fails on Azure or Hyper-V when using disks with a Vendor type of "Msft" Fixed an issue that caused Kingston SSD to report errors with Smarttools Upgrade was failing on Hyper-V - disks with a Vendor type of "Msft" not found. Table 3-15 Receiver Corrected an issue that caused SourceFire estreamer to stop collecting data , Enhanced the syslog collector to support multiple TLS connections Fixed an issue that caused duplicate files to be collected when multiple data sources use the same mount point Resolved a bookmark handling issue that occurred when setting up an Office 365 data source , , , , , , , Table 3-16 User Interface Fixed an issue that kept TLS 1.0 and 1.1 disabled on epo DB Server from collecting data from ESM Corrected a database query that kept some views from being populated Added the ability to import old interface (Flash) views into the new interface (HTML5) when the view is not in a holder Corrected an HTML5 dashboard misrepresentation - content shown under one Destination IP belonged to Normalized Sub-Groups. Resolved issues in update This update resolves known issues. For a list of current known issues, see McAfee Enterprise Security Manager 11.x.x Known Issues (KB90422). Component Databus Improved McAfee Event Receiver stability and performance. ELM McAfee Enterprise Log Manager mirroring now allows negative values for available disc space Corrected a rules update error , McAfee Enterprise Log Manager with SAN now starts after upgrading to 10.3.x. ESM Fixed inaccurate Last Event times in Device Summary Reports Table component no longer shows No Results at physical display level , , Fixed several server errors that were seen after upgrading Fixed the McAfee Enterprise Log Manager Integrity Check function. ESM: Alarms Wrong device_ip values are no longer added to watchlists. ESM: Case Management JSON API to close case no longer causes it to be deleted in the ESM interface. 6

7 Component ESM: Redundant ESM Redundant ESM is now notified of redundant McAfee Enterprise Log Manager fail over. ESM: System Properties Various ESM redundancy fixes Primary ESM is now able to complete a sync with a redundant ESM ESM no longer reports an error when trying to view VM data addition. ESM: Views You can now run views during background rebuilds. Receiver Refresh device button no longer displays an error after upgrading to epo , , Corrected an issue that caused the /usr/local/ace/incoming/bad folder to fill up after upgrading to User Interface You can now clearly see more than 2 SAN devices in the interface Removed the nonfunctional Standby tab from the ELM/ELS Properties >> Events and Logs page You can now search by File_hash in the HTML interface Fixed a filtering issue affecting some rule_name values in the HTML interface. Resolved issues in update This update resolves known issues. For a list of current known issues, see Enterprise Security Manager 11.x.x Known Issues (KB90422) , , Fixed server errors that occurred when upgrading from version Resolved issues with configuration files and starting active collectors in HA mode that occurred after upgrading to version 11. Resolved issues in the release This release resolves known issues. For a list of current known issues, see Enterprise Security Manager 11.x.x Known Issues (KB90422). Table 3-17 McAfee ACE , , Corrected a McAfee ACE upgrade issue Fixed a filter value in a configuration file that prevented a McAfee ACE from invoking a write McAfee ACE insert jobs no longer hang due to Bad Query errors Historical Correlation no works in newly created correlation manager when all of default correlation managers are disabled. 7

8 Table 3-18 Documentation Updated the Installation Guide with a note that Syslog forwards only UDP packets Added content explaining how to view receiver throughput statistics. Table 3-19 McAfee Enterprise Log Manager , Health monitor is now able to determine the amount of Micron SSD life remaining. Table 3-20 ELS Fixed an unmaintained log issue ELS now has more resources dedicated to clusters than an ENMELS in the same device class ELS now takes less time to catch up when the events backlog is large. Table 3-21 ESM , , IPv6 aggregation now matches the complete IPv6 address Forwarding Event filters are now shown correctly Dynamic watchlist no longer shows ERROR status You are now able to add additional storage with Hyper-V , , , Fixed red banner issues Corrected an issue that caused 0 bytes Tmp files to keep growing on the ESM Added RADIUS authentication for ESM , Corrected an ER 1 error when choosing an Active Directory user from the filter list , EPO red flags now clear , , Rapid7 VA datasource (DS) now collects data , Events are now populated after upgrading to IP address is now updated in the database when a user changes it via the UI , Global blacklist now accepts changes from ESM properties , Fixed an issue that caused lost device cluster info and SSH keys after upgrading to version Corrected an 1190 error that appeared when trying to download McAfee Enterprise Log Manager search result file Corrected issue caused by Event Distribution failing to load. Table 3-22 ESM: Alarms You can now edit alarms and watchlists Custom Fields now display in . 8

9 Table 3-23 ESM: Backup/Restore Reduced the amount of time required for an incremental backup. Table 3-24 ESM: Data Enrichment Data Enrichment field is now being replaced. Table 3-25 ESM: Policy Fixed an issue with an incomplete SetThirdPartyConfig configuration file ASP rules regular expression evaluation no longer throws an error in creation/edition. Table 3-26 ESM: Reports Report ' Weekly Overview' is now generated Case Management Report is now populated ESM Distributed Charts - Legend no longer shows {Unavailable} When exporting to CSV, column names now appear correctly. Table 3-27 ESM: System Properties An internal server error no longer occurs when opening ESM property - System Information. Table 3-28 ESM: Views , Netflow data now shows at REC and DS level NIST Filters now show results , , Fixed an issue that caused "Something went wrong" errors when using Device ID filters. Table 3-29 ESM: Watchlists , You can now view dynamic watchlists with large values Dynamic watchlists are now automatically updated, resulting in fewer false positives Corrected a user rights issue that occurred when creating dynamic watchlists Watchlists no longer drop URLs after closing. Table 3-30 Localization Fixed an incorrect translation in index setting for the accumulator field. Table 3-31 Receiver Import of IIS data sources from CSV now configures data sources correctly , , Corrected WMIP issues on receivers. 9

10 Table 3-31 Receiver (continued) , , , , Increased the collection capacity for Office Fixed an Azure installation failure issue Migrate data source now shows correct data during operation Collectorsctl now monitors inode depletion Corrected an issue that caused McAfee Enterprise Log Manager to run out of inodes Corrected a HiBit issue. Table 3-32 User Interface Fixed a problem that caused errors when adding "Bytes Sent" and "Bytes Received" fields to views , , Category "Random Strings" Hits view now displays category names McAfee ACE correlation rule parameters now retain configuration settings Removed the ability to search using watchlists on non-indexed fields Increase performance in drilldown and filter queries. Flash to HTML migration With each release, McAfee Enterprise Security Manager functionality continues to move from Flash to HTML5. Migration of features from Flash to HTML occurs only in major and minor releases, not in updates. Version Version Version 10.x Watchlists (The Flash version is still available, but will be removed in an upcoming release.) Message Forwarding/Data Routing Scorecard Dark Mode Convert Flash views to HTML views (import views into dashboard) New HTML Dashboard Copyright 2019 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.