McAfee Enterprise Security Manager 10.3.x Release Notes

Size: px

Start display at page:

Download "McAfee Enterprise Security Manager 10.3.x Release Notes"

Lillian Casey
5 years ago
Views:

McAfee Enterprise Security Manager 10.3.x Release Notes Contents Installation information What's new in update 10.3.4 Resolved issues in update 10.3.4 Migrating from Flash to HTML Installation information Upgrading to this release requires preparation and an understanding of how the upgrade process works.

1 McAfee Enterprise Security Manager 10.3.x Release Notes Contents Installation information What's new in update Resolved issues in update Migrating from Flash to HTML Installation information Upgrading to this release requires preparation and an understanding of how the upgrade process works. Before beginning the upgrade: Review the upgrade information in the McAfee Enterprise Security Manager Installation Guide. Verify that your current McAfee ESM version is 9.6.x (or later). You can only upgrade to 10.x from 9.6.x or later. Remove Nitro IPS devices from McAfee ESM. You cannot upgrade to 10.x with deprecated Nitro IPS devices. After completing the upgrade Before logging on for the first time, clear your browser cache. Not doing so might cause issues when you log on. If you plan to upgrade to 11.x, upgrade to (or later). 1

2 What's new in update This update includes performance enhancements and issue resolution. What's new in update New and updated McAfee ESM features. Import watchlist feature in the HTML interface validates shorter lists than Flash interface When importing watchlists using the HTML interface, lists containing 1,000 or more values are not validated. Values might be truncated or modified with no notification. In the Flash interface, validation and status messages are provided for lists of up to 25,000 values. What's new in the release Backup and Restore You can now back up and restore McAfee ESM data. Dark mode Setting McAfee ESM to dark mode adjusts the displays to reduce eye strain in dark operating conditions. Scorecard improvements The McAfee ESM Scorecard view can now integrate with Tychon (requires a Tychon data source). Tychon is an Enterprise Detection and Response (EDR) product that lets you collect additional data needed to populate Scorecard. In combination with McAfee Policy Auditor and Tychon, customers can use ESM to visualize the 10 assessment items in the US Department of Defense CyberSecurity Scorecard. Scorecard requires McAfee epo and McAfee Policy Auditor. Additional VM platforms ESM virtual machines can now be created on the Azure, Hyper-V (2016 and later), and XEN (6.5 and later) platforms. Driver support ESM now supports Intel P4600 drivers. Resolved issues in update This update resolves known issues. For a list of current known issues, see McAfee Enterprise Security Manager 10.x.x Known s (KB88184). Table 3-1 ASP Rules Corrected an issue that caused Cisco FMC IPS estreamer data to not display in some instances. Table 3-2 Database Improved dashboard query load times. 2

3 Table 3-3 McAfee Enterprise Log Manager Corrected an issue that caused available space to be reported in exabytes Fixed an issue that, in some instances, caused a Rules Update error message Corrected an issue that caused the interface to show the correct data storage device for the MGTDB Fixed an issue that caused raw logs to not display on the ELM tab Fixed an issue that prevented ELM Archive from retrieving packets for some events Fixed an issue that caused 1190 errors when trying to download ELM search result files Resolved an issue that could cause Send2ELM to send data to the wrong ELM after failover. Table 3-4 ELS Corrected an issue that prevented ELS from formatting SAN storage. Table 3-5 ESM , Resolved an issue that required a database restart to get the custom type names to display correctly , , , , , , , Corrected an issue that resulted in error messages when trying to view data Fixed a RADIUS authentication issue Fixed an issue that prevented device passwords from being changed in some circumstances Table component no longer shows No Results at Physical Display Level , Corrected an error that occurred when trying to download McAfee Enterprise Log Manager search results Fixed the ELM Integrity Check function Fixed an issue that caused ESM data export to return and error in some instances Fixed "GetReportRec: ERROR - report hash not found." error in /var/log/messages Added OS options to the Microsoft Adiscon Windows Events data source Resolved an issue that prevented Baseline Deviation alarms from triggering after upgrading to ESM Fixed an issue that prevented a SAN volume from mounting after upgrading to ESM Corrected an issue that caused EC38 errors after upgrading Fixed an issue that prevented historical correlation from passing records to ACE Resolved an issue that resulted in error "The drive configuration is incorrect (NotOk Unsupported drive configuration. ( ATA:-1 - HWRAID:-1)" when upgrading from to in Azure Corrected an issue that kept ESM from sending logs to ELM Fixed an issue that prevented Reports using fields with hebrew content from displaying correctly. 3

4 Table 3-5 ESM (continued) Resolved an issue that allowed a disabled CAC account to log in Corrected an issue that prevented an ELM and a device not at same version from sending data to the ELM. Table 3-6 ESM: Alarms Fixed an issue with Specified Event Rate alarms Corrected an issue that caused an incorrect device IP address to be added to the watchlist. Table 3-7 ESM: Backup/Restore Corrected an issue that prevented restoring an incremental backup when multiple files are selected. Table 3-8 ESM: Case Management JSON API to close case no longer causes it to be deleted in SIEM GUI. Table 3-9 ESM: Distributed ESM Flows no longer appear on a parent ESM data source that should show only events. Table 3-10 ESM: Policy Resolved an issue that required rolling out policy to all receivers in order to roll out filter rules to the receiver. Table 3-11 ESM: Redundant ESM Fixed a syncing issue between primary and redundant ESMs Corrected an issue that prevented Redundant ESM from being notified of Redundant ELM failover Resolved an issue that could cause Redundant ESM to use the incorrect key to send data to McAfee Enterprise Log Manager Fixed an issue that made ESM Redundancy show Status OK when Redundant ESM was missing events. Table 3-12 ESM: Reports Reports no longer fail at 99% after applying Patch 4 to ESM Resolved an issue that kept Reports for large time ranges (e.g. 1 month) from generating. Table 3-13 ESM: System Properties After a successful VM data addition, the interface no longer reports an error when trying to view it. 4

5 Table 3-14 ESM: Views Added case sensitivity to the Query Wizard Select field when creating views. Table 3-15 ESM: Watchlists Corrected an issue that resulted in a permissions error when creating dynamic watchlists Watchlist no longer drops URLs after closing. Table 3-16 Other , Upgrade no longer fails on Azure or Hyper-V when using disks with a Vendor type of "Msft" , Fixed an issue the caused Kingston SSD to report errors with SmartTools. Table 3-17 Receiver Fixed an issue that caused Sourcefire estreamer to stop collecting data , , , , , , Fixed slow Office 365 collection. Upgrading no longer causes the correlation engine to lock up, requiring a reset Corrected an issue that caused Azure installations to fail High availability preferred primary device is now shown in the drop-down menu. "No Preference" is now shown if a preferred primary device has not been selected Resolved an issue that prevented secondary receivers in HA pairs from responding to SNMPv2c queries , Clicking the Refresh Device button no longer results in an error after upgrading to epo Resolved an issue that caused Netflow with IPv6 to show IPv6 addresses in the wrong order Corrected an issue that caused HA receivers to delete community for SNMP Request in /etc/snmp/snmpd.conf after a return-to-service , Enhanced the syslog collector to support multiple TLS connections Fixed an issue that caused duplicate files to be collected when multiple data sources use the same mount point Flow direction is now shown correctly in flow list and flow details , , , , , , , Fixed an issue that kept TLS 1.0 and 1.1 disabled on epo DB Server from collecting data from ESM Fixed a bookmark handling issue that occurred when setting up an Office 365 data source. 5

6 Table 3-18 User Interface Altered search capabilities to prevent Invalid Regular Expression errors Removed an unused tab from the McAfee Enterprise Log Manager (or ELS) Properties >> Events and Logs window Corrected a rule filter issue that could occur when running a query for Palo Alto Corrected a database query that kept some views from being populated Added the ability to search by File_hash in the new user interface (HTML5) Added the ability to clearly see more than 2 SAN devices in the interface Added the ability to import old interface (Flash) views into the new interface (HTML5) when the view is not in a holder Resolved an issue that caused an EC1 errors when importing Flash views to HTML. Resolved issues in update This update resolves known issues. For a list of current known issues, see McAfee Enterprise Security Manager 10.x.x Known s (KB88184) Various ESM Redundancy fixes Corrected an issue that prevented McAfee Enterprise Log Manager with SAN from booting after upgrading to ESM , , , , , , , , , , Fixed several post-upgrade problems related to a kernel issue Geo Source ID /ASN data is now pulled after upgrading from ESM to ESM Corrected an issue that caused Office 365 collection to lag Resolved an issue that caused a TMP file to grow in size unnecessarily ACE insert jobs no longer hang with bad queries , Health Monitor now correctly determines the life left in Micron SSD , , , Fixed several geolocation-related issues. Resolved s Component McAfee ACE , Historical correlation managers work even when default managers are disabled. Filter issue fixed. McAfee Enterprise Log Manager Enterprise Log Search , , , , , , Log search process corrected. 6

7 Component McAfee ESM Alarms , , , Syslog or SNMP recipient settings saved correctly. Alarm s that use custom types now correctly include type and data. Asset Manager , , , , , , CAC authentication Correlation rules Data enrichment report Event forwarding Passwords Policies , , Red flags , Redundancy , , , , , , System properties , , , , Time zones , Rapid7 VA data now collected correctly. CAC authentication process corrected. Rule configuration saved correctly. Source user field correctly shows user name instead of Microsoft SID. Weekly report now generated correctly. Event filter displays correct values. When using Chrome Developer tool, password visibility corrected. SetThirdPartyConfig tmp file contains complete data source information. Red flag functionality corrected. Redundant ESM devices sync correctly. Changes to system properties saved correctly. Turkey time zone now available. Backup time zone used correctly. Views Watchlists , McAfee Event Receiver , , , , , , , , , , NetFlow data now visible. Dynamic watchlist status corrected. Event data process corrected. Hardware ETM-X7 with Intel P4600 mdadm now generates index_hd. AWS, Hyper-V, and Azure Supports ability to add storage (disks). HTML Improved performance of drill-down and filter queries. 7

8 Resolved s Component Redundancy , , , , , , , , , , , , , , , , , , , , , , Settings , Multiple Redundant ESM fixes aimed at preventing a frozen sync situation. You can now use a plus sign (+) in addresses. Redundancy The SendLiveData flag is no longer missing from the database. Backup Fixed an issue that slowed incremental backups. Restore Restore of Alert data now happens during a Restore Backup process. Reports , CSV Reports now return all Cases results. Resolved issues Find issues that have been fixed in this version. McAfee ACE , , , , , Fixed a recursive loop issue in correlation rules. Fixed the parsing of comma values in parser rules Corrected an issue that the McAfee ACE correlator log to fill with SEVERE errors McAfee ACE no longer deadlocks when running "correlator.sh -status" while a rule update is in progress McAfee ACE no longer generates an erroneous IndexOutOfBoundsException. Database , , , , The SendWatchlistChanges job no longer hangs. DBM Parameterized queries no longer show command as UNKNOWN under the custom types tab. McAfee Enterprise Log Manager , Fixed an issue that caused an Access denied (ER70) error when a non-admin user performed an McAfee Enterprise Log Manager search When updating McAfee Enterprise Log Manager, the process now completes if the CIFS share takes longer to respond than the update timeout. 8

9 McAfee Enterprise Log Manager: Redundant ELM , , McAfee Enterprise Log Manager redundancy setup no longer gets stuck at 20%. ESM , Resolved an issue that resulted in empty Scorecard & Asset, Threat, and Risk dashboards , You can now configure recipient addresses that include + (plus sign) Asset Sources pull from AD now works correctly CIFS View Files functionality no longer fails Corrected an out-of-memory problem caused by queries not terminating properly iscsi devices now work for Data Archival , Fixed an issue that caused Properties pages to appear blank when device communication was lost Fixed an issue that caused SFTP TestConnect to fail when there are thousands of files in a directory Fixed a kernel error that occurs when upgrading a combo device from 9.6.x to 10.1.x when all available loop devices are taken by McAfee Enterprise Log Manager storage pools Active response searches now execute successfully on an ESM device. ESM: Alarms , Corrected false positives for alarms based on non-us geolocations. ESM: Backup/Restore Fixed an issue that caused ESM scheduled daily backups to remote NFS shares to fail Restoring a backup now works correctly on receivers with HA settings Restoring a backup now restores Alert data. ESM: Case Management , Corrected a navigation issue that disabled the navigation buttons when viewing more than 100 case management cases Bad Query Error no longer occurs when adding Avg Severity field to a Case Management component. ESM: Data Enrichment Data enrichment no longer times out when using a pipe character as delimiter. 9

10 ESM: Distributed ESM , , , Corrected an issue that precluded the use of a VM as a Distributed ESM Child ESMs now show current data McAfee ACE no longer displays as out-of-sync and no longer shows invalid signature IDs for ACE events on distributed ESM devices. ESM: Redundant ESM , , Fixed a problem that prevented Redundant ESM from completing a sync Redundant ESM sync no longer stalls during a re-sync , , Sync data is now moved from primary to redundant ESM , , , , Corrected an issue that prevented Redundant ESMs from syncing properly in some instances. ESM: Reports Query CSV option now retrieves output with a filter set to Open cases. ESM: Views , , Fixed an issue that caused only 100 bars to be displayed in distribution charts on the Flash interface Corrected an issue that caused table widgets to display an error: "EC 255 Error Invalid Filter Item, Possible SQL Injection attempted." when marking events as reviewed Details pane no longer goes blank after paging the events list , Corrected an issue that caused an error when selecting a device during creation of a widget Fixed an issue that caused an HTTP 404 error when scrolling in a Dest IP widget In Scorecard, extra results are no longer displayed after deleting and re-pulling assets Added a validation to support translation of DB values to UI values Fixed an issue that caused some widgets to display records incorrectly for the Administrator user , The McAfee Enterprise Log Manager logging Archive tab now shows events on separate lines , , Fixed an issue that showed a "Something went wrong" error message when using Device ID filters. 10

11 McAfee Event Receiver , , , , , , , , Cloudtrail now connects to AWS. Improved HA stability and health monitoring , Send2ELM settings no longer cause receivers to become backlogged waiting for McAfee Enterprise Log Manager disk space to drop Fixed a memory usage error associated with WMI data sources Auto learn now runs on receivers Added a check to ensure the McAfee Event Receiver doesn't exhaust inodes with data collection Added IIS compatible date/time formats for the http collector McAfee Enterprise Log Manager no longer runs out of inodes epo database instance settings are now applied when changes are written Auto retrieve from VA sources now works Updating a KVM VM to no longer hangs at startup Wildcard expressions for NFS data sources no longer behave as backward matches NSM devices with less active sensors no longer generate Out of Sync flags on a McAfee Event Receiver multiple times per day You can now configure a device to correlate events from a specific device IPFIX now parses correctly IPv4 route is now applied to eth1 on high availability receivers. User Interface , Fixed a memory leak that caused multiple errors Test connections for data sources using Tivoli now test successfully Corrected an API issue that limited the number of returned alarms to 100. User Interface Page size property now works properly Error Converting circular structure to JSON after drilling down from Geolocation view Export to CSV now selects the correct data set or number You no longer get an infinite search loop when using 'contains' with an odd number of slashes Corrected an issue that caused packet data to be corrupted when downloaded , Page breaks are now respected in ELM Archive in HTML5 user interface , Event drill-down now shows accurate values in widgets. 11

x Ability to convert Flash views into HTML views (import views into dashboard) New HTML dashboard Copyright 2019 McAfee, LLC McAfee and the

12 Migrating from Flash to HTML With each release, McAfee Enterprise Security Manager functionality continues to move from Flash to HTML5. Migration of features from Flash to HTML occurs only in major and minor releases, not in updates. 10.x Ability to convert Flash views into HTML views (import views into dashboard) New HTML dashboard Copyright 2019 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.

McAfee Enterprise Security Manager 10.3.x Release Notes

McAfee Enterprise Security Manager 10.3.x Release Notes Contents Installation information What's new in update 10.3.3 Resolved issues in update 10.3.3 Migrating from Flash to HTML Installation information