McAfee Policy Auditor 6.2.2

Transcription

1 Release Notes McAfee Policy Auditor For use with McAfee epolicy Orchestrator

2 COPYRIGHT 2016 Intel Corporation TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Policy Auditor Release Notes

3 Contents 1 About this release 5 2 New features 7 3 Resolved issues 9 4 Installation instructions 11 5 Known Issues 13 6 Find product documentation 15 Index 17 McAfee Policy Auditor Release Notes 3

4 Contents 4 McAfee Policy Auditor Release Notes

5 1 About this release This document contains important information about the current release. We recommend that you read the whole document. Purpose This release of McAfee Policy Auditor provides enhanced performance, certain updated strings, and an updated McAfee Policy Auditor agent plug-in debug tool to support user-selected logging details, number of logs and maximum log size. The Policy Auditor agent plug-in debug tool works only on Windows platform only. McAfee Policy Auditor Release Notes 5

6 1 About this release 6 McAfee Policy Auditor Release Notes

7 2 2 New features The current release of the product includes these new features. Updated content management and user-interface strings Option Findings data purging batch size (not available in the user-interface) Number of benchmark results to purge per batch (on the Server Settings Edit Policy Auditor page) Remove related Findings when purging Audit Results (on the step 3 in New Audit Builder wizard) Purge Audit Results server task window stop task after this time (hours) (on the Server Settings Edit Policy Auditor page) Findings Data Retention (on the Server Settings Edit Findings page) Frequency to run update Audit assignments (no longer available in the user-interface) Change description The database field for the Findings data purge now compiles a bigger batch size for faster processing. The Findings purge batch size is instead of This setting is not customizable. The default value for the number of benchmark results to purge per batch has been increased to from the earlier value of 20. This is a customizable option and is available on the Server Settings Edit Policy Auditor page. The Remove related Findings when purging Audit Results option has been disabled by default. You can still enable this option in an audit, if needed, which you create from the Risk & Compliance Audits page. The earlier Database Maintenance stop task after this time (hours) string has been replaced with Purge Audit Results server task window stop task after this time (hours) for better clarity. Stop Data Maintenance after string has been replaced with Purge Findings server task window stop task after this time. This option is no longer customizable and has been removed from the Server Settings Edit Policy Auditor page. Policy Auditor agent plug-in debug tool changes Enable debug logging with the required detail, number of logs, and their maximum size. A new button Enable Debug Logging has been provided on the Policy Auditor agent plug-in debug tool to use these options: McAfee Policy Auditor Release Notes 7

8 2 New features Option Max Backup Index Log Details Max File Size Definition Provide the number of previous logs to include. Select the level of detail that you want to include in logs. EMERG Logs those events only that are urgent. FATAL Logs those events only that are fatal. ALERT Logs only alert messages. CRIT Logs only critical messages. ERROR Logs only error messages. WARN Logs only warning messages. NOTICE Logs only notices. INFO (Default) Logs only informative messages. This logging level is set by default and it provides brief information about the execution details. DEBUG Logs detailed information that can be used for debugging. NOTSET Sets the logging preference to not set. Specify the maximum file size for the logs. 8 McAfee Policy Auditor Release Notes

9 3 Resolved issues The current release of the product resolved these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Table 3-1 Install or Uninstall Reference Description Changing the index permission settings no longer cause the upgrade to fail and result any downgrade inconsistency Endpoint Deployment Kit can be used to uninstall Policy Auditor agent from multiple systems Policy Auditor agent deployment no longer starts automatically after an upgrade Upgrade no longer fails with arithmetic error on a system with a large Policy Auditor database. Table 3-2 Audits Reference Description User Right Assignment checks run successfully even if the system contains a stranded Security Identifier (SID) Fixes an issue where a tag could not be removed if it was used in an audit that has already been removed Audits can be saved without errors about permissions for a specific system An audit with multiple endpoints can be saved or edited without an exception error Audits no longer fail when they involve large database that has exceeded Integer count limit. Table 3-3 Benchmarks and checks Reference Description Rules can be edited and saved without any errors Removal of a platform from a benchmark in Internet Explorer 11 no longer results in an exception error Benchmarks on Solaris systems no longer fail with errors about CPE evaluation Repeated edits to a benchmark no longer result in unknown exception errors No more errors appear when editing an XCCDF benchmark that has complex references between rules, checks, and values Microsoft Windows Bulletin benchmark titles are displayed in English instead of Russian when the language selected is English CIS benchmarks can be imported even if they contain longer oval check references No more null pointer exception appears when importing a password policy check Check filter no longer includes checks that are not applicable to the platform selected. McAfee Policy Auditor Release Notes 9

10 3 Resolved issues Table 3-4 Reporting Reference Description Findings report generation no longer fails due to less storage space in the database Query on Audit Patch Results only contains distinct results. Table 3-5 File integrity monitoring Reference Description File Integrity Monitoring scan on AIX 6.1 Service Pack 4 no longer generates a core dump File Integrity Monitoring data purge is faster. Table 3-6 Script execution Reference Description Fixes the issue where Service Management Facility check results (smf-test) were inconsistent from SVCS checks Fixes the issue where the network utility checks (ndd-test) on Solaris do not collect correct information about ndd_items An audit on a Debian system now succeeds when it contains an OVAL object for pattern matching. Table 3-7 Content creator Reference Description Verify Registry Value rule type in Policy Auditor Content Creator doesn't result in mismatched data types Policy Auditor Content Creator now allows blank registry values Account Lockout: Duration check successfully retrieves the account lockout duration information from the local security policy Benchmarks created in Policy Auditor Content Creator can be imported to Policy Auditor Guest account related rules that are created in Policy Auditor Content Creator can be imported to Policy Auditor Benchmark template (.bme) file that was created in Policy Auditor can now be exported from Policy Auditor 6.2 without any issues. Table 3-8 General Reference Description The scan engine service (enginemain.exe) running on Windows systems no longer generates process58_item, which is a UNIX-specific system characteristic item in OVAL schema All McAfee binaries including fimcli.exe and auditmanagerservice.exe are digitally signed by McAfee Policy Auditor agent on an HP-UX system no longer crashes when multiple files have been opened while executing OVAL checks Audit assignments no longer get archived to be reassigned again for the next Update Audit Assignments task execution The Audit Manager service on Red Hat Enterprise Linux (RHEL) systems now creates PID files with correct file permissions OVAL unique function returns the list of unique values instead of the count of unique values. 10 McAfee Policy Auditor Release Notes

11 4 4 Installation instructions For information about installing or upgrading Policy Auditor, see McAfee Policy Auditor 6.2 Installation Guide. Consider these additional requirements: Install Policy Auditor server extension and agent plug-in versions that are supported in your environment. For Sun Solaris, HP-UX, IBM AIX endpoints the highest McAfee Agent version supported is v4.8.0 Patch 3 ( ), which is only supported with Policy Auditor agent plug-in. Endpoint operating system Windows, Linux, and MAC Sun Solaris, HP-UX, IBM AIX McAfee epo server version McAfee Agent version Supported Policy Auditor component versions or later or later Policy Auditor server extension version Policy Auditor agent plug-in version or later * or earlier Policy Auditor server extension version Policy Auditor agent plug-in version * If you're using McAfee epo 5.9 with McAfee Agent 4.8 to manage the Sun Solaris, HP-UX, IBM AIX endpoints, use the Policy Auditor server extension with Policy Auditor agent plug-in For more information on supported product versions, see this McAfee KnowledgeBase article: KB Install the Policy Auditor server extension and agent plug-in separately. You need a lower version of your Policy Auditor agent plug-in for your Sun Solaris, HP-UX, IBM AIX endpoints with McAfee Agent 4.8. Install Policy Auditor as an extension. Check in Policy Auditor agent plug-in packages for Sun Solaris, HP-UX, IBM AIX endpoints. See the McAfee Policy Auditor 6.2 Installation Guide for instructions. McAfee Policy Auditor Release Notes 11

12 4 Installation instructions 12 McAfee Policy Auditor Release Notes

13 5 Known Issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB McAfee Policy Auditor Release Notes 13

14 5 Known Issues 14 McAfee Policy Auditor Release Notes

15 6 6 Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. McAfee Policy Auditor Release Notes 15

16 6 Find product documentation 16 McAfee Policy Auditor Release Notes

17 Index D documentation product-specific, finding 15 M S ServicePortal, finding product documentation 15 T technical support, finding product information 15 McAfee ServicePortal, accessing 15 McAfee Policy Auditor Release Notes 17

18 0-00