Patch Release Notes. Release Juniper Secure Analytics. Juniper Networks, Inc.

Transcription

1 Juniper Secure Analytics Patch Release Notes Release Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA Published:

2 Copyright Notice Copyright 2015 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. The following terms are trademarks or registered trademarks of other companies: Java TM and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. FCC Statement The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Juniper Networks installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. Release Copyright 2015, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History October 2015 The information in this document is current as of the date listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at as modified by the following text, which shall be treated under the EULA as an Entitlement Document taking precedence over any conflicting provisions of such EULA as regards such software: As regards software accompanying the JSA products (the Program ), such software contains software licensed by Q1 Labs and is further accompanied by third-party software that is described in the applicable documentation or materials provided by Juniper Networks. 2

3 For the convenience of Licensee, the Program may be accompanied by a third party operating system. The operating system is not part of the Program, and is licensed directly by the operating system provider (e.g., Red Hat Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Labs is a party to the license between Licensee and the third party operating system provider, and the Program includes the third party operating system AS IS, without representation or warranty, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. For an installed Red Hat operating system, see the license file: /usr/share/doc/redhat-release-server-6server/eula. By downloading, installing or using such software, you agree to the terms and conditions of that EULA as so modified. 3

4 4

5 1 JSA RELEASE NOTES Installing r1 Patch Clearing the Cache Known Issues and Limitations Resolved Issues

6

7 1 JSA RELEASE NOTES r patch resolves several known issues in Juniper Secure Analytics (JSA). Installing r1 Patch Clearing the Cache Known Issues and Limitations Resolved Issues Installing r1 Patch If your deployment is installed with version of r3 or later, you can install r patch. NOTE Note: There is a known issue - Non-admin users are unable to add search filters in JSA r1 patch in r1. To fix this issue, please upgrade to r2 patch. Before you begin Ensure that you take the following precautions: Back up your data before you begin any software upgrade. For more information about backup and recovery, see the Juniper Secure Analytics Administration Guide. To avoid access errors in your log file, close all open JSA webui sessions. During the deployment, all appliances should run on the same software revision to patch the complete deployment. Verify that all changes are deployed on your appliances. The patch cannot be installed on appliances that have changes that are not deployed. About this task Patches are cumulative software updates to address known software issues in your JSA deployment. JSA patches are installed by using an SFS file.

8 8 JSA RELEASE NOTES Step 1 Step 2 Step 3 Procedure Download the r patch from the Juniper Customer Support website. Using SSH, log into your system as the root user. Copy the patch to the /tmp directory on the JSA console. NOTE Note: If space in the /tmp directory is limited, copy the patch to another location that has sufficient space. Step 4 Step 5 Step 6 Step 7 Step 8 Unzip the file in the /tmp directory using the bunzip utility: bunzip r sfs.bz2 To create the /media/updates directory, type the following command: mkdir -p /media/updates Change to the directory where you copied the patch file. For example, cd /tmp To mount the patch file to the /media/updates directory, type the following command: mount -o loop -t squashfs r sfs /media/updates/ To run the patch installer, type the following command: /media/updates/installer NOTE Note: If you have logged in through serial-based console, run the following command to install the patch automatically: /media/updates/installer --no-screen NOTE Note: The first time that you run the patch, there might be a delay before the patch install menu is displayed. Step 9 Using the patch installer, select all. The all option updates the software on all systems in your deployment. In high availability deployments, primary high availability appliances are patched and replicate the patch update to the secondary high availability appliance.

9 Clearing the Cache 9 If you do not select the all option, you copy the patch to each appliance in your deployment and install the patch. If you manually install the patch in your deployment, you must update your appliances in the following order: 1 Console 2 Event Processors 3 Event Collectors 4 Flow Processors 5 Flow Collectors If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. Results A summary of the patch installation advises you of any managed host that were not updated. If the patch fails to update a managed host, you can copy the patch to the host and run the installation locally. What to do next You are now ready to clear the Java cache and the browser cache. Clearing the Cache After you install the patch, you must clear your Java cache and your web browser cache before you log into the JSA appliance. Before you begin Ensure that you have only one instance of your browser open. If you have multiple versions of your browser open, the cache might fail to clear. Ensure that the Java Runtime Environment is installed on the desktop system that you use to view the user interface. You can download Java version 1.7 from the Java website: About this task If you use the Microsoft Windows 7 operating system, the Java icon is typically located under the Programs pane. Step 1 Procedure Clear your Java cache: a On your desktop, select Start > Control Panel. b Double-click the Java icon. c In the Temporary Internet Files pane, click View. d On the Java Cache Viewer window, select all Deployment Editor entries. e Click the Delete icon.

10 Known Issues and Limitations 10 Step 2 Step 3 Step 4 f g Click Close. Click OK. Open your web browser. Clear the cache of your web browser. If you use the Mozilla Firefox web browser, you must clear the cache in the Microsoft Internet Explorer and Mozilla Firefox web browsers. Known Issues and Limitations JSA3800 and JSA5800 appliances does not detect the interface cable during setup. During the setup, first you must verify the physically connected interface cable to JSA3800 and JSA5800 appliances. From the interface selection menu, select the connected interface cable and then proceed with the installation. Check the connectivity after the setup completion. QCHANGE_NETSETUP DOES NOT DISPLAY CURRENT SERVER THAT HAS PREVIOUSLY BEEN CONFIGURED When qchange_netsetup is subsequently run on a configured JSA appliance, the ' server:' field is blank even though the field was previously configured. Other fields on the same setup page contain previously configured data. CHANGING A JSA APPLIANCE IP USING QCHANGE_NETSETUP CAN CAUSE REQUIRED JSA SERVICES TO NOT START In JSA after running qchange_netsetup to reconfigure the IP address of an appliance, the user interface can become inaccessible and display the following message: "The server is temporarily unable to service your request due to maintenance downtime or capacity problems." The issue is caused by services not being able to start as residual file entries containing the 'old' IP address exist. Messages similar to the following might be visible in /var/log/qradar.log when this issue is occurring: com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Initializing resource

11 Known Issues and Limitations 11 loggers: f380a4bc com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Frameworks instance name: hostcontext.hostcontext com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Initializing with URL: file:/opt/qradar/conf/ com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Frameworks booting - logging, loader complete com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Loading frameworks.properties com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Initializing Cryptography API com.q1labs.frameworks.util.namedthreadfactory: [INFO] [NOT: ][ /- -] [-/- -]Thread factory created: Spillover Cache Vacuum

12 12 JSA RELEASE NOTES com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Frameworks global cache manager was initialized using: /opt/qradar/conf/ehcache.xml com.q1labs.frameworks.core.jmxhelper: [INFO] [NOT: ][ /- -] [-/- -]Initializing JMX for RMI com.q1labs.frameworks.core.jmxhelper: [INFO] [NOT: ][ /- -] [-/- -]Constructing mbean server at: service:jmx:rmi:// :7778/jndi/rmi:// :7778/jmxr m i com.q1labs.frameworks.logging.logmanagementagent: [INFO] [NOT: ][ /- -] [-/- -]Log management agent started. com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Initializing jpa com.q1labs.frameworks.core.frameworkscontext: [INFO] [NOT: ][ /- -] [-/- -]Initializing naming com.q1labs.frameworks.naming.frameworksnaming: [INFO] [NOT: ][ /- -] [-/- -]Naming initializing, failfast disabled: false

13 Resolved Issues 13 com.q1labs.frameworks.naming.frameworksnaming: [INFO] [NOT: ][ /- -] [-/- -]com.q1labs.simulator.util.event.eventlogger.name MUST be public, static and not final for naming to help with setting of NAME com.q1labs.frameworks.naming.frameworksnaming: [INFO] [NOT: ][ /- -] [-/- -]Naming initializing complete. Resolved Issues The following are the resolved issues addressed in r1 patch. CPU load might be exceptionally high when hostcontext starts disk maintenance on a console or a managed host On the Dashboard, the system might generate multiple SAR Sentinal threshold notifications when hostcontext runs disk maintenance on a Console or a managed host. This issue is due to hostcontext unexpectedly using all of the available CPU threads when performing disk maintenance on the system. When hostcontext starts disk maintenance, administrators might notice or correlate high CPU usage to system notifications for SAR Sentinel threshold to certain appliances. After disk maintenance is complete, the CPU usage should return to normal levels. Events and flows stop coming in when the SNMP daemon is enabled ECS stops working when SNMPV3 is configured when running or r1. To recreate: Apply or r1. Go to SNMP settings (Admin -> System Settings) and configure SNMPV3 with privacy protocol AES128 or AES256. ECS will no longer process flows and events. Workaround: Disable SNMPV3 (and use SNMPV2C) or set privacy protocol to DES.

14 14 JSA RELEASE NOTES If you have hit this issue and have patched to r2 or beyond you can save the settings once more at that patch level and the issue will resolve itself. Anyone attempting to configure this for the first time at r2 or beyond will not experience this issue. Anyone patching directly to r2 or beyond from a version prior to will not experience this issue. Arielsearch form may not load on chrome - system error box There was a problem handling the response from the server... Use of the Chrome web browser may result in a JavaScript error when accessing the Search form from the Log / Network Activity tab. Error message in seen in an error dialog box - There was a problem handling the response from the server while executing a remote method call. When the System error dialog appears, the details of the error may include one of the following: Method: getcolumndefinitionstring Error: undefined is not a function Method: fomatarielfilter Error: Object TypeError: Cannot read property 'items' of null has not (also the error Object # has no method 'clearitems') Steps to recreate: 1 Login to the JSA UI 2 Access the Log Activity tab 3 Open the New Search form 4 Return to the main Log Activity screen 5 Wait up to 15 minutes, and the System Error will present when accessing the Search form. Workaround: Use FireFox or logout of UI and close and reopen the browser. NullPointerException loading custom event properties Customer may be unable to access certain pages of the Custom Event Properties page. The following exception is displayed in the logs: (2345) /console/do/core/genericsearchlist]

15 Resolved Issues 15 com.q1labs.uiframeworks.action.exceptionhandler: [ERROR] [NOT: ][<IP Address 1>/- -] [-/- -]An exception occurred while processing the request: (2345) /console/do/core/genericsearchlist] java.lang.nullpointerexception com.q1labs.ariel.ui.bean.arielpropertyform.copyfromdao (ArielProp ertyform.java:181) com.q1labs.core.ui.util.copyutils.copybeans(copyutils.java:90) com.q1labs.core.ui.util.copyutils.copytolistofbeans (CopyUtils.java:59) com.q1labs.core.ui.util.queryutils.getqueryresults (QueryUtils.java:903) com.q1labs.core.ui.action.genericlist.execute (GenericList.java:130) org.apache.struts.action.requestprocessor.processactionperform

16 16 JSA RELEASE NOTES (RequestProcessor.java:484) com.q1labs.uiframeworks.action. RequestProcessor.processActionPerform (RequestProcessor.java:101) org.apache.struts.action.requestprocessor.process (RequestProcessor.java:275) org.apache.struts.action.actionservlet.process(actionservlet. java:1482) com.q1labs.uiframeworks.action.actionservlet.process (ActionServlet.java:103) org.apache.struts.action.actionservlet.dopost (ActionServlet.java:525) javax.servlet.http.httpservlet.service(httpservlet.java:643) javax.servlet.http.httpservlet.service(httpservlet.java:723)

17 Resolved Issues 17 org.apache.catalina.core.applicationfilterchain. internaldofilter(applicationfilterchain.java:290) org.apache.catalina.core.applicationfilterchain.dofilter (ApplicationFilterChain.java:206) com.q1labs.uiframeworks.servlet.threadnamefilter.dofilter (ThreadNameFilter.java:34) org.apache.catalina.core.applicationfilterchain. internaldofilter(applicationfilterchain.java:235) org.apache.catalina.core.applicationfilterchain.dofilter (ApplicationFilterChain.java:206) com.q1labs.uiframeworks.servlet.destroysessionfilter.dofilter (DestroySessionFilter.java:26) org.apache.catalina.core.applicationfilterchain. internaldofilter(applicationfilterchain.java:235)

18 18 JSA RELEASE NOTES org.apache.catalina.core.applicationfilterchain.dofilter (ApplicationFilterChain.java:206) org.apache.catalina.core.standardwrappervalve.invoke (StandardWrapperValve.java:233) org.apache.catalina.core.standardcontextvalve.invoke (StandardContextValve.java:191) org.apache.catalina.authenticator.authenticatorbase.invoke (AuthenticatorBase.java:563) org.apache.catalina.core.standardhostvalve.invoke (StandardHostValve.java:127) com.q1labs.uiframeworks.valve.errorreportvalve.invoke (ErrorReportValve.java:53) org.apache.catalina.core.standardenginevalve.invoke (StandardEngineValve.java:109)

19 Resolved Issues 19 org.apache.catalina.connector.coyoteadapter.service (CoyoteAdapter.java:293) org.apache.jk.server.jkcoyotehandler.invoke (JkCoyoteHandler.java:190) org.apache.jk.common.handlerrequest.invoke (HandlerRequest.java:311) org.apache.jk.common.channelsocket.invoke (ChannelSocket.java:776) org.apache.jk.common.channelsocket.processconnection (ChannelSocket.java:705) org.apache.jk.common.channelsocket$socketconnection.runit (ChannelSocket.java:898) org.apache.tomcat.util.threads.threadpool$controlrunnable.run (ThreadPool.java:690)

20 20 JSA RELEASE NOTES java.lang.thread.run(thread.java:804) WinCollect Last Heart Beat no longer updating after upgrading to WinCollect After upgrading to WinCollect the Last Heart Beat column for the WinCollect Agents is no longer registering any updates to the date/time. Reimplement vis discovery events Changes in the asset model have removed the VIS Discovery events. In JSA , there are no events emitted for: New Port Discovered New Vuln Discovered New Host Discovered Workaround: Contact Juniper Customer Support. A Log Source Extension (LSX) that contains a matcher with no field will cause DSM parsing failure If a log source extension (LSX) is created with a Matcher and no associated field entry, then uploaded for use into the UI, it will cause some DSM extensions not to load and in turn cause parsing to fail for the log source(s) that are using that LSX. Errors generated in qradar.log may appear similar to: May 19 18:09: [ecs] [DSM Extension Factory Loader] com.q1labs.sem.dsm.extension.dsmextensionfactory: [ERROR] [NOT: ][ /- -] [-/- -]Failed to read active extensions info from the database. May 19 18:09: [ecs] [DSM Extension Factory Loader] java.lang.nullpointerexception May 19 18:09: [ecs] [DSM Extension Factory Loader] at com.q1labs.sem.dsm.extension.dsmextension.initialize (DSMExtension.java:239) May 19 18:09: [ecs] [DSM Extension Factory Loader] at

21 Resolved Issues 21 com.q1labs.sem.dsm.extension.dsmextensionfactory.loadextensions (DSMExtensionFactory.java:226) May 19 18:09: [ecs] [DSM Extension Factory Loader] at com.q1labs.sem.dsm.extension.dsmextensionfactory.reload (DSMExtensionFactory.java:162) May 19 18:09: [ecs] [DSM Extension Factory Loader] at com.q1labs.sem.dsm.extension. DSMExtensionFactory$ExtensionTableListener.run (DSMExtensionFactory.java:642)May 19 18:09: [ecs] [DSM Extension FactoryLoader] at java.lang.thread.run(thread.java:780) Workaround: Correct the LSX with proper formatting and fields entries. JSA UI allows the importing of an LSX with an invalid matcher field name The JSA UI will allow the use of a Log Source Extension (LSX) with an invalid matcher field name which results in parsing failures for the log source(s) that are using that LSX. Example: <matcher pattern="valid_pattern" field="usernaem" capture-group=1 order=1> (notice the improper spelling of UserName) The UI simply removes the field from the matcher and allows the LSX to be used. Workaround: Validate the correct/required log source extension (LSX) variables are used. Error message Invalid Backup Archive when trying to restore a config backup Invalid Backup Archive message is received when trying to upload/restore what should be a valid config backup (backup taken from a specific build version and being applied to a same build version). Workaround: Contact Juniper Customer Support for a potential fix.

22 22 JSA RELEASE NOTES TXSentry messages caused by an asset database table that is allowed to grow too large for JSA VM TXSentry messages may appear in the UI and can be linked back to a specific asset database table that has grown too large for JSA VM to process efficiently. The following error will be seen in qradar.log: com.q1labs.hostcontext.tx.txsentry: [WARN] [NOT: ][<IP>/- -] [-/- -]Found a process on host <IP>: assetprofiler.assetprofiler, pid=14191 children= immediately=false, TX age=647 secs com.q1labs.hostcontext.tx.txsentry: [WARN] [NOT: ][<IP>/- -] [-/- -] TX on host <IP>: pid=14191 age=647 IP= port=43243 locks=64 query='select * from asset.upsertportscan( $1, $2, $3, $4 ) as result' Some of the drop down options in the rule response, rule action When setting magnitude contribution parameters (Severity, Credibility and Relevance) in a Rule Action: Only the drop down selection 'Set to' a value works as expected. The drop down options 'Increase by' and 'Decrease by' a value are ignored. Generated reports contain no data when the report contains a custom property which was deleted If a search has been created contains a custom property and then that custom property is deleted at some point, a resulting report generated from that search may contain no data. Error in /var/log/qradar.log that may indicate this is the issue: Jul 8 14:11: [accumulator_rollup.accumulator_rollup] [main] Caused by: Jul 8 14:11: [accumulator_rollup.accumulator_rollup] [main] java.lang.illegalaccessexception: Class com.q1labs.frameworks.nio.nioserializermarshaler can not access a member of class

23 Resolved Issues 23 com.q1labs.core.shared.ariel. CustomKeyCreator$DeletedCustomProperetyKeyCreator with modifiers "public" Workaround: Create a new report that does not contain a search with a custom property that has been deleted. Greatly reduced JSA user interface responsiveness due to Null Pointer Exception The JSA user interface may experience greatly reduced responsiveness. This may be caused by an issue with the assetprofiler. You can verify if this is the case by looking for the associated Null Pointer Exception error in: /var/log/qradar.error Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] com.q1labs.assetprofile.updateresolution.updatecontext: [ERROR] [NOT: ][ /- -] [-/--]AssetUpdate :UpdateResolutionWorker.run(): Unable to apply update 'AssetProfileUpdate FROM: IDENTITY - NetBIOS Names: [SERVERNAME], Usernames: [Username: Admin-name, Group: null, Type: LOGIN], ]' to profile from source IDENTITY// :60414 Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] java.lang.nullpointerexception Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] at com.q1labs.assetprofile.updateresolution.updateresolutionutil. mergeinterfacesipbased(updateresolutionutil.java:729) Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] at com.q1labs.assetprofile.updateresolution.updateresolutionutil. mergeassetsstandard(updateresolutionutil.java:150)

24 24 JSA RELEASE NOTES Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] at com.q1labs.assetprofile.updateresolution.updateresolutionutil. selectbestmatch(updateresolutionutil.java:113) Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] at com.q1labs.assetprofile.updateresolution. UpdateResolutionWorker. applyupdate(updateresolutionworker.java:399) Aug 12 10:26: [assetprofiler.assetprofiler] [SnapshotWorkerThread-0] at com.q1labs.assetprofile.updateresolution. UpdateResolutionWorker.run(UpdateResolutionWorker.java:130) Workaround: Contact Juniper Customer Support. JSA VM - Running scans using centralized credentials causes multiple copies of authenticated scan tools JSA VM - When running scans with centralized credentials, this may cause multiple copies of authenticated scan tools to start running.