McAfee Enterprise Security Manager

Transcription

1 Release Notes McAfee Enterprise Security Manager Contents About this release Resolved Issues Resolved Issues Resolved Issues Resolved issues in and Known issues Installation information Find product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. Resolved Issues Component Issue Description ACE Changed the validation of deviation correlation to allow numbers greater than zero and less than one. Database An ACE with 22 or more cores now processes files correctly. Corrected erroneous database allocation when adding a drive larger than 120GB to a VM combo Index rebuilds, when starting dbserverd, have been optimized for faster startup times. 1

2 Component Issue Description DBM Response Time values are now the same under Custom Types and Session Viewer. ELM ELM: Redundant ELM (RELM) ms-sql Successful Logins now trigger on DEM ELM now shuts down before the database starts deleting partitions. The shutdown occurs at 105 GB free space and a restart occurs at 125 GB free space. Health Monitor now accounts for all partitions instead of alerting when an individual partition approaches capacity. ELM Storage Pool Query timeout no longer causes incorrect Space Available values. ELM now returns logs of event IDs greater than 9,223,372,036,854,775,807. Vmlocal disks no longer prevent ELM upgrade ELM search function now works after upgrading Corrected an issue that caused an error when exporting ELM search results when the initial secondary ELM was running as primary. ESM Corrected a Signed Certificate Request zip error. ESM: Backup / Restore cpservice is now started after migrating to new datastore on an ESM VM Custom Rules no longer disappear in Full Backup after upgrading MRs Added the ability to filter on custom zones configured in the zone management menu Corrected a Signed Certificate Request zip error in FIPS mode Enabled addition of an Aruba data source client with a hostname in it ELM packet retrieval now works for NSM or EPO-managed devices Creation of data sources and data source clients now requires the same privileges UI timeout no longer produces 'ER60 Bad request' when radius password uses % symbol Corrected an issue that produced privilege errors for the default views Removed unnecessary HTTP Options verb Users can now modify dependent devices even if the parent has been removed Corrected the path to the database that was created as part of the system data migration process You can now add datasources using auto learn with ~250 in a group. The Add Device wizard now displays the final screen Backup Frequency settings now correctly set Next Auto-backup time Events are no longer missing after restoring incremental backups Files/directory are no longer deleted by Test connection for remote Backup(NFS). 2

3 Component Issue Description ESM: Data Enrichment ESM: Distributed ESM (DESM) Fixed an issue that caused remote paths to fail when testing connection to CIFS in the Source tab of the Data Enrichment Wizard Events from NSM and epo subdevices on a distributedesm now appear on the parent ESM. ESM: Policy Fixed an issue where an ASP rule with time mapping could not be modified after saving. ESM: Redundant ESM (RESM) ESM: Reports ESM: System Properties Fixed failure to clear the updated status of selected rules Corrected an issue that caused redundant ESM DB data to be written to the incorrect path A secondary ESM can now be upgraded using the console Resolved an issue that caused the daily backup to run out of disk space after failing over the Primary ESM. Disabled footers in reports no longer cause reports to fail Reports run as Alarm Action now run when using Non-Standard Date format Added an error message explaining that running reports on a redundant is not supported Reports scheduled to run on Sunday now run on Sunday ESM Properties Blacklist IP now saves the Description field NGCP user is now able to modify Login Security parameters. ESM: Watchlists Watchlists now function properly when using HEX values Watchlist Rules update set on Sunday no longer runs multiple times in a few hours. External API Corrected an error when executing API call on 9.6. Receiver Data collection directories are now verified during an upgrade. Curl collector now uncompresses zip files after upgrading to MR9. Events inserted on the same second that a pull was initiated are now aggregated. HA Reset now works correctly Oracle ASP (gsql) data source collection and parsing now work as intended Connection test for CIFS retrieval no longer fails when share name ends in $ (dollar symbol) Baghdad time zone is no longer treated as GMT. 3

4 Component Issue Description Log files are now left on the server when an error occurs, preventing lost events Removed configuration file paths for unused data types that caused the receiver index_hd to become full Reduced gsql (Oracle) CPU usage and enabled event collection Fixed an issue that caused epo integration to fail after upgrading to Fixed an RPCClient memory leak that caused the receiver to stop functioning. Resolved Issues Removed Hostname field label from Add Generic Data Source screen , , Corrected an issue that disabled data sources when writing out policy Corrected a user permission issue in the dashboard Fixed an issue that prevented retrieval of Alert Packets when Alert IDs were very large (above ). Resolved Issues Fixed an issue that prevented the job for Discover NSM Sensors from updating the sensors , AWS Cloudtrail Datasource now collects data as expected , , , , , , , , Daily reports with non- standard Date format run correctly after upgrading to 9.6.1MR1. Systems with filekeys in the format of /root/.ssh/id_rsa-{base64 string} now allow users to upload files , Partially successful VA retrieval now updates Last Retrieval Date-Time , Removed key export information from the product guide , , , , , , , Syslog now gracefully recovers from a condition of too many active TCP connections. Alarm configuration now works correctly for DS Groups SNMP settings are now transferred to a redundant ESM. 4

5 Watchlist entries are now present after restoring a full back-up Auto refresh now picks up newly added epo extensions Corrected an issue that caused an internal server error when viewing Correlation custom views Resolved an issue that resulted in an error when trying to set an event as reviewed while a filter is applied Policy import no longer reports non-existent conflicts Removed TLS v1.0 support Documentation now states that rule order is included in copy-and-paste actions Upload of SSL certificate now works correctly Corrected the Japanese translation of title of the 'Add Device Wizard' window Corrected an issue that caused invalid Signature ID validation errors Corrected typographical errors in Japanese version of the product guide and help Corrected invalid error messages that appeared during file upload , Syncing large records (>32k) on redundant ESMs no longer results in error messages Improved speed of execution for large reports Corrected a translation issue in Enterprise Log Search Filtering by special characters at the beginning of a string no longer results in a Bad Query Error Added translation to Network Interface Settings on ACE properties Resolved an issue that prevented daily reports from running. Resolved issues in and The current release of the product resolved these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Release notes are available on the Knowledge Center. ACE Added notifications when correlation rules, threshold, and deviations exceed maximum packet length Deviation component for flows using event count as the deviation field now successfully writes out to the ACE , Resolved an issue that caused alarms to trigger more frequently than the Maximum Condition Trigger Frequency (cooldown) setting Resolved an issue that would allow an unsupported field to a deviation , , Resolved an issue where estreamer would not write out correct json to be parsed Resolved an issue where the correlation rule was not triggering under specific conditions Set the maximum allowed value for ACE Risk Correlation Manager threshold to 99%. Alarms Alarm acknowledge date and time now correctly display in the details panel and the clipboard Clicking "Case Link" on an alarm's Actions tab no longer results in an error if the case summary contains pipe (' ') character. 5

6 Device status change alarms now accurately trigger at the data source level , Triggered Alarms in and do not log event Custom Types Custom types in Name/Value groups are now displayed in the event view for Japanese UI. Data Enrichment The enrichment process now uses the LDAP "Description" field content correctly LDAP Data Enrichment now returns results if a non-ascii character is used in the query Non-ASCII data in Path field Fails in Source of Data Enrichment When a user adds a data enrichment with a lookup field custom type = 5, the destination fields are replaced. Database Improved the logic to clean temporary files from archive directory when dbserver restarts The TNS module in the DBM now handles a particular data encoding that TOAD (Tool for Oracle Application Developers) uses. Distributed ESM Destination user and Object fields are more consistent in propagating up to the parent ESM Added a retry when pulling packet data. This ensures that packet data is pulled , Resolved an issue that caused the ACE to show out of sync on a distributed ESM. ELM Data collection now resumes after rebooting VMware vcenter Server ELM Backup settings now load properly , , , , , , Enhanced ELM log retrieval to search through all possible log files instead of just one log file. Some log entries in aggregated events were not being displayed. Fixed the counting of files for the rsync status to not include close matching numbers like 1, 10 and 11 multiple times Improved handling for displaying elm search metadata for different date formats , Logs sent to ELM are no longer deleted if an entry is not found in the ds2rg table MGTDB Mirrored storage device now appears in the Migrate DB screen Resolved an issue that caused incorrect raw logs to appear in the UI if ELM logs had duplicate archive IDs Resolved an issue that prevented a redundant ELM from syncing completely , , , Resolved an issue that would cause ELM Statistics to show zero logs for some Data Sources, even though the ESM UI shows there are logs in ELM. Resolved an issue that would trigger a device health alarm on a non HA receiver of: "HA status changed from Critical to Warning" Resolved an issue that, in rare instances, prevented logs from being displayed when a user was connected to an ELM through SFTP. 6

7 , Resolved an issue where ELM logs would not be fully decoded when retrieved through ELM Search Resolved an issue where the "Being moved" lock file was not cleaned up after an ELM DB size increase When reducing the size of a storage pool the amount of available space now displays correctly in the storage pools tab of ELM properties. ESM Removed symlinks to non-existent startup script Accumulator field is now displayed for Correlation Events , Resolved an issue that caused user to get 500 and 503 errors after upgrading to Set a limit on DAS drive size to avoid running out of disk space Corrected the DataSource time zone for Istanbul The ESM now exports views with non-ascii titles to PDF , Prevents multiple job processes from running concurrently Resolved an issue that caused the port number setting to be ignored when importing SFTP data source settings from a CSV file , , , , , Resolved an issue that caused false error messages when users tried to view event data. Resolved an issue where editing blacklist IP addresses would fail due to extra '\' characters present in the commands parameters Selecting a custom time range and a date format other than mm/dd/yyyy could produce incorrect data sets and time ranges Active Directory account is now automatically unlocked after the unlock threshold elapses Corrected an issue that caused invalid Signature ID validation errors. Health Monitor Enhancements to health monitor for device communication errors. Localization Corrected a translation error in SNMP Traps configuration Corrected the Japanese translation of the title of the 'Add Device Wizard' window Corrected the Japanese translation of the 'Query Archived Partitions' error message. Other Improved memory handling when the ESM populates the device tree and when retrieving a list of correlated events Added a check for a running thread before starting a new UpdateMTISThreads thread , Resolved a failed boot up issue Resolved an issue where the bloom does not get set when duplicate ELM id's span multiple partitions Corrected an issue that prevented upgrading an ELMERC to version Policy Added user information to policy change history Modified import logic to correctly maintain the encoding of Japanese characters. Receiver Modified error handling to ensure that data collection resumes after rebooting VMware vcenter Server. 7

8 , , IPMI now functions with ERC 1260 receivers Resolved an issue that caused syslog messages to be sent to a data source when the host name matched but the port did not match Resolved an issue that prevented parsing of an HTTP data source due to extra white space , , , Resolved an issue that would cause an error message to report that re-keying a device failed when it was actually successful. Resolved an issue where unknown events would show at the data source parent level when using SIEM Collector Removed dead links to prevent invalid symlink errors when powering off a REC IPMI now functions with ERC 1260 receivers Resolved an issue where the default gateway was not being assigned to the shared IP interface after switching to the primary server. Redundant ACL setting are now replicated to redundant ESMs. Reports , , Fixed the counting of files for the rsync status to not include close matching numbers like 1, 10 and 11 multiple times. Events in report are now visible in hexadecimal format Added a requirement for a device to be selected before running a report Resolved an issue that prevented deselected s in an group from being removed from group Resolved an issue that would cause stacking distribution charts to contain incorrect 'others' values Resolved an issue where the ESM would incorrectly delete temporary files that were being used for running report queries. Rules Resolved an issue that caused extra rows to be added when saving ASP rule text. System Properties Removed URL length limit that was causing a "{$ctrl.flashcontent}" message to be displayed after uploading.crt file Corrected a user permission issue that caused a "ER 60 Bad Request" error Resolved an issue that caused overlapping data on the display. User Interface Resolved an is where changing the hostname or vendor/model of a client data source would fail if the data source vendor/model and host name were in use by another clients Resolved an issue that prevented expanding of correlated events in source events when logged as a limited user Updated the label of the ACE communication configuration panel to be correct Resolved an issue that caused Correlation Rule Engine parameter names to display as "unknown" When doing a host lookup with correlation events, the host lookup now displays in the correct column Added notifications when correlating with a large threshold caused packet lengths to exceed the maximum supported packet length. 8

9 Changed parsing method to enable a user to add custom time formats in ASP rules when using a non-english version Scrolling in bar charts no longer generates tool tip errors User name is now displayed after a session timeout or another session login Time zone caching no longer causes incorrect time to be displayed. Views Resolved an issue that prevented components from binding to custom types Filter bar and widget settings can now filter on specific client and child data sources Added validation to preclude invalid characters when filtering with PolicyID Improved the handling of special characters for filtering and views Resolved an issue that inserted an extra column when exporting event views, which caused misalignments Resolved an issue that would cause long running delete queries to spawn additional queries Resolved an issue that caused nonsense titles to appear on the 'Event Destination Zones' window. Watchlist Watchlist now gets file hashes when uploading from an ATD Cyberthreat feed. Known issues 10.x known issues - see McAfee KnowledgeBase article: KB x known issues - see McAfee KnowledgeBase article: KB Installation information Upgrading to this release requires preparation and an understanding of how the upgrade process works. Read the upgrade instructions in the McAfee Enterprise Security Manager Installation Guide (PD27124), on the Knowledge Center. Before you can upgrade: Verify that your current McAfee ESM version is 9.6.x (or later). You can only upgrade to 10.x from 9.6.x. Remove Nitro IPS devices from the McAfee ESM System Tree. You cannot upgrade to 10.x with a deprecated Nitro IPS device. After completing the upgrade, and before logging in for the first time, clear your browser cache. Not doing so may cause issues when you log in. 9

10 Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. Tasks Use ESM Help on page 11 Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Frequently asked questions on page 11 Here are answers to frequently asked questions. Find localized information We provide localized (translated) McAfee ESM release notes, Help, product guide, and installation guide for: Chinese, Simplified Chinese, Traditional English French German Japanese Korean Portuguese, Brazilian Spanish Access localized online Help Changing the language setting in ESM automatically changes the language used in the online Help. 1 Log on to ESM. 2 On the system navigation pane of the ESM console, select Options. 3 Select a language, then click OK. 4 Click the Help icon in the upper right corner of the ESM windows or select the Help menu. The Help displays in the language you selected. If the Help appears in English only, localized Help is not yet available. A future update installs localized Help. 10

11 Find localized product documentation on the Knowledge Center 1 Visit the Knowledge Center. 2 Search for localized product documentation using the following parameters: Search terms product guide, installation guide, or release notes Product McAfee Enterprise Security Manager Version Choose a release version 3 In the search results, click the relevant document title. 4 On the page with the PDF icon, scroll down until you see language links on the right side. Click the relevant language. 5 To open the localized version of the product document, click the PDF link. Use ESM Help Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Task 1 To open ESM Help, do one of the following: Select the menu option Help Help Contents. Click the question mark in the upper right of ESM screens to find context-sensitive Help specific to that screen. 2 From the Help window: Use the Search field to find any word in the Help. Results appear below the Search field. Click the relevant link to display the Help topic in the pane on the right. Use the Contents tab (table of contents) to view a sequential list of topics in the Help. Use the Index to find a specific term in the Help. Keywords are organized alphabetically so you can scroll through the list until you find the keyword you want. Click the keyword to display that Help topic. Print the current Help topic (without scroll bars) by clicking the printer icon in the upper right of the Help topic. Find links to related Help topics by scrolling to the bottom of the Help topic. Frequently asked questions Here are answers to frequently asked questions. Where can I find ESM information in other languages? We localize the ESM release notes, Help, product guide, and installation guide. Find localized information on page 10 Where can I learn more about McAfee ESM? Use ESM Help on page 11 Visit the Knowledge Center Visit the Expert Center Watch McAfee ESM videos 11

12 Which data sources are supported? Visit the McAfee ESM website How do I configure specific data sources? Find current data source configuration guides on the Knowledge Center Where can I learn more about McAfee ESM content packs? For information about content packs, refer to the following KB articles on the Knowledge Center: KB How to implement SIEM Content Packs KB84036 FAQs for SIEM content packs KB Register for this KB to see what is in the latest content packs. Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0-00