McAfee Enterprise Security Manager

Transcription

1 Release Notes McAfee Enterprise Security Manager Contents About this release New features Resolved issues Instructions for upgrading Find product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. New features Added functionality for this release: Consolidated data source configuration reference Find current information about how to configure data sources for McAfee ESM in the new Data Sources Configuration Reference. This new reference consolidates content for more than 175 data sources in one place. Redundant ESM improved syncing Redundant ESMs (System Propterties ESM Management Redundancy) now sync much more efficiently. Syncing requires no down time and has minimal performance impact. The initial sync may take longer than the previous sync method, but subsequent syncs will be much faster. 1

2 ELS Search Syntax A new search syntax adds flexibility to ELS searches. Operator/ Modifier Description Characters Examples and Returns items that contain both terms. space and AND & john doe john and doe john AND doe john & Doe or Returns items that contain either term. or OR john or doe john OR doe john doe not Excludes terms from results. Must be used with AND. not NOT john and not doe john and NOT doe! john and!doe john and! doe "" Returns items that contain a specific term. Quotation marks must be used in pairs and search terms cannot contain spaces. () Nested search terms help narrow search results. Terms contained in parentheses are processed first. * Wild cards return terms that contain, start with, or end with a specific term. " "john" () (john and doe) or smith (john) and (doe or smith) john (doe smith) (john jane)(doe smith) * *abcd* - contains abcd* - starts with *abcd - ends with Resolved issues The current release of the product resolved these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Release notes are available on the Knowledge Center. ACE Added notifications when correlation rules, threshold, and deviations exceed maximum packet length Deviation component for flows using event count as the deviation field now successfully writes out to the ACE , Resolved an issue that caused alarms to trigger more frequently than the Maximum Condition Trigger Frequency (cooldown) setting Resolved an issue that would allow an unsupported field to a deviation. 2

3 , , Resolved an issue where estreamer would not write out correct json to be parsed Resolved an issue where the correlation rule was not triggering under specific conditions Set the maximum allowed value for ACE Risk Correlation Manager threshold to 99%. Alarms Alarm acknowledge date and time now correctly display in the details panel and the clipboard Clicking "Case Link" on an alarm's Actions tab no longer results in an error if the case summary contains pipe (' ') character Device status change alarms now accurately trigger at the data source level , Triggered Alarms in and do not log event Custom Types Custom types in Name/Value groups are now displayed in the event view for Japanese UI. Data Enrichment The enrichment process now uses the LDAP "Description" field content correctly LDAP Data Enrichment now returns results if a non-ascii character is used in the query Non-ASCII data in Path field Fails in Source of Data Enrichment When a user adds a data enrichment with a lookup field custom type = 5, the destination fields are replaced. Database Improved the logic to clean temporary files from archive directory when dbserver restarts The TNS module in the DBM now handles a particular data encoding that TOAD (Tool for Oracle Application Developers) uses. Distributed ESM Destination user and Object fields are more consistent in propagating up to the parent ESM Added a retry when pulling packet data. This ensures that packet data is pulled , Resolved an issue that caused the ACE to show out of sync on a distributed ESM. ELM Data collection now resumes after rebooting VMware vcenter Server ELM Backup settings now load properly. 3

4 , , , , , , Enhanced ELM log retrieval to search through all possible log files instead of just one log file. Some log entries in aggregated events were not being displayed. Fixed the counting of files for the rsync status to not include close matching numbers like 1, 10 and 11 multiple times Improved handling for displaying elm search metadata for different date formats , Logs sent to ELM are no longer deleted if an entry is not found in the ds2rg table MGTDB Mirrored storage device now appears in the Migrate DB screen Resolved an issue that caused incorrect raw logs to appear in the UI if ELM logs had duplicate archive IDs Resolved an issue that prevented a redundant ELM from syncing completely , , , Resolved an issue that would cause ELM Statistics to show zero logs for some Data Sources, even though the ESM UI shows there are logs in ELM. Resolved an issue that would trigger a device health alarm on a non HA receiver of: "HA status changed from Critical to Warning" Resolved an issue that, in rare instances, prevented logs from being displayed when a user was connected to an ELM through SFTP , Resolved an issue where ELM logs would not be fully decoded when retrieved through ELM Search Resolved an issue where the "Being moved" lock file was not cleaned up after an ELM DB size increase When reducing the size of a storage pool the amount of available space now displays correctly in the storage pools tab of ELM properties. ESM Removed symlinks to non-existent startup script Accumulator field is now displayed for Correlation Events , Resolved an issue that caused user to get 500 and 503 errors after upgrading to Set a limit on DAS drive size to avoid running out of disk space Corrected the DataSource time zone for Istanbul The ESM now exports views with non-ascii titles to PDF , Prevents multiple job processes from running concurrently Resolved an issue that caused the port number setting to be ignored when importing SFTP data source settings from a CSV file , , , , , Resolved an issue that caused false error messages when users tried to view event data. Resolved an issue where editing blacklist IP addresses would fail due to extra '\' characters present in the commands parameters Selecting a custom time range and a date format other than mm/dd/yyyy could produce incorrect data sets and time ranges Active Directory account is now automatically unlocked after the unlock threshold elapses. 4

5 Health Monitor Enhancements to health monitor for device communication errors. Localization Corrected a translation error in SNMP Traps configuration Corrected the Japanese translation of the title of the 'Add Device Wizard' window Corrected the Japanese translation of the 'Query Archived Partitions' error message. Other Improved memory handling when the ESM populates the device tree and when retrieving a list of correlated events Added a check for a running thread before starting a new UpdateMTISThreads thread , Resolved a failed boot up issue Resolved an issue where the bloom does not get set when duplicate ELM id's span multiple partitions Corrected an issue that prevented upgrading an ELMERC to version Policy Added user information to policy change history Modified import logic to correctly maintain the encoding of Japanese characters. Receiver Modified error handling to ensure that data collection resumes after rebooting VMware vcenter Server , , IPMI now functions with ERC 1260 receivers Resolved an issue that caused syslog messages to be sent to a data source when the host name matched but the port did not match Resolved an issue that prevented parsing of an HTTP data source due to extra white space , , , Resolved an issue that would cause an error message to report that re-keying a device failed when it was actually successful. Resolved an issue where unknown events would show at the data source parent level when using SIEM Collector Removed dead links to prevent invalid symlink errors when powering off a REC IPMI now functions with ERC 1260 receivers Resolved an issue where the default gateway was not being assigned to the shared IP interface after switching to the primary server. 5

6 Redundant ACL setting are now replicated to redundant ESMs Fixed the counting of files for the rsync status to not include close matching numbers like 1, 10 and 11 multiple times. Reports , Events in report are now visible in hexadecimal format Added a requirement for a device to be selected before running a report Resolved an issue that prevented deselected s in an group from being removed from group Resolved an issue that would cause stacking distribution charts to contain incorrect 'others' values Resolved an issue where the ESM would incorrectly delete temporary files that were being used for running report queries. Rules Resolved an issue that caused extra rows to be added when saving ASP rule text. System Properties Removed URL length limit that was causing a "{$ctrl.flashcontent}" message to be displayed after uploading.crt file Corrected a user permission issue that caused a "ER 60 Bad Request" error Resolved an issue that caused overlapping data on the display. User Interface Resolved an is where changing the hostname or vendor/model of a client data source would fail if the data source vendor/model and host name were in use by another clients Resolved an issue that prevented expanding of correlated events in source events when logged as a limited user Updated the label of the ACE communication configuration panel to be correct Resolved an issue that caused Correlation Rule Engine parameter names to display as "unknown" When doing a host lookup with correlation events, the host lookup now displays in the correct column Added notifications when correlating with a large threshold caused packet lengths to exceed the maximum supported packet length Changed parsing method to enable a user to add custom time formats in ASP rules when using a non-english version Scrolling in bar charts no longer generates tool tip errors User name is now displayed after a session timeout or another session login Time zone caching no longer causes incorrect time to be displayed. 6

7 Views Resolved an issue that prevented components from binding to custom types Filter bar and widget settings can now filter on specific client and child data sources Added validation to preclude invalid characters when filtering with PolicyID Improved the handling of special characters for filtering and views Resolved an issue that inserted an extra column when exporting event views, which caused misalignments Resolved an issue that would cause long running delete queries to spawn additional queries Resolved an issue that caused nonsense titles to appear on the 'Event Destination Zones' window. Watchlist Watchlist now gets file hashes when uploading from an ATD Cyberthreat feed. Instructions for upgrading Upgrading to this release requires preparation and an understanding of how the upgrade process works. Read the upgrade instructions in the McAfee Enterprise Security Manager Installation Guide (PD26817), on the Knowledge Center. Before you can upgrade: Verify that your current McAfee ESM version is 9.6.x (or later). You can only upgrade to 10.0.x from 9.6.x. Remove Nitro IPS devices from the McAfee ESM System Tree. You cannot upgrade to 10.0.x with a deprecated Nitro IPS device. Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. 7

8 Tasks Use ESM Help on page 9 Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Frequently asked questions on page 9 Here are answers to frequently asked questions. Find localized information We provide localized (translated) McAfee ESM release notes, Help, product guide, and installation guide for: Chinese, Simplified Chinese, Traditional English French German Japanese Korean Portuguese, Brazilian Spanish Access localized online Help Changing the language setting in ESM automatically changes the language used in the online Help. 1 Log on to ESM. 2 On the system navigation pane of the ESM console, select Options. 3 Select a language, then click OK. 4 Click the Help icon in the upper right corner of the ESM windows or select the Help menu. The Help displays in the language you selected. If the Help appears in English only, localized Help is not yet available. A future update installs localized Help. Find localized product documentation on the Knowledge Center 1 Visit the Knowledge Center. 2 Search for localized product documentation using the following parameters: Search terms product guide, installation guide, or release notes Product McAfee Enterprise Security Manager Version Choose a release version 3 In the search results, click the relevant document title. 8

9 4 On the page with the PDF icon, scroll down until you see language links on the right side. Click the relevant language. 5 To open the localized version of the product document, click the PDF link. Use ESM Help Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Task 1 To open ESM Help, do one of the following: Select the menu option Help Help Contents. Click the question mark in the upper right of ESM screens to find context-sensitive Help specific to that screen. 2 From the Help window: Use the Search field to find any word in the Help. Results appear below the Search field. Click the relevant link to display the Help topic in the pane on the right. Use the Contents tab (table of contents) to view a sequential list of topics in the Help. Use the Index to find a specific term in the Help. Keywords are organized alphabetically so you can scroll through the list until you find the keyword you want. Click the keyword to display that Help topic. Print the current Help topic (without scroll bars) by clicking the printer icon in the upper right of the Help topic. Find links to related Help topics by scrolling to the bottom of the Help topic. Frequently asked questions Here are answers to frequently asked questions. Where can I find ESM information in other languages? We localize the ESM release notes, Help, product guide, and installation guide. Find localized information on page 8 Where can I learn more about McAfee ESM? Use ESM Help on page 9 Visit the Knowledge Center Visit the Expert Center Watch McAfee ESM videos Which data sources are supported? Visit the McAfee ESM website How do I configure specific data sources? Find current data source configuration guides on the Knowledge Center Where can I learn more about McAfee ESM content packs? For information about content packs, refer to the following KB articles on the Knowledge Center: 9

10 KB How to implement SIEM Content Packs KB84036 FAQs for SIEM content packs KB Register for this KB to see what is in the latest content packs Intel Corporation Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others.