IDU Suite Release Notes

Transcription

1 U Suite Release Notes

2 Publishing Information Software version Document version 26 Publication date April 2011 Copyright Varonis Systems Inc. All rights reserved. This information shall only be used in conjunction with services contracted for with Varonis Systems, Inc. and shall not be used to the detriment of Varonis Systems, Inc. in any manner. User agrees not to copy, reproduce, sell, license, or transfer this information without prior written consent of Varonis Systems, Inc. Other brands and products are trademarks of their respective holders.

3 U Suite Release Notes Introduction Introduction U Suite introduces the following new functions and enhancements to existing functions: DatAdvantage Statistics - Drill-down is now available for special files Ability to exclude objects from U Analytics DataPrivilege Commit - Folder operations can now be run in bulk Support for the Dutch language Data Classification Framework (DCF) Extended attributes can be defined and used in rules Real-time status can be retrieved for the classification queue and for specified folders Reports New report - Open NTFS and share permissions New report filter - Disabled accounts SharePoint enhancements Exchange General availability Enhancements Noteworthy or changed behavior in the U Suite Resolved issues Known issues DatAdvantage Statistics Drill-down for Special Files This version enables drilling down through folders to view statistics on any special files that reside within them. In the resulting statistics chart, the bar for special files is colored blue. The jump and ownership management options available for folders (through the popup menu) are also available for special files. Proprietary and Confidential of Varonis 1

4 U Suite Release Notes Exclusion from U Analytics Administrators can define a list of entities that U Analytics will not take into consideration, so that no recommendations will be generated for the entities or their permissions. However, the entities are still monitored by DatAdvantage in every other way: they are considered when statistics are calculated, events are gathered for them, and so on. Several groups are predefined as excluded during installation. DatAdvantage for Exchange - General Availability Varonis is proud to announce general availability of DatAdvantage for Microsoft Exchange. DatAdvantage provides complete visibility into Exchange Servers to facilitate: Efficient and effective permission management Auditing of mailbox events Provision of recommendations and sandboxing Ownership detection and assignment Delegated management Rule-based management Creation of ethical walls Entitlement review Data classification More Exchange Enhancements This version introduces a number of enhancements to Exchange support: Installation of mixed versions (Exchange 2007 and Exchange 2010) is only supported if the Exchange Servers are located on different file servers The system is added to the filtered users list during installation The file server configuration is scanned for changes to the Exchange database Message collection can be filtered by pattern in the subject line A new search filter, "Message subject," has been added to the log Database availability groups (DAG) are supported for Exchange 2010 Clustered mailboxes are supported for Exchange 2007 Load balancing is supported for the Client Access Server (CAS) Pull Latest Events is now supported It is now possible to configure the types of events to be collected Expansion of distribution lists is prevented Proprietary and Confidential of Varonis 2

5 U Suite Release Notes DataPrivilege Bulk Commit Operations Support for Dutch This version of DataPrivilege enables running all folder operations in bulk. DataPrivilege now supports the Dutch language throughout the user interface. SharePoint Enhancements This version introduces the following enhancements to SharePoint support: Support for site creation events Support for full recovery mode - It is now possible to instruct the Enterprise Installer to create a new database (called "Varonis") that stores and works with SharePoint audit tables through synonyms. This mode is recommended for better performance and to reduce the size of log files, especially when SharePoint is configured with the Full Recovery model. Note: While this capability is provided by the new SharePoint agent, upgrade to the new agent is considered to be an upgrade to a beta product with or without recovery mode. It is therefore recommended to use caution in choosing to upgrade. Data Classification Framework (DCF) Extended Attributes Current Status Reports The DCF now supports the use of extended attributes in rule conditions. A number of predefined attributes have been included out of the box, and users can define additional attributes as necessary on the Advanced Options tab. With this version, users can now view the current status of the classification process. Classification status is provided for the overall system, and can be retrieved on demand for specific folders. This version introduces the following enhancements to U Reports: New report - Report 12l lists all the folders that can be accessed by global access groups (by default, everyone, Domain Users and Users) through both Share and NTFS permissions. Proprietary and Confidential of Varonis 3

6 U Suite Release Notes Agents to be Upgraded New report filter, Disabled accounts - Retrieve results that include disabled accounts. With this version, Varonis recommends upgrading the following agents: Agent Type Windows SharePoint Unix/Linux Upgrade Recommendation Recommended Recommended Recommended Upgrade Flows Versions 4.07 and higher may be upgraded directly to the current version. Versions lower than 4.07 must be upgraded first to 4.07 or higher, and then to the current version. Noteworthy or Changed Behavior The following issues are important for this release: V V V In this version, all directory and file errors are written to the DCF_LOGS table; the HResult on the DCF_Priorities and DCF_Files tables does not reflect real errors. V V If a user had L permissions to 'this folder only', the Work Area displayed 'L' and the Reports view showed RLX. Proprietary and Confidential of Varonis 4

7 U Suite Release Notes V V V V V It is now possible to add existing groups to folders For consolidated installations, reports can display approximately 250 file servers A configuration key was added to allow users to request direct permissions The Enterprise Installer now supports verifying the identity of a file server and fixing "fake" identities A new key in the Properties to Bind group enables configuring the display name for users and groups Processing logic has been changed so that an error is returned if an attempt is made to add a managed folder on a path that has no base folder A key has been added to enable configuring the display of the Advanced pane in requests A new filter, "Message subject," is now available under the "Mail Properties" filter A new option enables adding unresolved entities to the list of filtered users and groups. Resolved s The following issues have been resolved: V The Enterprise Installer failed if.net Framework 3.5 was not installed on the installation machine. Proprietary and Confidential of Varonis 5

8 U Suite Release Notes A timeout occurred when it was necessary to display 1,000 folders or more The Verify button updated incorrectly when a file server's S was changed U Analytics entered commands incorrectly into the AdminCmds table, so that recommendations could not by synchronized to DataPrivilege The search mechanism had poor performance when run on a depth of 1,000 folder levels The verification procedure 'FixFilerIdentity' failed after the SharePoint file server was added again The spverification_fixspfileridentity stored procedure did not fix the SharePoint file server identity The search did not function correctly in Administration > Base Folders > Data Owners View The "Added Outside DataPrivilege" and the "Recommendations" flags were displayed incorrectly Removal of folder owner was not synchronized properly with DatAdvantage. V Incorrectly localized strings caused the French installation to fail An encryption issue in the searcher service was resolved The entitlement review schedule did not function with special database configurations For file servers with a very large number of folders, the Permission wizard took a long time to load The Enterprise Installer did not set the supplied simple user permission so FileWalk could impersonate The commit process did not add file system permissions if the user performing the commit was a regular user (not an administrator or backup operator). V A patch was rolled up from version , which included a number of fixes to the Exchange provider. Proprietary and Confidential of Varonis 6

9 U Suite Release Notes For Exchange, the FileWalk GetFolder and FindFolder requests have been modified to retrieve smaller numbers of folders at a time The spgetowners bysubscription stored procedure returned an inncorrect ownertype if the user held more than one ownership role If more than 14,000 OUs existed, the PostAdWalk task failed and the Pull job did not work The DCF failed if it was run on unextracted RAR files The Subscription Form did not resize properly to enable viewing with larger fonts The DataPrivilege MSI was not upgraded when the Secondary Logon service was disabled The queue stopped responding if an address with an invalid format was inserted A timeout occurred during the creation of Entitlement Review requests A description of a user defined with multiple inheritance was incorrect A check was added to see whether the SQL Server is configured to use non-default ports; if it is not, a warning is issued Ownership could not be set from the Statistics view Upgrading the GUI did not always replace varonis.license.services.dll. V V Error severity levels greater than 18 can only be specified by members of the sysadmin role An arithmetic overflow error occurred in converting an expression to the smalldatetime data type Simple users could select the "All Owners" option in datadriven subscriptions to the file system Licensing now supports more than users per license. However, if a license is registered with an older version of the Enterprise Installer, the number of users is set according to the older method. Proprietary and Confidential of Varonis 7

10 U Suite Release Notes s arose in converting content databases due to impersonation problems The content database could not be modified if users did not exist The licensing mechanism now allows for a one-day time difference between the U and the client machine An option has been added to create a central Journal mailbox that uses a global journaling rule instead of the Journal Recipient method If a user had L permissions to 'this folder only', the Work Area displayed 'L' and the Reports view showed RLX In the synchronization report, relations that were added outside of DataPrivilege were given the timestamp of the current day When a license was re-registered, its initial creation date was re-embedded instead of the first registration date If the displayname attribute is missing, the CN attribute should be used instead; otherwise, Exchange ADWalk will fail Resolution between the frontend and the backend failed during creation of the Varonis content database The Scheduler was installed on remote commit hosts even though it was not needed. V V V V The Probe may fail when monitoring multiple CEPA resources. V Auditing in full recovery mode is now supported. Proprietary and Confidential of Varonis 8

11 U Suite Release Notes Incorrect prefixes were displayed for URLs A password was added to the migration process to ensure only authorized personnel perform authorized migrations Traverse permissions can now be set on base folders up to the level of the share A collation conflict occurred when DataPrivilege was installed after DatAdvantage The Classification Engine did not return all relevant results when a dictionary was used When SharePoint volumes and file servers are removed, the volumes are also removed from the Domain table A failure occurred when a new group was added but not properly synchronized A new registry key enables configuring whether the Windows agent sets up the NetApp server by default Expired requests did not cancel commit transactions s occurred in NetApp Inode2Path resolution Changes in the license validation process have been implemented The license master key did not validate the license version and address in question notification has been modified so that a list of processes that were run is no longer included Send Mail failed on an INSERT-EXEC statement within a try-catch block A new keyvalue enables configuring whether to use the FQDN for a resource user, or to use the identity exactly as entered List permissions were displayed as Read + List in the Work Area A new filter, Permissions, has been added to reports 4a and 4b Request has been added to the request summary After upgrade, the security mode of all volumes was set to the default (Mixed mode) When file permissions were changed (set_sec) on EMC Celerra, Open and Modify events were recorded The requestreason parameter in the mail templates contained an incorrect value. Proprietary and Confidential of Varonis 9

12 U Suite Release Notes The NetApp proxy now sets the RequireRpcAuth CifsQ registry key to 1 instead of The Migration Tool now enables using an existing database instead of copying it The Commit process stopped responding when invalid commands were executed The Save Owners feature for entitlement reviews was refactored The 'added outside DataPrivilege' indicator is only displayed when permissions or members are added to groups that are already managed in DataPrivilege In Entitlement Review configuration, the Start Date limitation is now in use only for entitlement reviews whose schedules are set to 'once' Report generation was enhanced to facilitate generating reports with large amounts of data Change DB Owner is now run on vrnsui The navigation menus can now be shown or hidden by altering the URL Folder details were missing in the notification sent to authorizers from a request created by the API For list items, the DCF returns the item description if one exists; if no description exists, the DCF returns the body of the list item A new table enables monitoring pulling activity The Enterprise Installer failed when the URL for the EWS was a CAS load-balancer Tables were recreated without first checking whether they already existed, which caused subscriptions to fail on rerun Files with extensions of *.exe and *.cab are automatically ignored by the engine The DCF engine now sends a list of the machine's IFilters to the log All string columns were changed to n/varchar(max) to prevent truncating strings or binaries A null reference exception occurred in the Exchange provider (in FileWalk) The Journal reader failed when message subjects contained special XML characters If the Pull job failed the temp table it created was not dropped. Proprietary and Confidential of Varonis 10

13 U Suite Release Notes A failure occurred in creating the foreign key between ADO and AuthorizersS The 'Requested Folder' filter did not function correctly in the Request and Authorization report Performance enhancements were made to the Pull mechanism Fully inherited folders were displayed as unique after PullWalk was run Pull Latest Events stopped responding and generated a timeout exception in the UI A failure occurred in calculation of timezone for notifications Connection issues with the Probe were resolved The Enterprise Installer failed to create databases when the Model database was larger than 80MB The Probe filtered events that arrived on a path containing an ampersand (&) Pull_Latest_Events failed with a Null exception A prerequisite check was added to ensure IIS is installed locally There was a Redundant join with remote SDT_{filer}_Dirs in PullDirectoriesAndAcls S resolution according to RFC 2307 is now supported A spelling error was corrected on the license upgrade screen Group members belonging to an unmonitored domain were not displayed in report 3a Locations are now sorted alphabetically in the Select Folders dialog box A new key was added to the application settings (Entitlement Review category) to enable switching from Simple mode to Advanced mode on the Entitlement Review request screen A new key was added to the application settings (General category) to allow approving or declining a request without providing an explanation If a user has permissions on another user s mailbox and is then deleted and another user with the same name is created, FileWalk fails because Exchange uses the old S Because EWS accesses public folders using client permissions and not admin permissions, FileWalk does not Proprietary and Confidential of Varonis 11

14 U Suite Release Notes retrieve public folders unless permissions are specifically granted to the FileWalk user The synchronization job now includes a step run on a weekly basis to shrink log files Send As permissions are not committed when the display name is different from the user name Administrators could not view all the subscriptions in the system An uninformative error message was displayed when a user with insufficient permissions tried to open a folder An error occurred (index out of range) when the Enterprise Installer found only Exchange Servers that were lower than 2007 SP The notification about successful upgrade of DatAdvantage was displayed even if the upgrade included only DataPrivilege The Advanced button for Entitlement Reviews was displayed after the "view only changed objects" option was selected, even when the button was hidden by configuration In the Alerts view, results were returned only for the currently active resource and not for the one selected Mailbox subfolders could not be selected in the Directory Picker during an advanced search A script to repair volume and share names was malfunctioning Performance improvements were made in report 12k A new key enables configuring RPC timeout for the FileWalk job A new keyvalue enables configuring the number of times FileWalk attempts to reconnect to the database after failure Folders found through the Search screen could not be removed A null-reference exception occurred in FileWalk message resolution The PullWalk job failed if there were changes to Active Directory that were older than 180 days because the upgrade process did not add table columns required for Exchange to the Hist_Archive table Support has been added for RHEL4 HugeMem SMP 32-bit The AutoTester threw an exception if an apostrophe was used in the name of a SharePoint site. Proprietary and Confidential of Varonis 12

15 U Suite Release Notes An SQL error occurred when synchronization was performed on an empty group The Windows Agent accepts both encrypted and unencrypted connections, depending on the file server type There was an inconsistency in localized resources String decryption failed due to encoding issues The Search filters functioned incorrectly There was an inconsistency in localized resources When the Commit engine is restarted, the order of transactions is not maintained FileWalk tried to crawl mailboxes that were pruned Licenses that included only SharePoint did not permit installation of DatAdvantage The Synchronize Owners feature did not work when executed from the popup menu Due to a Microsoft issue, a failure occurred when some reports were uploaded If a machine's S was changed, spgetlicense failed if there was a license bypass on the cluster The DCF failed to classify image files with ABBYY IFilter on x Due to a Microsoft issue, the vrnsmon service failed to start In Exchange, the inherited Receive-As ACE was not extracted There was an inconsistency in localized resources was not processed correctly with Outlook 2007 when it was set to the IMAP protocol There was an inconsistency in localized resources A memory leak occurred in the Probe when it connected to CEPA Licenses that did not include Unix did not allow adding another Active Directory domain In Exchange, the inherited Full Access ACE was not extracted The DataPrivilege upgrade failed the license check Indexing the Events table caused performance issues during upgrade. Proprietary and Confidential of Varonis 13

16 U Suite Release Notes Alteration of the Domain column of the Filers table on the Probe was not fault tolerant There was an inconsistency in localized resources The Enterprise Installer installed the Windows Agent even if the "Do not install or upgrade agent" checkbox was selected An error occurred when the user's display name was different from its common name (cn) The number of times the scheduler tries to reconnect to the database is now configurable The Probe now ignores IP addresses from Windows file servers There was a memory leak in the CEPA heartbeat FileWalk error messages have been improved to include the name of the relevant file server, not just its The addition of a file server resulted in a warning that a filtered user could not be configured The SharePoint agent did not update the remoting sections of the web.config file In report 4i, the full URL path did not appear in the Site column The Subject field in s displayed question marks if non- Latin characters were used Ubuntu 8.04 TLS 32-bit is now supported On the Base Folders pane, the auto-complete function returned managed folders in addition to base folders Users in the Recommended Users and Groups pane did not remain sorted after a directory was selected The agent queue failed to access kernel events via mapped memory Enhancements were made to the File Share Data-Driven Subscription form In report 3a, the 'Group Name' filter did not show direct relations ADWalk on SharePoint occasionally failed, possibly due to a threading issue in the SharePoint provider There was an inconsistency in localized resources The Probe inserted events with an invalid TimeSent value FileWalk inserted events with an invalid TimeSent value. Proprietary and Confidential of Varonis 14

17 U Suite Release Notes Support was added for the List View Threshold in SharePoint Domain custodians and owners of local groups were not removed when the relevant file servers were deleted If the pulling service was stopped, the status of pending requests was changed to Expired In some cases, enabling generic item event monitoring caused issues with the rendering of HTML/Javascript on SharePoint ADWalk and FileWalk may fail at invocation if a security program named Sophos Endpoint is installed A failure occurred in retrieving the QTree list FileWalk failed on a mailbox when a single folder within the mailbox failed Buttons were cut off in from the User Search window in localized versions A title string was not located in the resource files and thus was not translated Support was added for registry of DCF entities via CSV file Searching for base folders did not return all possible results ADWalk failed when inserting rows into the ActiveDirectory_OUs and ADOUsMonetored tables because the index on OU_name was not long enough. Known s The following are the new known issues in the current version: V V V In Entitlement Reviews, members of nested distribution lists are not displayed in the object list. V Proprietary and Confidential of Varonis 15

18 U Suite Release Notes V If a new evaluation license is registered with a different number of users than the previously existing evaluation license, the number of users is not overwritten SharePoint file servers are detected without their associated site lists. V V V V The Probe may fail when monitoring multiple CEPA resources. V V DatAdvantage treats mail-enabled public folders as regular users The Default and Other virtual groups may be selected in user pickers, even though no results will be returned if they are selected Due to the native behavior of the Microsoft UI control, the 'Show rows per status per file server' option does not restore the default when a minus sign (-) is inserted and Reload is clicked When extended Active Directory properties are added, the lists in the advanced search panes are only refreshed after the user moves to a different view and then returns to the advanced search In the Manage Ownership window, special files are not distinguished from directories. Proprietary and Confidential of Varonis 16

19 U Suite Release Notes The CE_SkipOffline flag has been set to True, so that the DCF skips offline files. However, it does try to scan archived files On SharePoint file servers, Rename events on list items appear as both Rename events and Modify events Port must be open for the Exchange Commit Agent When a user jumps from the Log View to the Review Area, the Directories tree is not expanded in the Review Area Permissions granted to the Creator Owner and Creator Group are not effectively granted to the underlying S Events for unmonitored special files may be presented in the UI for both Unix and SharePoint file servers The User/Group filter returns events on the directory path that contains the entered string Users of the type "public folder" can be added to the Site collection Administrators group and to all local SharePoint groups The UI may display events (as unmonitored) for unmonitored users Approved direct requests are displayed in the Advanced Search but cannot be found by a filtered search The results for simple and advanced searches may be inconsistent if the results include files or folders whose names contain only white spaces Because FileWalk resolution for messages is not synchronized with subject filtering, filtered messages are still retrieved on resolved open events Data on excluded groups may be displayed in reports Recipient mailboxes that reside on file servers other than that on which the sender resides are treated like external addresses Uninstalling or removing SharePoint file servers does not remove the Varonis item from IIS Pending Membership subrequests remain in the summary after the related groups are excluded It is not possible to open special files on SharePoint file servers through the popup menu If the Table Maintenance job fails, the view is not recreated Create List events are only supported for SharePoint Proprietary and Confidential of Varonis 17

20 U Suite Release Notes Resolved message information is based only on the visible data in the mailbox; this means it is only possible to gather information regarding BCC recipients through the Journal The DCF cannot be run on SharePoint when Non-IIS mode is set ADWalk sends mail messages as ASCII, which may result in display issues for certain languages The agent lacks set_sec(_dir) events on setfacl operations During upgrade, vrns_qd may remain in memory and a hard reset may be required For Windows 2000, if the msexec version is lower than 3.0, the Windows Agent MSI must be installed manually No Create events are gathered for SharePoint file servers until FileWalk is run Installation may fail when installing the Probe, U or Shadow on the same SQL instance as the SharePoint file server with audit mode set to 'Modified' A timeout may occur during repair or upgrade of a SharePoint file server. Proprietary and Confidential of Varonis 18