Juniper Secure Analytics Patch Release Notes

Transcription

1 Juniper Secure Analytics Patch Release Notes June r patch resolves several known issues in Juniper Secure Analytics (JSA). Contents Installing r1 Patch Clearing the Cache Known Issues and Limitations Resolved Issues Documentation Feedback Requesting Technical Support Self-Help Online Tools and Resources Opening a Case with JTAC Revision History

2 JSA Patch Release Notes Installing r1 Patch If your deployment is installed with version of Juniper Secure Analytics (JSA) or later, you can install r patch. NOTE: The JSA r patch can upgrade JSA and above to the latest software version. However, this document does not cover all of the installation messages and requirements. For information on upgrading from JSA to JSA , see the Upgrading to JSA guide. Ensure that you take the following precautions: Back up your data before you begin any software upgrade. For more information about backup and recovery, see the Juniper Secure Analytics Administration Guide. To avoid access errors in your log file, close all open JSA webui sessions. All appliances in the deployment must be on the same version. The patch for JSA cannot be installed on a managed host that is at a different software version from the console. All appliances in the deployment must be at the same software revision to patch the entire deployment. Verify that all changes are deployed on your appliances. The patch cannot be installed on appliances that has changes that are not deployed. Patches are cumulative software updates to address known software issues in your JSA deployment. JSA patches are installed by using an SFS file. The patch can update any appliance that is attached to the JSA console that is at the same software version as the console. To install a r1 patch: 1. Download the r patch from the Juniper Customer Support website Using SSH, log into your system as the root user. 3. Copy the patch to the /tmp directory on the JSA console. NOTE: If space in the /tmp directory is limited, copy the patch to another location that has sufficient space. 4. Unzip the file in the /tmp directory using the bunzip utility: bunzip r sfs.bz2 5. To remove tx000xx.sql files if listed any, type the following command: 2

3 Installing r1 Patch rm tx*.sql 6. To create the /media/updates directory, type the following command: mkdir -p /media/updates 7. Change to the directory where you copied the patch file. For example, cd /tmp 8. To mount the patch file to the /media/updates directory, type the following command: mount -o loop -t squashfs r sfs /media/updates/ 9. To run the patch installer, type the following command: /media/updates/installer NOTE: If you have logged in through serial-based console connection, run the following command to install the patch: /media/updates/installer --no-screen NOTE: The first time that you run the patch, there might be a delay before the patch install menu is displayed. 10. Using the patch installer, select all. The all option updates the software on all systems in your deployment. In high availability deployments, primary high availability appliances are patched and replicate the patch update to the secondary high availability appliance. If you do not select the all option, you copy the patch to each appliance in your deployment and install the patch. If you manually install the patch in your deployment, you must update your appliances in the following order: 1. Console 2. Event Processors 3. Event Collectors 4. Flow Processors 5. Flow Collectors If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. 11. After the patch completes and you have exited the installer, type the following command: umount /media/updates Results 3

4 JSA Patch Release Notes A summary of the patch installation advises you of any managed host that were not updated. If the patch fails to update a managed host, you can copy the patch to the host and run the installation locally. After all hosts are updated, administrators can send an to their team to inform them that they will need to clear their browser cache before logging in to the JSA interface. What to do next You are now ready to clear the Java cache and the browser cache. Related Documentation Clearing the Cache on page 4 Known Issues and Limitations on page 5 Resolved Issues on page 5 Clearing the Cache After you install the patch, you must clear your Java cache and your web browser cache before you log into the JSA appliance. Before you begin Ensure that you have only one instance of your browser open. If you have multiple versions of your browser open, the cache might fail to clear. Ensure that the Java Runtime Environment is installed on the desktop system that you use to view the user interface. You can download Java version 1.7 from the Java website: About this task If you use the Microsoft Windows 7 operating system, the Java icon is typically located under the Programs pane. To clear the cache: 1. Clear your Java cache: a. On your desktop, select Start > Control Panel. b. Double-click the Java icon. c. In the Temporary Internet Files pane, click View. d. On the Java Cache Viewer window, select all Deployment Editor entries. e. Click the Delete icon. f. Click Close. g. Click OK. 2. Open your web browser. 4

5 Known Issues and Limitations 3. Clear the cache of your web browser. If you use the Mozilla Firefox web browser, you must clear the cache in the Microsoft Internet Explorer and Mozilla Firefox web browsers. 4. Log in to JSA. Related Documentation Installing r1 Patch on page 2 Known Issues and Limitations on page 5 Resolved Issues on page 5 Known Issues and Limitations None. Related Documentation Clearing the Cache on page 4 Installing r1 Patch on page 2 Resolved Issues on page 5 Resolved Issues The following are the resolved issues addressed in r1 patch. OFFENSE GENERATION UNEXPECTEDLY STOPS OCCURRING IN JSA. APPLICATION ERROR POP UP WHEN OPENING AN OFFENSE. THE JSA USER INTERFACE CAN BECOME INACCESSIBLE DUE TO THE TOMCAT SERVICE RUNNING OUT OF MEMORY. WHEN CHANGING GLOBAL CONFIGURATION PASSWORD, IT MAY TAKE A LONG TIME TO COMPLETE. UNABLE TO FILTER ON CLOSED OFFENSES. RULE TEXT COUNTERS MIGHT RESET WHEN THE RULE TEST RELOADS. THE HIGH AVAILABILITY WIZARD FAILS TO ADD A HOST BECAUSE THE IP ADDRESS IS ALREADY DEFINED IN THE SERVER HOST TABLE. A HARMLESS ERROR MESSAGE MIGHT DISPLAY WHEN YOU APPLY A PATCH UPDATE TO YOUR JSA SYSTEM. NOTIFICATIONS FAIL IF THE CONFIGURED ADDRESS CONTAINS A HYPHEN "-". CHANGING FROM THE ALL USER ROLE TO THE ADMIN USER ROLE DOES NOT UPDATE THE EVENT OR FLOW LISTS DISPLAYED ON THE DASHBOARD TABLE. LIST OF EVENTS DOES NOT DISPLAY PROPERLY DUE TO HTML PARSING ERROR WHEN YOU USE THE MICROSOFT INTERNET EXPLORER 8 WEB BROWSER. 5

6 JSA Patch Release Notes PENDING AUTOMATIC UPDATES MIGHT INSTALL UNEXPECTEDLY WHEN YOU UPDATE A SCHEDULE ON THE UPDATES WINDOW. UNABLE TO CREATE A LOG SOURCE ONLY OR NETWORK ONLY SECURITY PROFILE WITHOUT BOTH LOG SOURCES AND NETWORKS SPECIFIED. SOURCE AND DESTINATION ASSET NAME COLUMNS DO NOT QUERY THE HOSTNAME COMPONENT OF THE ASSET PROFILE. MODIFYING A REPORT TEMPLATE MIGHT NOT ALLOW USERS TO CHANGE THE END DATE OF THE REPORT BEYOND SEPTEMBER 16, NETWORK I/O ISSUES ON A MANAGED HOST MIGHT GENERATE AN OUT-OF-MEMORY ISSUE ON THE CONSOLE. ARIELCLIENT CONTAINS ADDITIONAL LINE FEED AT THE END OF FILE. CANNED QUICK SEARCHES DO NOT SHOW IN MANAGE SEARCH RESULTS BUT CUSTOM QUICK SEARCHES DO. PERFORMING A SORT OF SEARCH RESULTS FOR AN IN-PROGRESS SEARCH GIVES ERROR THIS QUERY HAS TIMED OUT AND IS NO LONGER VALID. BULK ADD OF LOG SOURCES MAY GENERATE AN F5 ERROR ON THE UI. DATA ACCUMULATION AND UNIQUE COUNT MAY NOT BE DISPLAYED FOR THE ADMIN ON SEARCHES CREATED BY NON-ADMIN USERS. FILTERING ON A CUSTOM PROPERTY THAT CONTAINS THE SUBSTRING "ID:" RETURNS NO RESULTS INCORRECT HOST.TOKEN CAUSES EXTERNAL AUTHENTICATION TO FIRE FOR "SEC" USER. ADDING CUSTOM EVENT PROPERTIES WITH CERTAIN SPECIAL CHARACTERS CAN CAUSE AN EXCEPTION WHEN FILTERING. LOG ACTIVITY SEARCH SHOWS WRONG DATE WHEN THE DASHBOARD GRAPHS HAVEN'T FULLY LOADED AND VIEW IS PRESSED IN LOG ACTIVITY. DHCPV6 FLOW TRAFFIC BEING PARSED WITH INCORRECT EVENT NAME AND LOW LEVEL CATEGORY. AFTER AN UPGRADE TO JSA r2, NEW LOG SOURCES DO NOT AUTOMATICALLY DISCOVER ON MANAGED HOSTS. ARIEL RIGHT CLICK API DOES NOT WORK ON ARIEL PROPERTIES. APPLICATION ERROR IN MANY PAGES FOR USER WITH $ IN USERNAME. SEARCHES THAT COMBINE HIGH AND LOW CATEGORY SEARCH VALUE FILTERS RETURN INCORRECT RESULTS. UNABLE TO CHANGE LANGUAGE SETTINGS AS NON-ADMINISTRATOR USER. ADDING A SECONDARY TO A MANAGED HOST MAY FAIL DUE TO /STORE BEING BUSY ON THE SECONDARY. ASSETPROFILER ERRORS IN QRADAR.LOG THAT REFER TO MESSAGEMARSHALLERV2. 6

7 Resolved Issues THE 'EVENT PROCESSOR' SEARCH FILTER DOES NOT WORK WHEN SETUP IN RULES. SEARCHES AND/OR REPORTS THAT CONTAIN THE COLUMN 'SOURCE ASSET NAME' AND ARE GROUPED BY SOURCE IP WILL RETURN 'NONE'. IPFIX AND NETFLOW V9 ONLY READS 16-BIT AND NOT 32-BIT ASN NUMBERS. REPORTS RETURN DIFFERENT DATA WHEN RUN AGAINST RAW DATA VERSUS A SCHEDULED/ACCUMULATED DATA REPORT. WHEN LOGGING INTO THE JSA USER INTERFACE, CERTAIN DASHBOARD ITEMS SHOW AN ERROR MESSAGE. RULES THAT USE 'INCLUDE DETECTED EVENT FROM THIS ATTACKER FROM THIS POINT FORWARD' ARE NOT ADDING NEW EVENTS TO THE OFFENSE. WHEN APPLYING A LOG SOURCE EXTENSION TO A LOG SOURCE TYPE, THE USER INTERFACE APPEARS TO NOT APPLY THE CHANGE SUCCESSFULLY. OFFENSE SEARCH 'SAVE CRITERIA' OPTION THAT CONTAINS A 'SOURCE NETWORK' FUNCTIONS CORRECTLY BUT DOES NOT DISPLAY PROPERLY. NEWLY CREATED JSA DASHBOARDS ARE ACCESSIBLE TO ALL USERS WITH THE SAME ASSIGNED USER ROLE. UNABLE TO LOAD THE 'LOG SOURCES' PAGE IN THE JSA UI AFTER PATCHING FROM X TO X. RULES ARE NO LONGER ASSOCIATED TO OFFENSES AFTER A SOFT CLEAN SIM IS PERFORMED. HOSTCONTEXT SERVICE DOES NOT AUTOMATICALLY RESTART AFTER DAYLIGHT SAVINGS TIME CHANGE. EMPTY PLUG-INS OPTION ON ADMIN TAB IN THE JSA USER INTERFACE. SNMP DAEMON IS NOT ENABLED ON HIGH AVAILABILITY SECONDARY. THE REMOVE ITEM OPTION FROM WITHIN A TIME SERIES GRAPH DOES NOT ALWAYS WORK AS EXPECTED IN CHROME WEB BROWSER. JSA DATA BACKUPS MIGHT FAIL TO RUN SUCCESSFULLY ON MANAGED HOSTS. THE ARIEL RIGHTCLICK.PROPERTIES API DROPS THE '\' OR '$' CHARACTERS IN EVENT PROPERTIES. FILTERED NETWORK ACTIVITY SEARCHES MAY RETURN UNEXPECTED RESULTS. SILENT INSTALLS DO NOT WORK IN AN APPLICATION ERROR POP UP WINDOW OCCURS WHEN CREATING A FLOW RULE THAT TESTS AGAINST REFERENCE TABLE DATA. APPLYING JSA PATCH.SFS FAILS ON HIGH AVAILABILITY SECONDARY. AN ERROR HAS OCCURRED. REFRESH YOUR BROWSER... MESSAGE WHEN ATTEMPTING TO DISABLE OR DELETE A RULE IN JSA. 7

8 JSA Patch Release Notes TIME ZONE DATA DISPLAYED WITHIN JSA IS NOT ACCURATE FOR SOME TIME ZONES. SAVED SEARCHES WITH SPECIAL CHARACTERS CAUSES DASHBOARDS TO DISAPPEAR. WHEN DASHBOARDS ARE ADDED TO USER ROLES, THOSE USERS WILL NO LONGER SEE THE DEFAULT DASHBOARDS. IDENTITY HOSTNAME IS BEING POPULATED BY USERNAME IN OFFENSE. QFLOW CRASHES IF PACKET SOURCE ADAPTOR IS DISABLED. UNABLE TO RESTORE CONFIG BACKUP FOR NON-ENGLISH UI. EVENTPROCESSOR FILTER IN ADVANCED QUERY AND RESTAPI QUERIES ALL EVENT PROCESSORS WHEN SPECIFYING A SPECIFIC EVENT PROCESSOR. ERROR: NULL VALUE IN COLUMN WHEN ADDING A NEW ADMIN USER ACCOUNT WITH EXTERNAL AUTH AND NO PASSWORD IS ENTERED. RESPONSE TIME WHEN CONFIGURING A LOG SOURCE IS VERY SLOW WHEN USING WITH CHROME. ARIEL ERROR WHEN FILTERING ON A SORTED, AGGREGATED COLUMN. DELETING REFERENCE SETS USED IN RULES FAILS, BUT DOES NOT WARN WHY. RE-EDITING REPORT DESCRIPTION SHOWS HTML </BR>. DASHBOARD LEGENDS BLEEDING HTML CODE IN TOOLTIP. DSM JAR FILES ARE NOT BEING PROPERLY RESTORED FROM A CONFIG BACKUP. 'DOMAIN' DOES NOT WORK AS A SEARCH FILTER WHEN USING THE JSA ADVANCED SEARCH FUNCTIONS. AN INVALID CURSOR WAS PROVIDED TO THE QUERY. PLEASE TRY AGAIN WHEN A LOG OR NETWORK ACTIVITY SEARCH IS PERFORMED. RESTAPI EVENTS ARE DISPLAYING AS 'UNKNOWN' EVENTS. SYSTEM NOTIFICATION ERROR OUT OF MEMORY DISCOVERED FOR HOSTCONTEXT DURING BACKUP PROCESS. NULLPOINTEREXCEPTION IN JSA LOG FILES CAUSED BY AN INVALID REGULAR EXPRESSION (REGEX) IN A RULE SEARCH FILTER TEST. THE /STORE/TRANSIENT PARTITION DOES NOT GET RE-MOUNTED AFTER PERFORMING A FACTORY RE-INSTALL USING THE ISO. SCHEDULED SCANS DO NOT APPEAR IN THE SCHEDULED SCANS CALENDAR. AUTOMATIC POST SCAN REPORTS ARE NOT BEING GENERATED. Related Documentation Clearing the Cache on page 4 Installing r1 Patch on page 2 Known Issues and Limitations on page 5 8

9 Documentation Feedback Documentation Feedback Requesting Technical Support We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Find product documentation: Find solutions and answer questions using our Knowledge Base: Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at 9

10 JSA Patch Release Notes Call JTAC ( toll-free in the USA, Canada, and Mexico). For international or direct-dial options in countries without toll-free numbers, see Revision History June 2015 for JSA Release All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 10