McAfee Enterprise Security Manager 10.3.x Release Notes

Transcription

1 McAfee Enterprise Security Manager 10.3.x Release Notes Contents Installation information What's new in update Resolved issues in update Migrating from Flash to HTML Installation information Upgrading to this release requires preparation and an understanding of how the upgrade process works. Before beginning the upgrade: Review the upgrade information in the McAfee Enterprise Security Manager Installation Guide. Verify that your current McAfee ESM version is 9.6.x (or later). You can only upgrade to 10.x from 9.6.x or later. Remove Nitro IPS devices from McAfee ESM. You cannot upgrade to 10.x with deprecated Nitro IPS devices. After completing the upgrade Before logging on for the first time, clear your browser cache. Not doing so might cause issues when you log on. If you plan to upgrade to 11.x, upgrade to (or later). 1

2 What's new in update Update releases can update platform support. Import watchlist feature in the HTML interface validates shorter lists than Flash interface When importing watchlists using the HTML interface, lists containing 1,000 or more values are not validated. Values might be truncated or modified with no notification. In the Flash interface, validation and status messages are provided for lists of up to 25,000 values. What's new in the release Backup and Restore You can now back up and restore McAfee ESM data. Dark mode Setting McAfee ESM to dark mode adjusts the displays to reduce eye strain in dark operating conditions. Scorecard improvements The McAfee ESM Scorecard view can now integrate with Tychon (requires a Tychon data source). Tychon is an Enterprise Detection and Response (EDR) product that lets you collect additional data needed to populate Scorecard. In combination with McAfee Policy Auditor and Tychon, customers can use ESM to visualize the 10 assessment items in the US Department of Defense CyberSecurity Scorecard. Scorecard requires McAfee epo and McAfee Policy Auditor. Additional VM platforms ESM virtual machines can now be created on the Azure, Hyper-V (2016 and later), and XEN (6.5 and later) platforms. Driver support ESM now supports Intel P4600 drivers. Resolved issues in update This update resolves known issues. For a list of current known issues, see McAfee Enterprise Security Manager 10.x.x Known s (KB88184). Reference Resolution Various ESM Redundancy fixes Corrected an issue that prevented McAfee Enterprise Log Manager with SAN from booting after upgrading to ESM , , , , , , , , , , Fixed several post-upgrade problems related to a kernel issue Geo Source ID /ASN data is now pulled after upgrading from ESM to ESM

3 Reference Resolution Corrected an issue that caused Office 365 collection to lag Resolved an issue that caused a TMP file to grow in size unnecessarily ACE insert jobs no longer hang with bad queries , Health Monitor now correctly determines the life left in Micron SSD , , , Fixed several geolocation-related issues. Resolved s Component McAfee ACE , Historical correlation managers work even when default managers are disabled. Filter issue fixed. McAfee Enterprise Log Manager Enterprise Log Search , , , , , , Log search process corrected. McAfee ESM Alarms , , , Asset Manager , , , , , , CAC authentication Correlation rules Data enrichment report Event forwarding Passwords Policies , , Red flags , Redundancy , , , , , , System properties , , , , Time zones , Views Watchlists , Syslog or SNMP recipient settings saved correctly. Alarm s that use custom types now correctly include type and data. Rapid7 VA data now collected correctly. CAC authentication process corrected. Rule configuration saved correctly. Source user field correctly shows user name instead of Microsoft SID. Weekly report now generated correctly. Event filter displays correct values. When using Chrome Developer tool, password visibility corrected. SetThirdPartyConfig tmp file contains complete data source information. Red flag functionality corrected. Redundant ESM devices sync correctly. Changes to system properties saved correctly. Turkey time zone now available. Backup time zone used correctly. NetFlow data now visible. Dynamic watchlist status corrected. 3

4 Component McAfee Event Receiver , , , , , , , , , , Event data process corrected. Hardware ETM-X7 with Intel P4600 mdadm now generates index_hd. AWS, Hyper-V, and Azure Supports ability to add storage (disks). HTML Improved performance of drill-down and filter queries. Resolved s Component Redundancy , , , , , , , , , , , , , , , , , , , , , , Settings , Multiple Redundant ESM fixes aimed at preventing a frozen sync situation. You can now use a plus sign (+) in addresses. Redundancy The SendLiveData flag is no longer missing from the database. Backup Fixed an issue that slowed incremental backups. Restore Restore of Alert data now happens during a Restore Backup process. Reports , CSV Reports now return all Cases results. Resolved issues Find issues that have been fixed in this version. McAfee ACE , , , , , Fixed a recursive loop issue in correlation rules. Fixed the parsing of comma values in parser rules Corrected an issue that the McAfee ACE correlator log to fill with SEVERE errors McAfee ACE no longer deadlocks when running "correlator.sh -status" while a rule update is in progress McAfee ACE no longer generates an erroneous IndexOutOfBoundsException. Database , , , , The SendWatchlistChanges job no longer hangs. 4

5 DBM Parameterized queries no longer show command as UNKNOWN under the custom types tab. McAfee Enterprise Log Manager , Fixed an issue that caused an Access denied (ER70) error when a non-admin user performed an McAfee Enterprise Log Manager search When updating McAfee Enterprise Log Manager, the process now completes if the CIFS share takes longer to respond than the update timeout. McAfee Enterprise Log Manager: Redundant ELM , , McAfee Enterprise Log Manager redundancy setup no longer gets stuck at 20%. ESM , Resolved an issue that resulted in empty Scorecard & Asset, Threat, and Risk dashboards , You can now configure recipient addresses that include + (plus sign) Asset Sources pull from AD now works correctly CIFS View Files functionality no longer fails Corrected an out-of-memory problem caused by queries not terminating properly iscsi devices now work for Data Archival , Fixed an issue that caused Properties pages to appear blank when device communication was lost Fixed an issue that caused SFTP TestConnect to fail when there are thousands of files in a directory Fixed a kernel error that occurs when upgrading a combo device from 9.6.x to 10.1.x when all available loop devices are taken by McAfee Enterprise Log Manager storage pools Active response searches now execute successfully on an ESM device. ESM: Alarms , Corrected false positives for alarms based on non-us geolocations. ESM: Backup/Restore Fixed an issue that caused ESM scheduled daily backups to remote NFS shares to fail Restoring a backup now works correctly on receivers with HA settings Restoring a backup now restores Alert data. 5

6 ESM: Case Management , Corrected a navigation issue that disabled the navigation buttons when viewing more than 100 case management cases Bad Query Error no longer occurs when adding Avg Severity field to a Case Management component. ESM: Data Enrichment Data enrichment no longer times out when using a pipe character as delimiter. ESM: Distributed ESM , , , Corrected an issue that precluded the use of a VM as a Distributed ESM Child ESMs now show current data McAfee ACE no longer displays as out-of-sync and no longer shows invalid signature IDs for ACE events on distributed ESM devices. ESM: Redundant ESM , , Fixed a problem that prevented Redundant ESM from completing a sync Redundant ESM sync no longer stalls during a re-sync , , Sync data is now moved from primary to redundant ESM , , , , Corrected an issue that prevented Redundant ESMs from syncing properly in some instances. ESM: Reports Query CSV option now retrieves output with a filter set to Open cases. ESM: Views , , Fixed an issue that caused only 100 bars to be displayed in distribution charts on the Flash interface Corrected an issue that caused table widgets to display an error: "EC 255 Error Invalid Filter Item, Possible SQL Injection attempted." when marking events as reviewed Details pane no longer goes blank after paging the events list , Corrected an issue that caused an error when selecting a device during creation of a widget Fixed an issue that caused an HTTP 404 error when scrolling in a Dest IP widget In Scorecard, extra results are no longer displayed after deleting and re-pulling assets Added a validation to support translation of DB values to UI values. 6

7 Fixed an issue that caused some widgets to display records incorrectly for the Administrator user , The McAfee Enterprise Log Manager logging Archive tab now shows events on separate lines , , Fixed an issue that showed a "Something went wrong" error message when using Device ID filters. McAfee Event Receiver , , , , , , , , Cloudtrail now connects to AWS. Improved HA stability and health monitoring , Send2ELM settings no longer cause receivers to become backlogged waiting for McAfee Enterprise Log Manager disk space to drop Fixed a memory usage error associated with WMI data sources Auto learn now runs on receivers Added a check to ensure the McAfee Event Receiver doesn't exhaust inodes with data collection Added IIS compatible date/time formats for the http collector McAfee Enterprise Log Manager no longer runs out of inodes epo database instance settings are now applied when changes are written Auto retrieve from VA sources now works Updating a KVM VM to no longer hangs at startup Wildcard expressions for NFS data sources no longer behave as backward matches NSM devices with less active sensors no longer generate Out of Sync flags on a McAfee Event Receiver multiple times per day You can now configure a device to correlate events from a specific device IPFIX now parses correctly IPv4 route is now applied to eth1 on high availability receivers. User Interface , Fixed a memory leak that caused multiple errors Test connections for data sources using Tivoli now test successfully Corrected an API issue that limited the number of returned alarms to 100. User Interface Page size property now works properly Error Converting circular structure to JSON after drilling down from Geolocation view. 7

8 Export to CSV now selects the correct data set or number You no longer get an infinite search loop when using 'contains' with an odd number of slashes Corrected an issue that caused packet data to be corrupted when downloaded , Page breaks are now respected in ELM Archive in HTML5 user interface , Event drill-down now shows accurate values in widgets. Migrating from Flash to HTML With each release, McAfee Enterprise Security Manager functionality continues to move from Flash to HTML5. 10.x Ability to convert Flash views into HTML views (import views into dashboard) New HTML dashboard Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.