McAfee Active Response 2.1.0

Transcription

1 Release Notes McAfee Active Response Contents About this release What's new Resolved issues Installation information Known issues Getting product information by Where to find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. We do not support the automatic upgrade of a pre-release software version. To upgrade to a production release of the software, you must first uninstall the existing version. 1

2 What's new The current release of the product includes these enhancements and changes. Threat investigation improvements Improved grouping of potential threats The list of potential threats in the McAfee Active Response Workspace is now consolidated to show only the root process of the potential threat that triggered the tracing. Select the potential threat to see all processes spawned by the root process in the Trace Timeline. The severity level of the root process is set as an accumulation of the severity of the child processes. Spawned processes aren't shown as potential threats if they didn't execute separately. Threat timeline improvements You can see detailed information about code injection and self-injected code events on the Trace Timeline and Event Details panes of both injector and injectee. Threat remediation improvements Dismiss action Use the Dismiss action in the Host Actions and Global Actions menus to remove potential threats listed in the Active Response Workspace, on a specific affected host or globally across all hosts. When a potential threat is dismissed, it disappears from the Workspace and is no longer reported, unless the process produces new trace activity. Advanced remediation mode By default, global remediation applies the selected action to the root trace and stops all child processes. You can kill the entire process tree (root and child processes) using Advanced mode in Host Actions and Global Actions. Use Advanced mode to customize remediation actions on multiple child processes. Process tracing improvements Automatically update the trace rules You can automatically deploy trace rule content updates to endpoints when a new update is available in Software Manager. This unattended task is enabled by default in McAfee epo and can be scheduled to run every 240 minutes (4 hours). Roll back DAT rules to a previous version In case of faulty endpoint rules, the last update can be rolled back to a previous rule version. Rollback actions are taken on the endpoints by assigning a predefined client task. Health Status page improvements Health Status Alert window When you open the Workspace, the Health Status Alert window appears if the endpoints and servers need attention due to critical issues. Additional status details for endpoints and servers More details about the endpoints and servers are visible on the Health status page so you can quickly see: If the Trace plug-in has been disabled on an endpoint and how many endpoints are affected. Which client installations failed on endpoints and the number of failures on endpoints. The version number of Active Response, DXL Brokers, and TIE servers. If the cloud account is not valid or if the connection between McAfee epo and the cloud bridge is unreachable. Descriptive installation error messages If an installation on an Active Response client fails, go to Menu Reporting Threat Event Log to view the error messages. New events of type MAR INSTALL EVENT are created with details about why the installation failed on each endpoint. Linking McAfee epo Cloud account Updated procedure to create a McAfee epo Cloud account and link it to the McAfee epo Server. 2

3 Content updates Collectors The Process collector's reputation field outputs TIE-defined names so you can identify the reputation properly and compare it to the known reputation from when the process was created. Known Trusted This is a trusted file Most Likely Trusted Almost certainly a trusted file Might Be Trusted Appears to be a benign file Unknown Cannot make a determination at this time Might Be Malicious Appears to be a suspicious file Most Likely Malicious Almost certainly a malicious file Known Malicious This is a malicious file Not Set No reputation has been specified The Process collector's parentimagepath field outputs the path of the parent process so you can identify any created processes' information. The Process trigger's parentimagepath field outputs the path of the parent process so you can detect processes created or closed by another process with that specific path. Content updates Reactions Delete folder deletes a selected folder or folders on the system. Execute Reboot OS reboots the endpoint's operating system without warning the user. Execute Shutdown OS shuts down the operating system. Execute User Logoff logs off the user by user name. KillProcessByName kills a process by its name. KillProcessByPath kills a process by its path. KillProcessByHash kills processes that have a specific hash value on endpoints. KillProcessTree kills a process and its child processes. RemoveFileSafe performs a Validation and Trust Protection (VTP) check on endpoints before removing a file (for Active Response 2.1 clients only). ScheduleReboot schedules a system reboot for a certain day and time. Content updates Triggers The parentimagepath output field can now be used in a trigger condition. Resolved issues These issues were resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Software Manager now correctly displays the latest deployed versions after upgrading from Active Response 2.0 to (B ) The prevalence number of potential threats equals the number of affected hosts. (B ) 3

4 Potential threats are now properly sorted according to their severity score. (B ) Active Response with McAfee epo 5.9 now displays the Health Check status correctly. (B ) Active Response Server installation scripts now perform a preventive validation for the installation platform before starting installation. (B ) When running a search in the Workspace while a potential threat is selected, the Affected Hosts list and Trace time line now refreshes correctly. (B ) Known Trusted processes are no longer continually traced and do not appear as potential threats. If the endpoint cannot properly resolve the reputation, McAfee Global Threat Intelligence (McAfee GTI) file reputation is used, downgrading Known Trusted to Unknown. (B ) The net-redirections in MLOS has been disabled to prevent creating reverse shells on appliances, with update package bash mlos2.x86_64.rpm. (B ) The nc command in MLOS has been disabled to prevent creating reverse shells on appliances, with update package busybox mlos2.x86_64.rpm. (B ) The totals for potential threats in the Threat time line were removed to remove visual clutter. The bar chart displays active threats over time. The chart's trendline displays the prevalence of active potential threats on affected hosts.(b ) When you try to save a collector with two output names that are identical, the correct error message "Collector output name must be unique within the collector context" appears. (B ) When you run ScheduledTasks collector on a Linux endpoint that has a cron line with quotes or backslashes in the command field, the correct results are returned. (B ) When no potential threats are listed, the Potential Threats and Threat time line panes display the message "Check the health status for any issues." The Affected Hosts and Trace time line panes display the message "Change the filtering criteria". (B ) The error message "Error Fetching Data" no longer appears when multiple potential threats are listed, and Last 90 days is selected in the Workspace bar. (B ) Now, only root processes are used to build the process tree in the Trace time line. (B ) When installing the Active Response client on an endpoint with Visual C++, the installation failed and displayed the message "Error 0x800713ec: Failed to configure per-machine EXE package". We have updated the installer to correct this issue. (B ) The Stop and remove host action now performs a Validation and Trust Protection (VTP) check on each endpoint before removing the file by executing the RemoveFileSafe reaction. You can still remove VTP trusted files using Advanced Search. This feature is for Active Response 2.1 clients only. If you update the Active Response Server and extensions, but not an Active Response client, then that endpoint will not honor the VTP check. (B ) Installation information For information about installing or upgrading Active Response software, see the McAfee Active Response Installation Guide. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB

5 Getting product information by The Support Notification Service (SNS) delivers valuable product news, alerts, and best practices to help you increase the functionality and protection capabilities of your McAfee products. To receive SNS notices, go to the SNS Subscription Center at to register and select your product information options. Where to find product documentation Go to docs.mcafee.com to find the product documentation for this product. Go to support.mcafee.com to find supporting content on released products, including technical articles. Copyright 2017 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0-00