McAfee Enterprise Security Manager 9.5.2

Transcription

1 Release Notes McAfee Enterprise Security Manager Contents About this release New features for Known and resolved issues Upgrade instructions Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. We do not support the automatic upgrade of a pre-release software version. To upgrade to a production release of the software, contact the McAfee Beta Team at beta7@mcafee.com for the upgrade process. New features for McAfee Enterprise Security Manager (McAfee ESM) offers updated capabilities supporting the security connected vision, integrated big security data, and best-in-class SIEM features. McAfee Active Response searches McAfee Active Response offers continuous visibility and insights into your endpoints, so you can identify breaches as they happen. If Active Response is installed as an extension on a McAfee epolicy Orchestrator (McAfee epo ) device you have added to the ESM, you can run a search on Active Response from the ESM. The search generates a list of current endpoint data, allowing you to do the following: 1

2 View the list of search results Create a watchlist populated with search results Append Active Response search data to an existing watchlist Add a data enrichment source populated with search results Export the search data For more information, see the McAfee Active Response searches topic in the online Help or product guide. Cyber threat management manual upload source type New file and indicator validations have been added to the manual upload cyber threat management source type. For more information, see the following topics in the online Help or product guide: Set up cyber threat management Supported indicator types Errors on manual upload of an IOC STIX XML file Known and resolved issues For a list of known issues and resolved issues in this and previous 9.5.x product releases, see this McAfee KnowledgeBase article: KB Upgrade instructions To prepare your system for the software release, download the upgrade files for the ESM, Nitro IPS, ACE, ADM, Database Event Monitor (DEM), Receiver, ELMERC, ELM, and ESM/Receiver combo. Then upgrade them in the order described. For information about installing the devices, see McAfee Enterprise Security Manager Installation Guide. Tasks Download the upgrade files on page 6 When the system is ready to upgrade, download the upgrade files to your local system. Upgrade the system on page 7 You must upgrade the ESM and its devices in a specific order, based on your mode. After you upgrade, rewrite the device settings and roll out the policy. Upgrade ESM, ESMREC, or ENMELM on page 9 Once your system is ready, you can upgrade your ESM, ESMREC, or ENMELM to Upgrade devices on page 9 If you aren't in FIPS mode, upgrade the IPS, Event Receiver, ELM, ELM/Event Receiver, ACE, ADM, and DEM after the ESM is upgraded. If you are in FIPS mode, upgrade the devices before upgrading the ESM. 2

3 Preparing to upgrade You must do several things before you can upgrade. Make sure that the ESM database rebuild from a previous build (9.3.2 or later) is complete, and that you can schedule the appropriate outage window for this upgrade. Complete a database backup of the ESM before beginning the upgrade. Make sure that the soft raid subsystem is running with two active drives. If you are running ESM 4245R, 5205R, 5510R, or 5750R; ESMREC 4245R, 5205R, or 5510R; ESMLM 4245R, 5205R, or 5510R, issue the cat /proc/mdstat command in one of these ways: On the ESM console, click System Properties ESM Management Terminal, then click Write and type the command. SSH into the ESM. Connect a monitor and keyboard to the device. If the output looks like the following example, the raid is functioning properly and you can proceed with the upgrade: Personalities : [raid1] md_d127 : active raid1 sda[0](w) sdb[1](w) blocks [2/2][UU] Unused devices: <none> The [UU] code identifies active drives. If it shows [_U] or [U_], a drive is not part of the raid. You must contact McAfee Support before upgrading. Type of information Device types supported Device removal Details The ESM, ESM/Event Receiver (ESMREC), or ESM/Log Manager (ENMELM) only communicate with device models. To check the model of your device, issue the cat /proc/cpuinfo command. The output includes the CPU number on the model name line. The CPU must be one of the following: Before upgrading the ESM, ESMREC, or ENMELM, all device models specified and virtual IP addresses for the specified Nitro IPS models must be removed. If this isn't done, a message appears on the Login page and the message log stating that this problem occurred, and that the upgrade fails. ESM also fails to upgrade and notations are placed in the device message log. To remove a virtual IPS, select the device in the system navigation tree and click the Properties icon. Select Device Configuration Virtual Devices, then select the existing virtual devices and click Remove. Click Write to write the settings to the IPS. You must roll out the policy from the ESM, ESMREC, or ENMELM to the IPS device or the IPS remains in bypass mode and no traffic is inspected. 3

4 Type of information Rebuild time Upgrade paths Upgrade Receiver-HA devices Details Table rebuild time varies for ESM, ESMREC, and ENMELM. To speed up the upgrade of the ESM database: Set collection duration of events, flows, and logs to a longer pull time, allowing more time for the rebuild. On the ESM console, click System Properties Events, Flows & Logs, then set Auto check interval. Turn off collection of events, flows, and logs until the rebuild finishes. Complete this step only if the number of events and flows sent to the ESM is low. On the ESM console, click System Properties Events, Flows & Logs, then deselect Auto check interval. The rebuild time for devices is around 45 minutes. You can upgrade to directly from or later. You must upgrade versions before following this path: 8.2.x > 8.3.x > > > > > or later > To upgrade Receiver-HA devices, you must first check the Receiver's High Availability status. See Check Receiver high availability status in the ESM online Help. Special upgrade situations In special situations, you must take additional steps before or after upgrading. Situation Installing a new McAfee ESM model Obtaining offline rule updates Action When installing a new McAfee ESM model, register your hardware within 30 days to ensure that you receive policy, parser, and rule updates as part of your maintenance contract. If you don't register, you cannot receive upgrades. To get your permanent user name and password, Licensing@McAfee.com with the following information: McAfee grant number, account name, address, contact name, and contact address. 1 Go to 2 In the upper right corner, click Download My Products and click Go. 3 Enter your grant number, type the letters displayed, then click Submit. 4 Click MFE Enterprise Security Manager, then click MFE Nitro Rules Downloads. 5 Read the license agreement, then click I Agree. The available update files appear by ESM version. 6 Download the rules for the version of your ESM. Resolving device communication issues If you upgraded a McAfee device (not ESM), the message The device needs to be upgraded to before the operation can be performed might appear. Verify that the ESM has the correct version. 1 On the ESM console, select the device in the system navigation tree, then select the Properties icon. 2 Click Connection, then click Status. The version updates. 3 Retry the operation that resulted in the message. 4

5 Situation Upgrading a redundant ESM Action You must upgrade the primary ESM first, then upgrade the redundant ESM exactly as described. 1 On the primary ESM, select the ESM on the navigation tree and click the Properties icon. 2 Click Events, Flows & Logs and deselect the Auto check interval option. 3 After upgrading the redundant ESM, re-enable the collection of events, flows, and logs on the primary ESM. McAfee epo with Policy Auditor If the McAfee epo device is already on the ESM, you must refresh it. 1 If you are not on an all-in-one device, upgrade the Receiver where the McAfee epo device is connected. 2 On the ESM console, click epo Properties Device Management, then click Refresh. You can set up auto-retrieval on the Device Management tab 3 Click Receiver Properties, then click the Vulnerability Assessment tab. 4 Click Write. 5 Repeat step 2 to get VA data on the ESM. Refreshing registers Policy Auditor as a VA source, which in turn allows Policy Auditor to be written to vathirdparty.conf. 6 Log off the ESM console, then log back in. Upgrading High Availability (HA) Receivers Before you upgrade, set your preferred primary Receiver to No Preference, which allows you to use the Fail-Over option. The upgrade process requires the user to upgrade the secondary Receiver, click Fail-Over, then upgrade the new secondary Receiver. In this way, a primary Receiver is collecting data throughout the process, ensuring minimal data loss. After you upgrade both Receivers, you can reapply your preferred primary Receiver. 5

6 Situation Rebuilding the ELM management database Upgrading a redundant ELM Action Indexing your ELM management database might require additional time, depending on your ELM model. For example, the number of pools you have, the amount of data sent from logging devices, and your network bandwidth if using remote storage can increase the time it takes to complete the indexing. However, this background task minimally impacts your performance and, when complete, provides improved querying on your historical data. To check the status of the rebuild, go to ELM Properties ELM Information. If the message Database is rebuilding appears in the Active Status field, DO NOT stop or start the ELM database. The system indexes all new ELM data on the sending device before sending that data to the ELM. If you have Receivers logging to the ELM and they are near maximum capacity, contact Support. You must upgrade the standby ELM first, then upgrade the active ELM. The upgrade process suspends the ELM redundancy. After upgrading both ELMs, you must restart the ELM redundancy. 1 Upgrade the standby ELM. 2 Then upgrade the active ELM. 3 On the system navigation tree, select the standby ELM and go to ELM Properties ELM Redundancy. Click Return to Service. 4 Go to ELM Properties ELM Information and click Refresh. Both the active and standby ELMs should display an OK status. If the standby ELM displays a Not OK status, click Refresh again. After a few minutes, the standby ELM status should change to OK, redundant ELM rsync is 100% complete. You might need to click Refresh several times. Download the upgrade files When the system is ready to upgrade, download the upgrade files to your local system. Task 1 On the McAfee Product Downloads website at enter your customer grant number in the Download My Products field, then click Search. 2 Select the device you want to upgrade. 6

7 3 Select the correct link (MFE <device name> v9.5.2), read the McAfee EULA, then click I Agree. 4 Download these files to your local system: Device type McAfee Enterprise Security Manager (ESM or ETM) McAfee Enterprise Security Manager and Log Manager (ENMELM or ESMREC) McAfee Nitro Intrusion Prevention System (Nitro IPS or NTP) McAfee Event Receiver (ERC or ELMERC) McAfee Database Event Monitor (DEM) McAfee Advanced Correlation Engine (ACE) McAfee Enterprise Log Manager (ELM) McAfee Application Data Monitor (ADM) File name ESSREC_Update_9.5.2.tgz ESS_Update_9.5.2.tgz IPS_Update_9.5.2.tgz RECEIVER_Update_9.5.2.tgz DBM_Update_9.5.2.tgz RECEIVER_Update_9.5.2.tgz RECEIVER_Update_9.5.2.tgz APM_Update_9.5.2.tgz These files are now ready to be used to upgrade your ESM and devices. Upgrade the system You must upgrade the ESM and its devices in a specific order, based on your mode. After you upgrade, rewrite the device settings and roll out the policy. Before you begin Review Preparing to upgrade and Special upgrade situations. Make sure that your system is running version or later. If you recently upgraded to 9.3.2, verify that the database rebuild is complete. When upgrading to only, all active collectors (such as Windows, estreamer, and Checkpoint) stop collecting data until you rewrite the device settings and roll out the policy (see steps 5 and 6). Task 1 Upgrade the devices in this order. For details about upgrading the ESM and devices, see Upgrade ESM, ESMREC, or ENMELM and Upgrade devices. 7

8 Mode Order Non-FIPS 1 Upgrade the ESM, ESMREC, or ENMELM. 2 Wait for the database to build. 3 Upgrade the ELM or ELMERC. 4 Upgrade Nitro IPS, Event Receiver, ACE, DEM, and ADM. If you are upgrading a redundant ESM, see Upgrading a redundant ESM in Special upgrade situations. FIPS 1 Upgrade the ELM or ELMERC. 2 Upgrade Nitro IPS, Event Receiver, ACE, DEM, and ADM. 3 Upgrade the ESM, ESMREC, or ENMELM. You can begin when all device upgrades start. Failure to upgrade the devices before upgrading the ESM when in FIPS mode can affect ELM log collection. 2 Verify that you have communication with the devices. 3 Download the manual rules update to the ESM (see Obtaining offline rule updates in the Special upgrade situations section of this document). 4 Apply the updated rules. a On the system navigation tree, select the system, then click the Properties icon. b c On the System Information page, click Rules Update, then click Manual Update. Browse to the update file, click Upload, then click OK. 5 Follow this process to rewrite device settings for each device to make sure that all settings are applied. a On the ESM console, select the device in the system navigation tree, then click the Properties icon. b Follow these steps for each device. Device type Event Receiver or ESM/Event Receiver combo ACE Nitro IPS, DEM, or ADM Process For data sources: Click Data Sources Write. For VA sources: Click Vulnerability Assessment Write. For risk correlation: Click Risk Correlation Management Write. For historical correlation: Click Historical Enable Historical Correlation Apply. If it's already selected, deselect it, select it again, then click Apply. For rule correlation: Click Rule Correlation, select Enable Rule Correlation, and click Apply. If it's already selected, deselect it, select it again, then click Apply. For virtual devices (IPS and ADM): Click Virtual Devices Write. For database servers: Click Database Servers Write. 8

9 6 Roll out the policy to all upgraded devices. After rolling out the policy to a Nitro IPS device, make sure to take the device out of bypass mode on Device Configuration Interfaces. 7 If you have an ELM or ELMERC collecting logs from a device, sync the ELM (Device Properties Device Configuration Sync ELM). Upgrade ESM, ESMREC, or ENMELM Once your system is ready, you can upgrade your ESM, ESMREC, or ENMELM to Before you begin Read through this entire document. Verify that all devices attached to the ESM are supported in (see Device types supported in Preparing to upgrade). Task For option definitions, click? in the interface. 1 On the ESM console, select the ESM device, then click the Properties icon. 2 Select ESM Management, then click Update ESM. 3 On the Select Software Update File page, browse to one of these files. Device type Standalone Enterprise Security Manager (ESM) Enterprise Security Manager with a built-in Receiver (ESMREC) Enterprise Security Manager with a built-in Receiver and Enterprise Log Manager (ENMELM), also known as a Combination Box File ESS_Update_9.5.2.tgz ESSREC_Update_9.5.2.tgz ESSREC_Update_9.5.2.tgz 4 Select the file, then click Upload. You are informed that the ESM restarts and there is a loss of connection for all users. 5 Click Yes to continue, and when asked to close the browser, click OK. The upgrade, which can take several hours, takes place. 6 Once the upgrade is complete, log back on to the console through a new browser session. Upgrade devices If you aren't in FIPS mode, upgrade the IPS, Event Receiver, ELM, ELM/Event Receiver, ACE, ADM, and DEM after the ESM is upgraded. If you are in FIPS mode, upgrade the devices before upgrading the ESM. Before you begin Read through this entire document. Verify that all devices attached to the ESM are supported in (see Device types supported in Preparing to upgrade). 9

10 Task For option definitions, click? in the interface. 1 On the ESM console, select the device you want to upgrade, then click the Properties icon. 2 Click Management for the device, then click Update Device. 3 On the Select Software Update File page, browse to one of these files: Device type IPS Event Receiver ELM ELM/Event Receiver combo ACE DEM ADM ESS VM File IPS_Update_9.5.2.tgz Receiver_Update_9.5.2.tgz DBM_Update_9.5.2.tgz APM_Update_9.5.2.tgz Upgrades for this device are no longer available. Contact McAfee Sales to purchase a new ESM VM model. 4 Select the file, then click Upload. 5 On the Update Device Software page, click Yes to continue. The file uploads and the device restarts. 6 Once the communication is restarted, verify the version of the device. Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. Tasks Use ESM Help on page 12 Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Frequently asked questions on page 12 Here are answers to frequently asked questions. 10

11 Find localized information We provide localized (translated) McAfee ESM release notes, online Help, product guide, and installation guide for: Chinese, Simplified Japanese Chinese, Traditional Korean English Portuguese, Brazilian French Spanish German Access localized online Help Changing the language setting in ESM automatically changes the language used in the online Help. 1 Log on to ESM. 2 On the system navigation pane of the ESM console, select Options. 3 Select a language, then click OK. 4 Click the Help icon in the upper right corner of the ESM windows or select the Help menu. The Help displays in the language you selected. If the Help appears in English only, localized Help is not yet available. A future update installs localized Help. Find localized product documentation on the Knowledge Center 1 Visit the Knowledge Center. 2 Search for localized product documentation using the following parameters: Search terms product guide, installation guide, or release notes Product SIEM Enterprise Security Manger Version or later 3 In the search results, click the relevant document title. 4 On the page with the PDF icon, scroll down until you see language links on the right side. Click the relevant language. 5 Click the PDF link to open the localized version of the product document. 11

12 Use ESM Help Have questions about how to use ESM? Use the online Help as your context-sensitive information source, where you find conceptual information, reference materials, and step-by-step instructions on how to use ESM. Before you begin Optional: Find localized information on page 11. Task 1 To open ESM Help, do one of the following: Select the menu option Help Help Contents. Click the question mark in the upper right of ESM screens to find context-sensitive Help specific to that screen. 2 From the Help window: Use the Search field to find any word in the Help. Results appear below the Search field. Click the relevant link to display the Help topic in the pane on the right. Use the Contents tab (table of contents) to view a sequential list of topics in the Help. Use the Index to find a specific term in the Help. Keywords are organized alphabetically so you can scroll through the list until you find the keyword you want. Click the keyword to display that Help topic. Print the current Help topic (without scroll bars) by clicking the printer icon in the upper right of the Help topic. Find links to related Help topics by scrolling to the bottom of the Help topic. Frequently asked questions Here are answers to frequently asked questions. Where can I find ESM information in other languages? We localize the ESM release notes, online Help, product guide, and installation guide into the following languages: Chinese Simplified and Traditional Japanese English Korean French Portuguese Brazilian German Spanish Find localized information on page 11 Where can I learn about McAfee ESM? Use ESM Help on page 12 Visit the Knowledge Center Visit the Expert Center Watch McAfee ESM videos Which SIEM devices are supported? Visit the McAfee ESM website 12

13 How do I configure specific data sources? Find current data source configuration guides on the Knowledge Center What content packs are available? Read the KB article on the Knowledge Center Copyright 2016 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others.