STEALTHWATCH SYSTEM VERSION RELEASE NOTES

Transcription

1 STEALTHWATCH SYSTEM VERSION RELEASE NOTES This document provides the following information: What's New Fixes for issues reported by customers including previous releases o Version o Version Issues known to exist in this release. For additional information about the Stealthwatch System, go to the Lancope Customer Community web site ( For a list of alarm types and their IDs, access the Alarm IDs v6.9.0 file. You can also access this document via the Alarm List topic in the SMC Client Interface online help. Important: Multiple patches are required after upgrading to Please review the Readme document for each patch prior to installing to ensure all prerequisites have been met. The following is a list of the required patches for 6.9.1: patch-fcnf-rollup swu or later patch-smc-rollup swu or later patch-fsuf-rollup swu or later If you currently do not have pxgrid configured, then when you update to Stealthwatch v6.9.1 you must reconfigure Cisco ISE. (If you configured pxgrid in Stealthwatch 6.8.x, then your configuration will be copied forward to Stealthwatch v6.9.1) The ISE "Device Type" field and "Security Group" field that was populated in v6.8.x using syslog is not being mapped properly from pxgrid. See Known Issues for more information. The Open Virtualization Format (OVF) file does not have the minimum reserved memory requirements for the SMC and the Flow Collector. You will need to add additional resources to meet the minimum requirements. See Known Issues for more information Cisco Systems, Inc. All Rights Reserved.

2 Due to changes with APIs, customers running the Host Group Automation Service require a service software upgrade. Please contact See "Contacting Support" for upgrade assistance. For enhanced security, before you add a Flow Collector or Flow Sensor in the System Setup Tool, you must have first created a management channel between the Flow Collector and/or Flow Sensor and the Stealthwatch Management Console (SMC). If you have not done this, you will receive an error message when you try to add either appliance in the System Setup Tool. The specific instructions are on page 43 in the Stealthwatch Management Console VE and Flow Collector VE Installation and Configuration Guide or page 15 in the Hardware Configuration Guide. For increased security, we recommend updating the IDentity 1000/1100 appliance to v3.3.0.x to take advantage of the new openssl version with TLS 1.2. Notes: This document uses the term "appliance" for any Stealthwatch System product, including virtual editions (VEs) such as the Flow Collector VE. The Stealthwatch System requires Java version 8 (v1.8) or later. The Stealthwatch System supports Internet Explorer v11 and later. For this release, the security category point contributions have been recalibrated. After updating to v6.9.1 from v6.8.x, it could take 10 days for the system to rebaseline the security categories. You may see an increase or decrease in alarms at first and then a gradual return to a more standard level. Upgrading from v6.9.0 to v6.9.1 will not cause a re-baselining of security categories. Where once the setting "disabled" for a security event disabled the event, now disabling will disable the alarm. What's New The Stealthwatch System v6.9.1 introduces new features and capabilities in the SMC Web Application interface. These are the new features and improvements for the v6.9.1 release: Cisco Systems, Inc. All Rights Reserved.

3 Cognitive Threat Analytics Integration Internationalization and Localization Cisco ISE Clusters Licensing UCS Hardware Cognitive Threat Analytics Integration Note: CTA cannot be enabled on the Flow Collector 5000 series and is only available to Admin users. See Known Issues for more information. The Stealthwatch System is now integrated with Cisco Cognitive Threat Analytics (CTA). CTA quickly detects suspicious web traffic and/or NetFlow and responds to attempts to establish a presence in your environment and to attacks that are already under way. Stealthwatch can send NetFlow and web log data to the secure CTA cloud for detection. After enabling CTA, you will be able to access the CTA Dashboard from the top navigation menu. For more information, go to the CTA website or the CTA documentation. Configuration New docker services have been added to the SMC and Flow Collector. For information on how to configure CTA on your Stealthwatch system, see Stealthwatch and Cognitive Threat Analytics Configuration Guide on the Customer Community. Security Insight Dashboard Component 2017 Cisco Systems, Inc. All Rights Reserved. 3

4 This is the new component on the Security Insight Dashboard that identifies the hosts with suspicious web traffic and displays the following information: The number of affected users or hosts, sorted by incident risk, that CTA has identified as active on your network. The top six affected hosts with the incident type. Hover over the incident risk number for more information about the incident risk type. From this component you can access the following information: CTA Dashboard, which displays the health status, relative threat exposure, specific behaviors, highest risk hosts, and top risk escalations that CTA has identified on your network. To view this data, click View Dashboard. CTA Detected Incidents, which displays detailed information about the identified incidents on your network. To view this data, click the health status bar. The Host Report page, which displays information about a host IP address. To view this data, click the applicable host IP address. CTA Incident Detail, which displays the identified activities and flows for an incident. To view this data, click the ellipsis next to applicable host IP address, then click Open in Cognitive Threat Analytics. Host Report Component Cisco Systems, Inc. All Rights Reserved.

5 The CTA Incident Timeline is the new component on the Host Report page. This component shows the start date, duration, risk number, campaign, and activity of the incident that CTA has identified. Hover over the timeline to see more information about each section. From this component you can access the following information: CTA Incident Detail, which displays activities and flows for an incident. To view this data, click the host IP address or click Incident Detail. CTA Confirmed Threats, which displays information about the campaign, including affected users and infection history. To view this data, click the campaign ID. Internationalization and Localization SMC Web App The SMC Web App interface has been translated into Japanese, Chinese, and Korean. The language displayed is based off your default browser settings and you cannot change the language. If your browser language is unsupported, the web app will display in English. Note: The Client Interface and Administer Appliance are only available in English and most of the data displayed on the SMC is not internationalized. Online Help The online help for the SMC Web App has been translated into Japanese and Chinese. The language displayed is based off your default browser settings. If your browser language is unsupported, the online help will display in English. You can change languages by clicking on the globe icon in the header bar, as shown below Cisco Systems, Inc. All Rights Reserved. 5

6 Note: The Client Interface online help and Administer Appliance online help are only available in English. Cisco ISE Clusters You can now add multiple independent Cisco ISE clusters to a domain in the Stealthwatch System but all IP addresses within a domain must be different. Licensing Enhanced Messaging We have added enhanced messaging around licensing expiration. Flow Sensor VE Term Licensing Additional support has been added for Flow Sensor term licensing. For enhanced performance, higher resource limits are available for Flow Sensor VE. For more information, refer to the Flow Sensor VE Installation and Configuration Guide. Note: This is only available for the Flow Sensor Virtual Edition. UCS Hardware Following are the new UCS appliances available for v6.9.1: SMC 2200 UDP Director 2200 Flow Collector 4200/5200 Flow Sensor 1200/2200/3200/4200 For more information about the new hardware, refer to the specification sheets on the Customer Community. Contacting Support If you need technical support, please do one of the following: Contact your local Lancope partner. Call Submit a case using the Support form on the Lancope Customer Community web site (community.lancope.com) Cisco Systems, Inc. All Rights Reserved.

7 What's Been Fixed This section summarizes fixes made in this release for issues (bugs/defects) reported by customers in previous releases. The Stealthwatch Defect (SWD or LSQ) number is provided for reference. Version STE-84 SWD-7120 Port number for the server and protocol information have been added to the Response. In the SMC client interface, gaps appeared on the FlowCollector Trend chart on a Flow Collector running a Host Group Automation script. Improved the process so that the host group updates would work without causing gaps in the Flow Collection Trend graphs. NA 2462 SWD-7260 SWD-7322 SWD-7371 SWD-7411 SWD-7470 SWD-7525 In the SMC client interface the Host Manager displayed duplicate entries. New code has been written to transfer values from Java list object to Hash set object, which does not allow duplicates. The Flow Collector engine did not stop inserting data when the disk was 100% full. Added code to disable the stats the database writes at maximum disk utilization and to trigger the performance degraded alarm. A false alarm that the License Term would expire in less than 3 days occurred after a Flow Sensor was added to a Flow Collector. The code was updated to calculate the license expiration date correctly. The Flow Collector Database failed to back up admin hsql database when upgrading. The directory permission is now handled automatically, which allows the backup of the hsql database. The SMC client interface contained settings which are no longer applicable. VM Status and VM Server Status was removed from the Status drop-down menu. After upgrade, deleted exporters caused error "Thread interrupted" to occur. A bottleneck was discovered in the code and removed so that exporter deletions can be performed within a reasonable time period NA Cisco Systems, Inc. All Rights Reserved. 7

8 SWD SWD The selection for "Second" in Flow Table Filter was removed because the seconds rounded up to the next minute anyway SWD-7541 SWD-7549 SWD-7599 SWD-7615 SWD-7621 SWD-7631 SWD-7644 The delete option for an SSL Client certificate did not work on a secondary SMC. The fix was to allow the add/delete function for SSL client certificates in a secondary SMC. The flow traffic on the Flow Sensor 4010 showed no utilization with non-zero inbound traffic. We fixed the SMC detection of the Flow Sensor fiber port interface speeds used in utilization calculations. There was a database backup return error on system configuration. Updated the backup routines to handle file copies to CIFS destinations differently. The Hardware Configuration Guide had an error in the Configure Primary UDP Director section. The guide was updated with the correct information. The Top Conversations Report was not returning all results when a host filter was used. The fix was to correct the miscalculation while computing the transaction report values in the Top Conversations Report. The Flow Collector's Vertica database was using all of it's memory. We upgraded Vertica to fix issues with it consuming blocks of memory that it does not free until shutdown and issues with it allocating unused virtual memory. The Top Conversations transaction report was showing incorrect values. A fix has been provided to avoid duplicate values and show the appropriate number of records for each Flow Collector in the transaction report Cisco Systems, Inc. All Rights Reserved.

9 SWD-7653 IDentity v3.3.0 does not support TLS 1.0 or 1.1. The SMC Java client was updated so that the customer could use TLS v1.2 for connections back to the SMC SWD SWD-7689 SWD-7692 SWD SWD SWD-7739 SWD-7765 SWD-7787 SWD-7824 Users could not create a diagnostics pack for an appliance. The fix corrected an exception in the audit log when creating a diagnostics pack. The CPU average load calculation, on the SMC client interface dashboard, was incorrect. The CPU average load has been updated to reflect the updated appliances. The Top Conversations Report did not return all results when filtering hosts. In the Top Conversations report, the problem was in generating reports if more than one Flow Collector was configured. The fix corrects the query to collect all required data from data base for all required Flow Collectors. Users could not import of DAR and XML files to Document Builder. Fixed an issue with launching a new report from document builder that has several pages that are named alphabetically. Tomcat socket got stuck on an IP address. We implemented code to clear tomcat socket and firewall rule. Flow data queries across multiple Flow Collectors did not return consistent ordering. The fix is to order the records returned for a flow query by flowid when a specific ordering is not requested. This prevents different invocations of this method from returning different results. The Flow Table Service Summary and Service Port columns had mismatched port addresses. Fixed an issue where the service summary port was not updated to match the server port for certain flows. Flow query was failing for IPv6 IP address range 0000-FFFF. The flow query filter has been corrected to recognize and search IPv6 input values Cisco Systems, Inc. All Rights Reserved. 9

10 SWD-7862 Associated flow table carried previous advanced filter values. The Flow Table retain filter option has been excluded from the associated flow table SWD-7865 SWD-7939 SWD-7963 SWD-8072 SWD-8089 SWD-8095 SWD-8107 SWD-8128 SWD-8136 Stealthwatch Management Console had high memory usage for uwsgi appliance update process. Implemented a mechanism designed to prevent memory usage exceeding 4 GB by the uwsgi UPServ application. Uploading certificates will continue to display error message even after subsequent successful uploads. Stopped the service call whenever uploading invalid certificate so that the error does not persist after successful certificate upload. The client interface help was not showing topics when using the search tab. Fixed encoding error caused by a tomcat update. Top Reports returns more records than the set limit when there are two or more Flow Collectors. The Top Reports queries have been updated to split the amount of records evenly between Flow Collectors. The selection for "Second" in Flow Table Filter was removed because the seconds rounded up to the next minute anyway. Unable to activate SLIC after recent update to proxy settings. Added code to restart the tomcat process after updating proxy settings. notifications for scheduled documents were not being logged properly. We fixed the log base path location from pointing to the incorrect directory. Creating a diagnostic pack on the Flow Collector Database node triggered DB Channel Down alarm. We increased the session time-out period to avoid false DB Channel Down alarms. Cognitive Threat Analytics (CTA) API calls using JWT tokens were not being made correctly. JWT tokens are now being passed through Authorization headers NA Cisco Systems, Inc. All Rights Reserved.

11 SWD-8182 UDP Director 2010 could not boot after upgrade Fixed an issue with the kernel upgrading process. SWD-8239 Error when creating and configuring Custom Applications. A new java constructor has been added to avoid a bad request error when adding multiple custom application rules in the SMC Version SWD-6607 Flow Collection drops for one minute when adding or editing custom applications. We changed Application Definitions to perform the update at the beginning of the next minute instead of updating instantly to avoid gaps in flow collection SWD-6700 SWD-6715 SWD-6726 The SMC Client interface showed VM Server features. We removed instances of the VM Servers in the SMC Client interface Enterprise Tree and Traffic menu. On the SMC the Flow Trend report for a Flow Collector but the other is indicating that there was "no data available." We adjusted database queries used by the Flow Collection Trends report to allow larger values for the FPS and flow count values. In the SMC client interface, Flow Collector alarm details incorrectly displayed "I/O error." The error message was changed to: "Unable to connect. Timeout waiting for connection." Cisco Systems, Inc. All Rights Reserved. 11

12 SWD-6745 The Flow Collector crashed, and in the SMC Web App interface, the Flow Collection Trend had a 25-minute gap. Additional protection against a future potential crash was added to string handling in the flows SWD-6777 SWD-6823 SWD-6824 SWD-6839 SWD-6857 SWD-6858 SWD-6869 SWD-6886 A custom service that had been set to "Exclude Security Event" was still triggering Security Events. We updated the code to fetch the required service details from the configuration file and use it for event triggering. The Flow Collector 5000 Engine node did not show its associated database node. We added a link to the database node on the Flow Collector 5000 support page. The Flow Collector had performance problems. Special handling was added for broadcast hosts to prevent thread contention. The Flow Collector Database Storage Statistics showed incorrect capacity when the number of days of "Flow Interface Details" was smaller than those in "Flow Details." We fixed the code to correctly calculate "Capacity in Days" and "Remaining Days." The defect was that the SMC was not polling the ifhighspeed value for 10 Gbs interface of an exporter. We enhanced logging information to aid in determining the solution for the defect. A segment failure in the Flow Collector occurred when the flow interface buffer size was dynamically increased. The code was changed to make the buffer reallocation conflict safe. The SMC was not using the Secondary pxgrid Mitigation ISE Node when the Primary was down. The code was looking at only the primary host. A Java file was changed so that it would look at the next available host. The Vertica log file was growing too large. A log rotate entry in the config file was added so that old logs are purged and the log will not grow out of control NA Cisco Systems, Inc. All Rights Reserved.

13 SWD-6891 The SMC client took about 35 minutes to search a host and open its snapshot. SWD-6873 The locking behavior was adjusted to allow greater concurrency. SWD-6901 SWD-6904 SWD-6922 SWD-6928 SWD-6939 SWD-6941 SWD-6955 SWD-6960 SWD-6967 After the SMC was updated, the Scheduled Documents showed errors and would not display any graphs The problem for both defects was that an update to Java 8 still required some client groups to have Java 7. The coding was changed so that the SMC will use Java 8 properly. The FlowSensor was dropping 90% of packets. We updated the drivers so the network interface card could pass the packets to the engine to process. The defect was that the SMC Java client took 10 to 15 minutes to finish loading cache. We adjusted the lock acquisition behavior of a portion of the SMC Web application so that the loss of communication with Cisco ISE nodes does not cause long delays in the login process through the SMC Java client. The defect was that the Database Storage Statistics page on the Flow Collector Appliance Admin interface was not loading. We updated the JavaScript on the Database Storage Statistics page to use a different library function for greater browser support. The defect is that a UDP Director flowfan.xml modification and flowfan restart resulted in a High Availability (HA) cluster service error. The error was caused by the HA service detecting that the flowfan process was not running because of a delay during manual restart of the service. The delay has been removed. A custom service that had been set to "Exclude Security Event" was still triggering Security Events. We updated the code to fetch the required service details from the configuration file and use it for event triggering. Customer had an issue with multiple Cisco ASA's reporting longest duration exports of 1,800. The fix was to ignore the Summary Flows that are sent at the end of each firewall flow Cisco Systems, Inc. All Rights Reserved. 13

14 SWD-6976 The defect is that the customer was unable to configure custom certificates for SSL/TLS communications on the Stealthwatch appliances. The fix provides the ability to install and use certificates with a trust chain longer than 1. The update will restart nginx. The fix is applicable to all appliances SWD-7061 SWD-7107 SWD-7131 SWD-7132 SWD-7149 SWD-7229 SWD-7322 SWD-7324 SWD-7621 User received a SMC internal server error. To avoid this error message, an intermediary was placed between the interface requests that were causing this error and the Mongo database. The FlowCollector was not processing user name. The engine now processes Create events that have no bytes or packets so that it can process the AAA user name from the ASA "Flow created" record. Some Stealthwatch appliances did not respond to ICMP requests from a Nagios monitoring server. The default Docker IP address and the netmask for eth2 on the Flow Collector 5000 series database node were changed. A customer had an Internal Server error. The fix was to decrease the frequency of certain operations made by the SMC Web interface that can cause increased load on the Mongo database. The Flow Collector home page would not load in an Internet Explorer browser. The fix is to change some functions used in loading the Flow Collector home page, which were not supported by IE/Edge browsers. NetFlow decode was not properly retrieving ICMP type and code. An initialization problem in the NetFlow decoder was fixed to properly retrieve the ICMP type and code from the first ICMP Netflow record that it decodes. The Flow Collector engine did not stop inserting data when the disk was 100% full. Added code to disable the stats the database writes at maximum disk utilization and to trigger the performance degraded alarm. The Top Conversations Report was not returning all results when a host filter was used. The fix was to correct the miscalculation while computing the transaction report values in the Top Conversations Report Cisco Systems, Inc. All Rights Reserved.

15 SWD-7653 IDentity v3.3.0 does not support TLS 1.0 or 1.1. The SMC Java client was updated so that the customer could use TLS v1.2 for connections back to the SMC SWD-8136 Cognitive Threat Analytics (CTA) API calls using JWT tokens were not being made correctly. JWT tokens are now being passed through Authorization headers Cisco Systems, Inc. All Rights Reserved. 15

16 Known Issues This section summarizes issues (bugs) that are known to exist in this release. Where possible, workarounds are included. The defect number is provided for reference. Defect Number SWD-7627 SWD-7655 SWD-8197 SWD-8210 Description If you reboot your Flow Collector, it deletes all alarm history; however, if you replace your Flow Collector, the new Flow Collector retains the alarm history from the old Flow Collector instead of deleting it. Since the alarming host widgets (which display the number of hosts receiving alarms since the last reset hour for a specific category) on the Security Insight Dashboard and Host Group page then do not update until the next reset hour, you may see a discrepancy between these values and the alarm values in the Hosts table on the Host List View. The generation of a diagnostics pack may fail in large systems as a result of timing out. The Flow Sensor was not detecting enough applications. The ISE devicetype field that was populated in v6.8.x using syslog is not being mapped properly from pxgrid. Workaround None currently available; the feature will be available in a future release. To overcome this, open the SSH console for the appliance and run this command: dodiagpack. This will allow the generation of the diagnostic pack without timing out. The diagnostic pack can be downloaded using Browse File in the /admin/diagnostics folder, and it can be copied off the box using SCP. To provide more accurate application classification, we updated the thirdparty library for Application Identification. Due to this update, some traffic will no longer be classified as it was in prior versions and support has been removed for a variety of applications. Updates to the applications supported are dependent on future releases from the third-party library. This has been fixed in patch-smc- ROLLUP swu. SWD-8431 CTA does not work with trial licenses. A full license is required to work with CTA; this will be fixed in a future release Cisco Systems, Inc. All Rights Reserved.

17 Defect Number SWD-8458 SWD-8537 SWD-8673 SWD-8701 Description CTA Integration has an error with filtering external and internal host groups. CTA components are only displayed for Admin users. SystemConfig special character fonts look bad when using the SecureCRT client in ANSI mode. OVF resource defaults do not match the minimum reserved memory allocations for the SMC and the Flow Collector. NA CTA cannot be enabled on the Flow Collector 5000 series. NA On the Flow Sensor VE, Export Application Identification is off by default. Workaround This has been fixed in patch-smc- ROLLUP swu. This has been fixed in patch-smc- ROLLUP swu and patchfcnf-rollup swu. To overcome this, disable ANSI Color when connecting or use a different client to view the SystemConfig script. You will need to add additional resources to meet the minimum requirements stated in the Stealthwatch Management Console VE and Flow Collector VE Installation and Configuration Guide; this will be fixed in a future release. None currently available; this will be fixed in a future release. To enable application identification, this advanced setting will need to be manually selected Cisco Systems, Inc. All Rights Reserved. 17

18 2017 Cisco Systems, Inc. All Rights Reserved. SW_6_9_1_Release_Notes_DV_1_2