IM: Symantec Security Information Manager Patch 4 Resolved Issues

Transcription

1 IM: Symantec Security Information Manager Patch 4 Resolved

2 Symantec Security Information Manager Patch 4 Resolved The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version: Patch 4 Legal Notice Copyright 2010 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation 350 Ellis Street Mountain View, CA

4 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level

5 Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions that are related to CD-ROMs or manuals

6 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

7 This document includes the following topics: Patch 4 Resolved issues Patch 3 Resolved issues Patch 2 Resolved issues Patch 1 Resolved issues Patch 4 Resolved issues SSIM Patch 4 is cumulative and includes fixes from SSIM Patch 1, SSIM Patch 2, and SSIM Patch 3 which are described in later sections. The following resolved issues are included in version Patch 4 of the Security Information Manager: Incident description mismatch rectified Criteria type for Rules and Queries persists Precise event count displayed Exact status for event tracking shown Windows/Novell events class issue fixed Event criteria disappearance issue fixed New tool to re-sign archives Incident description mismatch rectified For some closed incidents that had incident description errors, the content in the description now matches appropriately with the corresponding rules.

8 Patch 4 Resolved issues Criteria type for Rules and Queries persists The Other Fields type in a criteria for rules and query persists between export, import, and copy. Precise event count displayed Precise event count is now displayed for the conclusions even when some of the related events are not archived. Exact status for event tracking shown The Tracking status is preserved whenever multiple incidents with different tracking status are selected and modified. Windows/Novell events class issue fixed Windows/Novell events class fields are now available for query filter for the SSIM servers that are upgraded from SSIM version 4.5. Event criteria disappearance issue fixed New tool to re-sign archives Rules with conditions having the lookup table fields that are created and saved, are shown appropriately even after the SSIM console is restarted. A tool is now available with SSIM to re-sign archives with the SESA certificate on SSIM server. You can use the following options while re-signing the archives: Option --all --name --from --to --help Format <archivename> <mm/dd/yyyy> <mm/dd/yyyy> Description Re-signs all archives on this machine Re-signs the selected archive by using the archive name Re-signs archives created on or after a specific date Re-signs archives created on or before a specific date Display this help

9 4.7.2 Patch 3 Resolved issues Patch 3 Resolved issues The following resolved issues are included in version Patch 3 of the Security Information Manager: Improved incident processing Improved asset filters Archive names are shown instead of archive IDs Unexpected archive creation error fixed Enhanced event archive validation Improved incident processing Improved asset filters SSIM can now process incidents even if there are null values in the fields. Asset filters are functioning appropriately for the OS name and OS version fields that may have leading or trailing spaces. Archive names are shown instead of archive IDs In some cases, archive IDs were displayed in the role properties. Now, archive names are displayed. Unexpected archive creation error fixed In certain scenarios, when you create an event archive, an unexpected error Error while checking duplicate archive is displayed. This issue is fixed. Enhanced event archive validation Results were not displayed on the Web UI for event archive validation whenever there were archives with huge size. This issue is resolved Patch 2 Resolved issues The following resolved issues are included in version Patch 2 of the Security Information Manager: Undo option available even after unsuccessful rule deployment

10 Patch 2 Resolved issues Rule import validation for existing users Automated restart of services after LDAP restore Improved ticket filter for localization Consistent character limit for rule name edition and creation Removal of unnecessary exceptions in icesvc.log Custom Font for legend is preserved Deadlock due to Java issue is circumvented Improved printer initialization Corrected sorting of numeric event field Localized font applied to legend Log file permissions corrected Enhanced cancel query operation Auto-Purge functionality fixed Enabled archiving of SSIM logs Consistent query export independent of export type Missing Change Password tool is restored Enhanced agent status in Statistics Viewer Ambiguity in Bug Traq ID references cleared Ambiguity in Event Type ID references cleared Undo option available even after unsuccessful rule deployment Previously, when editing a rule, the Undo option was not available after the "Cannot deploy" message was displayed. The issue is fixed. Rule import validation for existing users Previously, incidents were assigned to non-existent users when rules were imported. The issue is fixed. Automated restart of services after LDAP restore Previously, services had to be restarted manually after the LDAP restore in the replication environment. This issue is fixed.

11 4.7.2 Patch 2 Resolved issues 11 Improved ticket filter for localization Previously, the assignee of a ticket had a localized string while creating a new ticket. Due to this, the unassigned tickets that contained a localized string were not displayed in "All Unassigned Tickets" filter in the Tickets view. The issue is fixed. Consistent character limit for rule name edition and creation Previously, there was a difference in the number of characters in the rule name while creating (64 characters) compared to the number while renaming (40 characters). The issue is fixed. Removal of unnecessary exceptions in icesvc.log Previously, several error messages were logged in icesvc.log. The issue is fixed. Custom Font for legend is preserved Previously, when a report containing Top N or Trending queries was imported, the font type that is set for the legend of the query chart in the report was not imported. Hence, the default font (Arial) was used for the legend in the imported report. The issue is fixed. Deadlock due to Java issue is circumvented Previously, in some cases, events stopped arriving a few minutes after midnight. This was due to a bug in Java because of which the ICE service in SSIM was prone to deadlock under certain circumstances. The issue is fixed. Improved printer initialization Previously, the printer was initialized at startup and affected SSIM client performance. The issue is fixed. Corrected sorting of numeric event field Previously, sorting event count for query of Top # by vendor signature resulted in what appeared to be alphabetical ordering rather than numerical ordering. The issue is fixed.

12 Patch 2 Resolved issues Localized font applied to legend Previously, the DBCS characters of Legend were not displayed properly in the report. The issue is fixed. Log file permissions corrected Previously, upgrading to SSIM 4.7 MP2 broke the permissions of /opt/symantec/simserver/logs/simdbmu directory. The issue is fixed. Enhanced cancel query operation Previously, clicking cancel to stop the query execution took a lot of time. The issue is fixed. Auto-Purge functionality fixed Previously, auto-purge of closed incident/ticket/alert did not work. The issue is fixed. Enabled archiving of SSIM logs Previously, SSIM logs were not written to the default SSIM Logs archive. This issue is fixed. Consistent query export independent of export type Previously, exporting a query to a CSV file returned different results depending on the type of export that was chosen. The issue is fixed. Missing Change Password tool is restored Previously, the ChangePassword.tar file was missing after upgrading to SSIM 4.7 MP2. The issue is fixed. Enhanced agent status in Statistics Viewer Previously, when the Statistics Viewer was opened from System > Visualizer > Table View and you left the System View, the agent information was not updated in the Statistics Viewer. After some time, the agent status was displayed as "Down" in the table. The issue is fixed.

13 4.7.2 Patch 1 Resolved issues 13 Ambiguity in Bug Traq ID references cleared Previously, there were differences between BugTraq ID variables in correlation rules. The issue is fixed. Ambiguity in Event Type ID references cleared Previously, when Event Type ID is selected as filter criteria, in both queries and rules, the value Queue usage warning appears twice in the drop-down list. The issue is fixed and now two separate entries - "Agent queue usage warning" and "Audit queue usage warning" are present for event queries and rules Patch 1 Resolved issues The following resolved issues are included in version Patch 1 of the Security Information Manager: Precise date range data for event filters Retention of existing text on double-click Better handling of unscheduled reports Enhanced editing for event criteria Purging event data issue resolved Enhanced WSRF service for efficient memory usage Restriction of Hyphen(-) character for DAS volume name Removed unused SendMail package Removed unused Kerberos package Improved RBAC Appropriate default incident filter displayed Comprehensive unregistration process for SAV SIPs Improved time handling in rules Rectified product name handling Precise date range data for event filters Previously, when a date range was specified in the Event filter for the All Events view, the results were not displayed correctly. The issue is fixed.

14 Patch 1 Resolved issues Retention of existing text on double-click Previously, when you double-clicked in the Sensor configuration field, the existing text was removed. The issue is fixed. Previously, when you tried to edit the Sensor property field by double-clicking in the field, the existing text was removed. The issue is fixed. Better handling of unscheduled reports Previously, unscheduling reports caused some reports to disappear. The issue is fixed. Enhanced editing for event criteria Previously, all lines in a rule's event criteria were removed when trying to remove more than one line. Purging event data issue resolved Previously, Event Data Manager was unable to purge event data and exceptions were observed in the simdbmu.log file. The issue is fixed. Enhanced WSRF service for efficient memory usage Previously, when the WSRF service started, it cached the entire asset table and caused instability and random crashes. The issue is fixed by providing the paging feature. Restriction of Hyphen(-) character for DAS volume name Previously, when the hyphen (-) character was used in the DAS Volume name, the file system name displayed two hyphens. The hyphen character can no longer be used in the DAS Volume name and an error is displayed when it is used. Removed unused SendMail package Previously, the SendMail package was present in Symantec Security Information Manager. This unused package is removed. Removed unused Kerberos package Previously, the Kerberos package was present in Symantec Security Information Manager. This unused package is removed.

15 4.7.2 Patch 1 Resolved issues 15 Improved RBAC Previously, a member with a role that had permission to assign incidents to the team or to themselves, was not able to assign these unassigned incidents to themselves. The issue is fixed. Previously, Lookup Table Rule Group (Role properties) were not working correctly. Users with Read-only permission could modify or delete Lookup tables. The issue is fixed. Appropriate default incident filter displayed Previously, when you clicked the Incidents tile for the first time, incorrect filter was displayed. The issue is fixed and the correct default filter is displayed when you log on and click Incidents for the first time. Comprehensive unregistration process for SAV SIPs Previously, when the user unregistered the SAV SIPs, and installed and registered the SIPs again, a message was displayed indicating that the collector was already registered. The issue is fixed. Improved time handling in rules Previously, when the time in a valid date format for example, 12:30 P.M. was specified, an error was displayed indicating that the time was not in the valid format. The issue is fixed. Rectified product name handling Previously, some numeric code values were converted to product names and displayed in SSIM. The issue is fixed.

16 Patch 1 Resolved issues