Release Notes McAfee Policy Auditor 6.2.2 For use with McAfee epolicy Orchestrator
COPYRIGHT 2016 Intel Corporation TRADEMARK ATTRIBUTIONS Intel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence, McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfee Total Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Policy Auditor 6.2.2 Release Notes
Contents 1 About this release 5 2 New features 7 3 Resolved issues 9 4 Installation instructions 11 5 Known Issues 13 6 Find product documentation 15 Index 17 McAfee Policy Auditor 6.2.2 Release Notes 3
Contents 4 McAfee Policy Auditor 6.2.2 Release Notes
1 About this release This document contains important information about the current release. We recommend that you read the whole document. Purpose This release of McAfee Policy Auditor provides enhanced performance, certain updated strings, and an updated McAfee Policy Auditor agent plug-in debug tool to support user-selected logging details, number of logs and maximum log size. The Policy Auditor agent plug-in debug tool works only on Windows platform only. McAfee Policy Auditor 6.2.2 Release Notes 5
1 About this release 6 McAfee Policy Auditor 6.2.2 Release Notes
2 2 New features The current release of the product includes these new features. Updated content management and user-interface strings Option Findings data purging batch size (not available in the user-interface) Number of benchmark results to purge per batch (on the Server Settings Edit Policy Auditor page) Remove related Findings when purging Audit Results (on the step 3 in New Audit Builder wizard) Purge Audit Results server task window stop task after this time (hours) (on the Server Settings Edit Policy Auditor page) Findings Data Retention (on the Server Settings Edit Findings page) Frequency to run update Audit assignments (no longer available in the user-interface) Change description The database field for the Findings data purge now compiles a bigger batch size for faster processing. The Findings purge batch size is 250000 instead of 1000. This setting is not customizable. The default value for the number of benchmark results to purge per batch has been increased to 40000 from the earlier value of 20. This is a customizable option and is available on the Server Settings Edit Policy Auditor page. The Remove related Findings when purging Audit Results option has been disabled by default. You can still enable this option in an audit, if needed, which you create from the Risk & Compliance Audits page. The earlier Database Maintenance stop task after this time (hours) string has been replaced with Purge Audit Results server task window stop task after this time (hours) for better clarity. Stop Data Maintenance after string has been replaced with Purge Findings server task window stop task after this time. This option is no longer customizable and has been removed from the Server Settings Edit Policy Auditor page. Policy Auditor agent plug-in debug tool changes Enable debug logging with the required detail, number of logs, and their maximum size. A new button Enable Debug Logging has been provided on the Policy Auditor agent plug-in debug tool to use these options: McAfee Policy Auditor 6.2.2 Release Notes 7
2 New features Option Max Backup Index Log Details Max File Size Definition Provide the number of previous logs to include. Select the level of detail that you want to include in logs. EMERG Logs those events only that are urgent. FATAL Logs those events only that are fatal. ALERT Logs only alert messages. CRIT Logs only critical messages. ERROR Logs only error messages. WARN Logs only warning messages. NOTICE Logs only notices. INFO (Default) Logs only informative messages. This logging level is set by default and it provides brief information about the execution details. DEBUG Logs detailed information that can be used for debugging. NOTSET Sets the logging preference to not set. Specify the maximum file size for the logs. 8 McAfee Policy Auditor 6.2.2 Release Notes
3 Resolved issues The current release of the product resolved these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Table 3-1 Install or Uninstall Reference Description 1022906 Changing the index permission settings no longer cause the upgrade to fail and result any downgrade inconsistency. 1020187 Endpoint Deployment Kit can be used to uninstall Policy Auditor agent from multiple systems. 1115709 Policy Auditor agent deployment no longer starts automatically after an upgrade. 967565 Upgrade no longer fails with arithmetic error on a system with a large Policy Auditor database. Table 3-2 Audits Reference Description 1136325 User Right Assignment checks run successfully even if the system contains a stranded Security Identifier (SID). 1072476 Fixes an issue where a tag could not be removed if it was used in an audit that has already been removed. 1067704 Audits can be saved without errors about permissions for a specific system. 1033503 An audit with multiple endpoints can be saved or edited without an exception error. 985595 Audits no longer fail when they involve large database that has exceeded Integer count limit. Table 3-3 Benchmarks and checks Reference Description 1084794 Rules can be edited and saved without any errors. 1025567 Removal of a platform from a benchmark in Internet Explorer 11 no longer results in an exception error. 1072455 Benchmarks on Solaris systems no longer fail with errors about CPE evaluation. 962171 Repeated edits to a benchmark no longer result in unknown exception errors. 952466 No more errors appear when editing an XCCDF benchmark that has complex references between rules, checks, and values. 938442 Microsoft Windows Bulletin benchmark titles are displayed in English instead of Russian when the language selected is English. 1012660 CIS benchmarks can be imported even if they contain longer oval check references. 949610 No more null pointer exception appears when importing a password policy check. 936073 Check filter no longer includes checks that are not applicable to the platform selected. McAfee Policy Auditor 6.2.2 Release Notes 9
3 Resolved issues Table 3-4 Reporting Reference Description 1122146 Findings report generation no longer fails due to less storage space in the database. 960289 Query on Audit Patch Results only contains distinct results. Table 3-5 File integrity monitoring Reference Description 1042226 File Integrity Monitoring scan on AIX 6.1 Service Pack 4 no longer generates a core dump. 983308 File Integrity Monitoring data purge is faster. Table 3-6 Script execution Reference Description 1092418 Fixes the issue where Service Management Facility check results (smf-test) were inconsistent from SVCS checks. 1091505 Fixes the issue where the network utility checks (ndd-test) on Solaris do not collect correct information about ndd_items. 945293 An audit on a Debian system now succeeds when it contains an OVAL object for pattern matching. Table 3-7 Content creator Reference Description 1028264 Verify Registry Value rule type in Policy Auditor Content Creator doesn't result in mismatched data types. 941469 Policy Auditor Content Creator now allows blank registry values. 939404 Account Lockout: Duration check successfully retrieves the account lockout duration information from the local security policy. 925022 Benchmarks created in Policy Auditor Content Creator 6.0.1 can be imported to Policy Auditor 6.2. 919405 Guest account related rules that are created in Policy Auditor Content Creator can be imported to Policy Auditor 6.2. 917334 Benchmark template (.bme) file that was created in Policy Auditor 6.0.1 can now be exported from Policy Auditor 6.2 without any issues. Table 3-8 General Reference Description 969539 The scan engine service (enginemain.exe) running on Windows systems no longer generates process58_item, which is a UNIX-specific system characteristic item in OVAL schema. 938439 All McAfee binaries including fimcli.exe and auditmanagerservice.exe are digitally signed by McAfee. 929469 Policy Auditor agent on an HP-UX system no longer crashes when multiple files have been opened while executing OVAL checks. 1049965 Audit assignments no longer get archived to be reassigned again for the next Update Audit Assignments task execution. 1088118 The Audit Manager service on Red Hat Enterprise Linux (RHEL) systems now creates PID files with correct file permissions. 1060591 OVAL unique function returns the list of unique values instead of the count of unique values. 10 McAfee Policy Auditor 6.2.2 Release Notes
4 4 Installation instructions For information about installing or upgrading Policy Auditor, see McAfee Policy Auditor 6.2 Installation Guide. Consider these additional requirements: Install Policy Auditor server extension and agent plug-in versions that are supported in your environment. For Sun Solaris, HP-UX, IBM AIX endpoints the highest McAfee Agent version supported is v4.8.0 Patch 3 (4.8.0.1938), which is only supported with Policy Auditor 6.2.0 agent plug-in. Endpoint operating system Windows, Linux, and MAC Sun Solaris, HP-UX, IBM AIX McAfee epo server version McAfee Agent version Supported Policy Auditor component versions 5.3.1 or later 5.0.3 or later Policy Auditor server extension version 6.2.2 Policy Auditor agent plug-in version 6.2.2 5.3.1 or later * 4.8.0 or earlier Policy Auditor server extension version 6.2.2 Policy Auditor agent plug-in version 6.2.0 * If you're using McAfee epo 5.9 with McAfee Agent 4.8 to manage the Sun Solaris, HP-UX, IBM AIX endpoints, use the Policy Auditor server extension 6.2.2 with Policy Auditor agent plug-in 6.2.0. For more information on supported product versions, see this McAfee KnowledgeBase article: KB72961. Install the Policy Auditor server extension and agent plug-in separately. You need a lower version of your Policy Auditor agent plug-in for your Sun Solaris, HP-UX, IBM AIX endpoints with McAfee Agent 4.8. Install Policy Auditor 6.2.2 as an extension. Check in Policy Auditor 6.2.0 agent plug-in packages for Sun Solaris, HP-UX, IBM AIX endpoints. See the McAfee Policy Auditor 6.2 Installation Guide for instructions. McAfee Policy Auditor 6.2.2 Release Notes 11
4 Installation instructions 12 McAfee Policy Auditor 6.2.2 Release Notes
5 Known Issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB79078. McAfee Policy Auditor 6.2.2 Release Notes 13
5 Known Issues 14 McAfee Policy Auditor 6.2.2 Release Notes
6 6 Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at https://support.mcafee.com and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. McAfee Policy Auditor 6.2.2 Release Notes 15
6 Find product documentation 16 McAfee Policy Auditor 6.2.2 Release Notes
Index D documentation product-specific, finding 15 M S ServicePortal, finding product documentation 15 T technical support, finding product information 15 McAfee ServicePortal, accessing 15 McAfee Policy Auditor 6.2.2 Release Notes 17
0-00