Release Notes for Snare Central v8.4.3

Overview

Snare Central version 8.4.3 is a patch release that includes updated system packages, security patches, minor enhancements and bug fixes.

Security

• Explicitly removed and disabled log4j2 components linked to log4j vulnerability. 
  See the Snare Log4j/Log4Shell vulnerability CVE-2021-44228 for more details.

• Updated policykit-1 package to version 0.105-20ubuntu0.18.04.6 to mitigate vulnerability CVE-2021-4034

• Updated samba packages to version 2:4.7.6+dfsg~ubuntu-0ubuntu2.28 to mitigate vulnerability CVE-2021-44142

Features and Enhancements

• Improved parsing of Trend Micro Deep Security logs, recognised in Snare Central as TrendDSM log type

• Snare Central appropriately detects if running on AWS EC2 and sets kernel parameters appropriately

• Included libsnmp-dev package in Snare Central

Bug Fixes

• Upgrade process will now preserve STIG settings if STIG is enabled

• Fixed LDAP authentication Test button to work properly for large domain names

• Fixed an issue with the Firewall Backup option of the "Firewall Setup" section of the "Configuration Wizard" that prevented the backup from being created correctly

• Fixed parsing issue where Event ID field was empty for some Windows events received in Snare v2 format

• Fixed parsing issue where MS DNS logs received in Snare format had missing Time field

• Fixed parsing issue where MS DNS logs received in Snare v2 format had missing details

• Fixed parsing of DHCP logs sent from Snare Agent

• Fixed an issue in AMC that prevented the correct calculation of configuration differences between agents

• Fixed  "Arbitrary Data Import" functionality. Data now uploads and imports correctly

• Resolved an issue where the server time displayed in the Web UI does not match the actual server time

• Resolved a problem that could cause duplicate user accounts and groups after a side by side migration

• Fixed a problem that prevented the correct Elasticsearch configuration at installation and upgrade time

• Corrected NFS mount options in Disk Manager

• Improved performance of Reflector statistics graphs

• Improvements to Health Checker to be able to change disk thresholds for mounted NAS devices

• Improved table layout in PDF reports to better fit large data on the page and avoid columns being cut off

• Fixed periodic deletion of old PDF reports from PDF-Archive directories

• Updated terminal signal handling and restart procedures for the Snare Collector

• Validating queries in the event search objective, should take much less time on systems with large datastores

• Additional service and reflector-level system validation has been added to further contain corrupted data from rogue rsyslog clients that have an incorrect template definition

• Increased verbosity for legacy metadata generation function

• Fixed Multi-Table reports that occasionally returned no data