ArcSight Management Center 2.2 P1 Release Notes.pdf
- 1. HPE ArcSight Management Center Software Version: 2.2 Patch 1 Release Notes September 2, 2016
- 2. Legal Notices Warranty The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. The network information used in the examples in this document (including IP addresses and hostnames) is for illustration purposes only. HPE ArcSight products are highly flexible and function as you configure them. The accessibility, integrity, and confidentiality of your data is your responsibility. Implement a comprehensive security strategy and follow good security practices. This document is confidential. Restricted Rights Legend Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice © Copyright 2016 Hewlett Packard Enterprise Development, LP Follow this link to see a complete statement of copyrights and acknowledgements: https://www.protect724.hpe.com/docs/DOC-13026 Support Phone A list of phone numbers is available on the HPE ArcSight Technical Support Page: https://softwaresupport.hp.com/documents/10180/14684/esp-support- contact-list Support Web Site https://softwaresupport.hp.com Protect 724 Community https://www.protect724.hpe.com Contact Information Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 2 of 11
- 3. Contents About ArcSight Management Center 3 What's New in this Release 3 Technical Requirements 4 Upgrading ArcMC 6 Fixed Issues 7 Open Issues 8 Send Documentation Feedback 11 About ArcSight Management Center ArcSight Management Center, one of the ArcSight Data Platform (ADP) family of products, is a centralized management tool that simplifies security policy configuration, deployment maintenance, and monitoring in an efficient and cost-effective way. ArcMC offers these key capabilities: • Management and Monitoring: deliver the single management interface to administrate and monitor ArcSight managed nodes, such as Connector Appliances, Loggers, Connectors, and other ArcMCs. • SmartConnector Hosting: for the hardware appliance, as a platform to instantiate (host and execute) SmartConnectors ArcMC includes these benefits: l Rapid implementation of new and updated security policies l Increased level of accuracy and reduction of errors in configuration of managed nodes l Reduction in operational expenses What's New in this Release The ArcSight ArcMC 2.2 Patch 1 release provides the same functionality as ArcMC 2.2 , but fixes several existing issues which are described in "Fixed Issues" on page 7. HPE ArcSight Management Center 2.2 Patch 1 Page 3 of 11
- 4. For information about ArcMC 2.2 features and functionality, refer to the ArcMC 2.2 Release Notes, Administrator's Guide, and other documentation, available from the ArcSight product documentation community on Protect 724. Technical Requirements For ArcSight Management Center: Server For software form factor: l Red Hat Enterprise Linux 6.7 or 7.2 l CentOS 6.7 or 7.2 For appliance upgrade: Red Hat Enterprise Linux 6.7 or 7.2 Client System l Windows 7, 8, 10 l MacOS 10.8 l RHEL 6.5, 6.6, 6.7 CPU 1 or 2 Intel Xeon Quad Core(or equivalent) Memory l 16 GB RAM l 80 GB Disk Space (for software form factor) Supported Client Browsers l Internet Explorer 11 l Microsoft Edge (version current as of 6/24/2016) l Firefox ESR (version current as of 6/24/2016) l Google Chrome (version current as of 6/24/2016) l Mac Safari 9 Screen Resolution Optimal screen resolution for best view is 1920x1200 Hardware Models For new and upgraded ArcMC appliance deployments, all models C650x or C660x running RHEL 6.7 Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 4 of 11
- 5. For Managed ArcSight Products Managed Product Software Form Factor Hardware (Appliance) ArcMC Agent Version Required Software Connector v6.0.3 or later. Applies to software connectors running on Connector Appliance, Logger (L3XXX), or separate server. N/A ArcMC Agent is not required. Logger v6.0, v6.0P1, v6.0 P2, v6.1, v6.2 v5.5 P2, v6.0 + Bash vulnerability Hotfix+ Tzdata Hotfix, or v6.0 P1/6.0 P2, on models LX200, LX400, or LX500 v2.2 ArcMC v2.0.x, v2.1, v2.2, v2.2 P1 v2.0.x,v2.1 or v2.2 on new model C6500, migrated model C6400. v2.2 Connector Appliance v6.4 P3 or v6.4 P3 (6885) Hotfix v6.4 P3, on models CX200, CX400, or CX500 v2.2 Installer Files Available from the HP download site, the installer files for ArcSight Management Center 2.2 P1 are named as follows: l For Software ArcMC: ArcSight-ArcMC-2.2.0.1699.1.bin l For ArcMC Appliance: arcmc-1699.enc l In addition, for G9 C6600 appliances only, arcmc_rhel72_20160606160104.enc will upgrade the operating system from RHEL 7.1 to RHEL 7.2. l ArcMC Agent Installer: The ArcMC Agent installer for all appliance nodes, and for some types of software nodes, is bundled with the the ArcMC installer file. You may remotely install or upgrade the ArcMC Agent on a managed node directly from ArcMC, as follows: l You can install or upgrade the ArcMC agent remotely from a managing ArcMC on all managed appliance nodes (Logger Appliance, ArcMC Appliance, and Connector Appliance hardware form factor). l You can install or upgrade the ArcMC agent for remotely managed software nodes which are ArcMC v2.1 and Logger v6.0 or later. The ArcMC Agent cannot be upgraded or installed remotely on earlier versions of ArcMC and Logger, Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 5 of 11
- 6. nor for any software Connector Appliance managed node. For these node types, a manual installer is required. The Agent installer file is required and named ArcSight-ArcMCAgent- 2.2.1234.1.bin. Upgrading ArcMC Upgrade is supported from software ArcSight Management Center versions 2.1 or 2.2 to software ArcSight Management Center 2.2 Patch 1. You should also upgrade any managed ArcSight Management Centers to version 2.2 P1 as well. Always perform any OS upgrade, if needed, to a supported OS version before upgrading the ArcMC version. OS requirements for the new version are listed under Technical Requirements. To upgrade to ArcSight Management Center 2.2 P1: 1. Run these 2 commands from the directory where you copied the ArcSight Management Center software: chmod +x ArcSight-ArcMC-2.2.0.1699.1.bin ./ArcSight-ArcMC-2.2.0.1699.1.bin The installation wizard starts. Review the dialog box, and then click Continue. 2. Follow the prompts to upgrade. For your installation directory, choose your original ArcSight Management Center installation directory. 3. If you run the ArcSight Management Center software installer as a root user, then specify an existing non-root user and a port through which users will connect to ArcMC. If any port other than 443 (the standard HTTPS port) is specified, users will need to enter the port number in the URL they use to access the ArcSight Management Center. When prompted, enter the user name of the non-root user and the HTTPS port number, and then click Next. 4. Follow the prompts to complete product initialization. 5. If you run the installer as a root user, specify whether to run ArcSight Management Center as a system service or as a process. Additionally, a few libraries are added using ldconfig. For a complete list of those libraries, see /etc/ld.so.conf.d/arcsight_arcmc.conf and <install_ dir>/current/arcsight/install/ldconfig.out. Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 6 of 11
- 7. The upgrade is completed. Click Start ArcSight Management Now, or click Start ArcSight Management Center later, and then click Finish. Upgrading the ArcMC Agent ArcSight Management Center 2.2 P1 can only manage nodes that are running the ArcSight Management Center Agent version 2.2 P1. Consequently, after upgrading to ArcSight Management Center 2.2, you may also need to upgrade the ArcSight Management Center Agent on some or all previously managed hosts in order to continue management. An Agent upgrade is required for any of the following host types running ArcSight Management Center Agent 2.0 or earlier that you wish to continue managing: ■ Hardware Appliances: Hardware Connector Appliances, Logger Appliances, or ArcMC Appliances ■ Software Form Factors: Software Connector Appliances, Software Loggers, or software ArcMCs Upgrade Procedure ArcSight Management Center 2.2 P1 can remotely upgrade the ArcMC Agent on any number of managed hosts. For ArcMC Agent upgrade instructions, see the ArcSight Management Center 2.2 P1 Administrator’s Guide. Fixed Issues The following issues have been resolved in ArcSight Management Center 2.2 P1. Key Release Note Description ARCMC- 7613 Previously, renaming the "Default" location to another name and restarting the web service could cause duplicate containers. This issue has been fixed. ARCMC- 7027 An issue has been resolved where, if the appliance folder /opt/arcsight/conapp existed, an error would be returned during an upgrade. The upgrade will now proceed normally. ARCMC- 6977 In some cases, the ArcMC agent installation for localhost management could fail. This issue has been resolved. ARCMC- 6853 The Expand All and Collapse All links were formerly hidden in the Node Management tree when the user landed the on Node Management page. ARCMC- 6334 On the Event History page, when Cancel was clicked for Pending status, an incorrect job status was shown. Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 7 of 11
- 8. ARCMC- 6222 Localhost remote management, a feature of ArcMC 2.2, would not formerly work on an upgraded G8 appliance until the 'web' service was restarted. Localhost remote management will now work as expected on an upgraded G8 appliance. ARCMC- 6028 Previously, deploying a FlexConnector and selecting Logger Poll as its destination would return an error. This issue has been resolved. ARCMC- 5915 In Internet Explorer, on an upgraded ArcMC with many hosts, the exception error GetFrameFormName was sometimes displayed. ARCMC- 5913 In Configuration Management, when entering settings for a Logger Receiver configuration, a warning prompt was always displayed for the Logger Receiver name, even when the name was valid. This will no longer occur for valid names. ARCMC- 5625 In some cases, when there was complex data being loaded, the Node Management UI could take a long time to display page data. Display speed has been improved. ARCMC- 5624 The "Connector Detail" will now load and show the correct status of connectors more quickly. ARCMC- 5299 When a role is created with a duplicate name of an existing role, a more user-friendly message is displayed. ARCMC- 4275 After uninstallation of ArcMC, some files were not deleted. All files will now be deleted correctly. ARCMC- 4087 An issue has been resolved where in some cases, repository files uploaded in Connector Appliance would not be correctly deleted and reuploaded. ARCMC- 2011 If creating a WUC external configuration with all the parameters given on ArcMC, please make sure all the parameters are also given on the connector side (while creating the connector). Otherwise the push or compliance check may fail. ARCMC- 1284 An issue has been resolved where, if an attempt was made to add a CEF encrypted syslog destination using the Choose from an Existing Destination option, then there was no way to enter the shared key value. The key can now be entered. Open Issues ArcSight Management Center 2.2 P1 includes the following open issues. Use listed workarounds, where available. Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 8 of 11
- 9. Key Release Note Description ARCMC- 7898 The Apache process fails to start if "Client Certificate" or "Client Certificate AND User Password" has been enabled before Trusted Certificates are uploaded. Workaround: Apache will fail to start if the Trusted Certificates directory is empty. Upload Trusted Client certificates in the System Admin > Security > SSL Client Authentication > Trusted Certificates tab before enabling authentication methods from the System Admin > Users/Groups > Authentication > External Authentication tab. ARCMC- 6535 In some cases, when use ARCMC to push receivers to a target Logger, the receiver configuration files are generated but the pushed receivers are not populated on the target Logger UI. Workaround: Re-do the push of all missing receivers to the target logger. ARCMC- 6502 To display the very long name of a Logger Event Archive, please increase the width of the column. ARCMC- 6330 For software Logger installed on RHEL 7.1 or later OS version, the configuration push by ArcMC fails to push the SNMP destination to the target Logger. Workaround: Option 1: Push the config again to the destination Logger; Option 2: Manually add the SNMP destination on the target logger. ARCMC- 6195 Using table filters on Monitoring > Summary and Monitoring > Product pages hides all data in the tables. The workaround is to refresh these pages to see the entire list of data in these tables. ARCMC- 4114 If the location of Logger nodes is updated, the new location will not be reflected in the path of the Logger initial configuration source nodes. ARCMC- 4080 During a Logger Initial Configuration push, the /etc/hosts file of the destination loggers is replaced with the source logger's /etc/hosts file. So after the destination logger is configured using the Initial Configuration, login and manually edit the hosts file in the destination logger. ARCMC- 4077 In Internet Explorer 11, when selecting multiple rows with the mouse, the text in the rows also is highlighted. This has no impact on the actual row selection other than to highlight the text. Workaround: Use SHIFT+arrow keys to select multiple rows. ARCMC- 3977 Under Node Management, sorted lists do not save the user-preferred sort order. ARCMC- 2969 Context sensitive help for the All Configurations and Repositories menu items will not show the correct help. ARCMC- Under Administration >Network >System DNS, both the primary and secondary DNS Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 9 of 11
- 10. 2783 should be set to 0.0.0.0 instead of letting them be empty fields. Setting the fields to empty causes issues with DNS lookup. ARCMC- 1026 Turning interface homing on may result in a loss of connectivity to the appliance. If interface homing was already turned on and is known to be working, it can be left on. Workaround: If interface homing was turned on and connectivity was lost, it can be restored as follows: 1. In mouse/keyboard or iLO, log in to the console, and set the IP address of eth0 to its original address. This will cause the network service to be restarted and should restore network connectivity. 2. Once network connectivity has been restored, point your browser to the appliance's web UI, log in, and go to Setup > System Admin > Network > NICs. Turn Interface homing off, and then restart the network service. ARCMC- 52 If pages are loaded in a small browser window, then maximizing the browser does not resize wizard pages correctly. Maximize the window and refresh the view to view a wizard page properly. Release Notes HPE ArcSight Management Center 2.2 Patch 1 Page 10 of 11
- 11. Send Documentation Feedback If you have comments about this document, you can contact the documentation team by email. If an email client is configured on this system, click the link above and an email window opens with the following information in the subject line: Feedback on Release Notes (ArcSight Management Center 2.2 Patch 1) Just add your feedback to the email and click send. If no email client is available, copy the information above to a new message in a web mail client, and send your feedback to [email protected]. We appreciate your feedback! HPE ArcSight Management Center 2.2 Patch 1 Page 11 of 11