Table Of Contents
Quick Install and Release Notes for Cisco Security MARS Appliance 4.1.3
Introduction
New and Changed Features
pnLog Agent Updated
Upgrade PN Log Agent to a Newer Version
Cisco Secure ACS Solution Engine Support
Database Maintenance Changes
CLI Update: expert Command
New Vendor Signatures
Upgrade Instructions
Important Upgrade Notes for 4.1.3
Required Upgrade Path
Downloading the Upgrade Package from CCO
Important Notes
Compatibility Notes
Quick Install Notes
Installation Quick Reference
Checklist for Initial Configuration
Caveats
Open Caveats - Release 4.1.3
Resolved Caveats - Release 4.1.3
Resolved Caveats - Releases Prior to 4.1.3
Product Documentation
Obtaining Documentation, Support, and Security Guidelines
Quick Install and Release Notes for Cisco Security MARS Appliance 4.1.3
Revised: February 28, 2006, 78-17410-01
These release notes are for use with the Cisco Security Monitoring, Analysis, and Response System (CS-MARS), Version 4.1.3 running on either a Local Controller or on a Global Controller. They provide the following information:
•
Introduction
•New and Changed Features
•Upgrade Instructions
•Important Notes
•Quick Install Notes
•Caveats
•Product Documentation
•Obtaining Documentation, Support, and Security Guidelines
Introduction
Version 4.1.3 is now available as a patch upgrade to 4.1.2 (2042) of your CS-MARS appliance software. Registered SMARTnet users under the can obtain version 4.1.3 from the Cisco support website at:
http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars
New and Changed Features
In addition to resolved caveats, this release includes the following new features:
•pnLog Agent Updated
•Cisco Secure ACS Solution Engine Support
•Database Maintenance Changes
•CLI Update: expert Command
•New Vendor Signatures
pnLog Agent Updated
This agent is installed on a Windows server running Cisco Secure ACS, and it converts ACS log files into a format that can be processed by CS-MARS.
The agent differs from the previous version in the following ways:
•New version number is 4.1.3.
•The agent has been renamed from the perspective of the Services applet in the Windows Control Panel. The agent is now named pnLogAgentService.
•This new version addresses crashes found in previous versions.
•The previously limitation of 1,024 bytes of log data has been addressed. It was previously restricted to a single syslog packet. Now, the service sends the log data split across multiple syslog packets, which are reassembled into the full log message on the CS-MARS Appliance.
•The service restarts itself in the event of a failure; therefore, you do no longer need to configure those settings manually.
Upgrade PN Log Agent to a Newer Version
You can determine which version of the PN Log Agent is running on your server by selecting Help > About in the PN Log Agent Configuration dialog box. This program is updated independently of the CS-MARS Appliance software updates. Therefore, the version number does not correspond to any release of the CS-MARS Appliance software.
To upgrade to the new PN Log Agent from an existing installation, you must perform the following steps:
Step 1 On the Cisco Secure ACS or syslog server where PN Log Agent is running, uninstall the old agent.
a. To uninstall the old agent, click Start > Control Panel > Add/Remove Programs.
b. Select PnLogAgent in the list of currently installed programs, and click Remove.
c. Select Yes to confirm the removal.
Step 2 Reboot the server.
Step 3 Install the new agent. You can download this tool from the following URL:
http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars-misc
Step 4 Re-configure the new agent, specifying the list of files and IP address of the CS-MARS Appliance, etc.
For information on configuring the pnLog Agent, see "Install and Configure the PN Log Agent" in the User Guide for CS-MARS Local Controller Version 4.1.x.
Cisco Secure ACS Solution Engine Support
CS-MARS supports the Cisco Secure ACS Solution Engine via a remote logging host. Cisco Secure ACS Remote Agent for Windows and Cisco Secure ACS Remote Agent for Solaris are applications that support Cisco Secure ACS Solution Engine for remote logging.
While the Cisco Secure ACS Solution Engine supports up to five appliance via a remote logging host, CS-MARS currently supports only one Cisco Secure ACS Solution Engines per remote logging host. Otherwise, CS-MARS cannot identify the IP address of the originating Cisco Secure ACS Solution Engine.
To enable this support, follow these steps:
Step 1 Install and configure either the Cisco Secure ACS Remote Agent for Windows and Cisco Secure ACS Remote Agent for Solaris on the target remote logging host.
For instructions on installing and configuring the remote agent, see Installation and Configuration Guide for Cisco Secure ACS Remote Agents.
Step 2 Configure the Cisco Secure ACS Solution Engine to publish logs to the remote logging host.
Step 3 Install the pnLog Agent on the remote logging host.
For information on installing and configuring the pnLog Agent, see "Configuring AAA Devices" in the User Guide for CS-MARS Local Controller.
Step 4 Add the remote logging host to CS-MARS as a Cisco ACS 3.x reporting device.
Database Maintenance Changes
To address database maintenance concerns, any report results older than one year are deleted. This period is not user definable.
CLI Update: expert Command
The expert command is for exclusive use by Cisco to aid in debugging customer issues that require direct access to the internal data store of the CS-MARS Appliance. You may further restrict access to the expert command by setting the customer portion of the expert mode password via the passwd expert command. This command removes the default expert mode password set on the appliance from the factory.
As of 4.1.3, the following commands are accessible from the CLI:
•passwd expert - Allows you to change the customer portion of the pass phrase associated with the expert command. This password will not grant you access to the expert command; however, it does put into a place a multi-part authentication process by which you can prevent unauthorized access to the expert command of the software running on your appliance. To enable access to the expert command, you must provide this password to authorized Cisco personnel during any troubleshooting operation.
•expert - This command enables the expert mode interface of the CS-MARS Appliance. Even though you may have defined a unique password for the customer portion of the pass phrase associated with this command, you will not be able to authenticate as part of this command. Only an authorized Cisco personnel can enable the expert mode interface.
New Vendor Signatures
The following table describes the most recent signatures supported for each product or technology:
Product
|
Signature Version Supported
|
Cisco IDS 4.1/IPS 5.x
|
S208
|
McAfee Entercept HIDS 4.1
|
Agent Version 40-56
|
ISS RealSecure Network Sensor 7.0
|
24.22
|
ISS RealSecure Server Sensor 7.0
|
24.22
|
McAfee IntruShield NIDS 1.8
|
1.8.64.2
|
Snort NIDS
|
2.3.3
|
Netscreen IDP 2.1
|
Idp2.1r3 Update 254
|
Enterasys Dragon 6.x
|
Latest signatures as of 12-12-2005
|
Symantec Manhunt
|
3.4.3 Update 50
|
Qualys QualysGuard 3.x
|
Latest Knowledge Base XML file as of 02-07-2005
|
Common Vulnerabilities and Exposures (CVE) Database
|
Latest as of 09-08-2005
|
Upgrade Instructions
The CS-MARS upgrade packages are the primary vehicle for major, minor, and patch software releases. As administrator of the CS-MARS Appliance, you should check the upgrade site weekly for patch upgrades. In addition to addressing high-priority caveats, patch upgrade packages update system inspection rules, event types, and provide the most recent signature support.
For detailed instructions on planning and performing an upgrade or install, refer to Checklist for Upgrading the Appliance Software in the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System.
Important Upgrade Notes for 4.1.3
The following notes detail changes to the standard upgrade process:
•If you completed the 4.1.1 to 4.1.2 (2040) upgrade, verify whether the upgrade failed by entering `pnlog mailto <SMTP server> <sender> <recipient>' at the CLI. This commands mails the CS-MARS Appliance logs to the recipient. Open the e-mailed file attachment, and then open the newest upgrade*.log found in /var/log/. Successful upgrades from 4.1.1 (2022) to 4.1.2 (2040) include the following line:
Opening file:
/etc/data/secondarytables/reports/Report.0.Resource-Issues--IOS-IPS-DTM---All-Events.x
ml
If you do not see this line, then a problem occurred during the upgrade regardless of whether the version command reports 4.1.2 (2040). Please open a Cisco TAC case as the failed upgrade will prevent you from upgrading to the more recent 4.1.2 (2042). For more information on using the pnlog mailto, see pnlog in the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System.
•To upgrade from 4.1.1 or a successful or unsuccessful 4.1.2 (2040) to 4.1.2 (2042), download the package, perform the upgrade as defined in Checklist for Upgrading the Appliance Software. If you are upgrading from 4.1.1, you must also execute the following command at the CLI of the upgraded CS-MARS Appliance:
script -b patch_or_04_1_16.sh
The 4.1.2 (2042) image includes an additional command `script' that cleans the database of the data referenced in CSCsc31386. As a result of running the script, the total upgrade process from 4.1.1 to 4.1.2 (2042) may take much longer than previous releases; it depends on the amount of data stored on the CS-MARS Appliance. For a CS-MARS 200, it could double the normal upgrade time to two hours. To determine whether the script is still running, enter the following command and look for `patch_or_04_1_16.sh' anywhere in the output:
sysstatus -n 1 -b
The following notes relate to changes in your system or configuration as a result of upgrading to CS-MARS 4.1.2.
•Prior to the 4.1.1 release, CSA was identified by the device type name Cisco CSA 4.0. As part of an upgrade, any Cisco CSA 4.0 devices were renamed as Cisco CSA 4.x. This new name includes support for Cisco CSA 4.0 and 4.5.
•The new case management replaces the Escalate Incident functionality in CS-MARS 3.4.4 and earlier. However, escalated incidents are not converted to cases during the upgrade process. Therefore, you must close all open escalations before upgrading to CS-MARS 4.1.1 (CSCsb52057).
Required Upgrade Path
When upgrading from one software version to another, a prerequisite version is always required. This prerequisite version is the minimum level required to be running on the appliance before you can upgrade to the most recent version. Table 1 identifies the upgrade path that you must follow to reach the minimum level required to upgrade to current version.
Table 1 Upgrade Path Matrix
From Version
|
|
Upgrade Package
|
releases prior to 2.5.6
|
Contact Cisco Support
|
n/a
|
2.5.6
|
3.1.1
|
pn-3.1.1.pkg
|
3.1.1
|
3.2.1
|
pn-3.2.1.pkg
|
3.2.1
|
3.2.2
|
pn-3.2.2.pkg
|
3.2.2 or 3.3.2 Beta
|
3.3.3*
|
pn-3.3.3.pkg
|
3.3.3
|
3.3.4*
|
pn-3.3.4.pkg
|
3.3.4
|
3.3.5*
|
pn-3.3.5.pkg
|
3.3.5
|
3.4.1*
|
pn-3.4.1.pkg
|
3.4.1
|
3.4.2
|
pn-3.4.2.pkg
|
3.4.2
|
3.4.3
|
pn-3.4.3.pkg
|
3.4.3
|
3.4.4
|
pn-3.4.4.pkg
|
3.4.4
|
4.1.1
|
csmars-4.1.1.pkg
|
4.1.1
|
4.1.2 (2042) + script command
|
csmars-4.1.2.pkg
|
4.1.2 (2040) without error
|
4.1.2 (2042)
|
csmars-4.1.2.pkg
|
4.1.2 (2042)
|
4.1.3
|
csmars-4.1.3.pkg
|
Downloading the Upgrade Package from CCO
Upgrade images and supporting software are found on the CCO software download pages dedicated to CS-MARS. You can access these pages at the following URLs, assuming you have a valid CCO account and that you have registered your SMARTnet contract number for your CS-MARS Appliance
•Top-level page: http://www.cisco.com/cgi-bin/tablebuild.pl?topic=279644034
•Upgrade files: http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars
•Recovery image files: http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars-recovery
•Supporting files: http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars-misc
Note If you are upgrading from a version earlier than those posted on CCO, please contact Cisco support for information on obtaining the required images. Do not attempt to skip versions along the upgrade path.
For information on obtaining a CCO account, see the following URL:
•http://www.cisco.com/en/US/applicat/cdcrgstr/applications_overview.html
Important Notes
The following notes apply to the 4.1.3 release:
•Do not to use DISTINCT or SAME in queries, and do not run multi-line queries in Release 4.1.3. If you run such a query, the system time outs after 20 minutes without returning any results. The message "Timeout Occurred" appears instead. You can use DISTINCT and SAME in a Query to create a rule with the Query interface.
•For Symantec AntiVirus, the Symantec agent hostname (AV client computer name) appears in the "Reported User" column of the event data. Therefore, you can define a query, report or rule related to this agent based on the "Reported User" value.
•The False Positive and Query pages (multi-column result format) have changed. You can now query on firing events that triggered false positives within a time interval. Such queries will render events that did not appear on the False Positive page. To ensure performance, the False Positive page only displays false positives from the most recent 10,000 firing events. To view additional false positives, you must perform a query.
Compatibility Notes
Recent versions of Linus, such as RedHat Enterprise 4.0, Fedora Core 3 and 4, and Debian, have IPv6 mode enabled by default in the kernal module. This mode appends extra information to the event messages, such as sshd log messages pulled from a Linux client, resulting in an invalid source IP address being identifed by CS-MARS. An example symptom is "::ffff:" prepended to the expected source IP address.
To ensure proper processing and correlation of the event data, disable IPv6 support.
Quick Install Notes
It is recommended that users read the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System. However, for those users who simply want to get the CS-MARS Appliance up and running, the following two topics, taken from the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System, summarize the hardware installation and initial software configuration:
1. Installation Quick Reference
2. Checklist for Initial Configuration
Installation Quick Reference
Table 2 provides an overview of the installation and initial configuration process. Following installation and initial configuration, see the following publications for information on how to use a browser and the HTML interface to fully configure your CS-MARS Appliance to provide the security threat mitigation (STM) services you want from this installation:
•User Guide for CS-MARS Local Controller Version 4.1.x
•User Guide for CS-MARS Global Controller Version 4.x
Checklist for Initial Configuration
Initial configuration of the appliance accomplishes several goals:
•Introduces the two user interfaces to CS-MARS: the command line interface (CLI) and the HTML interface.
•Licenses the appliance.
•Prepares the appliance to monitor and communicate on your network.
•Configures the system time so that event correlation works properly.
•Ensures the system administrative account is configured properly.
•Ensures appliance is running the most recent version of software.
The following checklist describes the tasks required to initially configure your CS-MARS Appliance. Each task might contain several steps; the tasks and steps within should be performed in order. The checklist contains references to the specific procedures used to perform each task.
|
Task
|
|
1. Establish a console connection to the appliance.
Initial configuration requires a console connection to access the CLI. You should establish this connection with the power turned off on the CS-MARS Appliance. Three console connection options exist:
•A direct console connection to the appliance using a keyboard and monitor
•A standard serial console connection between a computer and the appliance using a terminal emulation package
•An Ethernet console connection between a computer and the appliance using a terminal emulation package
After you have chosen and configured your console connection, you must power up the appliance.
Result: The appliance is powered up and you can see the command line prompt through your console connection.
For more information, see:
•Establishing a Console Connection
|
|
2. Command Line Configuration: Setting the system administrative account's default password and configuring the interfaces.
The command line configuration is separated into three tasks, each task being separated by a reboot of the appliance. The first task involves performing three to four procedures:
•Collect the information required to configure the appliance to operate optimally on your network.
•Log in to the appliance and change the password associated with the system administrative account (pnadmin).
•Configure the eth0 network interface, specifying the default gateway and IP address and network mask pair for that interface.
•(Optional) Configure the eth1 network interface, specifying the IP address and network mask pair for that interface.
Each CS-MARS Appliance has two Ethernet interfaces: eth0 and eth1. The eth0 interface is the dedicated interface used for collecting event data and logs from your network. The eth1 interface is intended for use in an out-of-band management (OOBM) network or for a console connection. Therefore, your default gateway and IP address/mask values should focus on the network connections to be used to monitor the data streams of reporting devices, and these settings should be applied to eth0.
Note The CS-MARS Appliance does not allow you to configure both of its interfaces on the same network.
Result: The default password is no longer associated with the system administrative account and the appliance is more secure. Also, the eth0 is configured to communicate on your network. When you complete the IP address configuration changes for either, the appliance reboots.
For more information, see:
•Configuring Basic Network Settings at the Command Line
•Change the Default Password of the System Administrative Account
•Specify the IP address and Default Gateway for the Eth0 Interface
•(Optional) Specify the IP Address and Default Gateway for the Eth1 Interface
|
|
3. Command Line Configuration.
The second task of the CLI configuration involves setting the hostname of the appliance. The hostname is used to uniquely identify which appliance collects a specific log and which appliance fires an inspection rule. This unique identity is especially important in an environment where Global Controller is running. To complete this task, you must:
•Log in to the appliance using the system administrative account and the new password.
•Set the hostname of the appliance.
Result: The hostname is configured for the appliance. The appliance reboots.
For more information, see:
•Specify the Appliance Hostname
|
|
4. Command Line Configuration.
The third and final task of the initial CLI configuration involves specifying those settings that help ensure the integrity of the event correlation and complete your network connection, allowing access to the appliance from other hosts on the network. In other words, after you complete this phase, you can connect to and complete the appliance configuration using a non-console connection from any host on your network. To complete this task, you must:
•Log in to the appliance using the system administrative account and the new password.
•Set any additional static routes.
•Set the clock.
•Set the NTP server settings.
•Set the DNS domain name.
•Connect the appliance to the network (that is, plug in the Cat 5 cables.)
Result: Now you have network connectivity. You can access the CLI interface using an Secure Shell (SSH) client on any host that can reach the appliance, and you can log in to the HTML interface to complete the initial configuration.
For more information, see:
•Specify the Time Settings
•Set Up Additional Routes
•Completing the Cable Connections
|
|
5. Complete initial configuration using the HTML interface.
After you have completed the cable connections to the CS-MARS Appliance, defined the required network connection settings, and specified any additional default routes, you can start the HTML interface configuration process. Verify the configuration settings of your browser before configuring the CS-MARS Appliance (see Web Browser Client Requirements).
During this phase, you configure the following:
•Appliance license
•Zone identification (Global Controller only)
•E-mail server identification
•DNS addresses
•E-mail address for the system administrative account (pnadmin)
•TACACS/AAA login prompt settings
Result: You have configured your appliance to communicate on the network, properly correlate events, and issue system e-mails to a monitored e-mail address.
For more information, see:
•Completing the Configuration using MARS web interface
•Licensing the Appliance
•Verifying and Updating Network Settings
•Specifying the DNS Settings
•Configure E-mail Settings for the System Administrative Account
•Configure TACACS/AAA Login Prompts
|
|
6. Upgrade the appliance to the most recent software version.
The software version determines the currency of signatures, system inspection rules, features, and bug fixes. An important part of your security solution is ensuring that you maintain the most up-to-date software on the CS-MARS Appliance. This process involves preparing an upgrade strategy and selecting a method, determining your current version, identifying the most recent version, and downloading and applying all intermediate versions of the software.
Result: The appliance is running the most recent version of software.
For more information, see:
•Checklist for Upgrading the Appliance Software
|
Caveats
This section describes the open and resolved caveats with respect to this release.
•Open Caveats - Release 4.1.3
•Resolved Caveats - Release 4.1.3
•Resolved Caveats - Releases Prior to 4.1.3
Open Caveats - Release 4.1.3
The following caveats affect this release.
Reference Number
|
Description
|
CSCsc89884
|
Issue: MARS does not pull log from a windows box if both pull/push are checked Version
Description: If only pulling or pushing is checked, either works fine. But when both pulling and checking are checked in MARS GUI for a windows machine, MARS does not pull windows event logs for this device.
Workaround: Verify that only one of the options is selected.
|
CSCsc49248
|
Issue: A drop rule for "inactive reporting device" does not work.
Description: There are six internally generated event types in CS-MARS 4.1.x:
1. Sudden traffic increase event
2. Resource high usage event
3. Inactive reporting device detection event
4. VA integration event
5. Mitigation result event
6. DTM event
Events generated for items 4, 5 and 6 are processed against drop rules. However, items 1, 2 and 3 cannot be dropped as they are not processed against drop rules by design. Items 1, 2 and 3 record the history of what happened on the network and are retained in the database.
Workaround: You can delete the inactive device from CS-MARS or ensure that it is reachable by CS-MARS. For other event types, there is no workaround.
|
CSCsc23874
|
Issue: Resource Utilization reports are incorrectly available to be run as a query.
Workaround: Do not attempt to run any of the following reports as an On Demand query or to use them as part of a user-defined group:
Resource Utilization:
•Bandwidth: Inbound - Top Interfaces Resource
•Utilization: CPU - Top Devices Resource
•Utilization: Bandwidth: Outbound - Top Interfaces Resource
•Utilization: Concurrent Connections - Top Devices Resource
•Utilization: Errors: Inbound - Top Interfaces Resource
•Utilization: Errors: Outbound - Top Interfaces Resource
•Utilization: Memory - Top Devices
|
CSCsc50636, CSCsc50652
|
Issues: pnids50_srv process runs at 99% CPU when pulling large IP Logs
pnids50_srv process reaches 1GB in memory used when pulling IP Logs
These related issues, are specific to pulling IP logs from Cisco IDS/ IPS devices. The symptom is that the pnids50_srv and pnids40_srv services consume the system resources on the CS-MARS Appliance. As an improper configuration of the sensor can significantly degrade the sensor performance as well as that of CS-MARS.
Workaround: Ensure that settings for IP log creation on the sensor limit the size of the IP log (in terms of number of bytes or number of packets captured). Also, verify that IP packet logging is enabled only for signatures of interest and not for all signatures.
|
CSCsb77550
|
Issue: Re-importing CSA or Symantec agents fails.
When the user tries to agents from a CSV seed file, the following error message appears:
Result: The error message fails.
Workaround: If you import an agent list once, you must manually synchronize the agent list. To re-import the list of agents will not work.
|
CSCsb80082
|
Issue: When you remove/delete a Local Controller from a Global Controller, the Local Controller should revert to the Standalone mode. However, if you add the Local Controller to the Global Controller and delete it before you exchange certificates between the two appliances, then the mode does not revert.
Workaround: You can work around this issue by ensuring that you always import the certificate from the Local Controller before you attempt to remove it form in the Global Controller.
|
CSCsc04484
|
Issue: The rule or report list on a Local Controller (LC) appears empty after deleting a Global Controller (GC) report or rule group.
1. From the Rules or Reports page in the GC HTML interface, create a rule or report group with some elements in it.
2. Activate to push the group down to the monitored LC.
3. From the Rules or Reports page of a LC HTML interface, select the newly-created GC group in the filter list.
Result: The members of that group are listed.
4. Select the Summary page.
5. Select the Rule or Report page.
Result: The group is still selected as the "filter" for that page
6. Select the Summary page.
7. In the GC HTML interface, delete the rule/report group.
8. Activate to push changes down to the monitored Local Controllers.
9. In the LC HTML interface, navigate back to rule/report page.
Result: The filter list has "All" selected, but no rules or reports appear on the page.
Workaround:
1. Select another option in the filter list, and then All.
Result: The list of all rules/reports appears.
|
CSCsb71298
|
Issue: In Cisco Security Monitoring, Analysis and Response System (CS-MARS) Release 3.4, queries submitted from a Global Controller (GC) that are less than 10 minutes in length will appear as being "In Progress" on the GC, even after the attached Local Controllers (LCs) have finished running the query.
This will only occur in a GC/LC environment if a query is run over a duration less than 10 minutes.
Workaround: Query over time ranges that are no less than 10 minutes in length.
|
CSCsb67871
|
Issue: After re-installing a Local Controller, the zone and device data is lost in the Global Controller.
Workaround: Before you re-install (using a Recovery DVD) a Local Controller, you must delete that Local Controller and zone from the managing Global Controller.
|
CSCsb64587
|
Issue: After Global Controller restore, the Local Controller certificates are missing.
Workaround: After restoring a Global Controller, you must re-import the certificates of each managed Local Controller before communications are restored.
|
CSCsb71309
|
Issue: In Cisco Security Monitoring, Analysis and Response System (CS-MARS) release 3.4.4 and earlier, queries that are run from a Global Controller (GC) which have no results returned from any of the attached Local Controllers (LCs) will show up as "In Progress" in the GUI.
This occurs in a GC/LC environment, and only when a global query returns 0 results from every one of the LCs.
Workaround: You may have to wait up to 10 minutes for a GC Query status to be marked as "Finished", after all LCs have finished running the query.
|
CSCpn03077
|
Issue: Global Controller generates a system error when you add a Local Controller that was added already
Workaround: Before adding a Local Controller, verify that you have not previously added it to the Global Controller. If you do encounter this error, restart the GUI by closing your web browser and logging in again.
|
CSCpn03074
|
Issue: On the Incidents page of a Global Controller, the View and Show buttons do not work for incidents pushed up from the monitored Local Controllers.
|
CSCpn03070
|
Issue: If you upgrade a Global Controller/Local Controller pair, the Local Controller may appear offline for the first 10 minutes after the appliances reboot. The scheduler wakes up and re-syncs 10 minutes after startup.
Resolution: If you notice that the Local Controller appears offline, verify that at least 10 minutes have passed since the appliances rebooted. Alternatively, you can jump start the communication by navigating to Admin > Local Controller Management in the Global Controller user interface.
|
CSCpn03057
|
Issue: Copied rules have shortened year in front, which is confusing (e.g., 05.04.19) When you duplicate a system rule, the newly created rule has a timestamp appended to it. The date format is unclear, but it is YY.MM.DD.
|
CSCpn03052
|
Issue: JBoss 'OutOfMemoryError ' when accessing Management/Event Management tab.
Workaround: Avoid using the 10,000 items per page on the Event Management page.
|
CSCpn02976
|
Issue: GC:LC - Communication issues after time zone change. After initial configuration, if you change the timezone of a communication GC:LC, there may be problems with communications between the GC and LC.
Workaround: If you notice that the Local Controller appears offline, verify that at least 10 minutes have passed since the appliances rebooted. Alternatively, you can jump start the communication by navigating to Admin > Local Controller Management in the Global Controller user interface.
|
CSCpn02973
|
Issue: Not able to downgrade a Security Analyst to Notification only user. When you define a user account with the Security Analyst role, you cannot downgrade that role to Notification only.
|
CSCpn02968
|
Issue: Network group search is not working for "All IP addresses". If you select All IP addresses as the search space, the results may be inconsistent with the expected results.
|
CSCpn02901
|
Issue: GC/LC, rule does not display user <cxu> but allows such cfg
Workaround: Avoid using special characters in the keyword search for rules. The list of special characters not supported is as follows:
•less-than (<) <
•greater than (>) >
•ampersand (&) &
|
CSCpn02883
|
Issue: Event management search works only for event description. You cannot search on other fields, such as Event ID.
|
CSCpn02869
|
Issue: Rules editing: changing entry for select window drop-down list after error message results in the state not being saved.
Workaround: This issue appears when you have attempted to define an invalid rule and an error message appears. For example, while editing a user inspection rule"
1. Click Sources field.
2. Remove all sources.
3. Click Submit.
Result: Dialog box appears and prompts "please select one".
4. In the select window drop-down list, select "All Devices"
Result: Rule submission window appears and contains a blank Sources field.
To work around this issue, click one of the top tabs to cancel your work and redo your edit without submitting an invalid rule (as shown in Step 3).
|
CSCpn02804
|
Issue: Replay History feature not working correctly. When you configure a query that triggers replay history, the results are usually incorrect. The following cases will trigger a replay history:
•a query that uses AND or Followed By
•a query that uses the $ variables, such as $EventType, $Device1, etc.
•a query uses NOT EQUAL TO a service
If you define an invalid query, CS-MARS will be in a compromised state where queries will continue to fail, even if they are constructed correctly after the invalid query. To resolve this issue, log in to the CLI and pnstop/pnstart the CS-MARS system, then re-run your valid query.
|
CSCpn02688
|
Issue: Viewing a report on a Global Controller and viewing the corresponding report on the Local Controller may differ in time slightly.
|
CSCpn02666
|
Issue: The email sent when a batch query completes may not have data in the graph if the query only returns one result.
|
CSCpn02656
|
Issue: Leaving the browser on the Summary page for an extended period of time (several days) may occasionally run into an error.
Workaround: Refresh the page to return to the GUI.
|
CSCpn02653
|
Issue: No way to specify "!Keyword" without a good "keyword"
Workaround: Keyword search requires two keywords to use the "NOT" operator. For example, you cannot specify `NOT nimda'; instead, you must specify something like `virus NOT nimda'.
|
CSCpn02623
|
Issue: Sudden traffic increase does not process ICMP events.
While CS-MARS does process ICMP events on the parsing side, the sudden traffic rule does not fire based on ICMP events.
|
CSCpn02594
|
Issue: Clicking on the Path/Mitigate link in an incident that was fired from a device that has since been deleted may result in an error.
|
CSCpn02574
|
Issue: Having different times on the Global Controller and its associated Local Controllers may cause synchronization problems.
Workaround: Use the CLI to configure NTP or manually set the date and time to be the same on the Global Controller and Local Controllers.
|
CSCpn02566
|
Issue: Rebooting the CS-MARS while the box is in the upgrading state may cause system configuration errors.
|
CSCpn02558
|
Issue: After adding and deleting an agent or sensor to a host, adding a sensor with the same name and type as the previously deleted one back to that host will not work.
Workaround: Use a different agent/sensor name the second time around.
|
CSCpn02549
|
Issue: When viewing report results, clicking on "Edit" or "Clear" in the query summary at the top of the page results in a JavaScript error.
Workaround: Click directly on the "Report type" link to edit the query.
|
CSCpn02511
|
Issue: In migrating "Microsoft, Windows, Generic" device type to three new Windows device types, errors in affected OS could affect data migration and cause confusion about appropriate selection.
Workaround: When migrating data, you should make the following mappings for the OS name:
•Map "2000" to "Windows 2000"
•Map "Windows 2000 Professional Server" to either "Windows 2000 Professional" or "Windows 2000 Server" after verifying the data.
•Map "NT" to "Windows NT"
•Map "Microsoft Windows NT 4.0" to "Windows NT". Microsoft should be in vendor field and 4.0 should be in version field.
|
CSCpn02470
|
Issue: Using passwords with the "," (comma) or "'" (quote) characters may cause problems with loading devices from csv files.
Workaround: Avoid using passwords with these characters for the time being.
|
CSCpn02414
|
Issue: Long keyword strings in rules or reports can cause parts of the GUI layout to be pushed out of the browser window's edges.
|
CSCpn02410
|
Issue: The CS-MARS stores reported user names in a case-sensitive fashion. Devices that report case-insensitive user names can behave counter-intuitively if they report names inconsistently.
|
CSCpn02398
|
Issue: Reserved XML characters are not supported in the Keyword Search on the Rule page
Workaround: Avoid using special characters in the keyword search for rules. The list of special characters not supported is as follows:
•less-than (<) <
•greater than (>) >
•ampersand (&) &
|
CSCpn02385
|
Issue: Applying $VAR variables to queries on a Global Controller causes GUI errors and may not return correct results.
|
CSCpn02383
|
Issue: An IIS web server cannot be added to the CS-MARS as a generic web server. When configuring the CS-MARS to receive IIS logs, adding generic web server in Reporting Applications does not work.
Workaround: Choose windows operating system under general tab.
|
CSCpn02333
|
Issue: After performing a "pnreset -g" (which cleans up the GC data on the LC - a copy will be made of all GC data used by rules and reports while all other GC data will be deleted), the LC still shows the old zone name by which it was monitored from the GC. When adding that LC back to a GC that was re-installed from the recovery DVD, problems can occur if the zone names for the GC and LC do not match the ones used before.
Workaround: Use the same "old" GC name during the GC configuration. Use the same zone names when re-adding LCs to the GC.
|
CSCpn02251
|
Issue: After upgrading from a CS-MARS 100e to CS-MARS 100, pnstop and pnstart need to be run for the change to take effect.
|
CSCpn02177
|
Issue: Every 22nd reboot, the CS-MARS file system is checked for consistency. This takes time to complete, and happens before connecting to the network. While this is happening, it may appear that the box simply isn't starting.
Workaround: Attach a console to the CS-MARS to verify that checking is happening if the system does not seem to start after a reboot.
|
CSCpn02175
|
Issue: Data computed or stored on a standalone CS-MARS while in standalone mode will not be transferred to a GC. Only data computed on an LC that is currently monitored by a GC will be pushed up.
|
CSCpn02073
|
Issue: After renaming a cloud, clicking the cloud again causes an error.
Workaround: Refresh the page before clicking a renamed cloud.
|
CSCpn02061
|
Issue: Saving CSV files from reports with IE 6 under Windows XP SP2 causes the file to default to an .htm extension, not .csv extension.
Workaround: Select "All types" from the drop-down list while saving, and rename the file to have a .csv extension.
|
CSCpn02011
|
Issue: Certain special characters do not work in password fields. The characters are " ' ; (double-quote, single-quote and semi-colon).
Workaround: Use passwords that do not contain these characters.
|
CSCpn01489
|
Issue: Query summary doesn't mention "severity" if it's a criterion
When the user configures a batch query with a severity as one of the criteria (Red, Yellow, Green), this criterion doesn't appear in the "query summary" of the batch query page. However, the query is run with the correct criteria. When the results are viewed, the severity can be seen in the query details at the top of the page.
|
CSCpn01438
|
Issue: When running batch queries under a high system load and over a time range containing a large amount of data, the batch query might not complete. If the Progress Completed status stays at 0% for an extended period of time (a day), try stopping any other batch queries you have running or stopping and resubmitting your batch query with narrower criteria. If neither of these works, please contact Cisco Support.
|
CSCpn01416
|
Issue: Select: Temp paging fix on Notification-SNMP. All pages that display large numbers of items need to have paging implemented.
Workaround: Use the search window to locate desired object.
|
CSCpn01398
|
Issue: Unable to shutdown an interface: the customer should be able to shutdown an interface on CLI or GUI.1.
Workaround: Do not connect the second network interface to your network.
|
CSCpn01382
|
Issue: When you create a new group (MANAGEMENT > IP Management > Add Group) with a combination of Networks, Devices, and IP addresses and then select that group from the pull-down menu, only the Networks in the group appear, even though the Devices and IP addresses are in the group.
|
CSCpn01293
|
Issue: When administering CS-MARS, it is possible to select an unsupported OS from the pull-down menu when adding or editing a host for logging. If you select an OS that does not contain the string "Microsoft Windows" or "Sun Solaris" when you save the Pull host log or Receive hostlog parameters, (for example, if you select "Sun Cobalt"), then the GUI does not work correctly.
|
CSCpn01270
|
Issue: The free-form search may not work for the following devices:
•Check Point Opsec NG FP3
•Cisco CSA, 4.0
•Cisco, IDS, 3.1 and 4.0
•ISS, RealSecure, 6.5 and 7.0
•Entercept Entercept, 2.5 and 4.0
•IntruVert IntruShield, 1.5
|
CSCpn01219
(re-opened)
|
Issue: If you create a user in the CS-MARS GUI and select New Provider but do not enter a Pager number, qpage.com fails to run because it has an empty entry, and pnmonitor continually tries to restart the daemon that attempts to access qpage.com.
Resolution: Open each user profile and click Submit to ensure all the required fields are populated.
|
CSCpn01134
|
Issue: The cloud name input box accepts invalid characters. To reproduce this behavior, click on the Large Graph link on the Hotspot graph. Click on a cloud. Click Change name and enter invalid characters into the input field (for example, ~!# or ###). Sometimes the page returns an error message such as error: Error: Invalid or No Security Perimeter. The graph rendering fails with the IE status bar message "not well formed, line #:column#".
|
CSCpn01051
|
Issue: Logging into a CS-MARS from a non-supported browser and leaving the GUI open will prevent other users from logging into that MARS.
Resolution: If you log in to CS-MARS using a supported browser and see a message saying that your browser is unsupported, please check if another user has logged into the CS-MARS with an unsupported browser and not closed his browser window.
|
CSCpn01045
|
Issue: Entering an incorrect IP address or directory path for the data archiving feature will result in a cryptic error message.
Resolution: If you see a message of type "Status: PN-0002: No message for PN-0216" after configuring data archiving, please click "Back to Archiving" and check your IP address and directory.
|
CSCpn01019
|
Issue: When utilizing the data archiving feature, you may experience data loss if your network link is slow or if your archive server does not have the capacity to handle high throughput.
|
CSCpn00908
|
Issue: "Domain" in Configuration page - no use
Workaround: This issue was overcome by other events. This field no longer exists, however, you can specific the e-mail domain on the Configuration page to identify the default domain from which e-mail notifications are delivered by the appliance.
|
CSCpn00877
|
Issue: When you submit a name that is associated with a device type to the system, changes to its device type can cause issues to incorrectly display some of its configuration information.
Resolution: When adding a device, take care to give it its proper device type.
|
CSCpn00610
|
Issue: Backend logs can be out of order in the view page because the numbers are reused. Timestamps should be used as report identifiers.
|
CSCpn00596
|
Issue: On a freshly installed machine starting to get events and sessions, you can get a negative Data Reduction where there are more sessions than events. This is due to the fact that events are written to the database more frequently than sessions.
Resolution: Wait for some time to pass, as events gradually outnumber sessions this number will become increasingly accurate.
|
CSCpn00586
|
Issue: If you are investigating a false positive, and you see a message telling you that a service has crashed, this could be due to vulnerability scanning by the CS-MARS appliance. You may have to re-start the service.
Resolution: It is strongly recommended that you patch the security hole to eliminate this vulnerability.
|
CSCpn00455
|
Issue: If clouds are renamed through diagrams, the system might not display those names.
Resolution: Here are some work around steps to rename clouds:
1. Click the cloud you want to rename.
2. Enter in the new name in the text field near the top of the popup window.
3. Click "Change".
4. Once it's done, click "Close".
5. Click the "Large Graph" button in the Hotspot Graph.
6. Return to the Summary page.
|
CSCpn00293
|
Issue: When tabbing over three-digit entries in IP fields on the Configuration Information page, the cursor can disappear.
Resolution: Use your mouse to move between fields on this screen when editing IP addresses.
|
CSCpn00259
|
Issue: On the Setting Runtime Logging Levels page, if you set the level for GUI to Trace and save, it is saved as Debug.
Resolution: Do not change settings on the Setting Runtime Logging Levels page without a Cisco Support representative.
|
CSCpn00247
|
Issue: The automatic time-out feature built into the GUI does not work when the Summary page is left open with automatic refresh selected.
Resolution: Please log out of the system when you are no longer using it.
|
CSCpn00212
|
Issue: Diagrams on the Summary pages occasionally do not display.
Resolution: Exit the browser. The next time you log on, the diagrams should have re-drawn.
|
CSCpn00183
|
Issue: Adding many devices (more than 20) without activating those devices can cause messy output in the diagrams.
Resolution: Click the Activate button after adding many devices.
|
CSCpn00173
|
Issue: Nessus should check pre-NAT address instead of Post-NAT address.
|
CSCpn00166
|
Issue: The use of ANY in queries and rules is slightly inconsistent. When selecting ANY in the Query page, if other items are selected at the same time for that field, the ANY is ignored. When selecting ANY on the Rules page, if other items are selected at the same time for that field, the other items are ignored and ANY is the selection.
|
CSCpn00146
|
Issue: Identical reports differed by slashes and dashes result in conflicting reports. When you have reports with identical names differing only by slashes (/) and dashes (-), running and viewing the reports causes them to get confused and point at the other.
Resolution: Do not use slashes or dashes in your rule configuration.
|
Resolved Caveats - Release 4.1.3
The following customer found or previously release noted caveats have been resolved in this release.
Reference Number
|
Description
|
CSCsc88635
|
MARS is thrashing with all MARS processes continuously restarting
|
CSCpn03016
|
Spurious data for reverse traffic due to netflow flows not being ses
|
CSCsc21658
|
Parse CatOS & IOS related NAC messages
|
CSCsc21682
|
PnLogAgent should handle all the data ACS writes and not just 1024 bytes
|
CSCsc36677
|
DTM: Inactive signature detection should be across network
|
CSCsc39180
|
Need better error reporting for upgrade
|
CSCsc39539
|
Parsing error for PIX messages PIX-1-105008, PIX-1-105009
|
CSCsc39549
|
Parsing error for PIX-6-109024
|
CSCsc39833
|
Need to remove patch_or_04_1_16.sql script from 4.1.2 to 4.1.3 upgrade
|
CSCsc40735
|
Oracle running out of disc space
|
CSCsc40867
|
Delete report results older than 1 year.
Solution: To address database maintenance concerns, any report results older than one year are deleted. This period is not user definable.
|
CSCsc40882
|
Re-apply CS MARS upgrade packages
|
CSCsc50632
|
improve /log/sysbacktrace.*
|
CSCsc50636
|
pnids50_srv process runs at 99% CPU when pulling large IP Logs
|
CSCsc50652
|
pnids50_srv process reaches 1GB in memory used when pulling IP Logs
|
CSCsc56259
|
L2 connectivity is broken when FWSM is present.
|
CSCsc63154
|
JBoss memory issues on LC
|
CSCsc66855
|
Erroneous IP Address in Install Guide
Solution: Corrected IP address and baud rate in the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System.
|
CSCsc67806
|
DTM: csdam process syslog sending leaves hanging resources
|
CSCsc72419
|
Src/Dest IP for events from ACS show up as 0.0.0.0
|
CSCsc76603
|
Discovering IOS needs to add the domain name to the name
|
CSCsc79646
|
make GC "Security and Monitor Device" page more robust
|
CSCsc79860
|
Unused jboss ports need to be blocked in the system config file
|
CSCsc83940
|
Default administrative password on MARS appliances
Solution: See the expert command in "Appendix A, CLI Commands" of the Install and Setup Guide for Cisco Security Monitoring, Analysis, and Response System.
|
CSCsc85308
|
CPU check need to be added for discovery process
|
CSCsc85693
|
IDS events cause pnparser to crash
|
CSCsc87106
|
IOS NAC syslog has wrong Event Type
|
Resolved Caveats - Releases Prior to 4.1.3
For the list of caveats resolved in releases prior to this one, see the following documents:
http://www.cisco.com/en/US/products/ps6241/prod_release_notes_list.html
Product Documentation
For the complete list of documents supporting this release, see the release-specific document roadmap:
•Cisco Secure MARS Documentation Guide and Warranty
http://www.cisco.com/en/US/products/ps6241/products_documentation_roadmaps_list.html
Lists document set that supports the CS-MARS release and summarizes contents of each document.
For general product information, see:
http://www.cisco.com/go/mars
Obtaining Documentation, Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0612R)
© 2007 Cisco Systems, Inc. All rights reserved.
