Update the .NET 8 Version for LogRhythm SIEM

Beginning with LogRhythm SIEM version 7.17, SIEM components started to move from .NET 4.7 to .NET 8. With each quarterly release, the .NET 8 version is updated, but there are times where you may need to upgrade the .NET 8 version for compliance purposes before the next quarterly release has been made available.

Using this guide to update to the latest .NET 8 version before the next quarterly release isn’t expected to cause issues; however, it won’t be considered fully tested or supported by Exabeam until the next version of LogRhythm SIEM releases using that version.

As of LogRhythm SIEM version 7.21, the following LogRhythm components are running on .NET 8. If you have a distributed deployment and are not on the latest release, .NET 8 may not be on every LR server.

Component	LogRhythm SIEM Version in which the Component was Upgraded to .NET 8
Data Processor and Mediator	7.17
AI Engine	7.18
Alarming and Response Manager (ARM)	7.19
System Monitor Agent	7.21 System Monitor Agents have both a .NET 4 and .NET 8 release in LogRhythm SIEM version 7.21. 7.21.0.2019 is the version for .NET 8 Agents, and 7.21.0.1052 and 7.21.0.2017 are the .NET 4 versions. You can verify which version you have installed in Control Panel > Programs and Features.

Before Updating .NET 8

Before updating your .NET 8 instance, perform the following steps:

1. Open an Administrator Command Prompt on the server(s) where .NET 8 will be updated.

2. Run the following command to confirm what the current installed version is, and make note of it in case you need to roll back the update:

dotnet --info

LogRhythm components use the Microsoft.NETCore.App and Microsoft.WindowsDesktop.App runtimes. If you see any other versions listed in the system, check which third-party applications are installed and confirm that they are compatible with the desired .NET 8 version.

Update .NET 8

The following steps describe the process to update your .NET 8 version:

1. Download the installer for your desired .NET 8 version directly from Microsoft, using the installer in the .NET Desktop Runtime 8.0.xx section.

2. Move the installer to the LogRhythm server(s).

3. Right-click the installer and select Run as administrator.
   The install wizard opens.

4. Click Install.
   The .NET 8 version is installed.

5. Reboot the machine.

When manually updating .NET Desktop Runtime using this method, any older versions of .NET 8 that are on the server are uninstalled. If you require an older version of .NET 8 for third-party application compatibility, you can download the installer for the needed version and install the older versions after the newer version is installed.

Uninstall .NET 8

The .NET 4.7.2 Framework is still required for several LogRhythm components. Do not uninstall this from the server.

If you run into issues with the new .NET 8 version and need to roll back to an older version:

1. Follow the steps in the section above to reinstall the desired version.

2. Go to Settings > Apps.

3. Find the version you want to remove.
   It should be named “Microsoft Windows Desktop Runtime - 8.0.xx.

4. Click on the app and select Uninstall.
   The uninstall wizard opens.

5. Click Uninstall.
   The .NET 8 version is removed.

6. Reboot the machine.