7.10.0 GA Release Notes - 29 September 2022

Explanation: AI Engine Events now include Host information. This reduces misfires from AI Engine Unique Values rule blocks and provides correct logs in drilldown results.

Benefit: The system is more stable and enables users to spend more time on threat detection and response.

Relevant Documentation Updates: N/A

Explanation: The Admin API library now includes the Associate Pending Log Source endpoint. This enables SIEM administrators to manage pending or modify existing System Monitor Agents through the API.

Benefit: The Admin API reduces administrative overhead and expedites workflow by automating routine tasks.

Relevant Documentation Updates: Administration API Endpoints

Explanation: The Alarm API library now includes the Get Alarm URL endpoint. This enables SIEM administrators to retrieve alarm URLs which were configured in Platform Manager through the API.

Benefit: The Alarm API allows users to retrieve alarm information without a database connection.

Relevant Documentation Updates: Alarm API Endpoints

Explanation: The LogRhythm REST API now includes the Metrics API component. This enables SIEM API users to retrieve log volume and log indices TTL information from the Data Indexer.

Benefit: The Metrics API allows customers to return log volume and index information when given a specified time and date to expedite workflow.

Relevant Documentation Updates: Metrics API

Explanation: LogRhythm implemented new CSFR token security protocols during Web Console login.

Benefit: Enhanced security in Web Console.

Relevant Documentation Updates: N/A

Expected Results: Poorly written AIE Rules should be suspended until they are altered and re-enabled. 

Workaround: Rewrite the AIE Rule for better performance. Often, this involves adding filters, reducing log sources, and modifying the logic. Tuning an AIE Rule requires expertise, so contact LogRhythm Training, Professional Services, or a Sales Engineer to assist if necessary. Additional solutions to identify and monitor poorly performing rules are being developed for a future release.

Expected Results: These errors should not be generated in the AIE Engine log, but AIE is working and alarms are firing.  

Workaround: There is currently no workaround for this issue.

Expected Results: AIE Rule Blocks should fire when they are triggered at the same time. 

Workaround: As the behavior of simultaneous events is unpredictable and the use case for a 0-time interval is rare, LogRhythm does not plan to change this behavior at this time. To avoid the issue, set the evaluation period to 1 second.

Expected Results: The date and time of the AIE Event should not have a future time. 

Workaround: There is no workaround for this issue. 

Expected Results: AIE Rules should not fire if the rule block relationship is not met. 

Workaround: Change the Host (origin) or Host (impacted) fields to IP Address, and the AIE Rule works as expected. 

Expected Results: Logs in this directory should be purged after the number of days defined for expiration has passed, defaulted to 7 days. 

Workaround:  Manually remove these files to prevent the C drive from filling up.

Expected Results: Should be able to define an AIE rule's date and time using the UTC time zone.

Workaround: There is currently no workaround for this issue.

Expected Results: Alarms should not fire if a log is received for a Not Observed block. 

Workaround: While there is currently no workaround, LogRhythm is investigating this issue for a future release.

Expected Results: Alarms should execute quickly as expected with other AIE Alarms. 

Workaround: There is currently no workaround for this issue.

Expected Results: The AIE Engine should trigger alarms for Log Not Observed. 

Workaround: There is currently no workaround for this issue. 

DE14530

DE14531

Expected Results: Input normalization for MAC Addresses, requiring them to be entered in the accepted format.

Workaround: Use data masking rules to transform the MAC addresses to the colon delimited format.

Expected Results: Web Services does not need to be restarted to have a rule group change show up.

Workaround: Restart Web Services.

Expected Results: The Alarming and Response Manager should able to send alarm notifications using any SMTP server and SSL authentication. 

Workaround: There is currently no workaround for this issue. 

Expected Results: The Alarming and Response Manager should be aware of a change of status of the SRPs and should not continue to attempt to execute them. 

Workaround: Lower the logging level on the ARM to help mitigate this, but contact LogRhythm Technical Support if assistance is needed to retire the SRP. 

Expected Results: Recent alarms should be visible when searching in the client console.

Workaround: There is currently no workaround for this issue.

Expected Results: Case API and Admin API should start when using any size certificate. 

Workaround: Remove the server from the domain and reboot it. Verify that the 512-bit certificate has been removed, re-run the installers, and reboot. To avoid this issue, do not join the domain again or the certificate will be pushed out again. In addition, create a new certificate that uses a 384-bit (or less) hash or exclude the impacted system from the GPO that pushes the certificate.

Expected Results: When the Admin API log generates errors, it should provide some context within the error message. 

Workaround: There is currently no workaround for this issue. 

Expected Results: The extra semicolon, which is an optional valid separator in a content-type header, should not prevent scripts from working upon upgrade. 

Workaround: While there is currently no workaround, LogRhythm is investigating this issue for a future release.

Expected Results: The Log Level should be changed by updating the Log Level in Configuration Manager.

Workaround: There is currently no workaround for this issue.

Expected Results: Entities should be retireable and able to be hidden from view. 

Workaround: Contact Technical Support to assist you in removing entities that are no longer needed.

Expected Results: When exporting reports in .csv format, the column headers should not be repeated on each row.

Workaround: The report needs to be formatted to remove columns that show the column headers. In addition, LogRhythm data can be exported using Log Distribution Services (LDS).

Expected Results: The processing of a log should be the same whether it is parsed in Rule Builder or MPE. 

Workaround: Change the sub-rule to use a different tag, such as <Tag1>. If you are experiencing this issue, ensure that you are not using a custom Log Processing Policy and that there are no MPE timeouts. If issues persist, contact Technical Support and reference this bug number (DE1829) or its sister defect (DE1651).

Expected Results: When a search times out, a message should inform users and instruct them to re-run the search with a longer timeout. 

Workaround: Increase the timeout on the query and re-run it.

Expected Results: All chosen fields should appear on the report if they contain data.

Workaround: Running the report as an investigation yields the expected results in the Network (Impacted) column. LogRhythm is actively working on a solution to this issue in a future release.

Expected Results: Identity data should appear in reports that contain those fields.

Workaround: Run an investigation to provide the same information.

Expected Results: Disabling Log Source Virtualization should not change the behavior of the System Monitor. 

Workaround: This issue is caused by the scsm.ini file not being updated immediately. To work around it, refresh the Log Sources tab in the Client Console to force the .ini file to refresh.

Expected Results:  Second Look restore should run without issues. 

Workaround:  There is currently no workaround for this issue. 

Expected Results:  Reports should all display in the local time zone or that specified in the report configuration.   

Workaround:  There is currently no workaround for this issue.

Expected Results: When editing a report template, existing fields should remain unless they are explicitly removed. 

Workaround: When editing a report template that contains the Normal Date field, add that field back to the template prior to saving it.

Expected Results: The Console should not freeze when exporting logs. 

Workaround: Export selected logs instead of all logs to allow the export to complete. 

Expected Results: The hostname should be displayed the same for both Web and Client Consoles. 

Workaround: View the record in the Web Console. 

Expected Results: When right-clicking the Unconfigured TopX section in the investigation results, a menu appears to allow for configuration of results.

Workaround: Utilize the Web Console to view results in a widget-type format.

Expected Results: Users that are moved between Active Directory groups should update upon the move. 

Workaround: There is no workaround for this issue other than manually updating the profiles. 

Expected Results: The user importing the SmartResponse Plugin should have permissions granted automatically.

Workaround: Go into the User Profile Manager and grant access to the newly imported SmartResponse Plugin.

Expected Results: The entity delete functionality works without any issues.

Workaround: There is currently no workaround for this issue.

Expected Results: When custom settings are selected, they should persist through a Knowledge Base update.

Workaround: Reselect the Log Source Type settings prior to doing a Windows Host Wizard scan.

Duplicate Active Directory groups and users are being created because OU filters are not being used when scanning domains.

Expected Results: No duplicate entries should be created.

Workaround: There is currently no workaround for this issue.

DE12489

Expected Results: Alarms should continue to trigger and be displayed in the Web Console. 

Workaround: Contact Technical Support for assistance, as there could be many reasons for this behavior beyond this defect. Support will help determine the root cause.

Expected Results: The non-paged pool should not increase and cause system performance issues. 

Workaround: Restart the LogRhythm API Gateway service.

Expected Results: The Data Processor and Data Indexer should connect to Service Registry after a reboot of the Platform Manager. 

Workaround: Manually restart the API Gateway and Service Registry services on the Data Indexer and Data Processor after a reboot of the Platform Manager.

Expected Results: LRII should be able to run multiple times without affecting the plan file. 

Workaround: For assistance with this issue, contact LogRhythm Technical Support. 

Expected Results: Communication to the Platform Manager should be maintained after an install. 

Workaround: Restart Service Registry on each node in the cluster after the installation is complete. 

Expected Results: Filter should show data processor stats for only the selected cluster.

Workaround: Contact LogRhythm support for a new Mediator.json file.

Expected Results: The Diagnostic logs should be tuned to alarm less frequently. 

Workaround: There is currently no workaround for this issue.

Expected Results: An alarm should only generate when the cluster health changes to red. 

Workaround: Edit the impacted alarm to suppress for 24 hours or disable that alarm.

Expected Results: All services, regardless of version, should start after an upgrade.

Workaround: Re-run the Data Indexer component installer.

Expected Results: Temporary files should not be left on disk. 

Workaround: Contact Technical Support for assistance with the workaround for this issue.   

Expected Results: Elasticsearch should abide by the memory limit that is set. 

Workaround: For a workaround, contact LogRhythm Technical Support. 

Expected Results: Columbo should handle the warm node indices correctly and allow searches. 

Workaround: For assistance with this workaround, contact LogRhythm Technical Support. 

Expected Results: The Data Indexer should be removed and re-added instead of adding a second instance. 

Workaround: Uninstall both versions of the Data Indexer, ensure there or no hung .msi processes in the Task Manager, then re-install the 7.6.0 Hotfix 2 version. 

Expected Results: The Carpenter service should not cause port exhaustion. 

Workaround: Create a scheduled task to restart the Carpenter service each day. 

Expected Results: The Transporter should continue to run after a restart signal is sent.

Workaround: Restart the Transporter service.

DE12201

DE16040

Expected Results: Data should be stored in the format in which it was sent.

Workaround: There is currently no workaround for this issue.

Expected Results: Searching should work. 

Workaround: Either wait for the issue to naturally pass or manually adjust system clocks. 

Expected Results: Bulldozer should handle 2XDX nodes correctly.

Workaround: There is currently no workaround for this issue.

Expected Results: The weekday maintenance task should perform in a reasonable amount of time.

Workaround: There is currently no workaround for this issue.

DE260

DE9367

Expected Results: SQL deadlock issues should not cause a missed heartbeat.

Workaround: While there is no known workaround, LogRhythm is actively investigating this issue for a solution.

Expected Results: Transaction logs should be truncated by frequent scheduled backups throughout the day.

Workaround: There is currently no workaround for this issue.

Expected Results: Scheduled reports should not be sent to disabled accounts. 

Workaround: There is currently no workaround for this issue. 

Expected Results: The Client Console should provide an alternate way to retrieve the data if Crystal Reports is not able to render it. 

Workaround: Decrease the amount of data the report is trying to retrieve or export the data instead.

Expected Results: Searching against warm indices should return results whether the results are in hot or warm nodes.

Workaround: Contact Technical Support for assistance with this workaround.

Expected Results: Exported reports should not duplicate header and footer lines. 

Workaround: Export the report in another format or remove the extra lines from the .csv. 

Expected Results: When a disabled user is re-enabled, the user's login should also be enabled during the next AD Synchronization.

Workaround: Manually enable the user's login after the AD sync.

Expected Results: The report should show the accurate last backup time for each database. 

Workaround: Review the backup information in SQL Server Management Studio.

Expected Results: Archives should process, seal, and move out of the Unprocessed Archives folder as long as the processing rate is at or below the system specification. 

Workaround: Evaluate system sizing and consider an expansion to meet active load demands. In some systems, increasing the ArchiveSize setting in the Data Processor Advanced Properties to 51200 (from the default value of 10240) can help process archive files faster. If necessary, move large files out of the Unprocessed Archives folder to another drive and slowly feed them back in when the system is successfully processing the live data. A more permanent solution to this issue will be provided in a future release.

Expected Results: The AIE Data Provider service should start consistently and as expected. Failures should be consistently logged to alert when the service did not start correctly. 

Workaround: Restart the Mediator service to allow the AIE Data Provider service to start. A more permanent solution to this issue is being evaluated for a future release.

Expected Results: The Mediator continues to process and move archive files to inactive when the connection is restored.

Workaround: Ensure that the account the Mediator service is running has permission to access the network location.

In certain circumstances when Entity Archive settings are turned on, customers may receive the following error:

**ERROR** Failed to locate or create inactive subdirectory: The given key was not present in the dictionary.. Inactive archive files will be temporarily stored at the root of the system drive (C:\ in most cases). This error must be corrected in order for inactive archives to be stored at the specified location. 

Expected Results: Entity archiving should function without errors. 

Workaround: There is currently no workaround for this issue. 

Expected results: The Mediator should only attempt to seal the archive file once. 

Workaround: There is no workaround for this issue. 

Expected Results: Datadog's telemetry metrics parsing errors should not be present in the metrics collection file.

Workaround: There is currently no workaround for this issue.

Expected Results:  The SmartResponse Plugin should execute after selecting the System Monitor Agent. 

Workaround:  There is currently no workaround for this issue. 

Expected Results: Grouping values in SmartResponse Plugins should be allowed. 

Workaround: There is no workaround for this issue. 

Expected Results: SmartResponse Plugins should fire each time the AIE Rule is triggered. 

Workaround: There is no workaround for this issue. 

Expected Results: The TrueIdentity Sync Client should be able to connect using LDAP via port 636. 

Workaround: Use port 389 instead and ensure the proper certificates are in place for security. 

Expected Results: White space should be allowed in the OU/DC filter. 

Workaround: While there is no workaround for this issue, LogRhythm is investigating a resolution for a future release.

Expected Results: The TrueIdentity Sync Client should work for any number of users. 

Workaround: While there is no workaround for this issue, the next release of the Sync Client will be able to support larger AD environments.

Expected Results: When users try to download a PCAP that is no longer available on disk, the error message should provide that detail instead of an unclassified failure. 

Workaround: The error message will be changed in a future release. There are two simple troubleshooting steps to identify if the PCAP exists or if other issues are occurring in the integration: Log in to NetMon directly and verify if the selected PCAP has already aged out or should be available on disk. Recreate the API key for the selected NetMon and update the NetMon configuration in the Deployment Manager.

Expected Results: When copying widgets, all settings should remain. 

Workaround: Users can add a new widget to the dashboard and configure it manually to work around this issue. This issue is still being actively investigated and will be resolved in a future release.

Expected Results: All data contained in the .csv export should be valid and match the data displayed in the Web Console. 

Workaround: Export the same investigation from the Client Console or manually adjust the first and last date post export. LogRhythm is investigating a solution to this issue.

Expected Results: Users should be able to scroll through all TrueIdentity records in the Web Console. 

Workaround: Using filters to find specific data in the TrueIdentity page prevents the error message from showing and helps find data more quickly. LogRhythm is working on a resolution for a future release.

Expected Results: The Web Console should not time out when downloading large PCAP files. 

Workaround: Change the time out setting in the Configuration Manager.

Expected Results: The Current Processing Rate widget should show all logs being processed.

Workaround: Resolve any log source issues that are causing old logs to be ingested, or use Grafana or Performance Counters to check the current processing rate.

Expected Results: The Download PCAP button should appear when reviewing NetMon logs. 

Workaround: Reload the frame with the Download PCAP button to activate it.

Expected Results: The Node-Link Graph should function regardless of the browser zoom level. 

Workaround:  Return the browser to 100% zoom and refresh the Web Console. 

Expected Results: The Analyze Dashboard filter should reset. 

Workaround: In User Settings set the Drilldown setting to Open in Page. 

Expected Results: Drilling into data on a dashboard should not change the dashboard filter criteria. 

Workaround: Reapply the dashboard filter. 

Expected Results: After closing a previous drilldown tab, the next drill down into a widget item should not show the older filters.

Workaround: After drilling in a filter, refresh the web page. The next drill down into a widget item uses the correct filter.

Expected Results: The Analyzer grid should not update with new events when paused. 

Workaround: There is currently no workaround for this issue. 

Expected Results: drill down results should not be hidden. 

Workaround: Select Default Analyze Dashboard 

Expected Results: Event data should appear in the dashboard.

Workaround: There is currently no workaround for this issue. 

Expected Results: The search and drill down operations should return results upon completion or terminate. 

Workaround: Reload the page. 

Expected Results: The Timeline View widget works as normal.

Workaround: There is currently no workaround for this issue.

Expected Results: The checked count should reset. 

Workaround: After performing an action, select the Uncheck All option to reset the checked count. 

Expected Results: The search and drill down operations should return results upon completion or terminate. 

Workaround: Reload the page. 

Expected Results: Searching for terms should yield results for exact matches and not 'AND' the words separated by hyphens.

Workaround: There is currently no workaround for this issue.

Expected Results:  Lucene filtering should only apply to the widget from which it originated, Other widgets on the page will still lack the drilldown or time slice,

Workaround: There is currently no workaround for this issue.

Expected Results:  Component names should be shown.

Workaround: Hover over the icon to see the Component Name.