background image

530-025628-01

6

STRM Log Management Release Notes

Deleting a False Positive Building Block Value No Longer Causes Error

Previously, if you attempted to edit the User-BB-FalsePositive: User Defined False 
Positive Tunings Building Block to edit any of the configured values within the 
Building Block, the following error message appeared 

Invalid category id

This no longer occurs. 

Multiple Reports No Longer Generate From Single Template When Reports 
are Shared

When you created a new report using the Report Wizard, you can generate the 
report by selecting the

 Would you like to run the report now? 

check box in the 

report wizard or request the completed report template to generate using the 
Reports Template interface. Previously, if the report was shared with other users, 
both options may have resulted in the generation of multiple reports appearing in 
the Generated Reports interface with Admin as the listed owner. This no longer 
occurs. 

Now Able to Add 200 CIDRS for a Network Object

Previously, the limit of CIDR range(s) you could add to the network object was 70. 
If you attempted to add more than 70 CIDR range(s), an error appeared. In STRM 
Log Management 2008.2, the limit of CIDR ranges you can add is approximately 
200, depending on the data on your system. 

Now Able to Apply Any IP Filter When Searching for Events

Previously, when you attempted to filter in the Event Viewer using the Any IP filter 
option, invalid results appears. Now, in STRM Log Management 2008.2, this no 
longer occurs and valid search results appear. 

Now Able to Filter on Device Type Using Right-Click Option in Aggregate 
Display

Using the Display drop-down list box in the Event Viewer, you are able to view 
events using one of the available aggregate options. Previously, if you selected the 
Device Type option in the Display drop-down list box, you were not able to access 
the Filter menu using the right mouse button (right-click) for the Device Type 
column. This no longer occurs and the Filter menu is available. 

Now Able to Use Exclamation Point (!) In LDAP Authentication Passwords

Previously, when defining a password for your LDAP authentication, if you entered 
an exclamation point (!) as part of your password, the password was rejected. 
Exclamation points (!) are now supported. 

Now Able to Use Same IP Address for Off-Site Source and Target

Previously, when configuring off-site source and target in the deployment editor, an 
error appeared if you attempted to use the same IP address for the source and 
target. This no longer occurs. 

Summary of Contents for SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1

Page 1: ...ager Log Management Only STRM LM provides a comprehensive log management solution for organizations that want to implement a distributed log management solution to collect archive and analyze network...

Page 2: ...ch system in your deployment New Device Extensions Functionality You can now modify how a DSM parses logs For example you can use a device extension to detect an event that has missing or incorrect fi...

Page 3: ...re information on Release 2008 2 refer to the on line documentation STRM Log Management Installation Guide STRM Log Management Administration Guide STRM Log Management Users Guide STRM Log Management...

Page 4: ...a device requires STRM to forward logs through NSM Note For STRM to correctly process logs from SA and IC the logs should be sent from the devices in WELF format To enable WELF format on the device Un...

Page 5: ...if your license key expired and you uploaded a new license key STRM Log Management did not provide the option to deploy the new license key Changing the Authentication to STRM Log Management Authentic...

Page 6: ...nagement 2008 2 the limit of CIDR ranges you can add is approximately 200 depending on the data on your system Now Able to Apply Any IP Filter When Searching for Events Previously when you attempted t...

Page 7: ...nt 2008 2 this directory structure is properly created Events Appear in Event Viewer and Flows in Flow Viewer After June 30 2008 The Event Correlation Engine license expires on 30 June 2008 This licen...

Page 8: ...e configuration file and restart services Step 1 Open the configuration file on the machine that uses the custom SSL key normally the Web Server console Step 1 Add the directory path to your custom SS...

Page 9: ...oller IC device may appear incorrectly as an Enterasys device Workaround Add the Infranet Controller device manually Infranet Controller Device Appears as Secure Access Device An auto discovered Infra...

Page 10: ...nfiguration change the event query service process restarts and may be temporarily unable to process event searches Workaround Wait between 2 and 3 minutes for the Event Viewer to finish restarting Th...

Page 11: ...per Networks Inc in the United States and other countries JUNOS and JUNOSe are trademarks of Juniper Networks Inc All other trademarks service marks registered trademarks or registered service marks a...

Reviews: