HPE Security ArcSight ESM 软件版本 6.9.1c 补丁 1 发行说明说明书_百

HPESecurity ArcSight ESM

SoftwareVersion:6.9.1cPatch1

ReleaseNotes

March31,2017

ReleaseNotes

LegalNotices

Warranty

TheonlywarrantiesforHewlettPackardEnterpriseproductsandservicesaresetforthintheexpresswarrantystatements

ghereinshouldbeconstruedasconstitutinganadditionalwarranty.

HewlettPackardEnterpriseshallnotbeliablefortechnicaloreditorialerrorsoromissionscontainedherein.

Theinformationcontainedhereinissubjecttochangewithoutnotice.

Thenetworkinformationusedintheexamplesinthisdocument(includingIPaddressesandhostnames)isforillustration

purposesonly.

HPESecuritessibility,integrity,and

entacomprehensivesecuritystrategyandfollowgoodsecurity

practices.

Thisdocumentisconfidential.

RestrictedRightsLegend

icensefromHewlettPackardEnterpriserequiredforpossession,useorcopying.

ConsistentwithFAR12.211and12.212,CommercialComputerSoftware,ComputerSoftwareDocumentation,andTechnical

mentundervendor'sstandardcommerciallicense.

CopyrightNotice

©Copyright2017HewlettPackardEnterpriseDevelopment,LP

Followthislinktoseeacompletestatementofcopyrightsandacknowledgements:

/docs/DOC-13026

Support

ContactInformation

Phone

AlistofphonenumbersisavailableontheHPESecurityArcSightTechnicalSupport

Page:

/documents/10180/14684/esp-support-

contact-list

SupportWebSite

Protect724Community

HPEESM6.9.1cPatch1Page2of17

Contents

ArcSightESM6.9.1cPatch1

PurposeofthisPatch

UsageNotes

SSLClientAuthenticationAfterPatchInstallation

EnableIframeofCommandCenterPages

Section508Compliance

GeographicalInformationUpdate

VulnerabilityUpdates

InstallingESMVersion6.9.1cPatch1

VerifyingtheDownloadedInstallationSoftware

ArcSightESMMainComponentSuite

ToInstallthePatch

ToUninstallthePatch

ArcSightConsole

ToInstallthePatch

ToInstallthePatchonaMac

ToUninstallthePatch

FixedIssues

ArcSightConsole

ArcSightManager

CORR-Engine

ConnectorManagement

OpenIssues

CommandCenter

InstallationandUpgrade

OpenandClosedIssuesinESM6.9.1c

SendDocumentationFeedback

4

4

4

4

4

5

6

6

6

7

7

7

9

10

10

11

12

14

14

14

15

15

15

16

16

16

17

HPEESM6.9.1cPatch1Page3of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

ArcSightESM6.9.1cPatch1

Tctionsareincluded

foreachcomponent,aswellasotherinformationaboutrecentchangesandfixedandopenissues.

panewESM6.9.1cinstallation,refertotheArcSight

ESMInstallationandConfigurationGuide.

ThebuildnumberfortheESMsuiteforthispatchis2075.

ThebuildnumberfortheArcSightConsoleforthispatchis2250.1

Afteryouhaveinstalled6.9.1c,followtheinstructionsin"InstallingESMVersion6.9.1cPatch1"on

page 6ofthesereleasenotestoapplyPatch1.

PurposeofthisPatch

Thispatch:

l

l

l

l

l

UpdatestheJREto1.7.0_97

EnableHAenvironmentonnewlycertifiedOSversionsinthisPatch.

AddressescriticalissuesinESM6.9.1c.

Providesupdatesforgeographicalinformationandvulnerabilitymapping.

Providesimportantsecurityupdates.

RefertotheHPEArcSightESMSupportMatrixforthenewandexistingoperatingsystemssupported

inthispatch.

UsageNotes

SSLClientAuthenticationAfterPatchInstallation

IfyouhaveconfiguredSSLClientAuthenticationpriortoapplyingthispatch,andifyouused

keytoolguitogeneratekeypairsandcertificates,thenyoumustre-generatethemafterapplyingthe

patchandbeforere-startingservices.

EnableIframeofCommandCenterPages

ToallowiframingofCommandCenterpages,youcanaddthefollowingoptionalsettingin

ties:

HPEESM6.9.1cPatch1Page4of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

s=entries

Whereentriesareacommaseparatedlistoftheelementsthatcouldbeofoneofthefollowingtwo

forms:

l

l

origin(forexample,

)

key:::origin

Inthisexample,thekeyisan

thedefinitionoforigins,see/html/rfc6454.

Belowisanexampleof"s"stentryisorigin,while

thesecondiskey-valuepair:

s=,microsoft:::

ThirdpartyapplicationsthatneedtoiframeCommandCenterpagesshouldaddtheparameter"origin"

toURLspoimple:

host:8443/www/ui-

phoenix/xLauncher/?origin=microsoft#login

Inthatparametertheorigincouldbespecifieddirectly()orwithhelpofthekey

(microsoft)fromtheaboveESMconfigurationsetting.

ESMuses"origin"parameterfromHTTPrequesttolookupanentryin"s"

thereismatchingentry,inisspecifiedintheHTTP

request,butisnotpresentedin"s",therequestwillfailwiththeexception"Not

allowedrequest".

HTTPrequestswithout"origin"parameterarehandledbyESMthesamewayasbefore,sothereareno

ramingisnotallowedtopreventclickjacking

vulnerability:

//Clickjacking_Defense_Cheat_Sheet

talsobeneededtologinto

gCommandCenterdirectlycreates

browser'ult,thecookiesforiframedpagesarenotcreated.

Section508Compliance

Arcend,ArcSight

continuestomakeadvancesintheareaofaccessibilityinitsproductlines.

HPEESM6.9.1cPatch1Page5of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

GeographicalInformationUpdate

ThisversionofESMin

versionisGeoIP-532_2016601.

VulnerabilityUpdates

ThisreleaseincludesrecentvulnerabilitymappingsfromtheMay2016ContextUpdate.

Device

Snort/SourcefireSEU1495updated

CiscoSecureIDSS925updated

Juniper/NetscreenIDPupdate2738updated

McAfeeNetworkSecurityManager8.7.79.3

updated

TippingPointUnityOneDV8831updated

IBMSecurityHostProtectionforDesktops3260

updated

IBMSecurityHostProtectionforServers(Unix)

36.060updated

IBMSecurityHostProtectionforServers

(Windows)3260updated

IBMProventiaNetworkIPSXPU36.060updated

IBMProventiaNetworkMFSXPU36.060

updated

IBMProventiaServerIPSforLinuxtechnology

36.060updated

IBMRealSecureServerSensorXPU36.060

updated

VulnerabilityUpdates

Faultline,Bugtraq,CVE,X-Force,Nessus,MSSB

Faultline,Bugtraq,CVE,Nessus

Faultline,Bugtraq,CVE,Nessus,MSSB

Faultline,CVE,Nessus,MSSB

MSSB

Faultline,CVE,Nessus,X-Force

Faultline,CVE,Nessus,X-Force

Faultline,CVE,Nessus,X-Force

Faultline,Bugtraq,CVE,Nessus,X-Force,MSSB

Faultline,CVE,Nessus,X-Force

Faultline,CVE,Nessus,X-Force

Faultline,CVE,Nessus,X-Force

McAfeeHostIntrusionPrevention7.0/8.0contentCVE

version7007

InstallingESMVersion6.9.1cPatch1

Youcaninstallthispatchreleaseusingtheplatform-specificcomponentexecutablefilesprovided.

Patchinstallersareavailableforallsupportedplatforms.

HPEESM6.9.1cPatch1Page6of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

Note:KeepthefollowingpointsinmindwheninstallingPatch1:

l

Forallcomponentsandplatforms:Makesurethatyouhaveenoughspaceavailablebefore

tallerchecksfor1GBofspaceandgeneratesanerrorifitisnot

unintodiskspaceissuesduringinstallation,createenoughspace,restorethe

componentbasebuildfromthebackup,thenresumepatchinstallation.

Backup,patchinstall,anduninstallproceduresrequirepermissionsfortherelevantcomponents.

Toinstallapatch,makesurethattheuserwhoownsthebasebuildinstallationfolderhasfull

privilegesonthePATHwherethebasebuildisinstalled.

Touninstallthesoftwareyoumustbeatthesameuserlevelastheoriginalinstaller.

Itisagoodprac

adsallthefilespresent,

regardlessofrenaming,andcanpickupoldcodeinadvertently,causingundesirableresults.

Forbackup,patchinstall,anduninstall,werecommendthatyoulogintothetargetmachinewith

witchaccountsafterloggingin,thenspecifytheflag"

-

"

forthesucommand(

su-

).

l

l

l

l

Eachcomponenthasinstallanduninstallsteps.

VerifyingtheDownloadedInstallationSoftware

HPEprovidesadigitalpublickeytoenableyoutoverifythatthesignedsoftwareyoureceivedisindeed

fromHPEandhasnotbeenmanipulatedinanywaybyathirdparty.

Visitthefollowingsiteforinformationandinstructions:

/portal/swdepot/?productNumber=HPLinuxCod

eSigning

ArcSightESMMainComponentSuite

ThissectiondescribeshowtoinstalloruninstalltheESM6.9.1cPatch1forallthemaincomponents

omponentsincludetheManagerandtheCORR-Engine.

ToInstallthePatch

Note:Installationconsiderations:

l

Beforeyouinstallthepatch,verifythat

andanyofitssubdirectoriesarenot

beingaccessedbyopenshellsonyoursystem.

Ifforanyreasonyouneedtore-installthepatch,runthepatchuninstallerbeforeinstallingthe

patchagain.

l

HPEESM6.9.1cPatch1Page7of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

l

HPErecommendsthatyoucontinuethroughtheinstallationanddonotattempttocancelthe

installationprocessormovebackwardthroughtheinstallerwindows.

adthepatchfromtheHPESoftwareSupportOnlinesite

().

...where

XXXX

representsthesuitebuildnumber.

Besuretoverifythepatchfile;see"VerifyingtheDownloadedInstallationSoftware"onthe

previouspage.

2.

Asuserarcsight,extractthe

tar

file.

3.

StoptheArcSightservicesasuserarcsight:

/etc/init.d/arcsight_servicesstopall

4.

BackuptheArcSightdirectory,

/opt/arcsight

,hecopyinareadily

aprecautionarymeasuresoyoucanrestorethesystemtotheoriginal

state,ifnecessary.

Caution:HPErecommendsthatyoudonotsimplyrenamefilesandleavetheminthesame

adsallthefilespresent,regardlessofrenaming,andcanpickupoldcode

inadvertently,causingundesirableresults.

aveHighAvailabilityconfigured,runthefollowingcommandonthesecondaryserveras

userroottoputtheserverinstandbymode:

crm_standby-vtrue

6.

Fromthedirectorywhereyouextractedthetarfile,runthepatchinstallerasuserarcsight:

./

ToinstallinConsolemode,runthefollowingcommandfromtheshellpromptandthenfollowthe

instructionsinthewindow:

./ArcSightESMSuitePatch.

bin-iconsole

ode,theacceptanceradio

olemode,pressthe

Enterkeyuntilyouhavepagedthroughtotheendofthelicenseagreement.

alocationfortheuninstallerlink,ifyouwanttohaveashortcuttotheuninstallerinsome

thavewritepermissiontothespecifiedfolder.

hepre-installationsummarytoverifythatallthelocationslistedarecorrectandthatyou

haveenoughdiskspacetoinstallthispatch.

10.

PressEntertostarttheinstallation.

11.

WhentheinstallationiscompletepressEntertoExit.

HPEESM6.9.1cPatch1Page8of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

Note:IfyouhaveconfiguredSSLClientAuthenticationpriortoapplyingthispatch,andifyou

usedkeytoolguitogeneratekeypairsandcertificates,thenyoumustre-generatethemafter

finishingapplyingthepatchandbeforere-startingservices.

12.

StarttheArcSightservicesasuserarcsight:

/etc/init.d/arcsight_servicesstartall

aveHighAvailabilityconfigured,runthefollowingcommandonthesecondaryserveras

userroottobringtheserveronline:

crm_standby-D

ToUninstallthePatch

Ifneeded,usetheprocedurebelowtouninstallthispatchinstallationandrestorethesystemtothepre-

patchedstate.

Note:Beforeyoubegintouninstall,verifythattheManager’s

andanyofits

subdirectoriesarenotbeingaccessedbyanyopenshellsonyoursystem.

1.

StoptheArcSightservicesasuserarcsight:

/etc/init.d/arcsight_servicesstopall

aveHighAvailabilityconfigured,runthefollowingcommandonthesecondaryserveras

userroottoputtheserverinstandbymode:

crm_standby-vtrue

3.

Asuserarcsight,runtheuninstallerprogramfromeitherthedirectorywhereyoucreatedthelink

whileinstallingtheproductor,ifyouhadoptednottocreatealink,thenrunthisfromthe

/opt/arcsight/suitepatch_6.9.1.1/UninstallerData_6.9.1.1

directory:

./Uninstall_ArcSight_ESM_Suite_Patch

Alternatively,youcanrunthefollowingcommandfromthe/home/arcsight(orwhereveryou

installedtheshortcutlink)directory:

./Uninstall_ArcSight_ESM_Suite_Patch_6.9.1.1

Or,touninstallusingConsolemode,run:

./Uninstall_ArcSight_ESM_Suite_Patch_6.9.1.1-iconsole

Runtheuninstallerinthesamemodeinwhichyourantheinstaller(GUIorConsolemode).

4.

WhentheinstallationiscompletepressEntertoExit.

5.

StarttheArcSightservicesasuserarcsight:

/etc/init.d/arcsight_servicesstartall

HPEESM6.9.1cPatch1Page9of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

aveHighAvailabilityconfigured,runthefollowingcommandonthesecondaryserveras

userroottobringtheserveronline:

crm_standby-D

ArcSightConsole

ThissectiondescribeshowtoinstalloruninstalltheESM6.9.1cPatch1forArcSightConsoleon

Windows,Mac,andLinuxplatforms.

Tip:lowingstepsdonot

includeinformationforinstallingaConsolepatchonthoseplatforms.

ToInstallthePatch

Note:Installationconsiderations:

l

Beforeyouinstallthepatch,verifythattheConsole’s

directoryandanyof

itssubdirectoriesarenotbeingaccessedbyanyopenshellsonyoursystem.

Ifyouneedtore-installthepatch,runthepatchuninstallerbeforeinstallingthepatchagain.

HPErecommendsthatyoucontinuethroughtheinstallationanddonotattempttocancelthe

installationprocessormovebackwardthroughtheinstallerwindows.

l

l

eArcSightConsole.

2.

BackuptheConsoledirectory(forexample,

/home/arcsight/console/current

)bymakinga

aprecautionarymeasuresoyoucan

restoretheoriginalstate,ifnecessary.

Caution:HPErecommendsthatyoudonotsimplyrenamefilesandleavetheminthesame

adsallthefilespresent,regardlessofrenaming,andcanpickupoldcode

inadvertently,causingundesirableresults.

adtheexecutablefilespecifictoyourplatformfromtheHPESoftwareSupportOnlinesite

().

YYYY.Y

representstheConsolebuildnumber.

l

Patch-6.9.1.

YYYY.Y

-

Patch-6.9.1.

YYYY.Y

-

l

l

Besuretoverifythepatchfile;see"VerifyingtheDownloadedInstallationSoftware"onpage 7.

FortheMac,see"ToInstallthePatchonaMac"onthenextpage.

ofthefollowingexecutablesspecifictoyourplatform:

HPEESM6.9.1cPatch1Page10of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

l

OnWindows:

Double-click

OnLinux:

Verifythatyouareloggedinasuserarcsight,andthenrunthefollowingcommand:

./Patch-6.9.1.

YYYY.Y

-

l

ToinstallinConsolemode,runthefollowingcommandfromtheshellpromptandthenfollowthe

instructionsinthewindow:

./Patch-6.9.1.

YYYY.Y

--iconsole

TheinstallerlaunchestheIntroductionwindow.

5.

ReadtheinstructionsprovidedandPressEnter.

6.

odetheacceptanceradio

olemode,pressEnter

untilyouhavereadeverypage,andthenPressEntertoaccepttheagreement.

7.

Selectthelocationofyourexisting

directoryforyourConsoleinstallationby

typingtheappropriatechoiceandpressingEnter

Ifyouwanttorestoretheinstaller-provideddefaultlocation,selectRestoreDefaultFolder.

8.

PressEntertocontinue.

aLinkLocation(onLinux)orShortcutlocation(onWindows)byclickingtheappropriate

radiobuttonandPressEnterorclickNext.

hepre-installationsummarytoverifythatallthelocationslistedarecorrectandthatyou

haveenoughdiskspacetoinstallthispatch.

11.

PressEntertostarttheinstallation.

12.

Whentheinstallationiscomplete,pressEntertoexit..

Note:IfyouhaveconfiguredSSLClientAuthenticationpriortoapplyingthispatch,andifyou

usedkeytoolguitogeneratekeypairsandcertificates,thenyoumustre-generatethemafter

finishingapplyingthepatchandbeforere-startingservices.

ToInstallthePatchonaMac

ThepatchinstallerdownloadandrunprocedureisslightlydifferentontheMacthanontheother

supportedplatforms.

Note:HPErecommendsthatyoucontinuethroughtheinstallationanddonotattempttocancel

theinstallationprocessormovebackwardthroughtheinstallerwindows.

eArcSightConsole.

2.

BackuptheConsoledirectory(forexample,

/home/arcsight/console/current

)bymakinga

HPEESM6.9.1cPatch1Page11of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

justaprecautionarymeasuresoyoucan

restoretheoriginalstate,ifnecessary.

3.

Downloadthefile

toanywhereonyoursystem.

Tip:ThepatchinstallerfileshowsasaZIPfileonthedownloadsite,butdownloadsas

eordouble-clickonthisAPPfilelaunches

thepatchinstaller,snoneedto“extract”

or“unzip”thefile;itdownloadsasanAPPfile.

Besuretoverifythepatchfile;see"VerifyingtheDownloadedInstallationSoftware"onpage 7.

4.

Launchthepatchinstallerbydouble-clickingthe

ArcSightConsolePatch

file.

thestepsonthepatchinstallwizard,providingtheinformationasprompted:

l

eptanceradiobuttonis

disableduntilyouscrolltothebottomoftheagreement.

to

,where

yourpreviousConsolewasinstalled.

ChooseanaliaslocationfortheConsoleapplication(oropttonotusealiases).Thisisthesameas

alinklocationonUNIXsystemsorshortcutlocationonWindowssystems.

l

l

6.

ClickNext.

7.

VerifyyoursettingsandclickInstall.

ToUninstallthePatch

Ifneeded,usetheprocedurebelowtouninstallthispatchinstallation.

Note:Beforeyoubegintouninstall,verifythattheConsole’s

andanyofits

subdirectoriesarenotbeingaccessedbyanyopenshellsonyoursystem.

IfyousetupSSLClientAuthenticationorPKCS11tokensforauthenticationafterthispatchwas

applied,thenbeforeyouuninstallit,makeabackupoftheJRE'scacertsfileontheConsole

epath(usingWindowsasanexample)isConsolecurrentjrelibsecuritycacerts.

Afteruninstallisfinished,overwritetheJRE'ise,

authenticationmayfail.

eArcSightConsole.

uninstallerprogram:

OnWindows:

l

Double-mple,if

youcreatedanuninstallericononyourdesktop,double-clickthaticon.

l

IfyoucreatedalinkintheStartmenu,click:

HPEESM6.9.1cPatch1Page12of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

Start>AllPrograms>ArcSightESMConsole6.9.1cPatch1>UninstallArcSightESM

Console6.9.1cPatch1

l

Or,runthefollowingfromtheConsole’s

currentUninstallerData_

6.9.1.1

directory:

Uninstall_ArcSight_ESM_Console_

l

OnWindows8.1,runthefollowingfromtheConsole's

HOME>currentUninstallerData_6.9.1.1

directory:

Uninstall_ArcSight_ESM_Console_

OnLinux:

l

FromthedirectorywhereyoucreatedthelinkwheninstallingtheConsole(yourhomedirectory

orsomeotherlocation),run:

./Uninstall_ArcSight_ESM_Console_Patch_6.9.1.1

l

Or,touninstallusingConsolemode,run:

./Uninstall_ArcSight_ESM_Console_Patch_6.9.1.1-iconsole

l

Ifyoudidnotcreatealink,executethecommandfromtheConsole’s

HOME>/current/UninstallerData_6.9.1.1

directory:

./Uninstall_ArcSight_ESM_Console_Patch

l

Or,touninstallusingConsolemode,run:

./Uninstall_ArcSight_ESM_Console_Patch-iconsole

OnaMac:

l

FromthedirectorywhereyoucreatedthelinkwheninstallingtheConsole,run:

Uninstall_ArcSight_ESM_Console_Patch_6.9.1.1

l

FromtheConsole’s

/current/UninstallerData_6.9.1.1

directory,

run:

Uninstall_ArcSight_ESM_Console_Patch

3.

ClickDoneontheUninstallCompletescreen.

Note:IfyouareonaWindowssystemandyouplantouninstallthebasebuildConsoleafter

uninstallingPatch1,beadvisedthatyoursystemrestartswithoutwarninguponfinishingthe

eyoursystemaccordingly.

HPEESM6.9.1cPatch1Page13of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

FixedIssues

Thefollowingissuesarefixedinthisrelease.

•

•

•

•

ArcSightConsole

ArcSightManager

CORR-Engine

ConnectorManagement

14

14

15

15

ArcSightConsole

Issue

NGS-18270

Description

ibilityoftheEventIDcolumn

hasbeenenabled.

Thisissueisnowfixed.

NGS-18269WhenaddingcolumnsusingtheCustomizeColumnsfeatureinanactivechannel,theaddedcolumns

wouldappearblank,ormissingdata.

Thisissueisnowfixed.

NGS-13393

NGS-13390

Connector'sFiltertabisnowviewablebyuserswithread-onlypermissions.

Previouslythe"LastPasswordChange"date/timevaluewouldchangetothetimeofthelastlogin,and

passwordsneverexpired.

Now,evenafterrestartingtheArcSightConsoleThe"LastPasswordChange"remainsasthedate/time

whenthepasswordwasactuallychanged.

NGS-11782Thefollowingpopupdialogswillremainonthesamescreenwithconsoleonwindows.

InlineFilter-ConditionEditorpop-updialog

Tools-Configure,Results,Nslookup,Ping,PortInfo,Traceroute,andWhoispop-updialogs

ArcSightManager

Issue

NGS-18065

Description

ForanactivelistthatdefinestheDatetypefieldinitskeyordefinestheDatetypefieldwithout

specifyingakey,thevalueinitscountfieldwassometimesnotupdatedcorrectly.

Thisissueisnowfixed.

NGS-18064DuringactivelistimportfromaCSVfileandundercertainconditions,datefieldswouldbeimportedas

sueisnowfixed.

HPEESM6.9.1cPatch1Page14of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

Issue

NGS-17738

Description

Inordertoturnondebuglogging,setall"levelvalue"to"DEBUG"infile

/manager/arcsight-dm/plugins/g_

1.0.0/

ThenrestarttheManagerforthischangetotakeeffect.

NGS-16701Userscannowadjustthemaximumattachmentsizeupto100MBforreportsthataresentasemail

attachment,eSizepropertytothedesiredsize(inMB)inthe

otheESMAdminGuidetolearnhowtochangetheESMconfiguration

usingpropertyfiles.

Previously,whenimportingapackage(default)withanactivelist,the"LastModifiedTime"onthe

,theoriginal"LastModifiedTime"is

notpreserved,whichcouldcauseissueswithsyncingTTLforactivelistentriesacrosstwosystems.

Now,tiesfiletokeeptheLastModifiedTime

unchangedforentriesinanactivelistimportedfromapackage:d=true

NGS-13873

CORR-Engine

Issue

NGS-17810

Description

WhenrunninganSQLqueryvia'arcdt'orusinganESMresourcethatproducesanSQLquery(for

example,ActiveChannel,Query/QueryViewer,orReport),andtheconditionsoftheSQLquery

containedsomeIPaddressconstants,eithervia'IN()',ormultiple=predicates,combinedby'OR'

operators,theSQLquerycouldproduceincorrectresults.

Thisissuehasbeenfixed.

ConnectorManagement

Issue

NGS-13888

Description

Previously,aftergoingthroughtheconnectorimportwizard,theconfigurationchangesappearedfor

theconnectorresourceintheArcSightConsole,whenviewedintheInspect/r,

runningagentsetupdidnotshowthatthechangeshadtakeneffect.

Now,theImportConnectorConfigurationfeature,correctlyupdatestheconnectoraswell.

OpenIssues

Thisreleasecontainsthefollowingopenissues.

•

CommandCenter

•

InstallationandUpgrade

16

16

HPEESM6.9.1cPatch1Page15of17

ReleaseNotes

ArcSightESM6.9.1cPatch1

CommandCenter

Issue

NGS-20048

Description

WhenusingInternetExplorer11withActivClientmiddlewareandaPKCS#11token,anerrorisdisplayed

stating'Thispagecan'tbedisplayed',preventingtheuserfromloggingtoArcSightCommandCenter.

ifthereareproblemswithPINdialogtologintothecardinsomeclient(Firefox,IE,Chrome,ArcSight

Console),ecardissuccessfullyauthenticatedthroughthatclient,the

middleware(lient)mightskipcardauthentication,whenyourepeatPKCS#11loginfromthe

originalclient.

InstallationandUpgrade

Issue

NGS-19860

Description

WhenuninstallingtheConsolePatchonMac,iftheactualuninstallerbinarylocatedin

HOME>/current/UninstallerData_6.9.1.1isusedtoinvoketheuninstallprocess,thentheUninstallerData_

6.9.1.1directoryisleftbehindaftertheprocessfinishes.

Workaround:UsethesymboliclinkcreatedwhenthePatchwasinstalledtoinvoketheConsolePatch

UninstalleronMac,tetheArcSightConsole’sUninstallerData_6.9.1.1

directory,youcannowre-installArcSightConsoleESMpatch.

OpenandClosedIssuesinESM6.9.1c

ForinformationaboutopenandclosedissuesforESM6.9.1c,seethereleasenotesforthatversion.

HPEESM6.9.1cPatch1Page16of17

SendDocumentationFeedback

Ifyouhavecommentsaboutthisdocument,

emailclientisconfiguredonthissystem,clickthelinkaboveandanemailwindowopenswiththe

followinginformationinthesubjectline:

FeedbackonReleaseNotes(ESM6.9.1cPatch1)

Justaddyourfeedbacktotheemailandclicksend.

Ifnoemailclientisavailable,copytheinformationabovetoanewmessageinawebmailclient,andsend

yourfeedbackto***************.

Weappreciateyourfeedback!

HPEESM6.9.1cPatch1Page17of17