Fortinet opublikował nową wersję oprogramowania dla produktu FortiAnalyzer ! Aktualizacja firmware do wersji 6.2.2 wprowadza funkcjonalność umożliwiającą konfigurację przedziału czasowego dla maskowania danych w profilach użytkowników. Jeśli korzystacie ze starszych wersji firmware’u koniecznie przeprowadźcie aktualizację Waszych urządzeń bądź maszyn wirtualnych!
Nowość w 6.2.2:
- Administratorzy mogą skonfigurować przedział czasowy dla zamaskowanych danych w profilu użytkownika i zastosować profil do użytkowników. Przedział czasu może być skonfigurowany z GUI lub SLI i obsługuje liczby całkowite od 0 do 365. Dziesiętne nie są obsługiwane.
- Jeśli użytkownik wyszuka dane w zakresie czasu dłuższym niż skonfigurowany przedział czasowy, wówczas wszystkie dane zostaną zamaskowane.
- Dzienniki w czasie rzeczywistym są zawsze demaskowane.
- Ramka czasowa usuwania maski może mieć zastosowanie do przeglądania dziennika w zależności od ramy czasowej pliku.
Aby skonfigurować ramy czasowe w maskowaniu prywatności:
- Przejdź do System Settings > Admin > Profile > następnie utwórz bądź edytuj profil
- Włącz Privacy Masking.
- W sekcji Masked Data wybierz dane do zamaskowania.
- W polu Data Mask Key wprowadź hasło, aby zdemaskować dane.
- W polu Data Unmasked Time wprowadź liczbę całkowitą z zakresu od 0 do 365.
3. Przejdź do System Settings> Administrator> Profile i zastosuj skonfigurowany profil użytkownika do użytkownika docelowego.
Rozwiązane problemy w FortiAnalyzer 6.2.2:
| Bug ID | Description |
|---|---|
| 454164 | FortiAnalyzer’s Log Forward should support exclude function. |
| 498133 | Syslog is not sent using IPv6. |
| 503215 | When License status changes to “Duplicate License”, FortiAnalyzer does not update its own local event log. |
| 520018 | FortiAnalyzer should properly identify the firmware version after upgraded FortiGate. |
| 531843 | DLP file archived on FortiAnalyzer is not readable. |
| 542077 | FortiAnalyer 3700F may use high disk I/O with large log insert lag time. |
| 543324 | FortiAnalyzer shows inconsistent tunnel duration in FortiView for Site-to-Site VPN. |
| 543404 | FortiManager does not display log on “FortiGuard Distribution Server Download Log”. |
| 544097 | GUI may become unresponsive requires manual killing the fazsvcd process. |
| 544550 | FortiAnalyzer’s alert email should show correct file name when malicious file is detected. |
| 548866 | Master unit in FortiAnalyzer HA Cluster responds with VIP only for SNMP traffic. |
| 554798 | Users cannot change the FTP Server’s service port on “Upload logs using a standard file transfer protocol”. |
| 561230 | Top Websites in FortiView are not showing for certain categories. |
| 561896 | The database’s time and time zone should change according to system time. |
| 563938 | Analytic data should not be removed before quota is reached. |
| 564117 | FortiAnalyzer HA does not upload report to FTP server when load-balance is enabled. |
| 564455 | FortiAnalyzer should decode Punycode encoded URLs and displays it in Log View -> Security -> Web Filter. |
| 565634 | Pending report jobs may disappear when the jobs are running in multiple ADOMs. |
| 566609 | FortiAnalyzer incorrectly filers time frame in Log View. |
| 566873 | Privacy Masking is not working correctly in Event Manager. |
| 568490 | Report cover page’s background image may be misaligned. |
| 568774 | The fmgd process may crash every ten seconds when accessing NOC-SOC -> Compromised Hosts Monitor. |
| 569766 | Reports on FortiAnalyzer should give correct information for Bandwidth calculations. |
| 569941 | Users should be able to view logs when remote admin is authenticated as Realm/admin. |
| 575018 | The log field “bid” is an internal generated field and it should not be exposed to external APIs. |
| 577973 | When saving a report with device or VDOM selection, the VDOM information is corrupted by “|0”. |
| 578277 | FortiAnalyzer may not correct decode and generate the FPX license list. |
Znane problemy do rozwiązania w FortiAnalyzer 6.2.2:
| 574987 | ADOM quota retention removes more log data than the applied retention policy. |
| 575877 | FortiAnalyzer filters for Initial ‘1024’ characters only under report. |
| 576688 | FortiAnalyzer uses any value entered in “last N minutes”, “last N hours” or “last N days” to multiply the correct value when selecting any pre-defined range. |
| 576871 | FortiAnalyzer does not consider NTP server changes until the service restarts. |
| 577941 | Compromised host should be removed from list after being acknowledged. |
| 577951 | FortiView widgets using “Full” mode do not auto refresh using the Refresh Interval. |
| 578628 | Security Fabric group may not be recognized on FortiAnalyzer. |
| 578800 | Local Event log FTP upload always deletes transferred log file. |
| 578907 | The “exec log-aggregate all” command may return error: Failed to load client file list on server. |
| 579229 | FortiAnalyzer should generate FortiGate Event handler notification though REST API inside the OFTP tunnel for event received from non-FortiGate devices. |
| 579568 | FortiView > Summary > Top sources/Top destination does not resolve hostname in display. |
| 579871 | Restoring logs should display correct timestamps under log browse. |
| 579910 | SOC does not show AP SSID and AP clients for APs connected in bridge mode. |
| 580629 | Chromebooks are unable to log to FortiAnalyzer if admin has trusted hosts configured. |
| 580637 | FortiAnalyzer may not generate reports as per schedule. |
| 580979 | Top Threats exports to PDF represents incorrect filter. |
| 581074 | Non-super user accounts are unable to save report settings due to the error ‘Illegal change of admin-user’. |
| 581158 | Sorting by Threat Score in descending order should display entries with most Threat Score first. |
| 581769 | When running a report, FortiAnalyzer may not return data with sqllogd crashes. |
| 584413 | FortiView > Top destination > Bytes is not equal to the sum of the bytes under drill down section Source. |
| 584520 | Log Insert Lag Widget display spikes periodically. |
| 586404 | Deleting Report folder should delete report and should remove it from all schedules. |
| 586617 | Report in XML format may not encode in UTF8 when certain characters are returned from a dataset. |
FortiAnalyzer 6.2.2 – notatki producenta
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie