Fortinet udostępnił aktualizację FortiAnalyzer 7.6.5. W nowej wersji usunięto błąd powodujący nieprawidłowe tworzenie urządzeń SIEM na liście niezarejestrowanych w wyniku logów z klastrów FortiGate HA, naprawiono rozbieżność znaczników czasu w logach przekazywanych do Splunk po aktualizacji systemu oraz rozwiązano problem pustych raportów FortiNAC, które uniemożliwiały prawidłowe generowanie zestawień. Po więcej szczegółów zapraszamy do dalszej części artykułu.

Rozwiązane problemy:

Device Manager

Bug ID	Description
1204113	Security rating logs from the FortiGate-HA cluster are causing a SIEM device to be created on the FortiAnalyzer and displayed in the unregistered device list.

Log View

Bug ID	Description
1110895	Correlated logs for FortiMail doesn’t show up except in the ADOM which has the root vdoms.
1188362	Some detailed information in FortiMail logs is encapsulated within large message chunks. The current FortiAnalyzer log parsing logic does not yet support extracting these details from those chunks.

Others

Bug ID	Description
1179768	Due to the FortiGate’s log schema upgrades/updates, upon FortiAnalyzer’s upgrade, the Postgres table schema will be updated, which may take a significant amount of time to complete. The database migration from Postgres to ClickHouse will only begin after the Postgres schema upgrade has successfully finished. As a result, the process might appear to be stuck but it is simply progressing slowly. The only recommended action is to wait patiently for the upgrade to complete.
1196384	The „jitterentropy-rngd” process is using very high CPU even without FIPS enabled in FortiAnalyzer Hardware platform.
1204010	After the FortiAnalyzer upgrade, the timestamp and eventtime fields in the forwarded syslog logs to Splunk no longer match, showing a two-hour discrepancy.

Reports

Bug ID	Description
1179084	The FortiProxy default datasets do not include both required traffic subtypes – http-transaction and forward – even though each session generates both.
1204007	FortiNAC reports are empty.
1211383	When opening a report that contains bare text or similar nodes at top level, the editor throws an exception error.

Notatki producenta: FortiAnalyzer 7.6.5 Release Notes

Pozdrawiamy,

Zespół B&B
Bezpieczeństwo w biznesie

7.6.5 FortiAnalyzer FortiAnalyzer 7.6.5 Fortinet Fortinet FortiAnalyzer 7.6.5