What’s New in Superna Eyeglass Easy Auditor Edition

Release 2.5.6

What’s New! In Superna Eyeglass Easy Auditor Edition Release 2.5.6 can be found here.

Supported OneFS releases

8.0.0.x

8.0.1.x

8.1.x.x

8.1.2.x

8.1.3.x

8.2.0.x

8.2.1.x

8.2.2.x

9.0

9.1

Supported Eyeglass releases

Inter Release Functional Compatibility

End of Life Notifications

Technical Advisories

T11752 Custom Real-time Audit policy User selection filtering

To select a name from the User drop-down list on a Custom Real-time Audit policy trigger you must first type the first letter of the user domain (name format is DOMAIN\name) after which you can type any other letter from user name for further filtering. Leave a space between first letter and next letter if letters are not adjacent in user name. Example below

Workaround: None required.

—————————————————–

T11890 Able to save query without a name

The GUI allows saving of query without name.  Query can be run but cannot be deleted.  Only one query without a name will be able to be saved.

Workaround: Enter name when saving a query.

—————————————————–

T13573 Delete parent folder with subfolders shows duplicates in Where Did My Folder Go

Where Did My Folder Go search results for a parent deleted folder where subfolders were also deleted duplicates entries for some folders.

Workaround: None required

—————————————————–

T14722 Issues with custom report where path selected contains special language characters

Custom report where path selected contains special language characters may either not run or will complete with 0 results.

Workaround: Selecting a path higher up in the directory tree without special language characters may return results where special language characters not displayed correctly. Note that Wiretap and Where Did My Folder Go provide an option for reporting on these paths.

—————————————————–

T15037 Easy Auditor does not report files with multiple extensions correctly

For the case where a file has multiple extensions in the Easy Auditor report the first extension only is reported. For example file.pdf.gz is reported as a pdf not as a gz file.

Workaround: None available.
—————————————————–

T15582 Easy Auditor issues where path has & or brackets

Easy auditor has following issues for path with &:

- user or path search where path contains & return 0 results

- DLP trigger cannot be saved where path contains &

- Mass Delete trigger where path contains & returns 0 results

Workaround: Select path above path with & when defining custom search, DLP or Mass Delete triggers

Easy auditor has following issues where path contains bracket

- Wiretap, Where did My Folder Go, Active Auditor triggers not functioning

Workaround: No workaround available

—————————————————–

T20661 Large Report cannot be downloaded from Windows

There is an issue downloading reports with very large number of records from Windows using Chrome browser. On download a "Loading" message appears but once the Loading message stops, no download is started. This issue does not appear on MAC with Chrome browser.

Workaround:

1) On Windows, large reports can be successfully downloaded using Firefox browser build 72

2) The file is generated and present on the Eyeglass appliance and could be retrieved using a tool such as WinSCP. The report files are located on the Eyeglass appliance in the folder: /srv/www/htdocs/csv 

Active Auditing

T8878 Cannot save DLP trigger for a different NE but same path

With 2 licensed clusters a Data loss prevention policy cannnot use the exact same path on both clusters if entering 2 differnent policies one for each cluster.

Work around:  none only the first cluster and path can be added.

—————————————————–

T6305 Invalid username causes Wiretap error

If you enter an invalid username that cannot be resolved when setting up a Wiretap active auditing job it causes the job creation to fail with the following error:

Failed to create new wiretap:

Server error when processing request: java.lang.NullPointerException

Workaround: Enter a username that can be resolved in the documented supported format.

—————————————————–

T7547  Wiretap does not show user name for NFS events

For events generated over NFS protocol, Wiretap does not include user name in the event information. Only client IP address is displayed.

Resolution: A custom query can be built using the Report Query Builder based on path and timeframe in order to view user name.

—————————————————–

T12876 DLP trigger cannot be added

An error (Error saving response) occurs when adding a DLP trigger if there is an existing directory quota without data-protection overhead option enabled on the the path that a DLP trigger is being configured for.

Workaround: If possible, delete the existing quota and allow new quota to be created as part of adding the DLP trigger. Note that the directory quota that is created will be created with the data-protection overhead option enabled.

—————————————————–

T15198 Active Auditor Triggers may have inaccurate Signal Strength

Active Auditor trigger processing (DLP, Mass Delete, Custom Triggers) may receive duplicate events and as a result show a higher Signal Strength than is actually the case.

Workaround: None required. The duplicate events will cause early detection of configured triggers. The associated CSV for files involved in the detection is correct.

—————————————————–

T15250 The command to reset Active Auditor event queue must be run twice

The command igls adv eventTriggers set --operation=reset --topic=ea must be run twice to clear the queue.

Workaround: Execute the command a second time to clear the queue.

—————————————————–

T16978 Display of Files for Mass Delete always shows 1 file

On the GUI for Active Auditor > Active Events as well as in associated alarm information the number of affected files is always displayed as 1. This is a display issue only. The number of files configured in the trigger was correctly used in the detection.

Workaround: To see the full list of files, download the report containing the files by selecting the Files link in teh GUI and then Affected Files - CSV.

—————————————————–

T16980 Active Auditor events Affected Files-CSV may not show all events

Under some circumstances the Affected Files-CSV may not show all events for the Active Auditor trigger as the timeframe for the report may result in some events being excluded.

Workaround: Use the Report Query Builder to run a query with the same conditions and user as the associated trigger and a timeframte that starts before the detected time. Typically starting query an hour prior to the event would ensure all events were listed but may also include some audit events that are not related to to the trigger.

Robo Audit

T8694 Robo Audit may show Success when it did not run

Robo Audit may show as having successfully completed when in fact it did not run. For example:

• Robo Audit configured but disabled

• Robo Audit misconfigured and enabled

Workaround: Open the Robo Audit logs to see details of Job Execution.

—————————————————–

T11880 Robo Audit fails when configured to run on more than one cluster

When configured to run on more than one cluster, Robo Audit job will succeed for one cluster but fail for subsequent cluster.

Workaround: Configure Robo Audit to only run on one cluster.

—————————————————–

T15175 Existing Robo Audit Logs lost formatting after upgrade to 2.5.6

Any existing Robo Audit logs viewed from the Eyeglass GUI will have lost the formatting after upgrade to 2.5.6.

Workaround: None required. New logs will have correct formatting.

—————————————————–

General

T5858  ecactl commands do not switch to ecaadmin user

If you are logged into an ECA node as root user and execute an ecactl command, you are prompted to login as the ecaadmin user to continue but even though the console indicates that the login as ecaadmin is underway the login never completes and the command cannot be executed.   

Workaround: Login to ECA as ecaadmin user when using ecactl commands.

—————————————————–

T5915  Event retrieval stopped by Disable/Enable of Protocol Monitoring on the PowerScale

If you disable / enable Protocol Auditing on the PowerScale cluster the ECA does not recover and does not begin reading events once Protocol Auditing enabled again.

Workaround: If you need to disable/enable Protocol auditing down the ECA cluster first

    Ecactl cluster down

Then disable Protocol Auditing on the PowerScale cluster

After you have enabled Protocol Auditing on PowerScale cluster, the bring the ECA back up:

      ecactl cluster up.

—————————————————–

T6004  PowerScale Directory Selector Usage

In order to populate a cluster in the Directory Selector a directory must be selected in the file tree.   

Workaround: None required. Once cluster is populated a path can be selected from the tree or typed in but must begin with /ifs .

—————————————————–

T15457 HTML 5 vmware vcenter bug on OVA deployment

 Some versions of vmware vcenter HTML user interface have a known issue with OVA properties being read correctly post power on, leading to first boot issues.

Workaround: use the Flash client as a work around.

—————————————————–

T6097  UI Desktop Unexpected Behaviour

If you move a window to the edge of the Eyeglass desktop it may become stuck in that position.   

Workaround: Refresh browser.

—————————————————–

T6617  PowerScale Directory Selector does not display hidden directories

Directories that start with a dot (.) are not displayed in the PowerScale Directory Selector.   

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.

—————————————————–

T8091  Login Monitor Report does not have Sorting

When viewing the Login Monitor Report Built-In query results from the GUI, sorting on columns Logons, Logoffs, and failed Logons is not available.  

Workaround: Download the report csv file and open in spreadsheet for sorting and filtering of data.

—————————————————–

T8105 Alarm EAU0002 has no detailed information for failed auditor report

The alarm Info for EAU0002 alarm "Auditor report failed" does not have any detailed information on cause of report failure.

Workaround: In Easy Auditor / Running Reports tab select the report that failed and in the Job Details expand the tree and select the Info link for the failed step.

—————————————————–

T8249 Canceling Easy Auditor Running Report results in Critical severity alarm

Cancelling a running auditor report results in a Critical Severity alarm.

Workaround: None required. This alarm is informational only and does not indicate any critical issue in Easy Auditor.

—————————————————– 

T13539 PowerScale Directory selector missing directories

The PowerScale Directory selector currently has a maximum list size of 1000 so that environments with more than 1000 directories on the PowerScale will be missing directories in the directory selector.

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.

—————————————————–

Known Limitations

Reporting

Conditions under which audit events are not processed

In the following situations audit events will not be processed and any audit events which occur while processing is down are dropped - they are not recovered by post processing:

• ECA NFS mount is down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.

• ECA down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.

—————————————————–

T6260 Stale Access Report Known Limitations

1) The Stale Access Report Built-In query does not report on activity for shares under following conditions:

• Share access by AD user with run as root permissions
• Share access by AD group where AD group has nested group and access by user in sub-group

—————————————————–

T6361 Reporting for shares with local user permissions unsupported

Reports generated against shares which have a local PowerScale user permission configured may give unexpected results in the report and may cause email notification to fail.

—————————————————–

T6478 Stale Access and Share Access Report AD User Limitation

Reports have been successfully generated against AD environment with up to 4000 users.  Reports against larger AD environments may fail.

—————————————————–

T2842 Login Monitor Report Known Limitations

The Login Monitor Report Built-In query has following Known Limitations:

• NFS login is not reported
• Failed login due to invalid password, or invalid user are reported by user SID
• A login where user does not appropriate share permission is reported as a Logon and Logoff together

—————————————————–

T18936 Rerun of query required

Query may need to be re-run if the ECA OS product requirements have not been met for disk latency as this can cause search jobs to timeout in Eyeglass. The job may still complete by reviewing the finished jobs report tab. If the report shows error you will need to re-run the job. OS latency or memory issues can cause this and permanent fix should move the ECA VM's to flash based storage. This command can be run to look at disk statistics:

ecactl cluster exec iostat -xyz 6 6

This command will return a sample of disk IO per ECA. Consult documentation on latency requirements.

Active Auditing

T6061, T6465 Wiretap event rate display maximum of 25 events / s

Wiretap Watch window is limited to displaying events at a maximum of 25 events/s.  If there are more than 25 event/s which match the Wiretap filter this will result in events being dropped and not displayed.

Workaround: Define filter with smaller scope by adding a user and defining more precisely the path in the filter.  A report may also be run using same filter to retrieve all related results.

—————————————————–

T7500  DLP Known Limitations

DLP Active Auditing has following Known Limitations:

• Small Files DLP threshold affected by PowerScale Quota Usage Reporting

For small files, PowerScale Quota Usage reports a larger usage than actual storage consumed.  When setting a DLP threshold you must consider the threshold% against the quota reported usage.  For example, if actual space consumed by 1 small files is 20b but quota usage is reported by PowerScale as 8K then the threshold to detect copy of that file is not 100%, it is 20b/8K.

• DLP generate 1 signal when threshold crossed for any size of copy

Any copy that crosses the configured threshold will generate only 1 signal - whether the copy is one time the threshold configured or many times the threshold configured.

—————————————————–

T7525 Active Auditor Affected Files also shows Ransomware Defender Affected Files

When viewing the Affected Files for an Active Auditor event, any files associated wtih a Ransomware Defender event that has occurred at the same time are also displayed.

Workaround: Download the csv file and use the path associated with the Active Auditor event from the GUI to filter the results.

—————————————————–

T8744 No event processing once Signal Strength passes 2 times Critical Threshold

For the case where both Ransomware Defender and Easy Auditor are licensed, reaching Signals processed count of 2 times Ransomware Critical threshold for a particular user limit is applied independently for Ransomware Defender and Easy Auditor.

Workaround: None available.

—————————————————–

T11540 Active Auditor may report on Audit Failure events

Active Auditor may report on failed audit events.

Workaround: Reporting of failed audit events can be disabled on the PowerScale audit settings. Please contact support.superna.net for more information on disabling reporting on failed audit events.

—————————————————–

T12380 Ransomware Defender Ignore List settings are applied to Active Auditor analysis

Analysis of file events for Active Auditor triggers will ignore an user, IP or path that is configured in the Ransomware Defender Ignore list.

Workaround: None available.

—————————————————–

General

T8281 hbase major compaction affects queries

An hbase major compaction will prevent queries happening at the same time from completing.

Workaround: Re-run query once hbase major compaction has completed.

—————————————————–

T16137 Anyrelease restore does not restore all Ransomware Defender and Easy Auditor settings

There is no restore of settings from release 2.5.4 and earlier. For release 2.5.4 and earlier continue to capture all Ransomware settings (False Positive, Ignore List, Allowed Extensions, Security Guard) and Easy Auditor settings (Active Auditor Trigger settings, RoboAudit). Post restore verify settings and update where required before cluster up on ECA.

In all cases, restoring an Eyeglass backup using the --anyrelease option will not restore following Ransomware Defender and Easy Auditor settings:

Ransomware Defender: Event History, Threats Detected

Easy Auditor: Finished Reports, Scheduled Reports, Saved Queries

—————————————————–

Known Limitations

T16499 Easy Auditor reports double events

In some cases it will be expected that a single operation such as deleting a folder is reported by the SMB protocol or Isilon as multiple delete events that appear as duplicates.  Easy Auditor will record events as logged by Isilon and display all recorded events which may appear as duplicate but in fact is expected.