This update includes an upgrade to the internal Director database. Customers are strongly encouraged to take a backup of the Director before upgrading.
The Mandiant Security Validation (MSV) team is pleased to announce version 4.12.2.0 of the MSV platform.
Bug Fixes
- Fixed a Director database issue that would sometimes prevent Jobs from running after new version upgrades
- Fixed an issue where disabling "Auto Interface" on Windows Actors would not persist
- Fixed an issue where using PCAP Capture Enabled with non-root running Actors causes Actions to result in an error
- Fixed an issue where Operational Status displayed a non-existent error
- Fixed an issue where "Run Again" was not working for CLI Actions or Evaluations
- Fixed an issue with the Classic Splunk Integration where the Integration Actor was running into errors while processing raw events
- Fixed an issue where Repeating and Scheduled jobs were not honoring the selected proxy configuration
- Fixed an issue that prevented editing previously-created Preview Remote Integrations
- Fixed an issue where the drop down list was missing for filters in the Actions Library
Known Issues
- OVA Directors have the ability to update Preview Integrations. Non-OVA Directors will be able to update Preview integrations in a coming release.
- The Multisite Reporting feature and Preview Integrations service are not working properly with RHEL8 Directors. We are working to resolve this issue as soon as possible.
- Local Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involve Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV.
Appliance OS Security Update
The latest platform security update can always be found on the Validation Section of the Docs Portal. This security update applies to all versions of the product and is cumulative.
Important Installation Notes
Minimum Director version 4.10.0.0 or higher is required to upgrade to version 4.12.2.0.
As of Actor version 4.12.0.0, we have ended support for Actors on 32-bit architectures, as well as the following OSes: Windows 7, Windows 8.1, Windows Server 2012 R2, and MacOS 10.14 Mojave. Contact support if you have any questions or concerns. In the meantime, you must take the following actions:
- Retire any Endpoint Actors on these platforms
or - Replace the Actors with ones on supported platforms