McAfee Enterprise Security Manager (ESM) MR2

Transcription

1 Release Notes McAfee Enterprise Security Manager (ESM) MR2 About this document Thank you for choosing this McAfee product. This document contains important information about the current release. We strongly recommend that you read the entire document. About this release Release date Files included ESS_Update_9.6.1MR2.signed.tgz ESSREC_Update_9.6.1MR2.signed.tgz RECEIVER_Update_9.6.1MR2.signed.tgz APM_Update_9.6.1MR2.signed.tgz DBM_Update_9.6.1MR2.signed.tgz IPS_Update_9.6.1MR2.signed.tgz Upgrade Paths You can upgrade to MR2 directly from or later. You must upgrade versions before 9.5.x following this path: > > 9.4.2, or later > MR2 Bug Fixes and Enhancements This section provides a description of the fixes and enhancements included in this Maintenance Release. NOTE: This update is cumulative (i.e MR2 contains all the fixes and enhancements that were previously in MR1) and may be installed over the top of GA, MR 1, 2, 3, 4, 5, 6, 7, 8, 9 and GA, MR MR2 Bug Fixes ESM User Interface Auto refresh now picks up new epo extensions. 1

2 Other Other Resolved a failure to boot issue when upgrading to ESM 9.6 or ESM Views Bad Query on views filtering by Device Type ID CLASS ESM Redundant ESM (RESM) Resolved an issue that prevented SNMP Health Requests from being retrieved from a Redundant ESM ESM Other Added support for SMBv2 for file collection Receiver Collectors ESM User Interface Resolved an issue that prevented AWS Cloudtrail Datasource data collection. Resolved an issue that caused and error message while editing the Date time format of ASP mapping in Japanese version ESM Backup / Restore Fixed an issue that caused watchlist entries to not be restored from a full back-up ACE Other ESM Views Match component filter with a comma in correlation rule now works correctly. Filtering by special characters at the beginning of a string no longer results in a Bad Query Error ESM Other Removed symlinks to non-existent startup script ESM Other Accumulator field is now displayed for correlation events ESM Data Enrichment Data Enrichment Source tab now allows non-ascii characters in the Path field ESM Other Removed TLS v1.0 support ESM Other Updated to latest Java version Receiver Other Syslog now gracefully recovers when too many connections are active. 2

3 ESM Other Fixed an issue that prevented the job for Discover NSM Sensors from updating the sensors Receiver Collectors HTTPS curl collector mode now accepts Host Name ESM ESM Redundant ESM (RESM) Data Enrichment Added an optional config file to fine tune rsync for different customer environments. Resolved and issue that caused the data enrichment process to fail when using the LDAP "Description" field content ESM Other ESM Other ESM Alarms Corrected an issue that caused the port number setting to be ignored when importing SFTP data source settings from a CSV file. Set 1TB maximum disk usage limit on DAS drive packet tables. Fixed a regression that prevented internal events from being written ESM Reports Improved query and report speed ESM Other ESM Alarms When modifying a Checkpoint data source with child data sources, all the child data sources were disabled when the IP of the data source wasn't changed. This disabled state is now set only when validation is required for the IP/port of the data source. Added the ability to create alarms for groups of data sources Receiver Other Removed unused symlinks that caused error messages ESM Policy Corrected erroneous conflict errors during policy import process ESM System Properties Corrected an issue that prevented users from removing recipients from groups ESM Reports Fixed an issue that prevented reports with non-default date formats from being run. 3

4 ESM: Views Other Resolved an issue that was causing invalid error messages when viewing the content pack MR1 Bug Fixes ELM Other Resolved an issue that would cause ELM Statistics to show zero logs for some Data Sources, even though the ESM UI shows there are logs in ELM ESM Reports Selecting a custom time range and a date format other than mm/dd/yyyy could produce incorrect data sets and time ranges Database Other Improved the logic to clean temporary files from archive directory when dbserver restarts ELM Database The ELM database would delete old partitions without warning if the database and storage pools were stored on the same device and that device reached 90% full ESM Views Improved the handling of special characters for filtering and views ESM Alarms Device status change alarms now accurately triggers at the data source level ESM Data Enrichment LDAP Data Enrichment would not return any results if a non-ascii character was used in the query , ELM Search Resolved an issue where ELM logs would not be fully decoded when retrieved through ELM Search , Receiver Collectors Data collection would not resume after rebooting VMware vcenter Server ESM Alarms Clicking case link on the generated alarm's Actions tab would result in an error if the case summary contains pipe (' ') character ACE Other Deviation component for flows using event count as the deviation field would fail to write out to the ACE ELM Other When reducing the size of a storage pool the amount of available space would display incorrectly in the storage pools tab of ELM properties. 4

5 ELM Other Improved handling for displaying elm search metadata for different date formats , , Receiver Other Resolved an issue that would cause an error message to report that re-keying a device failed when it was actually successful ESM Views Resolved an issue that would cause long running delete queries to spawn additional queries , ELM Other Logs sent to the ELM would be deleted if no entry is found in ds2rg table ESM Custom Types Custom types in Name/Value groups would not be displayed in the event view for Japanese UI ELM Logs If ELM logs had duplicate archive ids incorrect raw logs would appear in the UI with some events , , , Receiver Other Resolved an issue where unknown events would show at the data source parent level when using SIEM Collector. ELM Redundant Fixed the counting of files for the rsync status to not include close matching numbers like 1, 10 and 11 multiple times ELM Database Resolved an issue where the Being moved lock file was not cleaned up after an ELM DB size increase ESM Policy The Japanese characters in the description when importing correlating rules was not being properly encoded. The import logic was modified to correctly maintain the encoding of characters ESM Flash UI Changing the hostname or vendor/model of a client data source would fail if the data source vendor/model and host name were in use by another clients ESM Redundant ACL setting would not get replicated to Redundant ESM ESM Distributed Resolved an issue that would cause pulling packet data the first time to fail ESM Flash UI When changing the name of existing parameters in the correlation rule editor, the name would change to unknown. The default value for the parameter was changed to always maintain the same format Receiver Other Resolved an issue that prevented parsing of an HTTP data source due to extra white space ESM Security Resolved an issue that caused AD user accounts to stay locked after the lockout duration has expired , , , Receiver Other Resolved an issue that would trigger a device health alarm on a non HA receiver of: "HA status changed from Critical to Warning". ESM Distributed Resolved an issue that would cause the ACE to show out of sync on a distributed ESM ESM Flash UI Resolved an issue that prevented expanding of correlated events in source events when logged as a limited user. 5

6 ESM Reports Resolved an issue that prevented deselected s in an group from being removed from group , Receiver Other IPMI would not function with ERC 1260 receivers , , ESM Watchlist Watchlist would not get all of the file hashes when it was uploaded from ATD Cyberthreat feed ESM Distributed Destination user and Object fields were sporadic in propagating up to the parent ESM , Receiver Collectors Resolved an issue where estreamer would not write , out correct json to be parsed ESM Other Multiple threads of the UpdateMTISThreads would run when the thread takes a long time to finish ESM Flash UI When doing a host lookup with correlation events, ESM Data Enrichment the host lookup would not display in the correct column. Performing data enrichment with a lookup field custom type = 5, the destination fields would not be replaced by data enrichment Receiver HA The default gateway would not be assigned to the shared IP interface after HA fail-over DBM Other The TNS module in the DBM failed to handle a particular data encoding that TOAD (Tool for Oracle Application Developers) was using ESM Reports Resolved an issue that would cause stacking distribution charts to contain incorrect 'others' values ACE Other Resolved an issue that would allow an unsupported field to a deviation ESM Health Monitor Enhancements to health monitor for device communication errors ESM Policy Added user information to policy change history ESM UI When correlating with a large threshold, it was possible to exceed the supported packet length ESM Reports Report would not be generated if Devices filter is empty. Added a check in the UI to validate a device is selected ESM Alarms Alarm acknowledge date and time was incorrectly displaying in the details panel and the clipboard , , , , , ELM Search Enhanced ELM log retrieval to search through all possible log files instead of just one log file. Some log entries in aggregated events were not being displayed ACE Other Added notifications when correlation rules, threshold, and deviations exceed maximum packet length ELM Other Resolved an issue that, in rare instances, prevented logs from being displayed when a user was connected to an ELM through SFTP. 6

7 Receiver Other Resolved an issue that caused syslog messages to be sent to a data source when the host name matched but the port did not match ESM Reports Resolved an issue where the ESM would incorrectly delete temporary files that were being used for running report queries ELM Other Resolved an issue where the bloom does not get set when duplicate ELM id's span multiple partitions ACE Other The correlation rule has never triggered under specific condition ESM Flash UI Updated the label of the ACE communication configuration panel to be correct ESM Rules Resolved an issue that caused extra rows to be added when saving ASP rule text ACE Other Set the maximum allowed value for ACE Risk Correlation Manager threshold to 99% ELM Redundant Resolved an issue that prevented a redundant ELM from syncing completely , , , ACE Other Resolved an issue that caused alarms to trigger more frequently than the Maximum Condition Trigger Frequency (cooldown) setting. ESM Other Resolved an issue that caused false error messages when users tried to view event data ESM Other Improved memory handling when the ESM populates , the device tree and when retrieving a list of correlated events. Resolved an issue where editing blacklist IP addresses would fail due to extra '\' characters present in the commands parameters Bugs McAfee SIEM ESM: Views When exporting table results from a custom case view, the dialog to download the results would not show up McAfee SIEM McAfee SIEM ELM ACE API service would stop running during logging to edsftp. Improved memory handling routines for java correlator processes. 7

8 McAfee SIEM ELM When a DAS entry in the Das.conf file had a uuid of zero, there would be an entry visible in the System > Properties > Database > Data Storage > DAS page which resulted in the appearance of an extra DAS device. Enhancements None All(except IPS) Hardware Added support for Gen 5 Hardware None Added support for Check Point R MR9 Security Fixes McAfee SIEM ESM Updated NTPD to version 4.2.8p9 Bug Fixes McAfee SIEM McAfee SIEM McAfee SIEM McAfee SIEM , , , , , , , , , McAfee SIEM ESM DBM DBM User Interface: Flash (traditional UI) ESM Modifications to the way CPConsoleServer.cfg handles the configuration parameter allow_ssh. DBM would fail to capture traffic from an MSSQL database when using dynamic ports. Removed the option to use nitrofirewall capture from the DBM. When selecting a client data source for filtering event forwarding results, the parent device would be shown on the device form instead of the client data source. Datasource inactivity flags would not properly clear. 8

9 , , McAfee SIEM ELM Improved the performance for obtaining ELM storage pool data. Enhancements None Receiver Other Added Support for CheckPoint R MR8 Security Fixes ESM Security Updated Kernel to resolve Dirty COW CVE (CVSS3 6.4/6.1) ESM Security Updated JRE/JDK package to version u ESM Security Resolved OS command injection (CVSS3 7.2 / 7.0) Receiver Security Resolved issue where file name can execute commands on upload (CVSS3 8.8 / 8.6) Bug Fixes ESM Alarms Alarms would show [object object] as the default values on Destination User filter ESM Alarms Resolved alarms that would generate QueryExec errors after upgrades ESM Database Resolved issue where open file handles would reach 0 even though files were open ESM SNMP Resolved SNMP timeouts. 9

10 ESM System Properties ESM System Properties s would fail to send if TLS and authentication were both enabled. When writing out global blacklist would result in error has been resolved ESM Reports Addressed an issue where the average normalized event severity bar chart was not being displayed in reports , , , REC Collectors estreamer collector restarting several times a day has been resolved. ELM Redundant Partial rsync files would accumulate in /tmp and not be cleaned up ELM Database ELM could incorrectly calculate disk space remaining and remove partitions to free up space ACE Correlation Addressed correlation rules from not triggering when using a contains clause that had Japanese characters in the target string. Enhancements REC Collectors Added support for estreamer to support block type 42 for record type MR7 Bug Fixes , , ELM Redundant Resolved SFTP connectivity issues on redundant ELM , , ESM IOC Indicators of Compromise (IOC) back trace would incorrectly match events when using the URL 10

11 , , ESM Backup & Restore Addressed an issue where restoring the configuration would fail with a ERCELM device , ESM Event Forwarding Resolved time out values that would cause events to be dropped when sending via TCP ESM Backup & Restore ESM Other ESM Other ESM Views ACE Correlation ESM Alarms ESM Properties ELM Storage ESM Other ACE Historical Correlation ESM Other ESM Backup & Restore Resolved issue where performing an ESM backup would result in slower alert inserts. Added logic to ensure enough space in memory to store user input values for active directory logins and user-defined fields in query results. Fixed locked ISO images so they work on an ERU device. Fixed sorting problems with table components. Correlation managers would not filter for flows. Performance modifications for Alarm queries. Increased the timeout for an active directory server with two IP addresses to allow enough time for the ESM to authenticate through the Second IP address if the first one fails. Added a health monitor check to warn when data is about to be over written before the retention period has expired. Enhanced DBSizeChange to keep index and bloom files on /ss1 instead of moving them or creating them on /db2. Health Flags for correlation would not occur in Historical mode on an ACE. NSM rules will not default to enabled. Differential backups now look at the syssettings table to figure out when the last successful backup of the Alert (and Packet), Connection, and Log tables MR6 Bug Fixes 11

12 ESM Views Queries with an * in the Sig ID field would return incorrect results , ESM Upgrade Upgrading the ESM would take longer than expected if Accumulator indexing is enabled Receiver HA ESM Policy Receiver Data Source ESM Correlation The call to WriteConf, which was a recursive call to itself, was corrected to get the configuration file name and allow the function to write corosync.conf as intended. Fixed reversal of time formats when editing ASP rules Updated Amazon CloudTrail collector to use configured proxy server for all traffic. When viewing some correlation events in the GUI the Correlation Details tab would show 'No Details Found' when a special character was used in the name or description of the correlation rule that generated the event , ESM Reports Device filters would not be retained for certain queries , ESM UI The recipients list for the Send Message action of Alarms would be displayed incorrectly ESM Alarms A field match alarm which used a contains match that ended in a backslash (\), would result in: "Error: Could not move file to device (ER126)" ESM Views Resolved an issue where cases assigned to a user that were part of a NOT IN filter remained in the other category Receiver Collector The mount collector would pull files smaller than 256 bytes repeatedly even if they hadn t changed ESM Reports Removed default time filter from "McAfee Collection Rate - Events Per Second" and "McAfee Collection Rate - Events Per Second" reports ESM Policy Historical correlation filter protocol field would allow too many characters ESM Alarms Fixed erroneous triggering of alarms after alarm trigger type is changed ESM Filters Queries for views or reports with a regex in the filters may not return ESM External API REST API would always return a locked status of false for all users when retrieving user list. 12

13 , , ESM External API Modified the caseaddcase and caseeditcase to allow event ids to be added / edited ESM Policy ESM Users & Groups Fixed failure to edit correlation rules in non-english languages. Resolved an issue saving devices to a group ESM Views Resolved an issue where queries with or conditions in the filter would not return results , Receiver Collectors Syslogcollector now waits the proper time before failing when trying to bind to the syslog socket Receiver Other ESM Alarms Resolved an issue with routing of syslog events to data sources when two data sources have the same host name but different port. Fixed encoding of correlation rule filter values ESM Users & Groups The Users and Groups dialog would not load if the initial password prompt was cancelled ESM Views Some view results were not being returned when querying a parent and group of child data sources ESM Other NSM Sensors auto refresh would fail with ErrMsg=Ok, Result: The session is invalid , , ESM Views Column names were displayed incorrectly on CSV files that were exported from a view , , ESM Other Resolved an issue where a content pack shows available to install but no associated file was found on the ESM , ESM Other Improvements to memory handling functions , Database Other Resolved an issue where some Partitions would be marked bad after a clean shutdown , , , , ELM Other Fixed erroneous path in use message when adding second SAN device to an ELM. 13

14 , Receiver Collector The mount collector would fail when the source directory contained many tens of thousands of files Receiver Collector Resolved an issue where SIEM collector connection would drop and events wouldn t be sent to the receiver Enhancements Database Other Decreased ESM shutdown time for systems that have a large number of alert partitions ESM Other Updated to OpenSSL 1.0.2j MR ESM Distributed When adding devices to a distributed ESM they would not be automatically refreshed on the parent system tree ESM Alarms Occasionally alarms would show in the triggered alarm view but not in the alarm pane , , , , ESM Other Source passwords for Watch lists were not encrypted in the database. ESM Other Geo-Location information for some IP addresses were incorrect. Receiver Collector Curl Collector would not pull events as frequent as it was configured to ESM Views The event summary selection would not be maintained in the drill-down view when switching data sources ESM Distributed Pulling packets from the child ESM could result in Malformed data (ER1010). 14

15 , , ESM Distributed When exporting data sources in a distributed ESM model they would sometimes be duplicated. ESM Alarms Certain alarm actions would show up twice in alert details ESM Reports Performance enhancements for CSV Reports ESM Distributed Device type filters for Distributed ESM were not correctly saved after upgrade , , , , ELM Archive In some cases ELM archive would fail to retrieve logs for aggregated events Database Other Enhanced clean-up of temporary files on das1 and ad ESM Reports Non-Admin users would not be able to see reports created by others even when sufficient access had been granted ESM Events Unnecessary internal events would be triggered on login for file deletions ESM Data Source SCP test connect could fail when thousands of files exist in the remote directory ESM Other Event aggregation exceptions would be deleted after a change to custom types ESM Improved memory handling for alarms and reports , ESM Distributed Pulling event would time out if the ESM was more than one day behind on retrievals ESM Other Modified string handling techniques for some API s , ESM Other SNMP V2 Trap Object Identifier was incorrectly formatted , Receiver High Availability Improved error reporting on the process to verify the hi_bit in ha_conf , ESM Alarms Triggered alarm views would not show acknowledged alarms when logged in as Non NGCP user. 15

16 Receiver Collector Improvements to curl collector ESM Other Increased the maximum number of detached partitions the GUI allows to be attached manually to ESM Backup & Restore ESM Backup & Restore last backup success dates were incorrectly using the last differential backup date. Improved space requirement checking for differential backups ESM Policy Performance enhancements for loading policy editor ESM Views Distribution Chart would be blank when filtering or stacking by device type ID ESM Views Table components would return no results with or filters and certain fields in Select statements ESM External API Selecting 159 fields through the External API would result in an error Database Other Improved database rebuild process ESM Policy When filtering by Tag all rules would be returned ESM Redundant A redundant ESM is now able to pull packets and ELM logs ESM Other When viewing triggered alarms not all alarms would show Database Other Improved the process of moving data partitions on the ESM , , , ESM Rules Rule updates could fail while checking for new MTIS threats MR4 16

17 ESM VA Source Testing the connection on a Critical Watch FusionVM Vulnerability Assessment Source with a Server URL could result in VAER1 HTTP Error: Not Found ESM Other Processing cyber threat feeds could have resulted in an access violation message being logged to /var/log/messages ESM Other Improved process for handling files in the /var/log/ace/enrichment folder to prevent the directory from becoming too large. Note: The MR4 upgrade process will delete extraneous files in the /var/log/ace/enrichment folder. If the folder contains a large number of files, (more than a few million) the delete process may take an extended period of time (up to 2 hours). While the delete process in underway, messages similar to the following are logged to var/log/messages: McAfee NGCPRebuild[1130]: Cleaning ACE Enrichment Directory (logged at the beginning of the process) McAfee NGCPRebuild[1130]: Cleaning up stale watchlist files. This process could take an extended period of time. (logged during the process at an interval of approximately 60 seconds) McAfee NGCPRebuild[1130]: Cleaning ACE Enrichment Directory completed. (logged at the end of the process) ESM ELM Search ELM Search downloads would not work for non-admin users ESM Distributed Event pulls would time out when the ESM was days behind on retrievals ESM Events When drilling down on IOC events event data would not populate in the details tab Database Other Partial backup would sometimes fail on a table containing closed partitions Receiver Collectors Mount collector would not run when a configured data source was disabled Database Other Narrows the search window to ensure non-relevant data isn t needlessly searched in order to pull data from child to master ESM. 17

18 ESM Data Source Writing out Data sources failed for receivers with multiple data sources if one of the data sources was an ACE , , ESM IOC False positive could be triggered when a cyberthreat feed was setup with multiple IOC s in one file Database Other Improved error handling for a theoretical data sorting failure Database Other Increased the query performance when handling large amounts IPSID s ESM Other Fixed memory leak associated with Risk Score ESM Other Occasionally while starting services CPServiced would start more than 1 instance MR , ADM Other ADM Kernel Panic MR2 Internal Release only Receiver Other Added functionality to clean out files older than a day from /var/log/data/va/ ESM Data Sources Updated the test connect functionality for SCP data sources to use the select system call to ensure the socket is ready for reading and writing before performing I/O operations ESM Security Modified the location to check for permissions for views to allow groups permission set in earlier releases to persist 18

19 ESM Logging Resolved an issue where the updated column for flow retrieval logs would show a negative number ESM ELM Increased the timeout for ElmDBStop to allow the ELM to startup automatically when there are large storage pools ESM Backup/Restore After a redundant ESM (RESM) failover more than one day of data was backed-up and could run out of disk space ESM Data Source Modified the check for duplicate data sources when a data source is created to not include the new data source in the list of existing data sources ESM Database Modifications made to improve the handling of long strings , ESM Alarms Made modifications so that the queries of alarms with the Condition of Deviation from Baseline and condition query of "Total Events" will run in the background ESM Database A failed move of a single partition could prevent all subsequent partition moves which caused the disk to run out of space Receiver Parsers The OpenVAS xml parser would try to read an item from the xml that did not exist ESM Database Root directory ran out of space due to an error message being repeatedly written to NitroError.Log ESM Database Released a database lock being held to long ESM Database Deletion of an incorrect partition on Receiver was possible in a rare circumstance MR1 Limited Release ESM Views View with Domain and SigID filter would load slowly ESM Database Database - Log table reported negative record count after an index rebuild ESM Database dbserverd threads locked from BFile^.UserCount being stuck 19

20 ESM Other ref lock not being released in some exception cases ESM Database Move Points being set "at 0" would cause partitions to be deleted or move to archive early ESM Correlation Improved error handing to detect corrupt records and continue processing the next record ESM Backups Enhancements to the ESM s backup procedures to include /root/.ssh/known_hosts ESM Views Export View queries would generate multiple times ESM Database Alert table closing down while dbserver is running ESM Rules Modification of a rule does not always show the correct regular expressions ESM Data Source ER15 upon editing Generic Data Source if the user does not have administrator rights ESM Events Event Forwarding would not work when using nondefault sate format user settings ESM Data Source Passwords for data source profiles were not being encrypted ESM Parsers ASP-Test segfault when opening a rule ESM Collectors Syslog-ng Client DS would not route correctly if its hostname contains an underscore character ("_") ESM Filters ER 15 when opening filter list with limited privileges ESM Backups Incremental backup would not start from last good backup ESM Other Assets without IP Addresses are being pulled from epo but should not be ESM Rules ASP Rule Editor: of PCRE's goes beyond limit - But ASP Rule Editor GUI says the opposite ESM Other Getting I/O lock on the SSD file system when reaching a certain I/O load on the ESM X6/X ESM Redundant Event details for a query that runs on a redundant were not correct. 20

21 ESM Filters Report Device filters would always show "Physical Display" , , ESM Other Improved memory handling. StringsS entry logged in /var/log/messages ESM Other GUI hung due to a thread lock not being released Receiver Collectors Syslog relay would not honor Hostname plus Port , , , , , , , Receiver VA Rapid7 Nexpose as Va Source Fails "Server message: Authorization required for API access Receiver Collectors estreamer could fail on an HA receiver pair when eth0 and eth1 are on same subnet Receiver Collectors Amazon Cloudtrail event logs are larger than collector and msgwrite can handle Receiver Collectors estreamer "title verification failed; expected: estreamer" Receiver Parsers The Advanced Syslog Parser (ASP) woulod stop parsing data after a SIEM upgrade if, prior to upgrade, there were only Custom ASP Rules and the Rules were ordered Receiver Data Sources Receiver could not write out data sources when client data sources have the same IP but different ports ACE Report Device filters always show "Physical Display" ADM Other ADM Kernel panic ELM Other Duplicate archive ids for ELM logs would cause incorrect raw logs to appear in the UI with some events ELM Bloom ELM indexing queue would get filled up with duplicate files 21

22 ELM Datbase Increasing size of management database fails with an error that there is not enough disk space even though there is enough disk space ELM Bloom Could not modify ELM Storage Pool. List index (0) out of bounds" error in the ELM's /var/log/messages ELM Bloom elmdbrebuild would fail after upgrade from to , , , Device Inserts Resolved the issue where puling events may result in a success message when zero events were pulled , , ESM Data Source Auto-learned data source would not be removed from the auto-learn file when being removed from the list. Installation instructions For new installation instructions please refer to the following document. McAfee Enterprise Security Manager Installation Guide For upgrade installation instructions please refer to the following document. McAfee Enterprise Security Manager Release Notes Troubleshooting installation issues Common issues encountered during/after installation When using the Chrome browser, you could see that the upgrade tarball will not upload properly to the ESM and is decompressed from a.tgz file. This is due to the way Chrome uploads the file. If you experience this issue we recommend using Internet Explorer, or FireFox to do the upgrade. Recovering from a failed installation Contact McAfee Support. Finding product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 22

23 1. Go to the ServicePortal at and click the Knowledge Center tab. 2. In the Knowledge Base pane under Content Source, click Product Documentation. 3. Select a product and version, then click Search to display a list of documents. 23