Sentinel 8.2.0.1 Release Notes

Issue: In Hyper-V Server 2016, Sentinel appliance does not start when you reboot it and displays the following message:

Workaround: Manually modify the disk UUID. For more information, see Knowledge Base Article 7023143.

Issue: Vulnerability scans report issues, such as the following message, with a vulnerable version of jquery:

Workaround: Ignore the issue since it is a false positive.

Issue: When you upgrade to Sentinel 8.2 HA appliance, Sentinel displays the following error:

Workaround: Before you respond to the above prompt, perform the following:

Issue: Installation of Collector Manager and Correlation Engine appliance fails in MFA mode if the operating system language is other than English. (Bug 1045967)

Workaround: Install Collector Manager and Correlation Engine appliances in English. After the installation is complete, change the language as needed.

Issue: An issue prevents Internet Explorer 11 from being able to open the Event Visualization dashboard. (Bug 981308)

Workaround: Use a different browser to view or modify the visualization dashboard.

Issue: A change to password storage in Sentinel 7.4 SP1 causes the following error to display when upgrading the appliance from versions prior to 7.4 SP1:

Workaround: The warning is expected and you can safely ignore it. There is no impact to the upgrade.

Issue: The Next and Back buttons in the appliance installation screens do not appear or are disabled in some cases, such as the following:

Workaround: Restart the appliance installation.

Issue: Sentinel displays the following message during start up in the server.log file:

Workaround: Ignore the exception. Although the message is displayed, Sentinel works as expected.

Issue: When there is a large number of events whose retention period has expired and SSDM tries to delete those events from Elasticsearch, the following exception is displayed in the server.log file:

Workaround: Ignore the exception. This exception occurs due to the time taken to delete the large amount of data. Although the exception is displayed, SSDM successfully deletes the events from Elasticsearch.

Issue: Sentinel Generic Collector performance degrades when Generic Hostname Resolution Service Collector is enabled on Microsoft Active Directory and Windows Collector. EPS decreases by 50% when remote Collector Managers send events. (Bug 906715)

Workaround: Uninstall the Collector and configure the Sentinel server and Collector Manager to resolve hostname to IP address or vice versa. For more information, see Resolving Hostnames and IP Addresses in the Sentinel Administration Guide.

Issue: If you manually install and enable time synchronization in open-vm-tools, they periodically synchronize time between the Sentinel appliance (guest) and the VMware ESX server (host). These time synchronizations can result in moving the guest clock either behind or ahead of the ESX server time. Until the time is synchronized between the Sentinel appliance (guest) and the ESX server (host), Sentinel does not process events. As a result, a large number of events are queued up in the Collector Manager, which may eventually drop events once it reaches its threshold. To avoid this issue, Sentinel disables time synchronization by default in the open-vm-tools version available in Sentinel. (Bug 1099341)

Workaround: Disable time synchronization. For more information about disabling time synchronization, see Disabling Time Synchronization.

Issue: When FIPS 140-2 mode is enabled in Sentinel, using Windows authentication for Agent Manager causes synchronization with the Agent Manager database to fail. (Bug 814452)

Workaround: Use SQL authentication for Agent Manager.

Issue: The Sentinel High Availability installation in non-FIPS 140-2 mode completes successfully but displays the following error twice:

Workaround: The error is expected and you can safely ignore it. Although the installer displays the error, the Sentinel High Availability configuration works successfully in non-FIPS 140-2 mode.

Issue: In Internet Explorer 11, when you launch the dashboards:

Workaround: Perform the following:

Issue: Restarting the Elasticsearch services in Sentinel fails with the unable to install syscall filter error after adding the Elasticsearch node to the cluster in RHEL 6. (Bug 1068600)

Workaround: Perform the following:

Issue: While using Keytool command, the following warning is displayed: The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12which is an industry standard format using "keytool -importkeystore -srckeystore /<sentinel_install_directory>/etc/opt/novell/sentinel/config/.webserverkeystore.jks -destkeystore /<sentinel_install_directory>/etc/opt/novell/sentinel/config/.webserverkeystore.jks -deststoretype pkcs12". (Bug 1086612)

Workaround: The warning is expected and you can safely ignore it. Although the warning is displayed, Keytool command works as expected.

Issue: In FIPS mode, when processing out-of-the-box threat Intelligence feeds from URLs, Sentinel displays the following error: Received fatal alert: protocol_version. This issue occurs because the out-of-the-box threat feeds now support only TLS 1.2, which does not work in FIPS mode. (Bug 1086631)

Workaround: Click Sentinel Main > Integration > Threat Intelligence Sources. Edit each URL to change the protocol from http to https.

Issue: If Sentinel is integrated with NetIQ Advanced Authentication Framework MFA mode, you do not get logged out of Sentinel dashboards when you log out of Sentinel Main and vice versa due to an issue in the Advanced Authentication Framework. (Bug 1087856)

Workaround: Until a fix is available in the Advanced Authentication Framework, refresh the screen to view the login screen.

Issue: After installing or upgrading to Sentinel 8.2 in high availability mode, launching Sentinel Appliance Management Console displays an error. (Bug 1093574)

Workaround: After installing or upgrading to Sentinel 8.2, if the error is displayed after a failover, run the following command to restart Sentinel services: