IBM Support

Release of QRadar 7.2.8 Patch 3 (7.2.8.20170105231716)

Release Notes


Abstract

A list of the installation instructions, new features, and resolved issues list for the release of IBM Security QRadar 7.2.8 Patch 3 (7.2.8.20170105231716).

Content

Known issue identified
A known issue has been identified where administrators who attempt update HA appliances from QRadar 7.2.8 might experience a pretest issue where the update to Patch 3 fails due to the error: 'Failed to disabled the crossover'. If this issue occurs the administrator can manually disable the crossover service, then run the installer again. After the update completes, the crossover service can be enabled. QRadar Customer Support can assist with this issue (http://ibm.biz/qradarsupport).

Known Issue in 7.2.8 Patch 3
Number Description
IV91816PATCHING QRADAR HIGH AVAILABILITY (HA) PAIR APPLIANCES CONFIGURED USING CROSSOVER CAN SOMETIMES FAIL


Upgrade information
Fix packs are cumulative software updates to fix known software issues in your QRadar deployment. There are five APARs associated with QRadar 7.2.8 Patch 3, which address a number of specific issues in QRadar 7.2.8. QRadar fix packs are installed by using an SFS file. The fix pack can update all appliances attached to the QRadar Console. If your deployment is installed with any of the following QRadar versions, you can install fix pack 7.2.8-QRADAR-QRFULL-20170105231716 to upgrade to QRadar 7.2.8 Patch 3:

Current QRadar VersionUpgrades to QRadar 7.2.8 Patch 3?
QRadar 7.2.3 (any patch level) or earlierNo, a minimum of QRadar 7.2.4 is required.
QRadar 7.2.4 (any patch level)Yes
QRadar 7.2.5 (any patch level)Yes
QRadar 7.2.6 (any patch level)Yes
QRadar 7.2.7 (any patch level)Yes

The 7.2.8-QRADAR-QRFULL-20170105231716 fix pack can upgrade QRadar 7.2.4 (7.2.4.983526) and later to the latest software version. However, this document does not cover all of the installation messages and requirements, such as changes to memory requirements or browser requirements for QRadar. To review any additional requirements, see the QRadar Upgrade Guide. If you are on a version of QRadar earlier than QRadar 7.2.4, you must upgrade to QRadar 7.2.4 before proceeding to QRadar 7.2.8. For more information, see the QRadar Software Upgrade Progression technical note.

Important: A QRadar 7.2.8 ISO is available on IBM Fix Central for administrators to want to install a new appliance or virtual machine. Administrators who want to complete a new install need to review the QRadar Installation Guide.


Before you begin
Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade. For more information about backup and recovery, see the IBM Security QRadar Administration Guide.
  • To avoid access errors in your log file, close all open QRadar sessions.
  • The fix pack for QRadar cannot be installed on a managed host that is at a different software version from the Console. All appliances in the deployment must be at the same software revision to patch the entire deployment.
  • Verify that all changes are deployed on your appliances. The patch cannot install on appliances that have changes that are not deployed.
  • The .SFS file is only capable of upgrading existing QRadar installations. A QRadar 7.2.8 ISO is available for administrators to want to install a new appliance or virtual machine. Administrators who want to do a new install need to review the QRadar Installation Guide.


Installing the QRadar 7.2.8 Patch 3 Fix Pack
The instructions guide administrators through the process of upgrading an existing QRadar version at 7.2.4 or later to the newest software version.



    Procedure
    1. Download the fix pack to install QRadar 7.2.8 Patch 3 from the IBM Fix Central website: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%2BSecurity&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.2.0&platform=Linux&function=fixId&fixids=7.2.8-QRADAR-QRSIEM-20170105231716&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc
    2. Using SSH, log in to your system as the root user.
    3. Copy the fix pack to the /tmp directory on the QRadar Console. Note: If space in the /tmp directory is limited, copy the fix pack to another location that has sufficient space.
    4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
    5. Change to the directory where you copied the patch file. For example, cd /tmp
    6. To mount the patch file to the /media/updates directory, type the following command:
      mount -o loop -t squashfs 728_QRadar_patchupdate-7.2.8.20170105231716.sfs /media/updates
    7. To run the patch installer, type the following command: /media/updates/installer
      Note: The first time that you run the fix pack, there might be a delay before the fix pack installation menu is displayed.
    8. Using the patch installer, select all.
      • The all option updates the software on all appliances in the following order:

        1. Console
        2. Event Processors
        3. Event Collectors
        4. Flow Processors
        5. Flow Collectors
      • If you do not select the all option, you must select your Console appliance.

        As of QRadar 7.2.6 Patch 3 and later, administrators are only provided the option to update all or update the Console appliance as the managed hosts are not displayed in the installation menu. After the Console is patched, a list of managed hosts that can be updated is displayed in the installation menu. This change was made starting with QRadar 7.2.6 Patch 3 to ensure that the Console appliance is always updated before managed hosts to prevent upgrade issues.

        If administrators want to patch systems in series, they can update the Console first, then copy the patch to all other appliances and run the patch installer individually on each managed host. The Console must be patched before you can run the installer on managed hosts.

        If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes.

    9. After the patch completes and you have exited the installer, type the following command: umount /media/updates
    10. Administrators and users should clear their browser cache before logging in to the Console.

      Results
      A summary of the fix pack installation advises you of any managed host that were not updated. If the fix pack fails to update a managed host, you can copy the fix pack to the host and run the installation locally.

      After all hosts are updated, administrators can send an email to their team to inform them that they will need to clear their browser cache before logging in to the QRadar SIEM interface.



Resolved issues

Note: Some APAR links in the table below might take 24 hours to display properly after a software release. A full APAR link for all QRadar versions is available

Issues resolved in 7.2.8 Patch 3
Number Description
IV89519RULES THAT TEST AGAINST REFERENCE MAP OF DATA SETS CAN SOMETIMES FIRE UNEXPECTEDLY
IV89901QRADAR AUTO UPDATE FEATURE CONFIGURED TO USE A PROXY SERVER CAN FAIL AFTER PATCHING
IV91030 QRADAR APPS THAT REQUIRE SPECIFIC USER ROLE PERMISSIONS CAN STOP WORKING AFTER PATCHING TO QRADAR 7.2.8 PATCH 1
IV91617 QFLOW APPLIANCES CAN STOP SENDING FLOWS TO FLOW PROCESSORS AFTER PATCHING TO QRADAR 7.2.8
IV92220TIME SERIES DATA ACCUMULATION DOES NOT WORK FOR NON-ADMIN DOMAIN USERS WITH MULTI-TENANCY DASHBOARD

Issues resolved in 7.2.8 Patch 2
Number Description
NONEQRADAR 7.2.8 PATCH 2 DOES NOT INCLUDE ANY RESOLVED ISSUES (APARs). THIS UPDATE INCORPORATES FRAMEWORK CHANGES IN ORDER TO SUPPORT THE NEW QRADAR NETWORK INSIGHTS APPLIANCE (19xx) IN A QRADAR DEPLOYMENT. THIS SOFTWARE VERSION WAS NOT PUBLISHED AS A GLOBAL SOFTWARE RELEASE. THIS DOWNLOAD IS ONLY AVAILABLE FROM QRADAR SUPPORT.

Issues resolved in 7.2.8 Patch 1
Number Description
SECURITY BULLETINAPACHE POI AS USED IN IBM QRADAR SIEM IS VULNERABLE TO VARIOUS CVEs (CVE-2012-0213, CVE-2014-3529, CVE-2014-3574, CVE-2014-9527, CVE-2016-5000)
SECURITY BULLETINIBM QRADAR SIEM IS VULNERABLE TO VARIOUS CGI VULNERABILITIES (CVE-2016-5385, CVE-2016-5387, CVE-2016-5388)
IV77767 QRADAR USER INTERFACE OUTAGES CAN OCCUR WHEN TRYING TO LOAD THE MANAGED SEARCH RESULTS PAGE
IV83509 USING 'WHEN THE EVENT(S) HAVE NOT BEEN DETECTED...' RULE WITH A RESPONSE TO CREATE NEW EVENT, THAT EVENT HAS INCORRECT QID
IV83701 ERRORS VISIBLE IN QRADAR LOGGING AFTER A CUSTOM EVENT PROPERTY HAS BEEN SUCCESSFULLY DELETED
IV84025 UNABLE TO DELETE RULES THAT ARE ADDED TO THE GROUP 'ANOMALY'
IV84615 RULE OR BUILDING BLOCK DELETION CAN FAIL WHEN THERE ARE INVALID SEARCHES
IV86422 'MORE OPTIONS' IS DISPLAYED TWICE WHEN PERFORMING A RIGHT CLICK OF A SOURCE AND/OR DESTINATION IP IN A NETWORK ACTIVITY SEARCH
IV86683 THE EVENT PAYLOAD INFORMATION FIELD DOES NOT PROPERLY DISPLAY UTF DATA IF IT CONTAINS CONSECUTIVE SPACES OR A TAB CHARACTER
IV87248 HIGH AVAILABILITY CONSOLE WITH CROSSOVER CONNECTIONS CAN HANG AND/OR FAIL DURING QRADAR PATCHING
IV87577 QUICK FILTER CONTAINING DOUBLE-BYTE CHARACTERS ON LOG AND/OR NETWORK ACTIVITY TAB DOES NOT WORK AS EXPECTED
IV87796 CUSTOM EVENT PROPERTIES DO NOT FORWARD THROUGH A CUSTOM RULE RESPONSE WHEN USING JSON FORMAT
IV87859 SOME LOG SOURCES CAN FAIL TO BE IMPORTED DURING A CONTENT MANAGEMENT TOOL IMPORT
IV88275 NON-ADMIN QRADAR USERS ARE UNABLE TO FILTER ON 'EVENT PROCESSOR'
IV88279 USER ROLE WITH ONLY 'MANAGE LOG SOURCES' UNDER 'DELEGATED ADMINISTRATION' CANNOT PERFORM A QRADAR DEPLOY FUNCTION
IV88324 THE SYSTEM HEATH (QRADAR HEALTH CONSOLE) FEATURE CAN HAVE VARIOUS PROBLEMS AFTER APPLYING A QRADAR PATCH
IV88392 ORDERING OF ASSETS BY IP ADDRESS SOMETIMES DOES NOT WORK AS EXPECTED
IV88708 QRADAR VULNERABILITY MANAGER - ASSET DETAILS RISK POLICY SCREEN SHOWS INCORRECT TIMESTAMP IN LAST EVALUATED FIELD WHEN TIME ZONE IS SET FOR NEW ZEALAND
IV89064 THE QRADAR ARIEL API CAN SOMETIMES RETURN NO RESULTS WHEN PROCESSING LARGE NUMBERS OF SEARCH RESULTS
IV89173 QRADAR VULNERABILITY MANAGER - CIDR DATA ENTRY VALIDATION FOR SCANNERS DOES NOT WORK AS EXPECTED
IV89196 SEARCHING ON COMPRESSED DATA USING FILTER 'RETENTION BUCKET IS' RETURNS NO RESULTS
IV89308 THE QRADAR RULES PAGE FAILS TO LOAD OR TAKES A LONGER THAN EXPECTED TIME TO LOAD
IV89309 SORT ON 'COUNT DESCENDING' ORDERING NOT WORKING AS EXPECTED IN REPORT OUTPUT
IV89345 QVM: CIS SCAN RESULT STATUS CAN SOMETIMES DISPLAY AS FAIL INSTEAD OF UNKNOWN IN THE USER INTERFACE
IV89365 QVM VULNERABILITY FILTERING BY VENDOR AND DATE RANGE SOMETIMES DOES NOT RETURN THE COMPLETE LIST OF VULNERABILITIES
IV89367 QRADAR SYSTEM NOTIFICATION: 'TRANSACTION SENTRY: RESTORED SYSTEM HEALTH BY CANCELLING HUNG TRANSACTIONS OR DEADLOCKS
IV89393 CONTENT MANAGEMENT TOOL (CMT) EXPORT OF CUSTOM RULES FAILS WITH A NULLPOINTER EXCEPTION
IV89408 QRADAR VULNERABILITY MANAGER SCANS UNEXPECTEDLY DISPLAY A ZERO VULNERABILITY COUNT AND NO ASSETS CREATED FROM THOSE SCANS
IV89516 SAVED SEARCHES ATTEMPTING TO USE CVE-ID NUMBER DATA IN REFERENCE SETS DO NOT WORK AS EXPECTED
IV89665 FILTERING ON 'USERNAME IS ANY OF' " " (A BLANK SPACE WITHIN QUOTES) DOES NOT DISPLAY AS A CURRENTLY APPLIED FILTER
IV89901 QRADAR AUTO UPDATE FEATURE CONFIGURED TO USE A PROXY SERVER CAN FAIL AFTER PATCHING
IV90087 SEARCHES CAN TAKE A LONGER THAT EXPECTED TIME TO COMPLETE IN QRADAR 7.2.8 GA
IV90323 UNABLE TO DELETE REFERENCE SET ELEMENTS USING THE QRADAR USER INTERFACE
IV90372 ATTEMPTING TO ADD AN ADVANCED SEARCH (AQL) TEST TO A RULE CAN CAUSE THE USER INTERFACE WINDOW TO BECOME UNRESPONSIVE
IV90419 EVENT DATA WRITTEN INTO QRADAR AT VERSION 7.2.3.X OR PRIOR CANNOT BE READ BY QRADAR VERSION 7.2.7.X AND 7.2.8 GA
IV90460 QRADAR DEPLOY FUNCTION CAN FAIL AFTER PATCHING TO QRADAR 7.2.8 GA
IV90646 QFLOW PROCESS CAN STOP WORKING AS EXPECTED ON FLOW APPLIANCES AFTER PATCHING TO QRADAR 7.2.8 GA
IV90649 PATCH PROCESS TO 7.2.8 GA FAILS DUE TO A USER AND AUTHORIZED SERVICE HAVING THE SAME NAME
IV90777 NO FLOWS OR EVENTS VISIBLE IN THE QRADAR USER INTERFACE AFTER RESTORING A CONFIGURATION BACKUP FROM 7.2.8 GA

Issues resolved in 7.2.8
Number Description
IV81172 SQL EXCEPTION WHEN RUNNING EVENTS/LOGS REPORTS BASED ON ADVANCED SEARCH FOR ASSETS
IV87841 RULE TEST WITH MULTIPLE REFERENCE SETS ONLY MATCHES FIRST REFERENCE SET IN TEST
IV82547 WEB APPLICATION XJAVASCRIPT FILTERING BROKEN
IV84386 CRITSIT: LOG ACTIVITY - UI EXCEPTION POPUP WHEN MOUSING OVER IP ADDRESSES
IV88370 REFERENCE DATA - BULK LOADING PERFORMANCE NEEDS WORK
IV84710 ASSET SCREEN IN UI IS SLOW WHEN THE NUMBER OF ASSETS IS MODERATE TO LARGE
IV85584 RULE WIZARD UI ISSUES
IV79236 CRITSIT: CANNOT ACCESS RULE WIZARD WHEN NAVIGATING TO AN EVENT THROUGH AN OFFENSE
IV85435 OFFENSE NAMING NOT WORKING CONSISTENTLY
IV87029 INDEX ROLLER BUG
IV70567 AUTOUPDATE HTTPS AND PROXY INTERCEPTION - CONNECT FAILURES BY UPDATECONFS.PL
IV84567 OFFENSES OVER TIME REPORTS CAN MISMATCH OFFENSE SCREEN
IV86839 FILTERING IN LOG SOURCES WHILE SORTED BY EPS CAUSES EXCEPTION
IV82557 NULLPOINTEREXCEPTION IN DATA DELETION CAUSES USER UNABLE TO DELETE RULE OR CUSTOM EVENT PROPERTY
IV89021 EVENTS CONTAINING ESCAPED CHARACTERS ARE DISPLAYED INCORRECTLY IN THE CUSTOM EVENT PROPERTY SCREEN






Where do I find more information?

[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"Documentation","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 May 2019

UID

swg27049342