IBM Support

Release of the QRadar Incident Forensics 7.3.1 Patch 7 ISO (7.3.1.20181123182336)

Release Notes


Abstract

This technical note contains installation instructions, new features, and includes a resolved issues list for the release of QRadar Incident Forensics 7.3.1 Patch 7 (7.3.1.20181123182336) ISO. These instructions are intended for administrators who are upgrading from QRadar Incident Forensics 7.2.8 Patch 1 or later to QRadar Incident Forensics 7.3.1 Patch 7 using an ISO file.

Content

About this upgrade


These instructions are intended to assist administrators to update appliances from QRadar Incident Forensics 7.2.8 to 7.3.1 Patch 7 by using an ISO file. For more information, see the QRadar Incident Forensics Installation Guide .

QRadar Incident Forensics 7.3.1 Patch 7 uses an ISO file to update to the latest software version. A minimum of QRadar Incident Forensics 7.2.8 Patch 1 (or later) is required to be able to upgrade to QRadar Incident Forensics 7.3.1 Patch 7.

See QRadar: Software update check list for administrators for a list of steps to review before updating your QRadar deployment.

Administrator notes

Current QRadar Incident Forensics Version Upgrades to QRadar Incident Forensics 7.3.1 Patch 7?
QRadar Incident Forensics 7.2.6 (any patch level) or earlier No
QRadar Incident Forensics 7.2.7 (any patch level) No
QRadar Incident Forensics 7.2.8.0 No
QRadar Incident Forensics 7.2.8 Patch 1 or later Yes, use these release notes to complete this process.
QRadar Incident Forensics 7.3.0 (any patch version) See the QRadar 7.3.1 Patch 7 SFS Release Notes for more information. The QRadar SFS file can update an existing 7.3.0 Incident Forensics install to version 7.3.1 Patch 7.
QRadar Incident Forensics 7.3.1 See the QRadar 7.3.1 Patch 7 SFS Release Notes for more information. The QRadar SFS file can update an existing 7.3.1 Incident Forensics install to version 7.3.1 Patch 7.
  1. You must be on QRadar Incident Forensics 7.2.8 Patch 1 or later to upgrade to QRadar Incident Forensics 7.3.1 Patch 7.
  2. The upgrade from QRadar Incident Forensics 7.2.8 Patch 1 to QRadar Incident Forensics 7.3.1 Patch 7 will use an .ISO file. In the past, ISOs were for new appliance installations only, but QRadar Incident Forensics 7.3.1 Patch 7 is an exception to this rule because of the Red Hat kernel update requirements.
  3. Utilities or custom scripts that power users created for their QRadar Incident Forensics deployment should be copied off the system. During the 7.3.1 Patch 7 update, a warning is displayed that only data in /store will be preserved. After the appliance reboots, any scripts, 3rd party accounts, or utilities in /tmp, or /, or /root are deleted. This does not impact any ISO files that were initially mounted by using /root because this cleanup occurs later in the installation procedure.


image-20181119155219-1
Figure 1: If you have installed QRadar 7.2.8 or later, you are not required to install each ISO release to update to QRadar 7.3.1 Patch 7.

The QRadar Incident Forensics 7.3.1 Patch 7 ISO (20181123182336) can upgrade QRadar Incident Forensics 7.2.8 Patch 1 (7.2.8.20161207001258) and later to QRadar Incident Forensics 7.3.1 Patch 7. However, this document does not cover all the installation messages and requirements, such as changes to memory requirements or browser requirements for QRadar Incident Forensics. If you are on a version of QRadar Incident Forensics earlier than QRadar Incident Forensics 7.2.8 Patch 1, you can upgrade to QRadar Incident Forensics 7.2.8 Patch 10 before proceeding to install the QRadar Incident Forensics 7.3.1 Patch 7 ISO.

Before you upgrade


Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade and verify that you have recent configuration backups that match your existing Console version. If required, take an on demand configuration backup before you begin. For more information about backup and recovery, see the QRadar Administration Guide .
  • All appliances in the deployment must be at the same software and patch level in the deployment.
  • Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
  • A QRadar Incident Forensics 7.3.1 ISO is available to upgrade from QRadar Incident Forensics 7.2.8 Patch 1 or install a new appliance or virtual machine. To complete a new install, review the QRadar Incident Forensics Installation Guide .
  • To avoid access errors in your log file, close all open user interface sessions.
  • If you are unsure of the IP addresses or hostnames for the appliances in the deployment, run the utility /opt/QRadar/support/deployment_info.sh to get a .CSV file that contains a list of IP addresses for every managed host.
  • If you are unsure of how to proceed when reading these instructions or the documentation, it is best to ask before you start your upgrade. To ask a question in our forums, see: https://ibm.biz/qradarforums .

Part 1. Staging files and pretesting your appliance


It is important to pretest your deployment to ensure that you will not experience unexpected issues when you update to QRadar Incident Forensics 7.3.1 Patch 7. A pretest is a common precaution to locate potential issues. The pretest does not restart services and can be completed without scheduled downtime. The pretest typically takes between 3 to 5 minutes to complete on each appliance. If for some reason your SSH session is disconnected, you can reconnect to the remote host using screen.

Procedure
The pretest should be completed on all hosts before you attempt to upgrade to QRadar Incident Forensics 7.3.1 Patch 7.

  1. You must install the QRadar Console with 7.3.1 before you begin this procedure.
  2. Download the QRadar Incident Forensics 7.3.1 Patch 7 ISO (5.5 GB) from the IBM Fix Central website: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Security+QRadar+Incident+Forensics&fixids=7.3.1-QRADAR-QIFFULL-20181123182336&function=fixId&parent=IBM%20Security

  3. Use SSH to log in to your Console as the root user.
  4. Open an SSH session to the QRadar Incident Forensics appliance.
  5. Type the following command: screen
  6. To make the directory for the update, type: mkdir -p /media/dvd
  7. To verify you have enough space (5.5 GB) in /root or /var/log for the ISO on all appliances, type:
    df -h /root /var/log | tee diskchecks.txt
    • Best directory option: /root
      It is available on all appliance types, is the best option to host the ISO file.
    • 2nd best directory option: /var/log
      This directory is available on all appliances, but there might not be the required space available.
    • DO NOT USE: /tmp, /store/tmp, or /store/transient for your ISO upgrade. These directories are partitioned as part of the upgrade; you cannot use them as storage locations or mount points for the ISO file.

      If the disk check command fails, retype the quotation marks from your terminal, then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 5.5 GB of space available in a directory to copy the ISO before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 5.5 GB available.

      Reminder: Any utilities or custom scripts that you have created for QRadar Incident Forensics should be copied off the system. During the 7.3.1 update, a warning is displayed that only data in /store will be preserved. Scripts, 3rd party utilities in /tmp, or /, or /root will be deleted during the upgrade.

  8. If there is not 5.5GB of space in /root or /var/log, make directory space for the ISO file.
  9. Using WinSCP or SCP, copy the ISO to the /root or /var/log directory on the QRadar Incident Forensics Console with 5.5 GB of disk space for the ISO file.
  10. To check for any previously mounted files in the /media/dvd directory, type the following command:
    df -h
  11. You must unmount any previously mounted files before you mount this software update file. To unmount any previously mounted files, type the following command:
    umount /media/dvd
  12. To mount the ISO, type the following command: mount -o loop /root/Rhe764forensics7_3_1_20181123182336.stable-7-3-1.iso /media/dvd
  13. To pretest the Console appliance, type: /media/dvd/setup -t
    The pretest output is written to the command window. Review this output after the pretest completes.
  14. Use SSH to open an SSH session to the other appliances in your deployment. QRadar Incident Forensics Support recommends that you run the pretest to identify issues before the update begins.
  15. To pretest the managed host, type: /media/dvd/setup -t

    Results
    If an appliance in your deployment fails the pretest, you can take the recommended action from the pretest utility. The issue must be resolved before the update to 7.3.1 begins to prevent downtime for specific appliances. If there are messages you do not understand or want to discuss further, you can use our forums: https://ibm.biz/qradarforums .

Part 2. Installing the QRadar Incident Forensics 7.3.1 Patch 7 ISO


These instructions guide you through the process of upgrading an existing QRadar Incident Forensics install at 7.2.8 Patch 1 or later to QRadar Incident Forensics software version 7.3.1 Patch 7. The update on the Console must be completed first before you attempt to update QRadar Incident Forensics 7.3.1 Patch 7.

Procedure
You must complete: Staging files and pretesting your deployment before you begin the installation steps listed below.

  1. Use SSH to log in to the Console as the root user.

    NOTE: When you log in, the SSH session should display 7.3.1 as the Console's version. This verifies that the QRadar Console has been updated to 7.3.1, which is required before you update your Incident Forensics appliance.
  2. Open an SSH session to the QRadar Incident Forensics appliance.
  3. To run the ISO installer, type the following command: /media/dvd/setup

    Important: Upgrading from QRadar Incident Forensics 7.2.8 Patch 1 or later to QRadar Incident Forensics 7.3.1 Patch 7 can take 1 to 2 hours to complete on the appliance.

Note: In QRadar 7.3.1 Patch 6, a kernel update was introduced to address issues with appliances failing to log in or list unit files. These issues could lead prevent the appliance from rebooting. This new kernel does not take effect until the appliance is rebooted. You might need to reboot your system manually for the kernel update to take effect.

To work around this issue, do one of the following:

  •  If you are able to use SSH, type the following command: systemctl --force --force reboot
  •  If you are not able to use SSH, you must perform a cold reboot of the appliance. To do this, physically reboot the appliance or use Integrated Management Module (IMM)


Results
A summary of the ISO installation advises you of any issues. If there are no issues, use SSH to log in to managed hosts and start the installer on each host to run the setup in parallel.

Part 3. Installation wrap-up

  1. After all hosts are updated, send an email to your team to clear their browser cache before logging in to the QRadar Incident Forensics SIEM interface.
  2. To unmount the /media/dvd directory, type: umount /media/dvd
  3. Delete the ISO from the appliance.
  4. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and will need to be reconfigured after the upgrade completes.
  5. Review any iptable rules configured because the interface names changed in QRadar Incident Forensics 7.3.1 Patch 1 due to the Red Hat Enterprise 7 operating system updates. Any iptables rules that use Red Hat 6 interface naming conventions must be updated.

Resolved issues for QRadar Incident Forensics 7.3.1 Patch 7


Some APAR links in the table below might take 24 hours to display properly after a software release is posted to IBM Fix Central.

Resolved issues in QRadar 7.3.1 Patch 7
Product Component Number Description
QRADAR SECURITY BULLETIN CVE-2018-2952 Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM QRadar SIEM
QRADAR SECURITY BULLETIN CVE-2018-1728 IBM QRadar SIEM is vulnerable to Cross-Site Scripting
QRADAR SECURITY BULLETIN CVE-2018-8897 IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities
QRADAR SECURITY BULLETIN CVE-2018-1730 IBM QRadar SIEM is vulnerable to XML External Entity Injection
QRADAR SECURITY BULLETIN CVE-2018-8034 Apache Tomcat as used in IBM QRadar SIEM is vulnerable to publicly disclosed vulnerability
QRADAR SECURITY BULLETIN CVE-2018-8036 Apache PDFBox as used in IBM QRadar Incident Forensics is vulnerable to Publicly disclosed vulnerability
QRADAR SECURITY BULLETIN CVE-2017-1622 The Application framework within IBM QRadar SIEM is vulnerable to Improper Certificate Validation
QRADAR VULNERABILITY MANAGER SEARCHES IJ11732 "APPLICATION ERROR" WHEN PERFORMING AN ASSET SAVED SEARCH EQUALS IN A VULNERABILITY SEARCH
QRADAR PROCESSES IJ11821 BUFFERUNDERFLOW EXCEPTION CAN OCCUR BETWEEN THE ECS-EC AND ECS-EP PROCESSES
QRADAR USER INTERFACE IJ10166 USERS CANNOT LOG INTO QRADAR DUE TO THREAD DEADLOCK
QRADAR SEARCHES IJ10862 EXPORTED ASSET SEARCHES CONTAINING A NETWORK FILTER CAN GENERATE BLANK XML OR CSV FILES
QRADAR REPORTS IJ05334 TABLE REPORT VALUE FORMATTING CAN DISPLAY INCORRECTLY FOR AQL AGGREGATED DATA
QRADAR OFFENSES IJ09017 OFFENSES NOT GENERATED WHEN USING A CUSTOM EVENT PROPERTY AS OFFENSE INDEX IN HISTORICAL CORRELATION
QRADAR NETWORK INSIGHTS FLOWS IJ08471 QRADAR NETWORK INSIGHTS CONTENT FLOWS ARE COUNTED AGAINST FLOW LICENSE WHEN THEY SHOULDN'T BE
QRADAR UPGRADES IJ08432 BACKLEVEL JTDS JAR FILES IN QRADAR 7.3.1 CAN SOMETIMES CAUSE AN OUT OF MEMORY WITH ECS-EC-INGRESS PROCESS
QRADAR OFFENSES IJ09017 OFFENSES NOT GENERATED WHEN USING A CUSTOM EVENT PROPERTY AS OFFENSE INDEX IN HISTORICAL CORRELATION
QRADAR REPORTS IJ09036 AQL QUERY WITH AN AGGREGATE THAT IS RUN AGAINST A CURSOR THAT CONTAINS AN AGGREGATE FAILS WITH 'GENRAL FAILURE'
QRADAR REPORTS IJ08228 CREATING AN AQL QUERY WITH A SUB-SELECT CAN CAUSE DASHBOARD TIMESERIES TO FAIL DUE TO THE GLOBAL VIEW CREATED
QRADAR FLOWS IJ11163 NETFLOW V9 / IPFIX INITIATOR/RESPONDER OCTET/PACKET FIELD DATA IS NOT PROCESSED BY QRADAR
QRADAR NETWORK INSIGHTS FLOWS IJ10158 QRADAR NETWORK INSIGHTS (QNI) DECAPPER 'OUT OF MEMORY' INSTANCES CAUSED BY MULTIPLE INSPECTOR COMPONENTS
QRADAR APPLIANCES IJ00712 A STANDBY HA MANAGED HOST REBUILT FROM THE RECOVERY IMAGE MAY NOT MERGE /STORE/TRANSIENT CORRECTLY CAUSING HA ISSUES
QRADAR APPLIANCES IJ03438 /OPT/QRADAR/SUPPORT CAN RUN OUT OF FREE SPACE AFTER UPGRADE DUE TO A LARGE NUMBER OF FAILED REPLICATION FILES
QRADAR OFFENSES IJ10545 OFFENSE SOURCE SUMMARY DISPLAYS INCORRECTLY FOR OFFENSES INDEXED ON REGEX CUSTOM PROPERTIES WITH FIELD TYPE "IP"
QRADAR UPGRADES IJ10818 CHANGES MADE TO LOGROTATE IN QRADAR 7.3.1 PATCH 6 CAN CAUSE /VAR/LOG AND OR /OPT TO RUN OUT OF FREE SPACE
QRADAR EVENTS IJ03211 HOSTCONTEXT SERVICES CAN FAIL TO START DURING A HIGH AVAILABILITY (HA) FAILOVER TO SECONDARY EP/FP APPLIAN
QRADAR DATA IJ08827 HOSTCONTEXT STARTUP ON A MANAGED HOST CAN OCCUR PRIOR TO DATABASE VERIFICATION
QRADAR RISK MANAGER DEVICES IV93144 QRADAR RISK MANAGER DEVICE BACKUPS CAN FAIL WHEN THERE IS AN EMPTY VALUE IN AN PROTOCOL CONFIGURATION ADDRESS SET
QRADAR VULNERABILITY MANAGER SCANS IV99512 CONCURRENT SCHEDULED SCANS THAT INCLUDE IP EXCLUSIONS CAN FAIL TO START AT THE SCHEDULED TIME
QRADAR VULNERABILITY MANAGER SCANS IV91226 QVM SCAN CAN FAIL TO START/PROGRESS WHEN THERE ARE A LARGE NUMBER OF IP ADDRESS SCAN EXCLUSIONS DUE TO A POSTGRES EXCEPTION
QRADAR VULNERABILITY MANAGER REPORTS IJ09183 VULNERABILITY TRENDING REPORTS CAN SOMETIMES BE BLANK
QRADAR VULNERABILITY MANAGER SEARCHES IJ08226 CLICKING 'VIEW IN BY' IN A VULNERABILITY SEARCH DASHBOARD NAVIGATES TO INCORRECT QRADAR WINDOW
QRADAR VULNERABILITY MANAGER SCANS IJ07030 VULNERABILITY SCANS EXPERIENCE A DELAY PRIOR TO COMMENCING WHEN A HIGH NUMBER OF IP EXCLUSIONS ARE DEFINED
QRADAR VULNERABILITY MANAGER SCANS IJ03246 ALL SCHEDULED SCANS THAT RUN ON DECEMBER 1ST START AT MIDNIGHT NO MATTER WHAT TIME THEY ARE CONFIGURED TO START
QRADAR DATA IJ10999 UPDATES TO REFERENCE DATA USING CUSTOM EVENT PROPERTIES (CEP) CAN CAUSE CEP AND RULES TO BE RELOADED/TMP
QRADAR OFFENSES IJ10070 QRADAR CAN STOP GENERATING OFFENSES DUE TO AN INCORRECT NULL CHECK
QRADAR RULES IJ08227 CUSTOM RULE ENGINE DOES NOT USE LOG SOURCES CONTAINED IN 'OTHER' LOG SOURCE GROUP FOR FUNCTIONAL TEST PARAMETERS
QRADAR USER INTERFACE IJ10532 WINCOLLECT AGENT 'LAST HEARTBEAT' STATUS DISPLAYS AS "UNAVAILABLE" WHEN WORKING AS EXPECTED


Where do I find more information?


[{"Business Unit":{"code":"BU008","label":"Security"},"Product":{"code":"SSUK44","label":"IBM QRadar Incident Forensics"},"Component":"Release Notes","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1","Edition":"All Editions"}]

Document Information

Modified date:
03 October 2019

UID

ibm10741175