IBM Support

Release of the QRadar Network Insights 7.3.1 Patch 3 ISO (7.3.1.20180327211425)

Release Notes


Abstract

This technical note contains installation instructions, new features, and includes a resolved issues list for the release of QRadar Network Insights 7.3.1 Patch 3 ISO (7.3.1.20180327211425). These instructions are intended for administrators who are upgrading from QRadar 7.2.8 Patch 3 or later to QRadar Network Insights 7.3.1 Patch 3 by using an ISO file.

Content

What's new


For information on what's new in QRadar products for version 7.3.1, see: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/c_qradar_ov_whats_new_731.html

About this upgrade


These instructions are intended to assist administrators to update appliances from QRadar 7.2.8 to QRadar Network Insights 7.3.1 Patch 3 by using an ISO file. This ISO can update QRadar SIEM, QRadar Risk Manager, and QRadar Vulnerability Manager products from 7.2.8 to version 7.3.1 Patch 3.

QRadar 7.3.1 Patch 3 uses an ISO file to update hosts to the latest software version. A minimum of QRadar 7.2.8 Patch 1 (or later) is required to be able to upgrade to QRadar Network Insights 7.3.1 Patch 3. Each host must be updated individually.

If you have installed QRadar 7.2.8 version or later, you are not required to install each ISO release to update to QRadar 7.3.1 Patch 3.

Current VersionISO Upgrades to QRadar Network Insights 7.3.1 Patch 3?
QRadar Network Insights 7.2.8 Patch 3 or laterYes, use these release notes to complete this process.
QRadar Network Insights 7.3.0 (any patch version)See the QRadar 7.3.1 Patch 3 SFS release notes.
QRadar Network Insights 7.3.1 See the QRadar 7.3.1 Patch 3 SFS release notes.



Figure 1: If you have installed QRadar 7.2.8 or later, you are not required to install each ISO release to update to QRadar 7.3.1 Patch 3.




Administrator notes

  1. The QRadar Console must be updated before you update your QRadar Network Insights appliance.
  2. If you have a software installation, you need your Red Hat Enterprise ISO and the QRadar Network Insights ISO. Administrators with software installations on their own hardware must read the QRadar Network Insights Install Guide to understand how to partition their systems appropriately.
  3. QRadar Network Insights must be on QRadar 7.2.8 Patch 3 or later to upgrade.
  4. The upgrade from QRadar 7.2.8 Patch 3 to QRadar Network Insights 7.3.1 Patch 3 will use a .ISO file. Previously, ISOs were for new appliance installations only, but QRadar 7.3.1 Patch 3 is an exception to this rule because of the Red Hat kernel update requirements.
  5. The ISO must be mounted to the appliance and run locally on each host.
  6. The 7.3.1 Patch 3 upgrade will take longer than expected due to the kernel changes to Red Hat 7 Enterprise. Early upgrade customers are reporting 2 to 2.5 hours to upgrade the Console appliance. You should be aware of this longer time frame and plan your maintenance accordingly.
  7. If power users created utilities or custom scripts for their QRadar deployment, these files should be copied off the system. During the 7.3.1 Patch 3 update, a warning is displayed that only data in /store is going to be preserved. After the appliance reboots, any scripts, 3rd party accounts, or utilities in /tmp, or /, or /root will be deleted. This does not impact ISO files mounted initially using /root because this cleanup only occurs later in the installation procedure.


Before you upgrade


Ensure that you take the following precautions:

  • Back up your data before you begin any software upgrade and verify that you have recent configuration backups that match your existing Console version. If required, take an on demand configuration backup before you begin. For more information about backup and recovery, see the IBM QRadar Administration Guide.
  • All appliances in the deployment must be at the same software and patch level in the deployment.
  • Verify that all changes are deployed on your appliances. The update cannot install on appliances that have undeployed changes.
  • A QRadar Network Insights 7.3.1 Patch 3 ISO is available to upgrade from QRadar 7.2.8 Patch 3 or install a new appliance or virtual machine. To complete a new installation, review the QRadar Network Insights Installation Guide.
  • If you are unsure of the IP addresses or hostnames for the appliances in the deployment, run the utility /opt/qradar/support/deployment_info.sh to get a .CSV file with information about the QRadar deployment. The CSV file will contain a list of IP addresses for each managed host.
  • If you are unsure of how to proceed when reading these instructions or the documentation, it is best to ask before starting your upgrade. To ask a question in our forums, see: http://ibm.biz/qradarforums.

Part 1. Staging files and pretesting your deployment (required)


It is important that you pretest your deployment to ensure that you will not experience unexpected issues when you update to QRadar 7.3.1 Patch 3. A pretest is a common precaution that should be taken before you install an update to locate potential issues. The pretest does not restart services and can be completed without scheduled downtime. The pretest typically takes between 3 to 5 minutes to complete on each appliance. If for some reason your SSH session is disconnected, you can reconnect to the remote host using screen.

Procedure
The pretest should be completed on all hosts by the administrator before you attempt to upgrade to QRadar 7.3.1 Patch 3.

  1. Download the QRadar Network Insights 7.3.1 Patch 3 ISO (5+ GB) from the IBM Fix Central website: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Security+QRadar+Incident+Forensics&fixids=7.3.1-QRADAR-QIFFULL-20180327211425&source=SAR&function=fixId&parent=IBM%20Security

    NOTE: QRadar Incident Forensics and QRadar Network Insights use the same ISO for both products to upgrade from 7.2.8 to 7.3.1 Patch 3.

  2. Use SSH to log in to your Console as the root user.
  3. Type the following command: screen
  4. To make the directory for the update, type: mkdir -p /media/cdrom
  5. To verify that you have enough space (5.5 GB), type: df -h /root /var/log | tee diskchecks.txt
    • Best directory option: /root
      It is available on all appliance types, and is the best option to host the ISO file.
    • 2nd best directory option: /var/log
      This directory is available on all appliances, but there might not be the required space available.
    • DO NOT USE: /tmp, /store/tmp, or /store/transient for your ISO upgrade. These directories are partitioned as part of the upgrade and administrators cannot use them as storage locations or mount points for the ISO file.

      If the disk check command fails, retype the quotation marks from your terminal, and then re-run the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have a minimum of 5.5 GB of space available in a directory to copy the ISO before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less than 5.5 GB available.

      Reminder: Utilities or custom scripts that administrators have created for QRadar should be copied off the system. During the 7.3.1 update a warning is displayed that only data in /store will be preserved. Therefore, scripts, 3rd party utilities in /tmp, or /, or /root will be deleted during the upgrade.

  6. If there is not 5.5GB of space in /root or /var/log, the administrator must make directory space for the ISO file.
  7. Use WinSCP or SCP to copy the ISO to the /root or /var/log directory on the QRadar Network Insights appliance.
  8. To mount the ISO on all appliances, type mount -o loop /root/Rhe764QRadar7_3_1_20180327211425.stable-7-3-1.iso /media/cdrom
  9. To pretest the Console appliance, type: /media/cdrom/setup -t
    The pretest output is written to the command window. Review this output after the pretest completes.
  10. Use SSH to open an SSH session to the other appliances in your deployment. QRadar Support recommends that all administrators run the pretest on each host to identify issues before the update begins.
  11. To pretest the managed host, type: /media/cdrom/setup -t

    Results
    If an appliance in your deployment fails the pretest, take the recommended action from the pretest utility. The issue must be resolved before the update to 7.3.1 Patch 3 begins to prevent downtime for specific appliances. If there are messages you do not understand or want to discuss further, you can use our forums http://ibm.biz/qradarforums to get advice. Administrators can open a ticket directly with QRadar Support (http://ibm.biz/qradarsupport).


Part 2. Installing the QRadar Network Insights 7.3.1 Patch 3 ISO


These instructions guide administrators through the process of upgrading an existing QRadar Network Insights install at 7.2.8 Patch 1 or later to QRadar 7.3.1 Patch 3. The update on the Console must be completed before you attempt to update QRadar Network Insights.


Procedure

  1. Use SSH to log in to the Console as the root user.
  2. Use SSH to log in to the QRadar Network Insights appliance.
  3. To run the ISO installer on the Console, type the following command: /media/cdrom/setup

    Important: Upgrading from QRadar Network Insights 7.2.8 Patch 1 or later to QRadar Network Insights 7.3.1 Patch 3 can take approximately 1 to 2 hours.


Results
A summary of the ISO installation advises you of any issues. If there are no issues, administrators can use SSH to log in to managed hosts and start the installer on each host to run the setup in parallel.


Part 3. Installation wrap-up

  1. After all hosts are updated, send an email to your team to inform them that they will need to clear their browser cache before they log in to QRadar SIEM.
  2. To unmount the /media/cdrom directory on all hosts, type: umount /media/cdrom"
  3. Administrators can delete the ISO from all appliances.
  4. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and must be reconfigured after the upgrade completes.
  5. Review all configured iptable rules because the interface names have changed in QRadar 7.3.1 Patch 3 due to the Red Hat Enterprise 7 operating system updates. Any iptables rules that use the Red Hat 6 interface naming conventions must be updated.



Resolved issues


Some APAR links in the following table might take 24 hours to display properly after a software release is posted to IBM Fix Central.
Resolved issues in QRadar 7.3.1 Patch 3
Product Component Number Description
QRADAR INCIDENT FORENSICSSECURITY BULLETINCVE-2018-1418IBM QRadar Incident Forensics, as found in IBM QRadar SIEM, is vulnerable to an authentication bypass leading to remote command injection
QRADARSECURITY BULLETINCVE-2017-1724IBM QRadar SIEM is vulnerable to cross-site scripting
QRADAR INCIDENT FORENSICSSECURITY BULLETINCVE-2017-1723IBM QRadar Incident Forensics, as used in IBM QRadar SIEM, is vulnerable to authenticated path traversal
QRADARSECURITY BULLETINCVE-2017-1722IBM QRadar SIEM is vulnerable to SQL Injection
QRADAR INCIDENT FORENSICSSECURITY BULLETINCVE-2017-1721IBM QRadar Incident Forensics, as found in IBM QRadar SIEM, is vulnerable to remote code execution
QRADARSECURITY BULLETINCVE-2014-3576IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2011-4314IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2016-4970IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2015-5262IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2016-3092QRadar SIEM contains vulnerable components
QRADARSECURITY BULLETINCVE-2015-0250IBM QRadar SIEM contains vulnerable components
QRADARSECURITY BULLETINCVE-2016-9878IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2015-5262IBM QRadar SIEM contains vulnerable components and libraries
QRADARSECURITY BULLETINCVE-2017-1624IBM QRadar SIEM is vulnerable to incorrect permission assignment.
QRADARSECURITY BULLETINCVE-2017-1733IBM QRadar SIEM is vulnerable to information exposure through log files.
QRADARSECURITY BULLETINCVE-2017-12163Open Source Samba as used in IBM QRadar SIEM is vulnerable to information exposure.
QRADARSECURITY BULLETINCVE-2017-12629Open Source Apache Solr as used in IBM QRadar Incident Forensics is vulnerable to arbitrary code execution.
QRADARSEARCHIJ00857RESOURCE LEAK IN ARIEL CAN CAUSE QUERY PROCESSING TO STOP
QRADARREPORTSIV98739CHANGES MADE TO CUSTOM COLUMN DEFINITION LAYOUT IN LOG/FLOW ACTIVITY DO NOT PERSIST
QRADARSEARCHIV95449USING THE 'UPDATE' BUTTON ON A LOG ACTIVITY SEARCH PAGE THE DAY OF A DST (TIME) CHANGE MOVES THE START/END TIME ONE HOUR
QRADARSEARCHIV91635QUICK SEARCHES CANNOT BE REMOVED FROM THE QUICK SEARCH LIST
QRADARREPORTSIJ01012A REPORT RUN AGAINST A LOG ACTIVITY SAVED AQL SEARCH MAY BE GENERATED WITH AN ERROR.
QRADARREPORTSIJ00416LOG AND NETWORK ACTIVITY EXPORTS TO CSV DISPLAY INCORRECT COLUMN NAMES
QRADARREPORTSIJ00066TABLE REPORTS USING ACCUMULATED AQL DATA DISPLAY INCORRECT COLUMNS
QRADAREVENT DATAIJ03379EVENT DATA PROCESSED INTO SPILLOVER CAN SOMETIMES FAIL TO PARSE WHEN PROCESSED BY THE REGULAR QRADAR PIPELINE
QRADARAPI SEARCHIV98260API SEARCHES USING A COMPLETED ARIEL SEARCH CAN SOMETIMES RETURN WITH AN ERROR 500
QRADARREPORTSIJ03534SOME GLOBAL VIEWS NOT WORKING AS EXPECTED AFTER UPGRADING TO 7.3.1.X CAUSING NO DATA IN DASHBOARDS AND FAILED REPORTS
QRADARKERNELIJ00141DISK MAINTENANCE DELETES /STORE/ARIEL/FLOWS (RECORDS AND PAYLOADS) DIRECTORY ON DATANODES THAT RECEIVE EVENTS ONLY
QRADAR NETWORK INSIGHTSFLOW COLLECTIONIJ04056PORT BASED APPLICATION MAPPINGS ARE IGNORED WHEN USING QRADAR NETWORK INSIGHTS
QRADAR NETWORK INSIGHTSFORENSICSIJ00952QNI DECAPPER STOPPED BECAUSE OF A RHEL OUT OF MEMORY FUNCTION
QRADARHIGH AVAILABILITYIJ03342NETFLOW TRAFFIC CONTAINING SUPERFLOWS CAN SOMETIMES REPORT INCORRECT FIRST/LAST PACKET TIME
QRADARAPPLICATION INSTALLIJ02076QRADAR APPS INSTALLED ON AN APPNODE CAN SOMETIMES FAIL TO LOAD/OPEN/INSTALL
QRADARAPPLICATION INSTALLIJ01144APPS THAT TAKE LONGER THAN 8 MINUTES TO INSTALL MAY BE STOPPED BY THE MARATHON HEALTH CHECK REGARDLESS OF THE APP HEALTH CHECK
QRADARAPPLICATION INSTALLIJ00207QRADAR APPLICATIONS CAN FAIL TO INSTALL OR UPGRADE WHEN THERE IS INSUFFICIENT FREE SPACE IN /TMP
QRADARUSER INTERFACEIV99511LOG SOURCE GROUP WINDOW CAN SOMETIMES FAIL TO LOAD WHEN GREATER THAN 1000 LOG SOURCES EXIST IN A GROUP
QRADARINSTALL/UPGRADEIJ03213QRADAR SYSTEMS BUILT AT 7.2.2.-7.4 CAN FAIL TO UPGRADE TO 7.3.1.X WITH A 'TA_DSM_INFO' VIOLATES FOREIGN KEY ERROR
QRADARDSM EDITORIJ00975A SESSION LEAK IN TOMCAT MAY OCCUR WHEN USING THE DSM EDITOR
QRADARHIGH AVAILABILITYIV94966XX48 HIGH AVAILABILITY APPLIANCES CAN BECOME UNRESPONSIVE DURING DRBD SYNCRONIZATION WHEN CONFIGURED WITH CROSSOVER
QRADARHIGH AVAILABILITYIJ03669UPGRADE TO QRADAR 7.3.X CAN FAIL ON HIGH AVAILABILITY (HA) SYSTEMS WITH 'ERROR EXECUTING 30-CHECKPARTITIONS.SH'
QRADARINSTALL/UPGRADEIJ03410QRADAR PATCH PRETEST CAN FAIL WHEN A DEPLOYMENT HAS MORE THAN NINE (9) NAT IDS
QRADARINSTALL/UPGRADEIJ02095VIS CAN FAIL TO START DURING UPGRADE TO QRADAR 7.3.0.X
QRADARINSTALL/UPGRADEIJ01522QRADAR UPGRADE FROM 7.2.8.X TO 7.3.0.X CAN SOMETIMES FAIL ON APPLIANCES WITH BONDED INTERFACES
QRADARINSTALL/UPGRADEIJ01120FACTORY REINSTALL FAILS ON QRADAR APPLIANCES THAT HAVE BEEN UPGRADED FROM 7.2.8 TO 7.3.0
QRADARINSTALL/UPGRADEIJ00999UPGRADING TO QRADAR 7.3.0 MAY LEAD TO A 4GB ISO AND OTHER FILES IN /STORETMP
QRADARINSTALL/UPGRADEIJ00902STATIC ROUTES CONFIGURED IN QRADAR 7.2.8 ARE REMOVED DURING AN UPGRADE TO 7.3.0
QRADARINSTALL/UPGRADEIJ00882AFTER A 7.3.0 UPGRADE, SERVICES MAY FAIL TO START ON THE APPLIANCE AFTER A REBOOT
QRADARLICENSINGIV99772'THE NUMBER OF CONFIGURED LOG SOURCES IS APPROACHING OR HAS REACHED THE LICENSE LIMIT' SYSTEM EVENTS
QRADARLICENSINGIV97442'THE EPS OR FPM LICENSE POOL IS OVER-ALLOCATED. PLEASE CONTACT YOUR ADMINISTRATOR' MESSAGE ON LOG/NETWORK ACTIVITY TAB
QRADARUSER INTERFACEIJ01488QRADAR'S TOMCAT PROCESS CAN RUN OUT OF AVAILABLE FILE HANDLES CAUSING USER INTERFACE STABILITY/FUNCTIONALITY ISSUES
QRADARDATABASEIV85442THE X-FORCE SCASERVER PROCESS CAN FAIL TO START DUE TO DATABASE FILE CORRUPTION AFTER AN UPDATE
QRADAR VULNERABILITY MANAGERSCAN POLICYIV98247CLICKING 'SAVE' AFTER EDITING A SCAN POLICY CAN APPEAR TO HANG AND NOT SAVE SUCCESSFULLY
QRADAR VULNERABILITY MANAGERREPORTSIV95105REPORTS CREATED FROM VULNERABILITY SCAN PROFILES CAN SOMETIMES BE BLANK
QRADAR VULNERABILITY MANAGERINSTALL/UPGRADEIJ04398PATCH/UPGRADE TO QRADAR 7.3.1 PATCH 2 CAN HANG FOR AN EXTENDED PERIOD OF TIME (HOURS) WITH "VULN_MAP_ASSET_MV DOES NOT EXIST"
QRADAR VULNERABILITY MANAGERSCAN PROFILEIJ00368SAVING A SCAN PROFILE CAN TAKE LONGER THAN EXPECTED
QRADARAPIIV98655REFERENCE SETS THAT CONTAIN LARGE DATASETS THAT ARE LOADED VIA THE API CAN SOMETIMES CAUSE UI INSTABILITY/INACCESSABILITY
QRADARUSER INTERFACEIV98452EMAIL RESPONSE USING CUSTOM EMAIL TEMPLATE DISPLAYS A TEMPLATE STRING CODE INSTEAD OF 'N/A' FOR NULL CUSTOM PROPERTIES
QRADARCUSTOM EVENT PROPERTIESIJ02479CUSTOM EVENT PROPERTIES ASSIGNED TO A LOG SOURCE ARE NOT VISIBLE IN SEARCH FILTER FOR NON-ADMIN USER





Where do I find more information?



[{"Product":{"code":"SS6E69","label":"IBM QRadar Network Insights"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"--","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
17 June 2018

UID

swg27050925