background image

530-025628-01

2

STRM Log Management Release Notes

Effective reporting and compliance auditing

Compliance-driven report 

templates meet specific regulatory reporting and auditing requirements.

Reliable and tamper-proof log storage

Support of extensive log file integrity 

checks, including NIST Log Management Standard SHA-x (1-256) hashing for 
tamper-proof log archives.

Simple upgrade to full STRM

Provides investment protection for organizations 

with expanding requirements in the areas of threat and compliance 
management.

New and Updated 
Functionality

STRM Log Management 2008.2 provides you with the following new and updated 
functionality:

Activation and License Key Enhancement 

- STRM Log Management 2008.2 

includes several enhancements to activation and license keys including:

-

Activation Keys

 - During installation of STRM Log Management, you must 

now enter an activation key to complete the installation. This activation key 
is available on the license CD. See the instructions that came with the 
license CD to install the activation key.

-

License Keys

 - The License key functionality is now enhanced in the STRM 

Log Management interface to include individual license keys for each 
system in your deployment. 

New Device Extensions Functionality

 - You can now modify how a DSM 

parses logs. For example, you can use a device extension to detect an event 
that has missing or incorrect fields. A device extension can also parse an event 
when the DSM to which it is attached fails to produce a result. 

Universal DSM Enhancement

 - With STRM Log Management 2008.2, the 

Universal DSM includes the following enhancements:

-

Device Extensions

 - Allows you to use the new device extensions 

functionality to enhance the DSM parsing of your logs. 

-

Multiple Universal DSMs

 - Allows you to support multiple Universal DSMs. 

-

Integration with Asset Profiles

 - Using STRM Log Management 2008.2, 

the Universal DSM is associated with an asset profile allowing you to track 
user identity data and associate that information to an asset profile. 

User Roles Enhancement

 - Administrative users can now be assigned 

additional controls including:

-

Administrator Management

 - Allows Administrative users to create and 

edit other administrative accounts. 

-

System Administrator

 - Allows Administrative users to access all areas of 

STRM Log Management. Also, users with this access are not able to edit 
other administrator accounts. 

User Account Enhancement 

- You can now disable a user account without 

deleting the account. A user with a disabled account is no longer able to access 
the STRM Log Management interface.

Summary of Contents for SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1

Page 1: ...ager Log Management Only STRM LM provides a comprehensive log management solution for organizations that want to implement a distributed log management solution to collect archive and analyze network...

Page 2: ...ch system in your deployment New Device Extensions Functionality You can now modify how a DSM parses logs For example you can use a device extension to detect an event that has missing or incorrect fi...

Page 3: ...re information on Release 2008 2 refer to the on line documentation STRM Log Management Installation Guide STRM Log Management Administration Guide STRM Log Management Users Guide STRM Log Management...

Page 4: ...a device requires STRM to forward logs through NSM Note For STRM to correctly process logs from SA and IC the logs should be sent from the devices in WELF format To enable WELF format on the device Un...

Page 5: ...if your license key expired and you uploaded a new license key STRM Log Management did not provide the option to deploy the new license key Changing the Authentication to STRM Log Management Authentic...

Page 6: ...nagement 2008 2 the limit of CIDR ranges you can add is approximately 200 depending on the data on your system Now Able to Apply Any IP Filter When Searching for Events Previously when you attempted t...

Page 7: ...nt 2008 2 this directory structure is properly created Events Appear in Event Viewer and Flows in Flow Viewer After June 30 2008 The Event Correlation Engine license expires on 30 June 2008 This licen...

Page 8: ...e configuration file and restart services Step 1 Open the configuration file on the machine that uses the custom SSL key normally the Web Server console Step 1 Add the directory path to your custom SS...

Page 9: ...oller IC device may appear incorrectly as an Enterasys device Workaround Add the Infranet Controller device manually Infranet Controller Device Appears as Secure Access Device An auto discovered Infra...

Page 10: ...nfiguration change the event query service process restarts and may be temporarily unable to process event searches Workaround Wait between 2 and 3 minutes for the Event Viewer to finish restarting Th...

Page 11: ...per Networks Inc in the United States and other countries JUNOS and JUNOSe are trademarks of Juniper Networks Inc All other trademarks service marks registered trademarks or registered service marks a...

Reviews: