Endpoint Security Process Tracker

Module Release Notes Release

1.2.7

Last Updated: September 17, 2023

Announcements ............................................................... 3

FireEye Customer Security Best Practices ......................................................... 3

Process Tracker Module Upgrade Considerations ................................................. 3

Upgrading the Process Tracker Module ................................................ 3

Fixed Process Tracker Issues .................................................... 4

Known Process Tracker Issues .................................................... 5

Documentation ........................................................ 6

1 | Announcements

Announcements

This document provides an overview of the resolved issues and known issues in the FireEye Endpoint Security Process Tracker Module 1.2.7 release.

FireEye Customer Security Best Practices

Because our quality assurance process includes continuous security testing, FireEye recommends updating all FireEye products with the latest releases as soon as possible. As an overall strategy to reduce risk exposure, customers are also encouraged to follow best practices, which include:

Always keep the product version up-to-date.
Limit network access to the management interfaces of the appliance using firewalls or similar measures.
Only issue accounts to trusted administrators.
Use strong passwords.
Monitor logs.
Restrict physical access to the appliance to trusted administrators.

Process Tracker Module Upgrade Considerations

FireEye recommends that you always perform a complete backup of your server before you upgrade it. This ensures that you can recover your Endpoint Security Server if a problem occurs during the upgrade. For complete information about backing up and restoring the server, see the Endpoint Security System Administration Guide.

Note

Be sure to enable quiesce mode for the Endpoint Security Server before you upgrade it or restore a backup to it.

See the Endpoint Security Server Deployment Guide for information about deploying modules to the Endpoint Security Server.

Upgrading the Process Tracker Module

Use the Endpoint Security Module Administration page to upgrade the Process Tracker Module. No changes in configuration or in policy are required after the upgrade. For more information, see the Endpoint Security Process Guard Module Guide.

Endpoint Security Process Tracker Module Release Notes Release 1.2.7 3

2 | Announcements

Fixed Process Tracker Issues

The following issues were resolved in the Process Tracker Module release 1.2.7:

Note

The relevant issue tracking numbers for each item are included in parentheses.

In the Web UI, when viewing record details in the Process Tracker Events page, the Process Cert did not update when you selected another event record. This issue has been resolved. (ENDPT-62442)
When using Firefox to access the Process Tracker Event page, the custom date picker did not appear when specifying a date filter. This issue has been resolved. (ENDPT-59809)
The date picker for Start Time and Create Time was not displayed properly. This issue has been resolved. (ENDPT-57903)
When exporting the grid to a CSV file, if the Args field had an embedded hashtag value, the row was not returned. This issue has been resolved. (ENDPT-59168)
Page navigation within the UI grid was slow. This issue has been resolved. (ENDPT-59059)
Filtering within the UI grid was case sensitive. This issue has been resolved. (ENDPT-53392)
The Process Tracker configuration in the Edit Policy page did not state agent restrictions. This issue has been resolved. (ENDPT-58314)
During backup of the Endpoint Security Server, an unnecessary stack trace was printed in the module log file. This issue has been resolved. (ENDPT-58213)

3 | Announcements

Known Process Tracker Issues

The following issues are known in the Process Tracker Module release 1.2.7.

Note

The relevant issue tracking numbers for each item are included in parentheses.

The Process Path filter produced unreliable results in the Process Tracker grid. (ENDPT-72491)
Many instances of Sequelize errors were recorded in the Process Tracker server module error logs. (ENDPT-62384)
The Certificate Algorithm incorrectly maps into the Certificate Subject field on the Process Tracker alert. (ENDPT-82092)
In the Process Tracker CEF event, the msg field and value are missing. (ENDPT-54000)
The Process Tracker is showing events with timestamps that are out of sync with the Endpoint Security Server. (ENDPT-76209)
The calendar date picker is not always visible when opened from the farthest right column. (ENDPT-84086)
The calendar date picker remains visible despite moving focus to another column. (ENDPT-84176)
The filter for the Process File Cert column does not work. (ENDPT-84070)
The filter for the Type column does not work. (ENDPT-83900)
The values for the Is Signed column and the Signature Verified column differ between the Endpoint Security Web UI and the CSV file export. (ENDPT-84185)

Endpoint Security Process Tracker Module Release Notes Release 1.2.75

4 | Announcements

Documentation

Documentation for all FireEye products is available on the Trellix Documentation Portal and the FireEye Market. Login is required for both sites:

https://docs.fireeye.com

https://fireeye.market/

Endpoint Security Process Tracker Module Release Notes Release 1.2.7

COPYRIGHT

Trellix and FireEye are the trademarks or registered trademarks of Musarubra US LLC, FireEye Security Holdings US LLC, and their affiliates in the US and /or other countries. Other names and brands are the property of these companies or may be claimed as the property of others.