F I R E E Y E    T E C H N I C A L    D O C U M E N T A T I O N

SECURITY ORCHESTRATOR

RELEASE NOTES

RELEASE 6.1

SECURITY ORCHESTRATOR / 2021

FireEye and the FireEye logo are registered trademarks of FireEye, Inc. in the United States and other countries. All other trademarks are the property of their respective owners.

FireEye assumes no responsibility for any inaccuracies in this document. FireEye reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

Copyright © 2021 FireEye, Inc. All rights reserved.

Security Orchestrator Release Notes

Software Release 6.1.0

Revision 1

FireEye Contact Information:

Website: www.fireeye.com

Technical Support: https://csportal.fireeye.com

Phone (US):

1.408.321.6300

1.877.FIREEYE

Contents

Announcements..................................................................4

FireEye Customer Security Best Practices..............................................................4

Upgrade Security Orchestrator..............................................................4

What's New..................................................................6

Inline Help and Guided Tutorials..............................................................6

Self-Starter Sample Playbooks and Exercises..............................................6

Audit Logging Changes..............................................................6

Test-Run Playbooks and Scripts...................................................6

Test Device Connections..........................................................7

Microsoft Active Directory Authentication over LDAP..................................7

Configurable Worker Threads........................................................7

Updates and Enhancements to Packages......................................7

Security Updates to Apache and SSL............................................7

Restoring a 6.0 Backup to a 6.1 Machine....................................8

New, Modified, or Deprecated CLI Commands..................................8

Modified Commands..............................................................8

Fixed Security Orchestrator Issues......................................................9

Known Security Orchestrator Issues.....................................................11

Technical Support............................................................13

Documentation..............................................................13

   © 2021 FireEye    3

Security Orchestrator Release NotesAnnouncements

Announcements

This document provides an overview of the new features and changes in the FireEye Security Orchestrator 6.1.0 release, including any new commands, resolved issues, and known issues.

FireEye Customer Security Best Practices

Because our quality assurance process includes continuous security testing, FireEye recommends updating all FireEye products with the latest releases as soon as possible. As an overall strategy to reduce risk exposure, customers are also encouraged to follow best practices, which include:

   
• Only issue accounts to trusted administrators
   
• Use strong passwords
   
• Monitor logs

Upgrade Security Orchestrator

You can upgrade to Security Orchestrator 6.1 from version 6.0 only.

To upgrade from an earlier version of Security Orchestrator, you must use snapshots to migrate data from the older version of Security Orchestrator to a new 6.1 virtual machine. You cannot install Security Orchestrator 6.1 directly onto a machine running version 4.x or 5.x.

The following sections in the Security Orchestrator System Administration Guide contain information and steps about deploying a new Security Orchestrator VM and migrating your existing configuration into the 6.1 machine:

   
• Virtual Appliance Installation
   
• Obtain SO Deployment Files
   
• Install the SO Virtual Appliance
   
• Configure the Virtual Appliance at Initial Startup
   
• Set SO Virtual Appliance Date and Time
   
• Access SO Web UI

4

© 2021 FireEye

   
• Troubleshoot SO Web UI Access Issues
   
• Using Snapshots to Save System Configuration
   
• Creating a Snapshot of Your SO Configuration
   
• Importing a Snapshot to Your SO Virtual Machine
   
• Migrating Data Into a New Version of Security Orchestrator
   
• Migrating Data Using a Snapshot Import

What's New

   The FireEye Security Orchestrator release 6.1.0 provides easier onboarding, a better user experience, and security fixes and improves platform performance. This section describes new features in the FireEye Security Orchestrator release 6.1.0.

Inline Help and Guided Tutorials

   A new guided tutorial helps new users learn Security Orchestrator. New inline help is provided in the Web UI. Help and tutorials are delivered using the Knowledge Bot. To use this feature, allow communication between the browser used with Security Orchestrator and the Knowledge Bot servers. See the topic "Enable Inline Help and Tutorials" in the Security Orchestrator System Administration Guide.

Self-Starter Sample Playbooks and Exercises

   New users can learn about the building blocks of playbooks step by step. Sample playbooks and instructions explain how to create playbooks, devices, adapters, forms, tables, and scripts. See the section "Sample Playbooks and Exercises" in the Security Orchestrator User Guide.

Audit Logging Changes

   Audit logs are now displayed for all resource configuration changes.

Test-Run Playbooks and Scripts

   A new "Test-Run" option allows you to test your playbooks and scripts in the playbook builder or the script editor. See the sections "Testing a Playbook" and "Testing a Script" in the Security Orchestrator User Guide.

Test Device Connections

   A new “Test” option on the Devices page allows you to check the connectivity between a device and the appliance before you configure the device. See the section “Testing Device Connectivity” in the Security Orchestrator User Guide.

Microsoft Active Directory Authentication over LDAP

   Security Orchestrator now supports third-party authentication servers such as Microsoft Active Directory for authentication. To configure, authentication, see the section "Configuring Microsoft Active Directory Authentication" in the Security Orchestrator System Administration Guide.

Configurable Worker Threads

   You can now tune performance in Security Orchestrator by updating worker thread configurations in the web.conf file. See the section "Optimizing Performance" in the Security Orchestrator System Administration Guide.

Updates and Enhancements to Packages

   Packages can now include native commands, tables, and forms. The new Manage Content page in the Web UI makes managing packages easier and now indicates which resources have been updated or deleted after creation of a package.

Security Updates to Apache and SSL

   Security Orchestrator 6.1.0 incorporates security updates to Apache and OpenSSL. Apache has been upgraded to version 2.4.6-97.el7.centos and OpenSSL has been upgraded to version 1:1.0.2k-21.el7_9.

   Security Orchestrator Release Notes    What's New

Restoring a 6.0 Backup to a 6.1 Machine

If you need to restore a 6.0 backup onto a 6.1 machine, be aware of the following requirements:

   
• You must create the 6.0 backup using the -withkey and --with-secrets parameters with the fso data backup command.
   
• The web.conf configuration file is not saved by the fso data backup command. If you made changes to this file, you must re-enter them manually after restoring the backup.
   
• The plugin-db.conf configuration file is not saved by the fso data backup command. After restoring the backup to the 6.1 machine, you must manually update the value of plugin.postgresql.password in plugindb.conf. If this value is not updated, plugins that use postgres may not function properly.

   

   

       

IMPORTANT: If the time to live configuration (engine.table_content.min_time_to_live value) was changed in web.conf before the backup was made, you must re-enter the new value manually after restoring the backup. If this value is not updated, Security Orchestrator may not function properly.

   

See the section "Backup and Restore SO Files" in the System Administration Guide.

New, Modified, or Deprecated CLI Commands

The CLI commands in this section were modified for this release.

Modified Commands

   
•        

  fso data backup

         

  The -withkey and --with-secrets parameters are not supported.

     
   
•        

  fso data restore

         

  The import-conf parameter is not supported.

     

Fixed Security Orchestrator Issues

The following issues were resolved in the Security Orchestrator 6.1.0 Release.

The relevant issue tracking numbers for each item are included in parentheses.

   
• On the Playbooks page, automatically triggered playbooks were not marked with the Auto icon. This issue has been resolved. (FSO-1345)
   
• On the All Activity page in the Web UI, incorrect results sometimes were displayed when filters and time controls were applied. This issue has been resolved. (FSO-1393)
   
• In the Web UI, the selection of Boolean values was made more intuitive. (FSO-1397)
   
• The display of multiple filters in the presence of multiple tags was improved. (FSO-1424)
   
• The resource name field is now limited to 256 characters and the description field is now limited to 1000 characters. (FSO-1450)
   
• The new Run Action button on the Playbooks page allows you to run a playbook directly from that page. (FSO-1684)
   
• Plug-ins that used a large number of custom parameters failed to load correctly. This issue has been resolved. (FSO-1702)
   
• Playbook execution status did not automatically refresh on the All Activity page. This issue has been resolved. (FSO-1704)
   
• When a script was copied and pasted into the Script Editor, the Save button was not enabled. This issue has been resolved. (FSO-1822)
   
• Unique task IDs of devices were not displayed in a playbook's device tasks. This issue has been resolved. (FSO-1825)
   
• Moving the mouse wheel did not zoom in and out of the playbook correctly. This issue has been resolved. (FSO-1826)
   
• A minor cosmetic bug in the Custom Script editor was fixed. (FSO-1832)
   
• The default size of the OVA RAM was increased to 32 GB. (FSO-1842)
   
• When a SO admin logged in, the username "FSO Admin" was not displayed correctly. This issue has been resolved. (FSO-1876)

   
•        

             When a new device was added in the Devices page of the SO Web UI, multiple values could not be added for devices or custom parameters of type "list." This issue has been resolved. (FSO-1918)        

     
   
•        

             While editing a Playbook task, if the user clicked outside the Edit Task window, the window closed without saving the user's changes. This issue has been resolved. (FSO-2160)        

     

   Release 6.1    New, Modified, or Deprecated CLI Commands

Known Security Orchestrator Issues

The following issues are known in Security Orchestrator release 6.1.0.

   
• If an existing table has the same name as a table in a new package, package installation may fail. As a workaround, rename the existing table and then install the package. (FSO-2248)

Technical Support

For technical support, contact FireEye through the Support portal:

https://csportal.fireeye.com

Documentation

Documentation for all FireEye products is available on the FireEye Documentation Portal (login required):

https://docs.fireeye.com/

FireEye, Inc. | 601 McCarthy Blvd. | Milpitas, CA | 1.408.321.6300 | 1.877.FIREEYE | www.fireeye.com

   © 2021 FireEye, Inc. All rights reserved. FireEye is a registered trademark of FireEye, Inc. All other brands, products, or service names are or may be trademarks or service marks of their respective owners.