Please be advised that two of the Enterprise Snare Agents have patch updates available – the Enterprise Snare Agent for Windows and the Enterprise Snare Agent for MS SQL.
For the Enterprise Snare Agent for Windows:
- Improve debugging output
Enhanced debugging support is added for the windows agent. To output debug logs to a file, and after stopping the snare service, the agent is run from administrative console, ie. SnareCore.exe -c -d9 >> log.txt
Then log.txt file will include the event IDs of all the events that SnareCore will capture, regardless if
they are ignored by objectives.
- Windows Agent Crashing on occasion with USB events
There was an issue with the registry bookmark handling of the events specially when dealing with USB events (where Enable active USB auditing? is selected on Network Configuration in the web UI). Due to this issue, Snare might crash while processing USB events. This issue is fixed in this release and now bookmarks and USB events work correctly together.
- SnareMSSQL does not remove its service on uninstall
An issue was identified with the uninstaller of the SnareMSSQL v1.4.1, v1.4.2 and v1.4.3 agent versions. Due to this issue if the uninstaller was run on a SQL server standalone machine then the uninstaller may not remove the SnareMSSQL service which could be left in a disabled state requiring a reboot to clear. This issue is fixed in this release. Now uninstaller removes the SnareMSSQL service correctly during uninstall.
- The MSSQL agent picks the machine hostname for current events instead of event hostname
An issue was found for installs that use cluster mode with the ‘system’ column on current events page. Due to this issue, sometimes, the machine hostname was shown in the system column instead of current active cluster node name. This issue is fixed in this release and now the system column shows the appropriate active node name.
- Issue with the loadinf option on cluster machine
- Error handling astray when checking groups
An issue was found with the way errors were reported on the web UI during the ‘Check Groups’ operation from objective page. Due to this issue, the next error was appended with the previous one; causing confusing error text. This issue is fixed in this release.
These updates can be downloaded from your client area, should you wish more information please contact us.