Trellix Enterprise Security Manager 11.6.7 addresses known issues.
This release is cumulative and includes all features and fixes from the previous release. We recommend that you always upgrade to the most current update.
Release details of Trellix ESM 11.6.7
For release dates and version number, see KB90422.
Rating
The rating defines the urgency for installing this update.
This update is recommended for all environments. Apply this update at the earliest convenience.
Upgrade Considerations
Trellix ESM 11.6.x and higher does not support environments with Distributed TESM configurations.
When upgrading to 11.6.x for the first time the normal process to upgrade HA receivers through the UI needs to be slightly altered.
Refer to Upgrade HA receivers in Trellix Enterprise Security Manager 11.6.x Installation Guide.
Skip step 6.
On step 7a, select the primary receiver instead of the secondary receiver in Receiver Management.
Note
The above steps are only needed when upgrading to 11.6.x for the first time.
Resolved issues
This release provides resolution for the following issues.
Category | Reference | Resolution |
|---|---|---|
User Interface | SIEM-39412 | Fixed an issue that caused Policy Editor to load very slowly resulting in UI freeze. |
Correlation | SIEM-39396 | Fixed an issue that was triggering a correlation rule overriding the rule logic. |
Correlation | SIEM-39306 | Fixed an issue that was preventing risk correlation to be triggered for only the matching filter criteria. |
Correlation | SIEM-39331 | Fixed an issue causing field match alarms to trigger overriding its conditions to trigger. |
Correlation | SIEM-39361 | Fixed an issue where multiple correlation rules were triggered for the same base event. |
Watchlists | SIEM-39370 | Special characters can now be used in watchlist values while creating and editing watchlists. |
Reports | SIEM-39305 | Fixed an issue that was causing reports to run immediately and not on the conditions set to run. |
User Interface | SIEM-39372 | Fixed an issue to show correct data and time for events with distribution views. |
Correlation | SIEM-39369 | Fixed an issue with rules getting triggered on an incorrect count of events. |
Filtering, Views | SIEM-23959 | Fixed an issue with dashboard queries where filter events were showing incorrect count. |
Rules | SIEM-27730 | Fixed an issue that was causing Policy Roller to fail to roll out policies when the priority of the rule was Null. |
User Interface | SIEM-39420 | The Run Now button is enabled for
screen of user interface. |
This release provides resolution for the following content issues through a rule update since Trellix ESM 11.6.6.
Category | Reference | Resolution |
|---|---|---|
3rd party, Parsers | SIEM-38939 | Updated the parsing rules for the Oracle Internet Directory data source. |
Known issues
For a list of known issues in this product release, see KB90422.