Notes for upgrading the Manager from 10.1 or 11.1 to 11.1.19.61

Enhanced security measures for proxy-based SSL/TLS decryption

Starting with this release of 11.1, enhanced security measures have been implemented to bolster both inbound and outbound proxy-based SSL/TLS decryption. The new features include the following:

Proxy-based SSL decryption is supported on NS9600 (standalone and stack), NS9500 (standalone), NS7600, NS7500, and NS3600 Sensors.
Support for jumbo frame parsing.
SSL decryption exclusions apply to both inbound and outbound SSL decryption.
Support for 4096-bit RSA and up to 521-bit ECDSA certificates.
HTTP2 traffic inspection with TLS is supported.

Note
The re-signing CA certificate must be created for server authentication and added to the browser as a trusted authority without purpose limitations.
The "Outbound" Block Flow configuration will apply to "Inbound" and may block inbound flow if an internal web server uses expired/untrusted CA certificates. Thus, an exception rule with the specific internal web server IP should be added to allow inbound flow without decryption when block flow is configured.
Once Inbound proxy is enabled, all Inbound traffic will be decrypted; However, it is recommended to create a proxy rule for Inbound SSL decryption.

License requirements for proxy-based SSL decryption

Model	System license	SSL license	Virtual license
NS9600 (standalone and stack), NS7600, and NS3600 Sensors	Requires a separate system license for each throughput per device.	Requires one SSL license per device, regardless of throughput.	NA
NS9500 (standalone) and NS7500 Sensors	Requires a separate system license for each throughput per device.	Requires an SSL license based on the device system license.	NA

A new command show ssl proxy is included to support the SSL enhancements.

Support for SMB and DCERPC layer 7 data collection and SmartVision attack related L7 metadata and alerts export to Trellix Network Investigator

Starting with this release of 11.1, Trellix IPS supports collecting layer 7 data for SMB (SMBv1 and SMBv2) and DCERPC protocols (over TCP). It also exports the SmartVision attack related L7 metadata related to these protocols from IPS Sensors and alerts from IPS Manager, when the integration between Trellix IPS and Trellix NI is enabled. The SmartVision alerts and L7 metadata collected for SMB and DCERPC protocol traffic and exported to NI further enhances its SmartVision capabilities for detecting malicious activities, such as malware lateral movement, data exfiltration, and beaconing.

Consider the following if you want to enable the detection and export of SmartVision attacks related L7 metadata and alerts related to SMB and DCERPC protocols to NI:

You need to use Manager and Sensor(s) running on 11.1 Update 8 and later, along with a compatible signature set (11.10.28.4 and above) that includes SMB and DCERPC related attack signatures.
Manager running on 11.1 Update 8 and later includes additional L7 data fields for SMB (under the netbios-ss section) and DCERPC protocols in the Devices → <Admin Domain Name> → Devices → <Device Name> → Setup → Advanced → L7 Data Collection page. These L7 fields related to SMB and DCERPC protocols are applicable only for Sensors running on 11.1 Update 8 version or later and can be customized accordingly.
Note
DCERPC L7 data collection is supported over TCP only.
When Trellix IPS and Trellix NI is integrated, Manager sends all relevant alert data (including SmartVision attacks) to NI. For SMB and DCERPC protocols, Sensors running on version 11.1 Update 8 or later send only SmartVision attack-related L7 metadata to NI.

Database pruning enhancements in the Manager

With this release of 11.1, a few enhancements have been made in the Trellix IPS Manager to speed up and optimize the task of database pruning. From this release onwards, the Manager creates and maintains a separate (active) partition for iv_alert_data, iv_alert, and iv_packetlog tables that stores alert and packet log data based on user configuration (that is, number of days or number of alerts configured). When the alert pruning activity is triggered (as per the configuration performed on Manager → <Admin Domain Name> → Maintenance → database Pruning → Alert Pruning page), all data is deleted at once, thus speeding up the database pruning process.

Support for script files for advanced malware detection

Starting with this release of 11.1, Trellix IPS supports script files to be scanned while configuring an advanced malware policy. It is available for configuration under the File Scanning Options section in the Policy → <Admin Domain Name> → Intrusion Prevention → Policy Types → Advanced Malware page. To know the list of advanced malware file extensions supported by signature sets, refer to KB96988.

After configuring the advanced malware policy, you need to assign it to the required Sensor monitoring resources such as ports, interfaces, and sub-interfaces. You must do a configuration and signature set update for any changes in the policy to take effect.

Enhancements around SSL key push failure in the Manager

Previously, the reason for SSL key push failure was undetermined. With this release of 11.1, a thorough analysis revealed that the failures were due to missing or corrupted certificates. Additionally, SSL key push would fail when a new shared secret key was issued. This enhancement provides a clear resolution in the Manager, displaying the reason for the SSL key push failure.

Terminology updates in the UI

Navigation Path	Prior to 11.1.19.61	11.1.19.61 and later
Devices → <Admin Domain Name> → Manager Management	The Synchronize Policies menu Policy tab shows the synchronization status for all the Managers added to your Central Manager.	The Policy tab from Devices → <Admin Domain Name> → Manager Management → Synchronization shows the synchronization status for all the Managers added to your Central Manager.
Devices → <Admin Domain Name> → Manager Management	The Synchronize Faults menu from Devices → <Admin Domain Name> → Manager Management → Synchronize Faults allows automatic synchronization of faults between the Managers and the Central Manager.	The Faults tab from Devices → <Admin Domain Name> → Manager Management → Synchronization allows automatic synchronization of faults between the Managers and the Central Manager.
Manager → <Admin Domain Name> → Users and Roles → Roles	On clicking icon to create a new role: Add a custom role page is displayed. Privileges field has two sections - Available and Assigned. You can use or icon to assign or unassign privileges for the role.	On clicking icon to create a new role: Role Details panel is displayed on the right side of the page. Privileges field includes a list of all privileges with checkboxes. You need to select the required checkbox(es) to select privilege(s) for the role.
Manager → <Admin Domain Name> → Setup → Central Manager	All configurable fields come under the Central Manager section of the page. Click Finish to save the changes; or click Refresh.	The Central Manager section includes the Status field and rest of the fields are available under Define Trust section of the page. Click Configure to save the changes.
Manager → <Admin Domain Name> → Setup → Proxy Server	One of the fields available is User Name.	The field is renamed to Login Name.
Manager → <Admin Domain Name> → Reporting → Preferences	The Preferences page includes the following: 3 sub pages - Header and Footer, Language, and Output Limits. While editing, in the Header for generated reports section of the Header and Footer page: Click the Edit Logo button that allows you to choose between Text, Image, and Trellix Logo (Default) for the right header section of the report. The right header section comes with a drop-down with [None] and Text.	The Preferences page includes the following: 3 tabs: Header & Footer, Language, and Output Limits. While editing, in the Header for generated reports section of Header & Footer tab of the Preferences page: You can directly choose between Text, Image, and Trellix Logo (Default) for the right header section of the report. The right header section comes with Header Right Detail field with a textbox to enter text.
Manager → <Admin Domain Name> → Reporting → Configuration Reports	During the configuration of any report: Configuration options of any report selected are displayed on the top of the page. Report output option is named as Output Format. When the report is configured, click Submit to generate the report. Click to close the configuration options and come back to the reports page.	During the configuration of any report: Configuration options of any report selected are displayed in a window at the right side of the page. Report output option is renamed to Report Format. When the report is configured, click Run to generate the report. Click to close configuration options window of a specific report.
Manager → <Admin Domain Name> → Integration → TLC	Export to file link and Open TLC Console button is available in the Export Certificate section of the page. Import Certificate section includes New TLC Certificate, Current TLC Certificate, and Upload TLC Certificate fields.	Export and Open TLC Console buttons are displayed on the lower left side of the page. New TLC Certificate, Current TLC Certificate, and Upload TLC Certificate fields appear in the page without any section header.
Manager → <Admin Domain Name> → Integration → HP Network Automation	A note regarding customized message appears in the Message Preference field.	A tooltip regarding customized message appears in the Message Preference field.

Apart from the terminology updates mentioned above, this release of Manager (11.1.19.61 and later) displays the following changes:

The following pages have been removed, and consequently, all associated UI configuration options, buttons, and related dashboards have been removed from the other pages in the Manager:
1. Network Forensics page (in Analysis → Network Forensics)
2. Endpoint Executables page (in Analysis → Endpoint Executables)
3. NTBA Quarantine Events page (in Manager → <Admin Domain Name> → Setup → Notification)
4. Related dashboards that have been removed: Top Applications (NTBA), Top Destinations (NTBA), Top Endpoint Executables (NTBA), Top Files (NTBA), Top Sources (NTBA), and Top URLs (NTBA).
The Reconnaissance Policy configuration report has been removed from Manager → <Admin Domain Name> → Reporting → Configuration Reports page.

This release provides the following enhancements related to platforms, environments, or operating systems:

Apache Solr upgrade

Starting with this release, the IPS Manager uses Apache Solr version 8.11.4 that includes additional security against new vulnerabilities and bug fixes.

JDK upgrade

Starting with this release of 11.1, the IPS Manager uses JDK version 1.8u432-b06 which includes additional security against new vulnerabilities.

Apache Tomcat server upgrade

Starting with this release of 11.1, the Tomcat server used in the Manager is upgraded to version 9.0.102. This server update provides a collection of security fixes.