Documentation forSecurity Event Manager

SEM 2022.2 release notes

Release Date: April 8, 2022

These release notes were last updated on July 5, 2022.

This document summarizes new features, improvements, and fixed issues in Security Event Manager (SEM) 2022.2, additional features, and upgrade notes and workarounds for known issues.

New in SEM 2022.2

Added features and improvements

  • Improvements to historical events including:
    • Improved importing and exporting of historical event queries.
    • Sharing of selected queries between users.
    • Auditing of saved searches
    • Auditing of historical searches
    • Auditing of CSV exports
  • Improvement to live events including:
    • Improved importing of live event filters
    • Auditing of live searches with changed timeframe
    • Auditing of CSV exports
  • Improvement to agent security:
    • Removed the Settings > Security tab from the SEM Console. This tab provided the option to allow older agents to install using less secure communication techniques.

    • For security reasons, the enable/disable TLS commands have been removed from the CMC manager menu from this release. TLS is now always enabled for database connections.

For information on these features, see SEM Event Views: Live and Historical in the SEM 2022.2 Administrator Guide.

For system requirements, see SEM 2022.2 System Requirements.

If you are looking for previous release notes for SEM, see Previous Version documentation.

New customer installation

For information about installing SEM, see the SEM Installation Guide and the SEM Getting Started Guide.

SolarWinds advises that, as a best practice, the SEM appliance should not be set up to be available to the Internet or any public-facing network. In addition, using this practice will help prevent access by unauthorized users. For further information on SEM security, see the SEM security checklists.

Before you upgrade

Migrate LDAP connectors (introduced in SEM 2020.4)

It is recommended that users remove any ambiguity in their Directory Service Tool connector configurations to allow migration to run as smoothly as possible. This can be by ensuring only one Directory Service Tool connector configuration is set up per domain.

All Directory Service Tool connectors are removed in process of the migration.

Upgrade agents

For AIX, HPUX and Solaris, agents installers now only contain custom Java; this means customers need to install Java themselves as a prerequisite.

  1. Upgrade Java installation to the latest version. See System Requirements for supported versions.
    For AIX agents, see Known Issues - AIX agent not connected after SEM upgrade.
  2. Upgrade SEM agents using latest custom Java installer.

How to upgrade

If you are upgrading from a previous version, use the following resources to plan and implement your upgrade.

SEM  must be upgraded to 2020.2 or 2020.2.1 before upgrading to 2022.2. To upgrade from earlier versions, see the SEM Upgrade Path to help you plan and execute your upgrade.

Download the upgrade package from the SolarWinds Customer Portal.

SSO Login

In SEM 2022.2, the weak, deprecated 3DES and RC4 Kerberos encryption types have been disabled by default. These have been replaced with AES-based encryption.

After upgrading to SEM 2022.2, users who were using 3DES or RC4 encryption will be unable to log into SEM using the SSO login.

There are two options to enable the Kerberos AES encryption:

For the whole Active Directory:

  1. Open the Group Policy Management Console, locate the relevant domain and select Default Domain Policy
  2. Right-click Default Domain Policy and select Edit.
  3. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
  4. Open Network security: Configure encryption types allowed for Kerberos.
    • Enable Define these policy settings.
    • Enable AES128_HMAC_SHA1.
    • Enable AES256_HMAC_SHA1.

For a single user in the Active Directory:

If you have encryption enabled for the whole directory, you do not need to enable individual users.

    Locate the user account in Active Directory Users and Computers.

  1. Select Properties.
  2. Select the Account tab.
  3. In the section titled Account Options, ensure the following options are selected.

CMC

Since SEM 2020.4, a password is required to access the CMC command-line interface. The default CMC password is password. See Change the SEM CMC password for instructions on changing this.

File system consistency check (fsck)

During your upgrade, the system may run a fsck check during reboot. This can last 30 or more minutes depending on the quantity of data in the data partition. With the Debian version upgrade, the file system is configured to initiate the check when certain conditions are met:

  • 21 mounts since the last check (during the 22nd reboot)

Or:

  • Six months since the last check

Supported connectors

The list of currently supported connectors can be found here.

Fixed issues

SEM 2022.2 fixes the following issues:

Case Number Description
00934523 Using not " != " in historical events works correctly for event that have emojis in them.
00893267 C drive is accessible while setting up FIM connector.
00157739 After Linux reboot, the manager now runs as expected.
n/a Issue where Linux agents remained in disconnected state after start or reboot resolved.
n/a Externally CA signed certificate imports correctly.

Third Party CVEs

SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.

CVE-ID Vulnerability Title Description Severity
CVE-2022-22965 Spring4Shell Vulnerability

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment.

If the application is deployed as a Spring Boot executable jar (i.e. the default), it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

9.8: Critical

Known issues

USB Defender service stops working after local policy USB detached
Issue: When USB Defender with Local policy is set up. A USB device that is not on Local policy whitelist is inserted and successfully disconnect by USB Defender. However, when reinserted and successfully ejected once or more than ten times the service fails.
Resolution/Workaround: None.
[Rules builder] [Email templates] - Not possible to select Event Data in Email action for rule with single condition and occurrence settings
Issue: After selecting Send Email Message in a single condition event rule, and selecting an email template, you cannot select Event Data as value for the parameter.
Resolution/Workaround: The rule must be triggered by one event only.
  • Unable to install MacOS agent on BigSur
    • Issue: Unable to install the MacOS agent on BigSur.
    Resolution/Workaround: Execute/start the customJava installer, kill it, and then execute the agent installer with bundled java.
  • "Set time when a rule won't trigger actions after rule was true" not working
    • Issue: "Set time when a rule won't trigger actions after rule was true" functionality in rules does not work.
    Resolution/Workaround: None.

    End of life notices

    Version

    EOL

    Announcements

    EOE Effective

    dates

    		 EOL Effective dates
    6.7 May 18, 2021: End-of-Life (EoL) announcement – Customers on SEM versions 6.7, 6.7.1, and 6.7.2 should begin transitioning to the latest version of SEM. August 18, 2021: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for SEM versions 6.7, 6.7.1, and 6.7.2 will no longer be actively supported by SolarWinds. August 18, 2022: End-of-Life (EoL) – SolarWinds will no longer provide technical support for SEM version versions 6.7, 6.7.1, and 6.7.2.
    2019.4 April 19, 2022: End-of-Life (EoL) announcement – Customers on SEM versions 2019.4, and 2019.4.1 should begin transitioning to the latest version of SEM. October 19, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for SEM versions 2019.4, and 2019.4.1 will no longer be actively supported by SolarWinds. October 19, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for SEM version versions 2019.4, and 2019.4.1.
    2020.2 April 19, 2021: End-of-Life (EoL) announcement – Customers on SEM versions 2020.2, 2020.2.1 and 2020.2.2 should begin transitioning to the latest version of SEM. October 19, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for SEM versions 2020.2, 2020.2.1 and 2020.2.2 will no longer be actively supported by SolarWinds. October 19, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for SEM version versions 2020.2, 2020.2.1 and 2020.2.2.
    2020.4 April 19, 2021: End-of-Life (EoL) announcement – Customers on SEM versions 2020.4, and 2020.4.1 should begin transitioning to the latest version of SEM. October 19, 2022: End-of-Engineering (EoE) – Service releases, bug fixes, workarounds, and service packs for SEM versions 2020.4, and 2020.4.1 will no longer be actively supported by SolarWinds. October 19, 2023: End-of-Life (EoL) – SolarWinds will no longer provide technical support for SEM version versions 2020.4, and 2020.4.1.

    Legal notices

    © 2022 SolarWinds Worldwide, LLC. All rights reserved.

    This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.

    SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

    The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.