What's New in 6.6.2

• Bug Fixes

• Known Issues

Bug Fixes

This release resolves the following issues:

1. Currently, Policy based retention for EventDB does not cover two event categories: (a) System events with phCustId = 0, e.g. a FortiSIEM External Integration Error, FortiSIEM process crash etc., and (b) Super/Global customer audit events with phCustId = 3, e.g. audit log generated from a Super/Global user running an adhoc query. These events are purged when disk usage reaches high watermark.

2. Bug 842147: Parser process on any FortiSIEM node may have high CPU or even crash, while evaluating event retention policies. This bug was introduced in release 6.6.0.

Known Issues

1. phFortiInsightAI process may consume high CPU on Workers from excessive Win-Security-4624 logs.

   The following workaround is available:

   1. SSH to each Supervisor and Worker node.

   2. Find the file /opt/phoenix/data-definition/FINS-template.json. Open the file for edit and remove the following two entries and then save the file.

      "Win-Security-4624": {
          "ac": "user logged on"
      },
      "Win-Security-4634": {
          "ac": "user logged off"
      }, 
      

   3. Kill phDataManager process on each worker and supervisor by running the following command.

      killall -9 phDataManager

      phDataManager will restart.

   4. Refresh the AI model by running the following on each worker and supervisor:

      1. Stop the phfortiInsightAI service by running the following command.

         service stop phFortiInsightAI

      2. Remove the local model by running the following command.

         rm -rf /opt/fortiinsight-ai/ai_model

      3. Start the phFortiInsightAI service by running the following command.

         service start phFortiInsightAI

         Once the model is removed, and service restarted, the AI will turn back to training mode. Training will resume for 2 weeks time period.

   5. Confirm by running the following command.

      curl http://localhost:8144/api/stats

      It should return

      {"cargo":{"memory":{"free":2182098520,"total":2244476928,"limit":2822242304,"allocated":15100232,"warning_threshold":2547567820,"warning_issued":false},"live":{"status":"training",...

   6. If not, then run the following command.
      

      curl http://localhost:8144/api/live?type=training

2. FortiSIEM uses dynamic mapping for Keyword fields to save Cluster state. Elasticsearch needs to encounter some events containing these fields before it can determine their type. For this reason, queries containing group by on any of these fields will fail if Elasticsearch has not seen any event containing these fields. Workaround is to first run a non-group by query with these fields to make sure that these fields have non-null haves.