CISCO SWD-14010 Stealthwatch Flow Collector NetFlow User Guide
- June 13, 2024
- Cisco
Table of Contents
CISCO SWD-14010 Stealthwatch Flow Collector NetFlow
Product Information
The Stealthwatch Flow Collector NetFlow Update Patch v7.3.1 is a software update patch for the Stealthwatch Flow Collector NetFlow appliance. This patch, patch-fcnf-ROLLUP008-7.3.1-01.swu, includes several fixes for defects in the previous version.
The patch addresses the following fix:
- Defect SWD-16828: Fixed an issue where Interface Top Reports were showing incorrect results. Rows (all data) were missing when searching for specific hosts or hostgroups, and client or server.
This patch also includes previous defect fixes, which are listed in the user manual.
Product Usage Instructions
Download:
- Go to Cisco Software Central at https://software.cisco.com.
- In the Download and Upgrade section, select “Access downloads”.
- Type “Secure Analytics (Stealthwatch)” in the Select a Product field, then press Enter.
- Select the appropriate appliance model.
- Under Select a Software Type, choose “Stealthwatch Patches”.
- Select the desired release version.
- Download the patch update file, patch-fcnf-ROLLUP008-7.3.1-01.swu, and save it to your preferred location.
Installation:
- Log in to the SMC (Stealthwatch Management Console).
- Click on the Global Settings icon, then click on Central Management.
- Click on Update Manager.
- On the Update Manager page, click on Upload, and then open the saved patch update file, patch-fcnf-ROLLUP008-7.3.1-01.swu.
- Click the Actions menu for the appliance, then click Install Update.
Note: The Flow Collector engine will be stopped, and the appliance will be restarted as part of the patch installation process.
Stealthwatch Flow Collector NetFlow
Update Patch v7.3.1
This document provides a description of the patch and installation procedure
for the Stealthwatch Flow Collector NetFlow appliance v7.3.1.
Stealthwatch Flow Collector NetFlow Update Patch v7.3.1
This document provides a description of the patch and installation procedure
for the Stealthwatch Flow Collector NetFlow appliance v7.3.1.
There are no prerequisites for this patch.
Patch Description
This patch, patch-fcnf-ROLLUP008-7.3.1-01.swu, includes the following fix:
| Defect | Description |
|---|
SWD-16828
| Fixed an issue where Interface Top Reports were showing incorrect results. Rows (all data) were missing when searching for specific hosts or hostgroups, and client or server.
Previous fixes included in this patch are described in a table on the next page.
Download and Installation
Download
To download the patch update file, complete the following steps:
- Go to Cisco Software Central, https://software.cisco.com.
- In the Download and Upgrade section, select Access downloads.
- Type Secure Analytics (Stealthwatch) in the Select a Product field, then press Enter.
- Select the appliance model.
- Under Select a Software Type, select Stealthwatch Patches.
- Select All Release, then select release version.
- Download the patch update file, patch-fcnf-ROLLUP008-7.3.1-01.swu, and save it to your preferred location.
Installation
To install the patch update file, complete the following steps:
- Log in to the SMC.
- Click the Global Settings icon, then click Central Management.
- Click Update Manager.
- On the Update Manager page, click Upload, and then open the saved patch update file, patch-fcnf-ROLLUP008-7.3.1-01.swu.
- Click the Actions menu for the appliance, then click Install Update.
The Flow Collector engine is stopped, and the appliance is restarted as part of the patch installation process.
Previous Fixes
The following items are previous defect fixes i ncluded in this patch:
| Defect | Description |
|---|---|
| SWD-14010 | Fixed an issue with refactor syslog compliance toggling. |
| SWD-15136 | Fixed issue to prevent database backup from canceling. |
| SWD-15235 | Fixed an issue to enable reloading snmpd for configuration changes. |
| SWD-15421 | Fixed an issue with the rotate Chrony log files. |
| SWD-15443 | Fixed issue with add file check before reading SSL files |
| SWD-15465 | Fixed an issue with incorrect patch version on installing multiple |
SWUs.
SWD-15574| Fixed an issue with the initiator setting on ASA bi-directional
flows. (LSQ-5071)
SWD-15592| Fixed the issue where 50% of Traffic Showing was Unknown on the
Dashboard.
SWD-15593| Fixed an issue where some applications were not being detected.
SWD-15679| Fixed issue with secret manager being removed after installing the
v7.2.1 update patches.
SWD-15712| Fixed an issue where the SE Query provided incorrect data.
SWD-15713| Fixed an issue where the v7.2.1 update patch installation failed
due to docker not running.
Defect| Description
---|---
SWD-15730| Fixed and issue where the NVM Process Hash and Parent Process Hash
were missing in Flow Collector.
SWD-15732| Fixed issue that was preventing osaxsd-server from completing the
package upgrade.
SWD-15574| Fixed an issue with setting the initiator on the second half of an
ASA bi-flow. (LSQ-5071)
SWD-15744
| Fixed an issuer where flows without client and server bytes/packets were missing interface information. (LSQ- 5118)
SWD-15779
| Fixed an issue where the Palo Alto, AppId/UserId, fields seemed to initiate
the Flow Collector Oversubscribed alarm. (LSQ-4919 )
SWD-15842| Fixed an issue with system alarms not clearing.
SWD-15885| Fixed an issue support for ASA bi-flows with bytes = 0 and pkts > 0
and Flow Action needs to be set
SWD-15947
| Fixed an issue where TrustSec and user data were missing from active user
sessions in new flows after FC reboot or upgrade.
SWD-15984| Fixed an issue where the eta analysis tool was running when
generating diag pack. (LSQ-5308)
SWD-16024| Fixed an issue to prevent enabling the datastore advance option in
System Config unintentionally.
SWD-16025| Fixed an issue where running a database backup failed. (LSQ- 5358)
SWD-16030| Fixed an issue with the Flow Collector engine indexing the groups
array with values greater than, or equal to, 65535.
SWD-16049| Fixed an issue where the swe-detections-worker service on the Flow
Collector wasn’t registering observations.
Defect| Description
---|---
SWD-16054
| Fixed a Port Scan Alarm issue where the associated flow table was empty
because the client server wasn’t following the initiator order. (LSQ-5366)
SWD-16068| Fixed an issue where docker images weren’t cleaned up during
package upgrade.
SWD-16087/SWD- 16437| Fixed an issue where flow-based Identities were missing
on Users report.
SWD-16111/SWD- 16114| Fixed an issue with SIGSEGV in the Threat Feed Update.
(LSQ-5437)
SWD-16163| Fixed an error with flow duration values calculated by the Flow
Collector engine.
SWD-16183| Fixed an issue where customized applications were not tagging
traffic according to DPI definitions. (LSQ-5456)
SWD-16169 / SWD-16210| Fixed an issue where NetFlow data from Checkpoint
exporters didn’t process properly due to Checkpoint inadvertently using the
PEN field. ( LSQ-5470)
SWD-16284| Fixed an issue with the range policy_id value.
SWD-16333| Enhanced the Flow Data Lost alarm to set limits longer than the
hard-coded, 30-minute threshold. (LSQ-5549)
SWD-16805
Clones: SWD-16783 SWD-16944
| Fixed an issue where Flag counters were not accurate on TCP flows. In
addition, some non-TCP flows were displaying TCP flag counters.
SWONE-7828| Fixed an issue where the ingest service was falling behind and not
catching up.
SWONE-12159| Added TrustSec improvements.
SWONE-14903 / SWONE-18750| Fixed an issue with three memory-related changes to
svc-db- ingest.
SWOS-206| Enabled the upgrade process to continue when upgrading
Defect| Description
---|---
| osaxsd-server.
SWOS-357| Updated cryptography dependencies to versions built against
CiscoSSL.
Contacting Support
If you need technical support, please do one of the following:
-
Contact your local Cisco Partner
-
Contact Cisco Stealthwatch Support
-
To open a case by web:
http://www.cisco.com/c/en/us/support/index.html -
To open a case by email: tac@cisco.com
-
For phone support: 1-800-553-2447 (U.S.)
-
For worldwide support numbers:
www.cisco.com/en/US/partner/support/tsd_cisco_worldwide_contacts.html
-
Copyright Information
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
© 2022 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
References
- Support - Cisco Support and Downloads – Documentation, Tools, Cases - Cisco
- Cisco
- Cisco
- Cisco Software Central
- Cisco Software Central
- Cisco Trademarks - Cisco