Version 11.1

Version 11.1.5

Date: 2021-03-10

What's new:

• 'Flow receive time' was added to Event Evidence in Event Detail to improve analysis of event flows. 'Flow receive time' is shown only if enabled in FCC > FMC Configuration > Flow database fields.

• Flow pairing timeout was increased from 60 to 75 seconds to decrease the number of false positive detections caused by delayed flows of opposite direction.

Fixed issues:

• 7634473: Removed detection of client's attempt to contact DHCP server from 'DHCPANOMALY: FakeServer' submethod if there is no response from the server.

• 'App tag' column is not shown in 'Event Evidence' if empty.

Version 11.1.4

Date: 2021-02-25

Fixed issues:

• 7635147: Data feeds are now sorted correctly in the Perspective settings in data feed selection.

• Fixed an issue that caused ADS to crash in very rare cases on appliances with high load.

• 'Data feed IP' column in Event Evidence was renamed to 'Flow source IP' to match Flowmon Monitoring Center terminology.

Version 11.1.3

Date: 2021-02-15

What's new:

Various performance optimizations to make Event Detail and Event Evidence load faster and improve system responsiveness when analyzing multiple events.

• Event Detail and corresponding Event Evidence load times were reduced especially for the events with long duration and high amount of flows in the Event Evidence.

• Event Evidence is loaded after opening the corresponding tab in the Event Detail.

• Event Evidence now takes the first 1000 (default value that can be changed) flows from the FMC according to the receive time instead of the start time. Thanks to this change the flows load much quicker, however in case of a higher number of flows than the limit, the delayed flows can be missing in the Event Evidence when compared to the list of flows sorted in the FMC according to the start time.

Fixed issues:

• 7634882: Fixed rare issue that caused collector to stop working.

• 7634163: Fixed high system load caused by segfaults in ICMPANOM method in some cases.

Version 11.1.2

Date: 2021-01-20

What's new:

• Work with filters is now significantly faster.

• Increased minimum disk quota due to extended Flowmon Threat Inteligence data.

Fixed issues:

• Resolved an issue that caused the application to freeze for a few minutes when filters were edited multiple times during processing of a large number of events.

• Fixed an error during the import of false positives from an XML configuration.

Version 11.1.1

Date: 2020-12-03

What's new:

• Allowed to add an IP address to multiple filters at once without losing the context.

• Added compatibility with Flowmon OS 11.1.0.

• New interactive Rest API guide replacing the old pdf documentation.

Available directly in the UI (near to user guide) since Flowmon OS 11.1.

• Added user guide for Czech and Japanese languages.

Fixed issues:

• Data feeds are correctly imported from XML configuration.

• The analysis page displays correct times although client and server time zones are not the same.

• 7633738: Missing pre-defined comment containing hostname in the Adding IP to filter dialog when invoked on the Analysis page.

• 7634112: Time-shifted swim line in the visualization on the Analysis page if the event started before displayed interval.

Known issues:

• The user guide for Czech and Japanese languages is not updated for changes introduced in version 11.1.

Version 11.1.0

Date: 2020-09-30

What's new:

• The proxy correlation has been reimplemented for the stream processing.

  • For more information see product specification and user guide chapter Data Feeds.

• The Adobe Flash version of Event Visualization has been replaced with a new one based on the Javascript D3 library.

• The false positive engine has been revamped.

  • The false positive rules are now properly applied in situations when the event is matched by multiple false positive rules.

  • The user is now no longer able to define the time interval for false positives with the targets specified.

  • The usage statistics have been simplified.

• The profile 'live' has been renamed to 'All Sources' to correspond with the FMC naming convention.

• The profile group name identifier has been added to the data feed configuration.

Fixed issues:

• 7631970: The character '&' is now properly displayed in the CSV export.

• The names for standalone data feeds are now properly translated everywhere in the UI.

• The format of the syslog messages has been adjusted to match the CEF standard.

Known issues:

• The user guide for Czech and Japanese languages is not available yet.