Version 12.4

Introduction

We are excited to announce the features and enhancements implemented in version 12.4 of Flowmon ADS. This release:

• Enables event reporting through Syslog using TCP to specific targets.
• Improves performance (especially the responsiveness of the Analysis page) in large installations

Flowmon ADS 12.4.3 release date: 24th February 2025

Let us know your feedback

Customers helped to choose and validate some of the features that went into this release. We want to hear from you to continue to improve Flowmon ADS. You can request to join and participate in pre-release activities on the Flowmon Customer Validation Program (CVP) and vote on and submit your product ideas on our ideas portal. Thank you for helping to make Flowmon ADS better!

What's New in Flowmon ADS 12.4?

Event reporting through Syslog using TCP

There is better flexibility with event reporting using Syslog because you can report events to a specific target (IP:port) using the TCP protocol. Previously, you could use only the UDP protocol for a direct target, or TCP for all targets defined in the Configuration Center.

How to enable

To use this feature, go to Settings → Processing → Custom Actions → Syslog and when creating or editing a Syslog, select "ADS syslog sender" as the target, and then select the TCP protocol.

Performance improvements

• Improved the load speed of the Analysis page and its content in distributed architecture deployments.
• The Analysis Summary is loaded in parallel to the rest of the content on the Analysis page.
• Responsiveness on the Data Feeds page is improved when making actions (edit, delete, start, and stop) on installations with a large number of Data Feeds.
• Source IP addresses are loaded faster on the Analysis page, especially in environments with a large number of events.

Other changes

• Users are informed about upcoming blacklist feed availability changes on the Blacklist page and through a bell message. The following message is shown:
  "Starting with ADS 13.0, all Flowmon Origin blacklists will be accessible only on appliances with license with valid support."
• PHP was updated to version 8.3.
• MITRE ATT&CK® mapping was updated to version 15.

Fixed issues

Issues fixed in Flowmon ADS 12.4.3

Ticket number	Issue topic	Issue details	Resolution details
212094	ADS Event Evidence	The loading of flow data in ADS Event Evidence degraded when being used frequently.	The database was optimized to improve performance when loading flow data for ADS Event Evidence.
212767	IDS Event Evidence	IDS Event Evidence did not include flow data from slave units when Flowmon ADS was deployed in distributed architecture.	The Master unit is now queried instead of slave units to correctly provide flow data for IDS Event Evidence from all slave units.
-	SYSCHECK	The SYSCHECK:Duplicity submethod reported packet duplicities incorrectly.	The submethod now correctly reviews only the UDP flows, removing false detection over TCP flows.

Issues fixed in Flowmon ADS 12.4.2

Ticket number	Issue topic	Issue details	Resolution details
204814, 206990, 210185, 211221, 211248	System	Editing filters sometimes causes the Flowmon ADS User Interface (UI) to become unavailable.	Fixed a database function that could occasionally cause system deadlock.
-	SIP	Flowmon ADS sometimes reports SIPFLOOD events for phones that are behaving correctly.	Fixed a flow pairing issue that could result in false-positive detection.
-	Detection methods	The DNSANOMALY:TCPHighTraffic events report a high amount of unsucessful flows.	Unsuccessful TCP connections sent towards a server are no longer counted towards detection (data limit).

Issues fixed in Flowmon ADS 12.4.1

Ticket number	Issue topic	Issue details	Resolution details
205847	Domain name	The Source IP domain name is not shown on the Analysis page, even if the information exists (for example, the information is shown in the General IP Information or on the Events page).	The domain name is now shown on the Analysis page too.
206690, 207233	System	After multiple filter edits in a short period, the Flowmon ADS UI is not available.	Fixed a database function that could occasionally cause system deadlock.
206697	Quotas	Flowmon ADS shows an "Insufficient data quota set. All events have been deleted due to insufficient ADS database size quota. Please check the quota settings." error message when the quotas settings are correct and events are being deleted.	Fixed a rare issue that caused the database autovacuum function to stop working, resulting in exceeded quota and event deletion.
207010	Perspectives	Events are not shown in perspectives.	Datafeed actions (edit or delete) no longer causes unwanted perspectives modification that could (in a specific configuration) result in events not being shown.
208300	SIP	Processing SIP traffic can lead Flowmon ADS to restart repeatedly.	Processing SIP traffic while having false-positives rules configured for SIP detection methods no longer crashes Flowmon ADS.

Issues fixed in Flowmon ADS 12.4.0

Ticket number	Issue topic	Issue details	Resolution details
205178	Update process	Update to Flowmon ADS 12.3 takes too long (approximately one hour) when the IDS Collector is enabled and the appliance communicates through a proxy.	Oinkmaster now respects proxy settings and no longer causes the update process to take too long.

Known issues

• REST Application Programming Interface (API) calls only work in the tenant that the user was created in. Currently, there is no API call to switch tenant. This means that the base tenant admin cannot switch to the subtenant to adjust the configuration using the REST API.
• When working in multiple browser tabs and switching to a different tenant in one tab, refresh the other tabs to prevent unexpected issues when making changes in tabs where the tenant was not manually switched.
• Reports imported from configuration files generated in Flowmon ADS 12.3.0 or older do not contain report chapters created in Flowmon ADS → Report Chapters. The faulty imports are accompanied with the error message, for example: "Cannot display widget 'Events by type for all - Critical'. Please contact your administrator to grant you access to this chapter.". You need to re-create the affected reports.

Release information and installation

Flowmon Anomaly Detection System (ADS)

Version: 12.4.3

Date: 2025-02-24

You can use this package for new installations or to upgrade Flowmon ADS on a Flowmon appliance.

Copyright notice

Copyright © 2007 - 2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.

Support information

If you need help, contact our Support team at the Flowmon Support and Learning Hub.

Compatibility

• This package is compatible with Flowmon 12.4.0 or higher.

• This package is compatible with Flowmon Packet Investigator 12.3.0 or higher.

Dependencies

The following table summarizes the minimum required versions of Flowmon and Flowmon ADS for various versions of the package.

The table only lists versions with dependency changes.

Flowmon ADS version	Minimum required version of Flowmon	Minimum required version of ADS	Notes
12.4.0	12.4.0	12.3.0
12.3.0	12.3.5	12.2.0
12.2.0	12.3.0	11.1.1*	*ADS 12.0.4+ is needed when upgrading FM to 12.3.0
12.1.0	12.2.0	11.1.1*	*ADS 12.0.4+ is needed when upgrading FM to 12.2.0
12.1.0	12.2.0	11.1.1*	*ADS 12.0.4+ is needed when upgrading FM to 12.2.0
12.0.0	12.0.0	11.1.1*	*ADS 11.2.4+ is needed when upgrading FM to 12.0.0
11.4.1	11.1.9	10.0.0*	*ADS 11.1.1+ is needed when upgrading FM to 11.1.9
11.3.2	11.1.7	10.0.0*	*ADS 11.1.1+ is needed when upgrading FM to 11.1.7
11.3.0	11.1.6	10.0.0*	*ADS 11.1.1+ is needed when upgrading to 11.1.6
11.2.0	11.1.0	10.0.0*	*ADS 11.1.1+ is needed when upgrading FM to 11.1.0
11.0.4	11.0.1	10.0.0

Installation

The installation requires a Flowmon ADS license. To upgrade from previous major versions, a license with the Standard or Extended support is required.

The first installation and uninstallation of Flowmon ADS restarts the flow collector for a short period of time, during which flow data is not collected. This affects traffic charts in the Flowmon Monitoring Center and the event chart in Flowmon ADS.

1. Download the package from the Support portal. Do NOT unpack it.
2. Log in to Flowmon Configuration Center on your Flowmon appliance.
3. Open the Version page.
4. Click Import package and choose the installation package.
5. Wait until a notification is displayed informing that the update was successful.

After upgrading from a previous major version, the web User Interface (UI) may display incorrectly with visual issues like missing text. If that happens, try to clear the browser cache.

Cleaning local storage in Firefox/Chrome browser:

1. Press F12 on your keyboard to open developer tools.
2. Select the Console tab.
3. Type the following command: localStorage.clear();
4. Press enter to confirm the command.

Notes

The Czech and Japanese translations (user guide and texts added or changed in the UI) might not be available with beta releases. The translations will be available with the stable release at the latest.