Proofpoint | ObserveIT On-Premises Release Notes version 7.18.2

Version 7.18.2

This document provides information about features, issues that were discovered and fixed since the previous release, and any limitations of the release. It is important that you read this document before you install and configure this version.


New Features and Enhancements

macOS 27 Golden Gate Support

macOS 27 Golden Gate is now supported. Configuration Profile 7.18.2 is required.

Code Requirement:

anchor apple generic and identifier logger and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists / or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = DJR63QYCGL)

Multiple Endpoint Search from Database

The Endpoints tab (Configuration > Endpoint Management > Endpoints) displays a list of all the endpoints with their related details.

From version 7.18.2, you can search for multiple endpoints in the Endpoint field. Separate the endpoints with a comma, for example endpoint1, endpoint2.

 

FAM Mechanism Improvement

Improved FAM mechanism performance from Database side.

Upgrades and Support

Node js upgraded to 22.23.2

.NET upgraded to 10.0.11

Axios package upgraded to version 0.31.1

Undici upgraded to 6.270.0

SSMS 22.4.1 fully supported

viewer.exe supported with FIPS compliance

Microsoft OLE_DB driver to 19.4.2.0

Microsoft ODCB driver to 18.6.2.1

Last version supporting Sql Server 2016

From On-Prem version 7.18.2, Sql Server 2016 will no longer be supported.

C++ version upgraded to 14.51.36247

Active Directory Attributes

Attributes can now be added from the Active Directory reporting roles:

  • User Display Name

  • User Email

  • AD Group Name

Additional New Abilities

Updated missing executable file in the Agent Mapping page.

Added testing on Chrome Beta versions on the Windows and Mac Agent side.

Spunk New Abilities

  • Added User/Group name to Audit_Configuration_visio table.

  • Added ability to skip writing to Splunk tables. Added in database configuration.

  • Added the following fields to Splunk API report audit_logins_v0:

    • Endpoint Name

    • Session Login

Resolved Issues

[Issue 1473]: Fixed an issue where the agent status shown in the UI did not reflect the agent's actual status. Added a registry value on the agent side to view the status.

[Issue 1719]: Fixed an issue where Offline session was inserted into the Chunks table with incorrect SessionDay.

[Issue 1655]: Fixed an issue where playing and opening FAM events in the File Diary performed slowly across all systems.

[Issue 1662]: Fixed an issue where LDAP mechanism did not work correctly when LDAPs were enabled.

[Issue 1585]: Fixed an issue where black screen after login was caused by mismatched signature .

[Issue 1583]: Fixed an issue where the log description syntax wrote the last exit status instead of status.

[Issue 1696]: Fixed an issue where the ppx binary was not shipped with the other binaries on RedHat/CentOS 9, which caused tampering detection to trigger.

[Issue 1461]: Fixed an issue where when creating a recording policy, activity filtering was missing on USB Activity.

[Issue 1411]; Fixed an issue where ispFileMonitoring store procedures were performing poorly.

[Issue 1617]: Fixed an issue where User Activity in the User Activity Profile in the Users dashboard did not contain data.

[Issue 1725]: Fixed an issue where bulk data stream was incorrect on USB Archive Copy procedure.

[Issue 1608]: Fixed an issue where Insider Threat Intelligence page was missing dashboard summary data.

[Issue 1573]: Fixed an issue where User Permissions in the Administration settings was indicated as Saved. After refreshing the memory, it was shown as not saved.

[Issue 1556]: Fixed an issue where Agent MSI did not automatic unregistered values properly.

[Issue 1532]: Fixed an issue where getCertificateFromKeychain log message did not include the DictItem.

[Issue 1441]: Fixed an issue where registration occurred in the incorrect time before the active name registered, for example VDI registered as a temp machine.

[Issue 1360]: Fixed an issue where customer could not change the input message in the message box on Windows Agent.

[Issue 1173]: Fixed an issue where upgrade process was prevented from removing files from the installation package.

[Issue 1498]: Fixed an issue where session remained on in Hot Drive despite that the session indicated it was completed.

[Issue 1558]: Fixed an issue where data was not inserted into User Risk Dashboard. Application ID was missing.

[Issue 1435]: Fixed an issue where the Agent service key did not work: MissingSessionToleranceInSec, AgentLoadGracePreiod, Debug_SummarizeAvailabilityOfRcdcl

[Issue 1690]: Fixed an issue where the UI showed incorrect tamper status because the agent reported the wrong OS version to the backend. This occurred on several Red Hat Enterprise Linux machines in the same environment.

[Issue 1554]: Fixed an issue where audit_logins_v0 event timestamp was not correct.

[Issue 1553]: Fixed an issue where the RQL parser's ISO conversion treated colons as a conflict.

[Issue 141]: Fixed an issue where the Agent failed to detect key logging in the console when using applications such as Teams and Zoom on Japanese-language systems.

[Issue 1643]: Fixed an issue where screenshots were written to the wrong date folder with an incorrect structure on Hot storage.

[Issue 1566]: Fixed an issue where an error was returned indicating that lifetime validation failed due to an expired token.