Post Upgrade Tasks

This topic is divided into two sections. Complete the tasks in one of the following sections based on your upgrade path:

Post Upgrade Tasks for Customers Upgrading from version 11.7.x.x

Complete the tasks that apply to the hosts in your environment.

General

(Conditional) Configure NAT-Based IP Addresses

If you have a host, such as a VLC, that requires a NAT-based IP address in order to connect to the NW Server host, you must update the host configuration with the following steps.

  1. Log in to the host that requires the use of NAT IP addresses, using the console or SSH.
  2. Run the following command:
    nw-manage --enable-nat-usage
  3. To set the NAT address for the NW Server:
      1. Log into the NW Server using the console or SSH.
      2. Run the following command:
        nw-manage -update-host --host-id <UUID of NW Server> --ipv4-public <NAT IP of NW Server>

    Note: You can find the UUID and view the current NAT IP address of the host by running nw-manage --list-hosts.

(Conditional - For Warm-Standby Hosts Only) Register the Secondary IP Address of Warm-Standby Hosts

The Warm-Standby server must be upgraded to 11.5 or later before completing the following steps.

    1. Log in to the NW Server using the console or SSH.
    2. Run the following command:
      nw-manage --add-nws-secondary-ip --ipv4 <ip address of Warm/Standby Server>

Note: If the Warm-Standby server requires a NAT-based IP address (IPv4-public) for any host to access it during failover, the NAT IP address must also be registered by running the following command: nw-manage --add-nws-secondary-ip --ipv4 <NAT-based IP address of Warm Standby Server>

  1. Verify the correct Warm Standby host IP address value by running the following command:
    nw-manage --get-nws-secondary-ip

Review Contents of /etc/hosts.user for Obsolete Host Entries

After upgrading the NW Server host or a component host, review the contents of the /etc/hosts.user file for any obsolete host entries. The /etc/hosts.user file contains system and user-generated entries that are not managed by NetWitness Platform. However, entries from /etc/hosts.user are merged with NetWitness Platform-generated host mappings to create and update /etc/hosts. To avoid conflicts with NetWitness Platform-generated mappings, and to avoid generating connectivity errors resulting from an IP address change, RSA recommends that you remove any entries in /etc/hosts.user that include a non-loopback IP address of a NetWitness Platform host.

After updating /etc/hosts.user, you must refresh the system by running the following command:
nw-manage --refresh-host --host-key <ID, IP, hostname or display name of host>

Jetty Configuration

For Jetty Configuration and related information, see Manage Custom Host Entries topic in the System Maintenance Guide.

Reconfigure DNS Servers

By default, a component host upgraded from 11.4 or earlier is configured with the same system DNS server as the NW Server. If this component host requires a different system DNS address, see "Change Host Network Configuration" in the System Maintenance Guide for instructions.

Make Sure Services Have Restarted and Are Capturing and Aggregating Data

Make sure that services have restarted and are capturing data (this depends on whether or not you have auto-start enabled).

If required, restart data capture and aggregation for the following services:

  • Decoder
  • Log Decoder
  • Broker
  • Concentrator
  • Archiver

Start Network Capture

  1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.
    The Services view is displayed.
  2. Select each Decoder service.

  3. Under netwitness_actions_button.png (actions), select View > System.

  4. In the toolbar, click netwitness_startcapturedr_140x33.png

Start Log Capture

    1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.
      The Services view is displayed.
    2. Select each Log Decoder service.
    3. Under netwitness_actions_button.png (actions), select View > System.
    4. In the toolbar, click netwitness_startcapturedr_140x33.png

Start Aggregation

  1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.

    The Services view is displayed.

  2. For each Concentrator, Broker, and Archiver service:

    1. Select the service.
    2. Under netwitness_actions_button.png (actions), select View > Config.
    3. In the toolbar, click netwitness_startaggr.png

Event Stream Analysis (ESA)

Note: Mixed mode is not supported for ESA hosts in NetWitness Platform version 11.5 and later. The NetWitness server, ESA primary host, and ESA secondary host must all be on the same NetWitness Platform version.

There are no required post-upgrade tasks for ESA. For ESA troubleshooting, see ESA Troubleshooting Information.

If you want to add support for Endpoint, UEBA, and Live content rules, you must update the multi-valued and single-valued parameter meta keys on the ESA Correlation service to include all the required meta keys. It is not necessary to make these adjustments during the upgrade; you can make the adjustments later at a convenient time. For detailed information and instructions, see "Update Your ESA Rules for the Required Multi-Value and Single-Value Meta Keys" in the ESA Configuration Guide

Show Updates to an ESA Rule Deployment

You can view changes to an ESA rule deployment, such as adding or removing rules. When there is a change to a deployment, the update icon (netwitness_exclpt.png) appears next to the name of the deployment in the Rules tab options panel.

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.The Rules tab is displayed.
  2. In the options panel, under Deployments click Show Updates on the far right.
    netwitness_deployvwupdates_esacorr.png
  3. Click Deploy Now.

If you are unable to deploy the ESA rule, see Known Issues for the workaround.

Respond

The Primary ESA server must be upgraded to 11.7.1.0 before you can complete these tasks.

Note: After upgrading the primary NW Server (including the Respond Server service), the Respond Server service is not automatically re-enabled until after the Primary ESA host is also upgraded to 11.7.1.0. The Respond post-upgrade tasks only apply after the Respond Server service is upgraded and is in the enabled state.

(Conditional) Restore Any Respond Service Custom Keys in the Aggregation Rule Schema

Note: If you did not manually customize the incident aggregation rule schema, you can skip this task.

If you added custom keys in the var/lib/netwitness/respond-server/data/aggregation_ rule_schema.json file for use in the groupBy clause for 11.x, modify the /var/lib/netwitness/respond-server/data/aggregation_rule_schema.json file and add the custom keys from the automatic backup file.

The backup file is located in /var/lib/netwitness/respond-server/data and it is in the following format:
aggregation_rule_schema.json.bak-<time of the backup>

Reference Log Decoder

For full functionality, make sure your reference Log Decoder is at 11.5 or later. If you never set up a reference Log Decoder, there is no need to take action. For details, see the Log Parser Customization Guide.

Windows Log Collector

Update the Windows Log Collector UUID

After upgrading to 11.5 or later, for each Windows Log Collector configured in your environment, run the following command on the NW Server:

wlc-cli-client --update-to-uuid --host <WLC host address>

Context Hub

Disable the UCF configuration

Disable the UCF (Unified Collection Framework) configuration to stop sending events to NetWitness. Do the following steps.

  1. On the UCF host, stop the UCF services (SA SecOps Watchdog, RSA Unified Collector Framework). For more information, see "Manage Unified Collector Framework" topic in Archer Integration Guide for RSA NetWitness.
  2. Create a backup of the collector-config.properties file which is in the following location.
    C:\Program Files\RSA\SA IM integration service\config
  1. In the collector-config.properties file, comment the lines that starts with “archer.ArcherPull.baseUri = xxx” by adding # character before the line.
    For example,
    #archer.ArcherPull.baseUri = xxx
    #archer.ArcherPull.instance = xxx
    #archer.ArcherPull.userName = xxx
    #archer.ArcherPull.password = xxx
    #archer.ArcherPull.readWrite = xxx
    #archer.ArcherPull.moduleId.dataBreach = xxx
    #archer.ArcherPull.moduleId.incident = xxx
  1. Also delete the value “ArcherPull” in all the lines. For example, for the line “archer.configured.endpoints = ArcherPull,ArcherPush”, delete “ArcherPull” but retain the other values. “archer.configured.endpoints = ArcherPush”
  1. Start the UCF services (SA SecOps Watchdog, RSA Unified Collector Framework). For more information, see "Manage Unified Collector Framework" topic in Archer Integration Guide for RSA NetWitness.

User Entity Behavior Analytics

IMPORTANT: Before the upgrade, if you encountered and resolved the task failure issues, then after the upgrade, you must replace the authentication.json file before you run the post-upgrade tasks. The task failure issues in Airflow and their solutions are described in the 'Troubleshooting' topic of the UEBA Configuration Guide.

IMPORTANT: Every UEBA deployment when upgraded requires additional steps to complete the upgrade process. When you upgrade from 11.5.x to 11.5.x.x or 11.6.x to 11.6.x.x, you must follow UEBA instructions in the Upgrade Guide for 11.5.x.x or 11.6.x.x, before you upgrade to 11.7.x.

Note: When you upgrade to 11.7.1.0 from 11.4.x.x, you don't need to rerun the UEBA system for the last 28 days, if you don't update the current processing schemas. When you upgrade to 11.7.1.0 from a version prior to 11.4.x, the UEBA system runs a rerun automatically.

  1. (For Virtual Machines Only) Update the airflow parallelism on VM.
    If the UEBA system is running on VM, update the airflow parallelism to be 64 by running the following command as root from the UEBA host.

    sed -i "s|parallelism = 256|parallelism = 64|g" /var/netwitness/presidio/airflow/airflow.cfg

    Note: Copy this command in a single line.

  2. Update the UEBA configuration using the following command from the UEBA machine.
    source /etc/sysconfig/airflow

    source $AIRFLOW_VENV/bin/activate

    OWB_ALLOW_NON_FIPS=on python /var/netwitness/presidio/airflow/venv/lib/python2.7/site-packages/presidio_workflows-1.0-py2.7.egg/presidio/resources/rerun_ueba_server_config.py

  1. (Optional) Update the UEBA processing schema, if needed.

    RSA recommends that the UEBA start date is set to 28 days earlier than the current date. For UEBA systems that intend to process TLS data, you must make sure that the start date is set to no later than 14 days earlier than the current date.

    For more information, see the "reset-presidio script" section in the UEBA Configuration Guide.

  2. Run the airflow upgrade DAG.

    • Go to Airflow main page https://<UEBA-host-name>/admin

    • Enter the admin username and password.

    • Click the Play in presidio_upgrade_dag_from_<previous_version> to_11.7.1.0.
      netwitness_airflow1_1193x652.png

      Note: A light green circle will appear next to the upgrade DAG row during the upgrade. If the upgrade process is completed successfully the light green circle changes to green. If the upgrade process fails, the light green circle changes to red.

  3. Set the appropriate "Boot Jar Pools" slots:

    • Physical Appliance: Update the spring_boot_jar_pool slot value be 18.

    • Virtual Appliance: Update the spring_boot_jar_pool slot value to 22.
      To update the “Spring Boot Jar Pools” slots, Go to the Airflow main page, tap the “Admin” tab at the top bar and tap “Pools”.
    1. To access the Airflow UI, go to https://<UEBA_host>/admin and enter the credentials.
      User: admin
      Password: The environment deploy admin password.
    1. Click on the pencil mark of the Pools to update the slot values.
      netwitness_airflowtbs.png
  4. Edit the spring_boot_jar_pool and update the slots amount to 5.
    netwitness_airflowslt_1116x193.png

Post Upgrade Tasks for Customers Upgrading From 11.5.3.2 or 11.6.x.x

Complete the tasks that apply to the hosts in your environment.

General

(Conditional) Configure NAT-Based IP Addresses

If you have a host, such as a VLC, that requires a NAT-based IP address in order to connect to the NW Server host, you must update the host configuration with the following steps.

  1. Log in to the host that requires the use of NAT IP addresses, using the console or SSH.
  2. Run the following command:
    nw-manage --enable-nat-usage
  3. To set the NAT address for the NW Server:
      1. Log into the NW Server using the console or SSH.
      2. Run the following command:
        nw-manage -update-host --host-id <UUID of NW Server> --ipv4-public <NAT IP of NW Server>

    Note: You can find the UUID and view the current NAT IP address of the host by running nw-manage --list-hosts.

(Conditional - For Warm-Standby Hosts Only) Register the Secondary IP Address of Warm-Standby Hosts

The Warm-Standby server must be upgraded to 11.5 or later before completing the following steps.

    1. Log in to the NW Server using the console or SSH.
    2. Run the following command:
      nw-manage --add-nws-secondary-ip --ipv4 <ip address of Warm/Standby Server>

Note: If the Warm-Standby server requires a NAT-based IP address (IPv4-public) for any host to access it during failover, the NAT IP address must also be registered by running the following command: nw-manage --add-nws-secondary-ip --ipv4 <NAT-based IP address of Warm Standby Server>

  1. Verify the correct Warm Standby host IP address value by running the following command:
    nw-manage --get-nws-secondary-ip

Review Contents of /etc/hosts.user for Obsolete Host Entries

After upgrading the NW Server host or a component host, review the contents of the /etc/hosts.user file for any obsolete host entries. The /etc/hosts.user file contains system and user-generated entries that are not managed by NetWitness Platform. However, entries from /etc/hosts.user are merged with NetWitness Platform-generated host mappings to create and update /etc/hosts. To avoid conflicts with NetWitness Platform-generated mappings, and to avoid generating connectivity errors resulting from an IP address change, RSA recommends that you remove any entries in /etc/hosts.user that include a non-loopback IP address of a NetWitness Platform host.

After updating /etc/hosts.user, you must refresh the system by running the following command:
nw-manage --refresh-host --host-key <ID, IP, hostname or display name of host>

Reconfigure DNS Servers

By default, a component host upgraded from 11.4 or earlier is configured with the same system DNS server as the NW Server. If this component host requires a different system DNS address, see "Change Host Network Configuration" in the System Maintenance Guide for instructions.

Make Sure Services Have Restarted and Are Capturing and Aggregating Data

Make sure that services have restarted and are capturing data (this depends on whether or not you have auto-start enabled).

If required, restart data capture and aggregation for the following services:

  • Decoder
  • Log Decoder
  • Broker
  • Concentrator
  • Archiver

Start Network Capture

  1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.
    The Services view is displayed.
  2. Select each Decoder service.

  3. Under netwitness_actions_button.png (actions), select View > System.

  4. In the toolbar, click netwitness_startcapturedr_140x33.png

Start Log Capture

    1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.
      The Services view is displayed.
    2. Select each Log Decoder service.
    3. Under netwitness_actions_button.png (actions), select View > System.
    4. In the toolbar, click netwitness_startcapturedr_140x33.png

Start Aggregation

  1. In the NetWitness Platform menu, go to netwitness_adminicon_25x22.png (Admin) > Services.

    The Services view is displayed.

  2. For each Concentrator, Broker, and Archiver service:

    1. Select the service.
    2. Under netwitness_actions_button.png (actions), select View > Config.
    3. In the toolbar, click netwitness_startaggr.png

Event Stream Analysis (ESA)

Note: Mixed mode is not supported for ESA hosts in NetWitness Platform version 11.5 and later. The NetWitness server, ESA primary host, and ESA secondary host must all be on the same NetWitness Platform version.

There are no required post-upgrade tasks for ESA. For ESA troubleshooting, see ESA Troubleshooting Information.

If you want to add support for Endpoint, UEBA, and Live content rules, you must update the multi-valued and single-valued parameter meta keys on the ESA Correlation service to include all the required meta keys. It is not necessary to make these adjustments during the upgrade; you can make the adjustments later at a convenient time. For detailed information and instructions, see "Update Your ESA Rules for the Required Multi-Value and Single-Value Meta Keys" in the ESA Configuration Guide

Show Updates to an ESA Rule Deployment

You can view changes to an ESA rule deployment, such as adding or removing rules. When there is a change to a deployment, the update icon (netwitness_exclpt.png) appears next to the name of the deployment in the Rules tab options panel.

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.The Rules tab is displayed.
  2. In the options panel, under Deployments click Show Updates on the far right.
    netwitness_deployvwupdates_esacorr.png
  3. Click Deploy Now.

If you are unable to deploy the ESA rule, see Known Issues for the workaround.

New Health and Wellness

Note: New Health and Wellness in 11.5.x.x replaces Next GEN Health and Wellness (BETA) in 11.4.x.x.

Deploy the New Health and Wellness Content from Live

After you upgrade from version 11.5.3.2 to 11.7.1.0, New Health and Wellness content is not updated. To use the latest (default) content, you must deploy the content through NetWitness Live Services.

Note: RSA recommends you to take a copy of 11.4.x.x Health and Wellness content before you deploy the content from NetWitness Live Services, as it overwrites the existing content.

  1. Log in to NetWitness Platform UI.

  2. Click netwitness_configureicon_27x24.png (CONFIGURE) > LIVE CONTENT.

  3. In the Search Criteria panel, select the Resource Types as:

    • Health and Wellness Dashboards
    • Health and Wellness Monitors

  4. Click Search.

  5. In the Matching Resources view, select the checkbox to the left of the resources that you want to deploy.

  6. In the Matching Resources toolbar, click netwitness_deploybtn.png .

  7. In the Deployment Wizard > Resources tab, click Next.

  8. In the Services tab, select the Metrics Server service.

  9. Click Next.

  10. Click Deploy.
    The Deploy page is displayed. The Progress bar turns green when you have successfully deployed the resources to the selected services.

  11. Click Close.

(Optional) Update UUID of New Health and Wellness Host to Update Service Configuration Documents

If you have configured services for New Health and Wellness from nw-shell using set-config API and upgrade NetWitness Platform version from 11.5.3.2 to 11.7.1.0, you must update IP with UUID for a host on which New Health and Wellness is installed.

This is an example of service configuration file with the file path /root/example_config.json

{

"service" : "concentrator",

"serviceId" : "6c552cde-4153-4e1b-a0a0-c74e8756cce1",

"enabled" : true,

"username" : "nwservice",

"password" : "4f809baabcbe7ed663c10e4cf786ce24",

"port" : 9200,

"secure" : true,

"host" : "196.168.0.1",

"verifyHostname" : false,

"conversionUnit" : "SECONDS",

"interval" : "60 SECONDS",

"exclusion" : [ ],

"inclusion" : [

"/concentrator/**",

"/database/**",

"/sdk/**",

"/sys/**"

]

}

To update UUID of a host:

  1. SSH to Admin Server.

  2. Check the UUID of a host on which New Health and Wellness is installed using the command:
    orchestration-cli-client --list-hosts

    This lists NetWitness Platform hosts along with the respective UUIDs. Make a note of the UUID of host on which New Health and Wellness is installed.

  3. Identify the services on which set-config API is invoked using the command:
    mongo localhost/metrics-server -u deploy_admin -p <deployment_password> --authenticationDatabase admin --eval 'db.metric_config.find({ "createdBy": { $ne: "system" }})'
    This will list the configuration documents of the services on which set-config API is invoked.
    Sample output
    { "_id" : ObjectId("5f83f44b913a613985072396"), "port" : 0, "secure" : true, "family" : "NEXTGEN", "service" : "concentrator", "enabled" : true, "interval" : { "duration" : NumberLong(120), "unit" : "SECONDS" }, "inclusion" : [ "/concentrator/**", "/database/**", "/sdk/**", "/sys/**" ], "exclusion" : [ "/concentrator/config/recovery/**", "/concentrator/config/rules/**", "/concentrator/devices/**", "/sdk/stats/queries/**", "/sys/config/scheduler/**" ], "forceDisabled" : false, "createdBy" : "admin", "createdOn" : NumberLong("1602483359444"), "lastModifiedBy" : "system", "lastModifiedOn" : NumberLong("1604382316156"), "_class" : "com.rsa.asoc.metrics.config.ElasticConfigUpdateEntity" }

Note: If no service documents are listed which means no services are configured before the upgrade, so you can ignore the remaining steps.

  1. In the configuration file, update the service document “host” field by replacing IP with the UUID of the host on which New Health and Wellness is installed.

For example, "host" : "196.168.0.1" will become "host" : "e28665d5-1c2c-dbe3-1b9e- 4767271ce805"

Note: If you do not know the file used for configuration (For example, /root/example_config.json). You can create a new file containing the configuration of the service.
To create new configuration file:
1) List all the services using the following command:
orchestration-cli-client --list-services
Result
Service-ID of the service is displayed. For example,
2020-12-01 10:11:30.195 INFO 11535 --- [ main] c.r.n.i.o.c.OrchestrationApplication : Service: ID=60a97481-1568-4da1-b91a-e0f0b38836d4, NAME=concentrator, HOST=196.168.0.1:56005, TLS=true
2) To get the current configuration of the same service run the following commands:
a) SSH to Admin Server
b) Log in to nw-shell
c) Run the following command:
connect --service metrics-server
d) Navigate to the below location:
/rsa/metrics/elastic/get-config
e) Run the following command:
invoke <service_id> [example: invoke 60a97481-1568-4da1-b91a-e0f0b38836d4]
Result:
example_config.json
{
"service" : "concentrator",
"serviceId" : "6c552cde-4153-4e1b-a0a0-c74e8756cce1",
"enabled" : true,
"username" : "nwservice",
"password" : "4f809baabcbe7ed663c10e4cf786ce24",
"port" : 9200,
"secure" : true,
"host" : "196.168.0.1",
"verifyHostname" : false,
"conversionUnit" : "SECONDS",
"interval" : "60 SECONDS",
"exclusion" : [ ],
"inclusion" : [
"/concentrator/**",
"/database/**",
"/sdk/**",
"/sys/**"
]
}
3) Copy the Configuration file above (For example, /root/example2_config.json) and save it in a file (For example, /root/example2_config.json).

  1. Log in to nw-shell using the command:
    nw-shell
  2. Connect to metrics-server service using the command:
    connect --service metrics-server

  3. Enter the log in command:
    login

  4. Enter the admin username and password.
  5. Go to /rsa/metrics/elastic/set-config and invoke configuration files using the command:
    invoke --file /<absolute_path_of_service_config_file>
    For example, invoke --file /root/example2_config.json

 

Respond

The Primary ESA server must be upgraded to 11.7.1.0 before you can complete these tasks.

Note: After upgrading the primary NW Server (including the Respond Server service), the Respond Server service is not automatically re-enabled until after the Primary ESA host is also upgraded to 11.7.1.0. The Respond post-upgrade tasks only apply after the Respond Server service is upgraded and is in the enabled state.

(Conditional) Restore Any Respond Service Custom Keys in the Aggregation Rule Schema

Note: If you did not manually customize the incident aggregation rule schema, you can skip this task.

If you added custom keys in the var/lib/netwitness/respond-server/data/aggregation_ rule_schema.json file for use in the groupBy clause for 11.x, modify the /var/lib/netwitness/respond-server/data/aggregation_rule_schema.json file and add the custom keys from the automatic backup file.

The backup file is located in /var/lib/netwitness/respond-server/data and it is in the following format:
aggregation_rule_schema.json.bak-<time of the backup>

Reference Log Decoder

For full functionality, make sure your reference Log Decoder is at 11.5 or later. If you never set up a reference Log Decoder, there is no need to take action. For details, see the Log Parser Customization Guide.

Windows Log Collector

Update the Windows Log Collector UUID

After upgrading to 11.5 or later, for each Windows Log Collector configured in your environment, run the following command on the NW Server:

wlc-cli-client --update-to-uuid --host <WLC host address>

Context Hub

Disable the UCF configuration

Disable the UCF (Unified Collection Framework) configuration to stop sending events to NetWitness. Do the following steps.

  1. On the UCF host, stop the UCF services (SA SecOps Watchdog, RSA Unified Collector Framework). For more information, see "Manage Unified Collector Framework" topic in Archer Integration Guide for RSA NetWitness.
  2. Create a backup of the collector-config.properties file which is in the following location.
    C:\Program Files\RSA\SA IM integration service\config
  1. In the collector-config.properties file, comment the lines that starts with “archer.ArcherPull.baseUri = xxx” by adding # character before the line.
    For example,
    #archer.ArcherPull.baseUri = xxx
    #archer.ArcherPull.instance = xxx
    #archer.ArcherPull.userName = xxx
    #archer.ArcherPull.password = xxx
    #archer.ArcherPull.readWrite = xxx
    #archer.ArcherPull.moduleId.dataBreach = xxx
    #archer.ArcherPull.moduleId.incident = xxx
  1. Also delete the value “ArcherPull” in all the lines. For example, for the line “archer.configured.endpoints = ArcherPull,ArcherPush”, delete “ArcherPull” but retain the other values. “archer.configured.endpoints = ArcherPush”
  1. Start the UCF services (SA SecOps Watchdog, RSA Unified Collector Framework). For more information, see "Manage Unified Collector Framework" topic in Archer Integration Guide for RSA NetWitness.

Update UEBA Configurations

IMPORTANT: In order to complete an upgrade process, every UEBA upgrade needs to be followed by upgrade steps.
In case of gradual upgrade, follow the instruction of each upgrade’s guide before continuing to the next upgrade.

IMPORTANT: The UEBA system requires a re-run in the following cases:
(a) When removing a UEBA schema.
(b) When the UEBA is upgraded from 11.3.x or from a lower version.
The UEBA system does not require a re-run in case of upgrading from 11.4.x or higher version (even in case of adding a schema).

Note: The Modeled Behaviors functionality is added to UEBA in 11.5.2. For any reason if you need to disable this functionality for your organization, see "Enable or Disable the Modeled Behaviors for Users" topic in the NetWitness UEBA Configuration Guide.

  1. (For Virtual Machines Only) Update the airflow parallelism on VM.

    If the UEBA system is running on VM, update the airflow parallelism to be 64 by running the following command as root from the UEBA host.

    sed -i "s|parallelism = 256|parallelism = 64|g" /var/netwitness/presidio/airflow/airflow.cfg

  2. Update the UEBA configuration using the following command as root from the UEBA machine.

    python /var/netwitness/presidio/airflow/venv/lib/python2.7/site-packages/presidio_workflows-1.0-py2.7.egg/presidio/resources/rerun_ueba_server_config.py

  3. (Optional) Update the UEBA processing schema, using the following script:
    python /var/netwitness/presidio/airflow/venv/lib/python2.7/sitepackages/presidio_workflows-1.0-py2.7.egg/presidio/utils/airflow/reset_presidio.pys

    RSA recommends that the UEBA start date is set to 28 days earlier than the current date. For UEBA systems that intend to process TLS data, you must make sure that the start date is set to no later than 14 days earlier than the current date.

    For more information about the script, see "reset-presidio script" section in the NetWitness UEBA Configuration Guide.

  4. Run the airflow upgrade DAG.

    Note: An error message may appear at the top of the Airflow home page until the post upgrade process is complete.

    1. Go to Airflow main page https://<UEBA-host-name>/admin and enter the credentials.

      User: admin

      Password: The environment deploy admin password.

    2. Click the Play in presidio_upgrade_dag_from_<previous_version> to_11.7.1.0.

      netwitness_airflow1.png

      Note: A light green circle will appear next to the upgrade DAG row during the upgrade. If the upgrade process is completed successfully the light green circle changes to green. If the upgrade process fails, the light green circle changes to red.

  5. Set the appropriate Boot Jar Pools according to the setup.

    • Physical Appliance: Update the spring_boot_jar_pool slot value be 18.

    • Virtual Appliance: Update the spring_boot_jar_pool slot value to 22.

    To update the number of Spring Boot Jar Pools:

    1. Go to the Airflow main page https://<UEBA_host>/admin and enter the credentials.

      User: admin

      Password: The environment deploy admin password.

    2. Click the Admin > Pools.
    3. Edit the spring_boot_jar_pool and update the slots amount.

    netwitness_airflowslt1151_1092x159.png