Snare releases latest versions of Enterprise Agent v5.8.0 and Snare Agent Manager for Windows v2.0.0

The latest versions of Enterprise Agent v5.8.0 and Snare Agent Manager for Windows v2.0.0 include important security updates to continue to enhance cybersecurity, and features and enhancements to improve overall user experience and more fully integrate Enterprise Agent and Snare Agent Manager (SAM).

Security updates

Added configurable maximum failed logins limit. If this limit is exceeded, the user will be locked out for a period of time. The maximum number of failed login attempts and the lock timeout are configurable via Access Configuration in Snare Enterprise Agent v5.8.0 and General Settings in Snare Agent Manager (SAM) for Windows v2.0.0.

Third party libraries have been upgraded in both Snare Enterprise Agent and SAM for Windows:

OpenSSL upgraded to version 3.1.1
Boost upgraded to version 1.81.0

A Snare Windows Agent-specific third-party upgrade was conducted for SQLite, which was upgraded to version 3.40.1.

Snare Windows Agent security updates

the failback certificate lookup logic was improved to consider expiry and issuer and reduce the need to re-create a self-signed certificate
the support of a big key size token for TLS_AUTH connection has been released
the platform has switched to a stronger encryption technique for sensitive data in INF files
usage of MD5 has been replaced with a stronger hashing algorithm in License Manager
removed dependency on MD5 hashing to reinforce Agent security during Snare Agent upgrade.

Note: After this change, upgrading Snare Agent from versions earlier than 5.4.0 for Agents that had password enabled is not supported. Customers who need to upgrade the Agent from pre-5.4.0 version, are advised to perform a two-step upgrade:

step 1: upgrade from pre-5.4.0 version to v5.7.0 or 5.7.1
step 2: upgrade from v5.7.* to the latest version

SAM security updates

moved to a stronger encryption method for storing SMTP passwords
fully removed dependency on MD5 hashing that is deprecated and not secure:
replaced usage of MD5 with a stronger hashing algorithm in License Manager
removed support for MD5-based authentication in Agent Scanner. Only 5.4+ agents are now supported
SAM v2.0.0 will not be able to discover pre-v5.4.0 agents during the network scan
it is recommended to discover and upgrade older Snare Agents to the latest version prior to upgrading to SAM v2.0.0
MD5-based Agent-to-SAM authentication has been removed, including usage of MD5 hashes for legacy front end resource caching
MD5 has been removed from the About page.

After this change SAM will accept connections only from Agents v5.5.0 and newer.

Snare Agents older than v5.5.0 will not be managed by SAM starting from this version. SAM will not accept connections from older agents, as old authentication methods were fully deprecated for security reasons.

Customers who have older agents in their fleet are advised to upgrade the Agents to v5.5.0 or newer prior to upgrading SAM to this version.

New features and enhancements

Starting from version 5.8.0, Snare Agent has the ability to pull configuration and policy updates from Snare Agent Manager (SAM). This functionality is licensed, and requires a license with Agent Management Console (IA_SAM_CONFIG) feature. Customers who have an existing AMC license will be able to transition to use this new capability.

This functionality replaces previous method of pushing configuration from AMC (Snare Central component) to Snare Agents.

Starting from SAM v2.0.0 and Snare Agent 5.8.0, Agent’s configuration and policies can be fully managed in Snare Agent Manager (SAM).

Recommendations

Customers who use AMC to push configuration to the Agents, are encouraged to migrate to this new mechanism where Agent policies are defined in SAM, and Agents pull policy updates from SAM.

This new mechanism is more secure and provides the ability to manage Agents’ configuration without having web access enabled on every managed endpoint.

Please see for details.

The existing AMC in Snare Central will be deprecated at a future date still yet to be announced.

SAM allows users to define Agent groups, load, and update master configuration, and provide it to the relevant Agents. Please see Release Notes of SAM v2.0.0 and the User Guide for more details.

SAM now offers a new Agents Management > Agents Policies interface that allows to:

create Managed Groups of Agents using a variety of filters, such as Agent type, version range, IP filters, Hostname regular expression
automatically assign an Agent to a group, based on group filters
assign master configuration to a group, loaded from an Agent or from a file
edit selected fields in master configuration
configure frequency with which Agents in a group will be connecting to SAM to check for configuration updates
provide an updated configuration to the connected Agents
review the Agents assigned to a group and see their status.

SAM-specific features and benefits

added a new setting under Email Alerts, allowing to select/deselect License Features for exceeded allowance alerts. This will allow users to opt out from receiving email alerts for alternative features
introduced Agent license cache for better performance
revamped SAM header and sidebar
general performance improvements in memory management.

Snare Agent-specific features and benefits

the ability to export Agent Setting in JSON format from command line, using -j flag, was added
this JSON file can optionally be used as a master configuration in SAM Agent Policies management
Snare Agent can now be packaged and deployed in the same MSI package with Microsoft’s Sysmon tool for System Monitoring
use Snare MSI Builder 3.1.0 to package both products for deployment via a group policy (For further details see Snare MSI Documentation v3)
reminder: Snare Agent is capable of collecting events generated by Sysmon out-of-the-box.
an on-screen error notification was added when Snare Agent cannot subscribe to Application, System or Security audit logs (usually due to insufficient permissions)
code improvements to clear tool diagnostics were implemented.

Bug fixes

Snare Agent

a previously standalone-licensed Snare Agent now obtains the license correctly after MSI upgrade or reinstall with SAM IP set in template.inf. This is related to support case.
fixed very high CPU usage when Snare Agent cannot subscribe to core Windows logs.
fixed possible truncation of very large audit logs (over 16kB).
fixed form validation of custom Agent Heartbeat Frequency field.
fix for possible corner case when determining certificate name.
fixed possible error when accessing Access Configuration page.

SAM

resolved an issue where there could be a delay in Agent detection and license allocation.
new license is now automatically distributed to Agents whose license expired.
fixed incorrect Agents count in upcoming license expiry warning.
fixed issue in Agent License ‘Replace With’ drop down list, where only the current feature license id could be listed.

Snare releases latest versions of Enterprise Agent v5.8.0 and Snare Agent Manager for Windows v2.0.0

Security updates

Snare Windows Agent security updates

SAM security updates

New features and enhancements

Recommendations

SAM-specific features and benefits

Snare Agent-specific features and benefits

Bug fixes

Snare Agent

SAM

CALL US AT:

Americas

APAC

EMEA

Adelaide (Corporate HQ)

Products

Recent Posts