GREYCORTEX Mendel 2.6.1 Released

In the newest version of GREYCORTEX Mendel (2.6.1) we have implemented several new features to improve performance, including a new flow scheme. This new scheme will also store more flow data and metrics. Existing data will be automatically transferred into this new scheme to ensure its continued usability. This data transfer process will run in the background, allowing you to continue to work with new flow data. Depending on the amount of existing flow data, the transfer may take few days, but it will not affect system usability.

We have also added a new DHCP application parser. This means you can now use DHCP data to identify hosts by their hostnames, giving you better knowledge/​information about hosts; for better and more effective action.

Additional Features

• Added new aggregated flow structures and their visualizations to achieve better performance
• Added an additional severity decision mechanism for outlier detection to better highlight larger anomalies
• Added a new DHCP application parser
• Added the capability to display unfinished flows
• Added an additional metric:  UET — User Experience Time — to network flows

Improvements

• Improved database query performance
• Improved the precision of the Round Trip Time and Server Application Response Time metrics computation
• Optimized the performance of the Peers graph for faster loading
• Upgraded the database to achieve greater performance
• Set default log interval in log reporting to 7 days

Bugs Fixed

• Fixed SMB protocol identification
• Fixed network services model calculation
• Removed queries to root DNS servers
• Fixed missing DNS server configurations, which occurred in rare cases
• Fixed settings for RX queues in network drivers
• Fixed timezone usage
• Fixed filtering issues in Incident Management
• Fixed data inconsistency between Peers and Hosts graphs
• Fixed report generation where data fields did not display correctly
• Fixed hyperscan support on non-Intel architectures
• Fixed password escaping issue
• Fixed custom server certificate handling
• Fixed system monitoring data propagation
• Fixed DNS server settings
• Fixed ICMP event and flow pairing
• Fixed MS-SQL protocol parser
• Fixed time handling in False Positives for different time zones
• Fixed color configuration for Port Sweep detection
• Fixed flows search in Outlier events
• Fixed issue with duplicate hostnames
• Fixed flow search in limit events
• Fixed network configuration calculation
• Fixed Url Share functionality in the comments field in Incident Management
• Fixed filtering issue in Incident Management
• Fixed pagination in Incident Management
• Fixed issue in Url Share
• Fixed transfer data calculation in the Peers graph
• Fixed firewall autoconfiguration when enabling Netflow source
• Fixed events filtering by name
• Fixed subnet traffic calculation
• Fixed allow/​deny configuration description
• Fixed the “To Filter” button in Peers graph
• Fixed port and service name filtering
• Fixed other issues related to Incident Management
• Fixed subnet icons in Events
• Fixed vulnerability to CVE-2016–2183
• Fixed empty service description editing
• Fixed false positives value editing
• Fixed ICMP flow filtering on services
• Fixed the assignment of hosts into incorrect subnets
• Fixed host information display in the Analysis module
• Fixed invalid DHCP transaction IDs in individual flows
• Fixed DHCP parsing issues on flows from the DHCP relay
• Fixed the password warning message when the password is shown as invalid during installation
• Fixed the event payload display in IDS events
• Fixed issues with special characters during installation
• Fixed an issue with filtering port number and service name together
• Fixed an issue with flow duration calculation
• Fixed cancel button functionality in Flows view
• Fixed calculation of the number of subnets in Events
• Fixed the use of an incorrect filter in subnet to filter function in the Events tab
• Fixed the filling service in False Positive
• Fixed traffic information in incident links