Cisco Cyber Vision Release Notes, Release 5.1.x

 

Introduction to Cisco Cyber Vision   4

Cisco Cyber Vision Documentation   4

What’s New in Cisco Cyber Vision Center Release 5.1.1  5

Device inventory report  5

Zone and conduit visualization  5

Certificate renewal enhancement for sensors  5

Monitor ingestion chain follow-up  5

Port range entry in sensor templates  5

New API for bulk acknowledgment of vulnerabilities  5

Integrations removed  5

GUI enhancements  5

OMRON protocol revamped  5

Active Discovery: New protocols added  5

Beta UI 5

Asset visibility  6

Functional group recommendations  6

Vulnerabilities  6

Alerts  6

Communications list for assets  7

Other enhancements  7

Materialized views: performance improvements  7

SNORT memory containments  7

Tags added for ignition SCADA  7

Refresh service status in system statistics  7

Sensor label added to the response for sensor list API 7

API enhacement: force sorting on another field when pagination is used  7

sbs-diag command: disk test option added to test performance  7

Monitor sbs-services monitoring service  7

MTU of sensor management extension changed to 1400. 7

Warning message for component limit changed  7

Tracking license tokens in use for the current DB  8

Known limitations  8

Beta UI Vulnerability page does not display device details  8

Cyber Vision sensor self-update  8

Address reservation in DPI configuration  8

Compatibility  8

Compatible Cyber Vision Centers  8

Compatible Sensors  8

Compatibility between the centers and sensors  9

Fresh Installs and Upgrades  10

Install Cisco Cyber Vision  10

Upgrade process considerations  10

Upgrade path  10

Cisco Cyber Vision partition size  11

Resolved Caveats  11

 

 

Introduction to Cisco Cyber Vision

Cisco Cyber Vision helps industrial organizations improve operational resilience by providing continuous visibility into operational technology (OT) security posture. Cisco Cyber Vision equips you with the required insights to build secure industrial networks, reduce downtime, and enforce cybersecurity policies through seamless integration with the IT security operations center. Cisco Cyber Vision enables easy deployment within an industrial network.

Cisco Cyber Vision offers the following capabilities:

·       Unmatched visibility on all assets connected to the industrial network, including their detailed profiles and communication patterns.

·       Enhanced view of the OT security posture, including asset vulnerabilities, risk scores, intrusions, malicious activities, and abnormal behaviors.

·       Automated network segmentation by grouping assets into zones, and sharing this information with Cisco Secure Firewall or Cisco ISE for enforcement.

·       Reporting to help stakeholders implement security best practices and drive compliance with industry standards and regulations.

·       Extends IT security operations to OT by integrating with security, network management, or any custom tool. Cisco Cyber Vision helps provide rich context on OT assets and communication activities to help gain a unified view of both IT and OT domains.

Cisco Cyber Vision Documentation

●      Cisco Cyber Vision Admin Guide, Release 5.1.x

●      Cisco Cyber Vision Upgrade Guide, Release 5.1.x

●      Cisco Cyber Vision Active Discovery Configuration Guide, Release 5.1.x

●      Cisco Cyber Vision Network Sensor Installation Guide for Cisco IC3000, Release 5.1.x

●      Cisco Cyber Vision Network Sensor Installation Guide for Cisco IR8340, Release 5.1.x

●      Cisco Cyber Vision Network Sensor Installation Guide for Cisco IR1101 and IR1800, Release 5.1.x

●      Cisco Cyber Vision Sensor Application for Cisco Switches Installation Guide, Release 5.1.x

●      Integrate Cisco Cyber Vision with Cisco Identity Services Engine (ISE) through pxGrid, Release 4.4.1 and Later Releases

●      Cisco Cyber Vision Center Appliance Installation Guide, Release 4.4.0 and Later

●      Cisco Cyber Vision Center VM Installation Guide, Release 4.4.0 and Later

●      Cisco Cyber Vision for Azure Cloud Installation Guide, Release 4.4.0 and Later

●      Cisco Cyber Vision for the AWS Cloud Installation Guide, Release 4.4.0 and Later

●      Cisco Cyber Vision syslog notification format Configuration Guide

What’s New in Cisco Cyber Vision Center Release 5.1.1

The Cisco Cyber Vision Center Release 5.1.x series begins with the release 5.1.1.

Deploy sensors using docker containers

You can now deploy Cisco Cyber Vision sensors using docker containers. Cisco Cyber Vision supports dockers running on Linux OS, specifically, Ubuntu releases 20.04, 22.04, and 24.04.

Device inventory report

The Device Inventory Report is an automated summary that captures data related to devices, their risk profiles, and the inventory distribution summary for a chosen preset.

Zone and conduit visualization

Cisco Cyber Vision limits the number of displayed objects to maintain performance and prevent browser issues. You can now view only top-level groups (zones) and summarized activities (conduits). The new map feature aligns zones and conduits with ISA/IEC 62443 standards.

Certificate renewal enhancement for sensors

Cisco Cyber Vision certificates are valid for two years and sensor certificates are now renewed automatically. The renewal process begins 35 days before certificate expiration. If the first attempt fails, the renewal process is initiated again later. If a certificate is not renewed before it expires, communications are interrupted until the renewal is complete.

Monitor ingestion chain follow-up

The service status page shows whether all Cisco Cyber Vision processes and extensions are running smoothly, and ensures that the data queues from sensors are not congested.

Port range entry in sensor templates

When you create a sensor template, you can now enter a range of continuous port numbers in the port mapping window.

New API for bulk acknowledgment of vulnerabilities

A new API is introduced to allow the bulk acknowledgment of vulnerabilities. To view the new API, in your Cisco Cyber Vision center, go to Admin > API.

Integrations removed

Cisco FTD is no longer supported. Cisco Firepower Management Center (FMC) is not supported as a direct integration. The Cisco Secure Dynamic Attributes Connector (CSDAC) integration can pass dynamic object attributes to Cisco FMC.

GUI enhancements

The Cisco Cyber Center UI pages for policy creation and licensing contain some visual changes. The functionalities and workflows remain unchanged.

OMRON protocol revamped

OMRON DPI is updated to standardize the protocol in alignment with other Cisco Cyber Vision protocols.

Active Discovery: New protocols added

·       MMS unicast scanner 

·       BACnet broadcast scanner 

Beta UI

Cisco Cyber Vision Center offers a beta UI experience, with informative, easy-to-handle dashboards that present data on assets, vulnerabilities, alerts, and organization hierarchies. You can quickly apply data filters to view necessary information.

This UI experience is a beta feature. To access the beta UI and its features, write to cv-beta@cisco.com. You will receive the command to enable the Cisco Cyber Vision Beta UI in addition to the existing classic UI.

You can also configure functional groups in the beta UI, and assign data sources to organization hierarchies.

To configure network definitions, sensors, and PCAPs, you must continue to use the classic UI. The overall task flows of Cisco Cyber Vision are currently spread across the classic and beta UIs, with the beta UI offering enhanced visualization of the center’s data.

Asset visibility

The beta UI offers asset visibility, where assets refer to any physical machine of the industrial network such as a switch, an engineering station, a controller, a PC, a server, and so on. The Asset Visibility page allows you to filter assets by organizational hierarchy, data sources, and functional group assignment. You can also delete assets from the Asset Visibility page.

Functional group recommendations

Cisco Cyber Vision can analyze the network communication characteristics of assets that aren’t already assigned to a functional group, and suggest a functional group assignment. In the Cyber Vision Center Beta UI, choose Configuration > Functional Groups, and click Start Asset Clustering for AI-generated grouping recommendations. You can review the recommendations and then accept or discard them.

Vulnerabilities

The Common Vulnerability Scoring System (CVSS) model is used to evaluate the score of vulnerabilities. The CVSS score ranges are:

·       0.0: None

·       0.1–3.9: Low

·       4.0–6.9: Medium

·       7.0–8.9: High

·       9.0–10.0: Critical 

You can filter and sort assets by vulnerability score in the beta UI dashboard.

Alerts

In the Alerts page, you can filter alerts for assets by organization hierarchies, data sources, and functional groups. The alert category Critical vulnerabilities in monitored entities is persistently displayed in the alerts page. The count of alerts for the category varies according to the filters used on the page.

A readily available out of box alert rule creates alerts for CVSS scores of 9 and greater. You can edit this rule or create new rules to view alerts for CVSS scores of 7 to 10. Click Critical vulnerabilities in monitored entities for the list of alert rules.

After reviewing the asset details, you can remove an alert from the dashboard by acknowledging the vulnerability.

Communications list for assets

In the Asset Visibility > Assets > Asset Detail > Communications page, you can view a map of an asset's communication activity. You can assess an asset’s overall communications, and filter by protocol to see any specific activity.

Other enhancements

Materialized views: performance improvements

To avoid any large requests on the database during navigation, preset data is pre-computed with the help of the materialized views feature. Materialized view requests were changed to improve performance. Preset data are now computed faster than before.

SNORT memory containments

SNORT now runs with some memory limits to avoid the consumption of all sensor memory.

Tags added for ignition SCADA

Some new components and activity tags have been created to highlight ignition devices and their communications.

Refresh service status in system statistics

You can now update service status in the System Statistics > System Health page of the Cisco Cyber Vision center.

Sensor label added to the response for sensor list API

Sensor label is now added in the response for the API to get sensor lists.

API enhacement: force sorting on another field when pagination is used

S API route GET answers have been changed to improve usability.

sbs-diag command: disk test option added to test performance

A new option is available for the CLI command sbs-diag to compute disk performance metrics.

Monitor sbs-services monitoring service

A new service, sbs-services monitoring, is added to the service monitoring task to notify you of any failure in the Service Status page (System Statistics > System Health > Service Status).

MTU of sensor management extension changed to 1400.

The MTU of sensor management extension has been revised to 1400.

Warning message for component limit changed

The warning messages regarding the maximum number of components have been improved. The maximum allowed limit for components is 150,000, and you receive warning messages for the following scenarios:

·       When the number of components is close to the maximum limit, you are notified that the center will soon stop data ingestion to preserve the system.

·       When the limit is reached, the center stops data ingestion.

Tracking license tokens in use for the current DB

New entries are available in the Admin > License page when the center runs in Evaluation Mode, without licenses, to estimate the count needed for each license.

Known limitations

Beta UI Vulnerability page does not display device details

If the timespan setting for a device is too short, vulnerability data for the device is not displayed. If click the vulnerability link for a device fails to display data, increase the timespan setting for the device.

Cyber Vision sensor self-update

·       After a Cyber Vision sensor self-update process is complete, if a platform is restarted within 5 minutes of the update the sensor returns to the previous version.

·       If a Cyber Vision sensor is first updated to version n using the self-update feature, then to version n+1 with the sensor management extension, the sensor remains at version n.

Address reservation in DPI configuration

The docker reserves the first address of a defined network. You must not assign the first address when you configure the DPI interface in an Encapsulated Remote Switched Port Analyzer (ERSPAN).

Compatibility

Compatible Cyber Vision Centers

Table 1.        List of centers compatible with Cisco Cyber Vision Release 5.1.1.

 

Compatible Sensors

Table 2.        List of sensors compatible with Cisco Cyber Vision Release 5.1.1.

 

Compatibility between the centers and sensors

There is downward compatibility of one release between the global center and synchronized centers, and between centers and sensors.  

If the global Center runs release N, it can manage synchronized centers that run releases N or N-1.

For example, a global center running release 5.0.0 can manage other centers running releases 5.0.0 or 4.4.x.

If a center runs release N, it is compatible with sensors running releases N or N-1.

For example, a center running release 5.0.0 can manage sensors running releases 5.0.0 or 4.4.x.

 

Fresh Installs and Upgrades

Install Cisco Cyber Vision

In the case of fresh installs, go to  Cisco Software Central, and in the Download and Upgrade section, click Access Downloads. Use the search button to find Cyber Vision, choose Cyber Vision Center, and choose release 5.1.1.

From the list of software displayed, download the following:

1.     One center OVA or VHDX file, depending on your network architecture.

2.     Cisco Cyber Vision Sensor Management Extension

3.     Cisco Cyber Vision Reports Management Extension

To install the Cisco Cyber Vision center, see the guide that applies to your architecture:

·       Cisco Cyber Vision Center VM Installation Guide, Release 4.4.0 and Later

·       Cisco Cyber Vision Center Appliance Installation Guide, Release 4.4.0 and Later

·       Cisco Cyber Vision for Azure Cloud Installation Guide, Release 4.4.0 and Later

·       Cisco Cyber Vision for the AWS Cloud Installation Guide, Release 4.4.0 and Later

To install the extensions:

 

Upgrade process considerations

If you are upgrading to Cisco Cyber Vision release 5.1.1 from an earlier release, see the Cisco Cyber Vision Upgrade Guide, Release 5.1.1.

Upgrade path

Table 3.        Upgrade paths to Cisco Cyber Vision Center release 5.1.1

 

Cisco Cyber Vision partition size

Cisco Cyber Vision Center system has two partitions, one for the system and one for data. The system partition size must be at least 1 GB for the upgrade process to complete successfully—a lower partition size results in upgrade failure.

If your Cisco Cyber Vision center runs 3.1.0 or earlier versions, the system partition may be 512MB which is insufficient to upgrade to Cisco Cyber Vision center release 4.4.0 and later. Contact the Cisco TAC team to get support with updating the system partition to 1 GB.

To check the system partition size of your Cisco Cyber Vision center, access the center CLI and use the command:

lsblk

Sentryo hardware and Cisco IC3000 sensors

If you are upgrading to Cisco Cyber Vision release 4.4.0 or later releases:

1.     Sentryo hardware are not supported. Remove any connected Sentryo hardware before you start the upgrade process.

2.     Cisco IC3000 sensors must run Cyber Vision center release 4.3.0 or later releases. If the Cisco IC3000 sensors connected to your Cisco Cyber Vision center run an earlier Cyber Vision release, upgrade them to 4.3.0 or later releases before you initiate the upgrade process.

Resolved Caveats