IBM Security Resilient

Resilient Launch v37: Read about the latest enhancements here

By MICHAEL LYONS posted Wed June 10, 2020 03:59 PM

  

Resilient.jpg
We are pleased to announce the launch and general availability of Resilient v37.  This release brings a lot of new and exciting functionality.  Below is the summary of the features.

Feature Description

Artifacts

Added a Related Incidents column in the incident's Artifacts tab that displays the number of incidents where this artifact appears. Clicking the number displays a table of the specific incidents.

Also changed the algorithm that relates artifacts to ignore the artifact's type. The relation is now based on the artifact's value regardless of type. For example, an incident with an IP Address-Source of 9.8.7.6 artifact matches to another incident with an IP Address-Destination of 9.8.7.6 artifact.

Audit log

Audit messages are logged for threat service enable and threat service disable.

Report and Analytics Performance

Introduced a number of performance improvements regarding generating reports and viewing analytics dashboards. These improvements include optimizing the Incident History Report, loading widgets in the Analytics Dashboard more efficiently, and improving the process of running multiple incident reports simultaneously.

Resilient for MSSPs

IMPORTANT: If you are using the Resilient QRadar plugin and you are upgrading your Resilient platform from Version 36.1 or earlier, make sure to upgrade the plugin to V3.4.1 before using it with the Resilient platform V37.

Security Updates

The security update for this release addresses various security issues. For on-premises customers, consult your Resilient Installation Guide for the location of these updates. On-Cloud customers are updated automatically.

SNMP monitoring

For on-premises customers, the Resilient SOAR Platform Virtual Appliance Installation Guide provides the procedures to monitor the Resilient platform using SNMP. This enhancement was in response to a customer's Request for Enhancement (RFE).

System Requirements

For on-premises customers, the virtual appliance default configuration has been changed to 4 CPUs and 16GB memory. This does not impact upgrades. For standalone installations, the minimum memory recommendation for the system hosting the Resilient platform has increased to 16GB, and the CPU recommendation is 4 CPUs.

Usability Improvements

This release contains a number of usability enhancements, including:

  • The list of attachments displayed in an incident page is limited to three with the option to display more.
  • The banner timeout in the task window is extended, and a user can make it remain open by hovering the mouse over it.

Web Browser Support

Internet Explorer is no longer supported. The Resilient platform supports the Chrome, Firefox, Safari, and Edge web browsers.

Dark Mode Default for New Users

 

Due to the extreme popularity, all new users added to Resilient will now have their default theme setting changed to Very Dark.

 

Notifications

 

We are now introducing the ability to enable/disable notifications within Resilient.  The notifications can be disabled globally (turned off) or disabled within the platform or via email, allowing admins to become very granular and exact with their notifications.

 

Privacy

 

The privacy tab has now been revamped to only show the most relevant information for your organizations.   Through configuration only the relevant data types and regulators are displayed to be able to gather your privacy regulation insights in the blink of an eye.

 

Performance

 

Performance improvements have been made to the Incident History Reporting, Auditing, and Privacy features. 

 

Diagnostics

Improvements to logging have been done to accelerate troubleshooting complex support issues.

 

 

Additionally, we are pleased to announce the launch and general availability of Resilient v37.2 in mid-July.  This release brings Apps and App Host into GA.  See a summary of this new functionality below:

 

Resilient SDK

Resilient App / integration development has now been simplified with the creation of the resilient-sdk.  The new SDK contains everything needed to create Apps / integrations including the generation of the new zip formats and containers needed for custom apps.   For more information on the resilient-sdk please visit the Resilient Developer Page

 

Apps and App Host

The new Apps and App Host feature is our next-generation integration infrastructure that containerizes integrations and brings the integration management into the WebUI, bringing install times down to just a few minutes.   A new tab has been added to the Administrator Settings for the management of App installation, configuration, deployment, and debugging through log retrieval.    Additionally, the pairing of a new App Host is managed through the WebUI such that hosts are registered for deployment of containers to.  

 

Apps (like integrations) are still downloaded from the AppXchange in a zip package, however if you look at the content of what you download it has changed slightly to include specifics about containers and configuration.  The zip for an App then uploaded into the UI pushing the App configuration and customizations into the Resilient server.  Certain parts of the configuration are auto generated such as the API key, certificate, host, port, and org when the app is installed to reduce configuration time.  Further configuration may be necessary to log into remote systems and can be done via a file editor in the WebUI.   Once configuration is complete the app executable can be deployed to the paired Apphost, which will pull down containers from our centralized container repository.   If the App run into issues while running the container can be restarted or a guided log retrieval experience is displayed in the UI. 

 

If you have existing integration from the AppXchange today, the integrations can be redownloaded and installed into the WebUI.   If any of your integrations have been customized or home grown, then we will be providing a new resilient-circuits-SDK that will include the new commands to create the new packaging as well as the containers.   Once the container is built a container registry will need to be setup and configure in the App Host.  Once configured the packaging can be uploaded to the WebUI. 

 

For information on the Apps and App Host deliverable see the documentation for v37.2 when its available here.

 

For more information on developing your own apps go here when v37.2 has been released.

 

 

To learn more about Resilient v37/v37.1/v37.2, watch the replay of our June 2nd webinar – Release Report: v37 of Resilient.


#Resilient
#Featured-area-2
#Featured-area-2-home
0 comments
194 views

Permalink