Tenable One Identity Exposure 3.11 (2021-12-01)

Tenable One Identity Exposure version 3.11 includes the following new features:

  • A new Indicator of Exposure lists dangerous permissions and misconfigured parameters related to the Windows Public Key Infrastructure (PKI).

Bug Fixes

Tenable One Identity Exposure version 3.11 contains the following bug fixes:

Bug Fix Defect ID
Tenable One Identity Exposure returns the API Score information again. N/A
Tenable One Identity Exposure now provides better analytics performances thanks to new SQL index. N/A
The widget edition now takes into account previously selected domains. N/A
Tenable One Identity Exposure purges the previous version's events from internal queues after each upgrade. N/A
The analytics service successfully reconnects to the RabbitMQ server after failures. N/A
The indicator of exposure C-PASSWORD-POLICY is more resilient against a specific corner case. N/A
Tenable One Identity Exposure ignores InheritOnly ACEs when it checks ACLs to avoid false positives. N/A
The trail flow no longer freezes. N/A
The indicators of attack requiring Sysmon tolerate better versions of Windows event, which strengthens detection. N/A

Patches

Tenable One Identity Exposure version 3.11.7 contains the following patches.

Patch Defect ID
Tenable One Identity Exposure correctly flushes out Login event (4624) from its cache memory after a Logoff event (4634). N/A
Tenable One Identity Exposure displays attacks that occur on the 1st day of the month in the correct month. N/A
When you remove a GPO, Tenable One Identity Exposure only displays the deleted event. N/A
When the SYSVOL connection breaks, Tenable One Identity Exposure renews the connection to allow the listener to fetch new events. N/A
The allow lists for Credentials Roaming users and groups now accept the samAccountName format. N/A

This patch also updates OpenSSL-related software to address the security issue CVE-2022-0778.

Tenable One Identity Exposure version 3.11.6 contains the following patches.

Patch Defect ID
SQL services are running when upgrading from version 3.11.3. N/A
Split architecture installations include TLS options. N/A
Rabbit MQ correctly resumes after upgrading from version 3.1.5 to 3.11.3. N/A
Event insertion no longer affects performance. N/A
Events for Indicators of Attack do not consume too many memory resources. N/A

Tenable One Identity Exposure version 3.11.5 contains the following patches.

Patch Defect ID
Tenable One Identity Exposure deduplicates Windows event logs' strings to reduce memory usage. N/A

Tenable One Identity Exposure version 3.11.4 contains the following patches.

Patch Defect ID
The Tenable One Identity Exposure installer pre-fills values for IP/ports from variables during an upgrade. N/A
The upgrade correctly considers existing certificates. N/A
The SQL service account can now access local certificates. N/A
Tenable One Identity Exposure updates group members when they change Organizational Units (OU). N/A
The Security Probe installer completes after a reinstallation. N/A
The Tenable One Identity Exposure installer verifies that the PFX certificates are valid. N/A