10.1 Release Notes

This article provides important information about StorageGuard™ version 10.1 by Core6, including new features, resolved issues, knowledgebase updates, and upgrade guidance.

In this article

• At a Glance – StorageGuard 10.1
• StorageGuard overview
• New in Version 10.1
• Installation Notes for this Release
• Upgrade for this Release
• Important Notes
• Known Issues
• Limitations
• Getting help
• Revision History

At a Glance – StorageGuard 10.1

StorageGuard overview

StorageGuard secures enterprise storage and backup environments by continuously assessing configuration posture and exposure. It automatically collects configuration data across platforms and identifies misconfigurations, drift from approved baselines, deviations from vendor hardening guidelines, compliance gaps, and ransomware protection weaknesses.

Operators can easily query configurations, investigate findings, and validate posture using natural language.

Key capabilities of StorageGuard

New in Version 10.1

New features and highlights

This StorageGuard release introduces significant enhancements across configuration change management and integrations:

Change Control

A new Change Control area tracks and summarizes configuration changes across scanned assets over time. It includes:

• A vertical timeline of configuration changes for each scanned asset
• AI-powered risk scoring for each detected change
• The ability to compare a storage system against any past point in time
• The ability to mark changes as authorized or unauthorized
• Findings now include a Recent Configuration Changes section to shed light on the changes occurring prior to the detection of the finding 
• An overview page with insight and trend information, including stability, change rate, and other metrics

Figure 1: The Change Control area

New AI-assisted workflows for onboarding, custom checks, and remediation

Generate a remediation plan for an asset

• Right-click an asset and select Remediation Planning to generate a suggested remediation plan for its findings.
• Plans can be scoped to critical findings only, configuration hardening, or vulnerabilities.

Figure 2: AI-assisted remediation planning

Define a new custom configuration check with the AI assistant

• Supply the check name and the storage or backup platform, then describe what you want to verify.
• The assistant then presents a complete check for your approval, including the mapped API endpoints, data fields, evaluation logic, and script.

Figure 3: Defining a custom check with the AI assistant

Onboard new systems with step-by-step guidance

• The AI assistant guides you through onboarding new systems onto StorageGuard, step by step.

Support Matrix

The following storage solutions were added to the support matrix:

• Dell Secure Connect Gateway (SCG) – Inventory, Custom Checks and Vulnerability Identification
• Oracle ZFS Storage Appliance (ZFSSA) – Full Support

Hitachi VSP scan reformed and expanded

The Hitachi VSP scan has been substantially revised and now offers greater flexibility: arrays can be scanned directly, through a separately installed Configuration Manager, and/or through Ops Center. The scan also covers the Hitachi management application layer – Common Services, Administrator, Automator, and others.

ARMIS integration

StorageGuard can now be integrated with ARMIS and can be used to enrich Storage/Backup Assets within the ARMIS inventory with risk level and risk detail information.

Enhanced security

Additional changes and enhancements

The following section highlights additional notable changes or enhancements:

Fixed issues

The following issues are resolved:

Knowledgebase Updates

The following section describes new and modified checks.

New checks

The following table identifies systems for which new checks have been added:

For the detailed list of checks, contact support.

Renamed checks

Removed checks

Hitachi VSP legacy HiCommand checks

• SG-C0159T151V01: HiCommandCLI password
• SG-C0160T151V01: Tiered storage manager CLI password
• SG-C0161T151V01: RADIUS authentication protocol
• SG-C0186T151V01: WWN security
• SG-C0201T151V01: Device manager IP ACL
• SG-C0256T151V01: Cipher suite strength
• SG-C0280T151V01: User ID is enable on password
• SG-C0352T151V01: CIM comm security
• SG-C0355T151V01: External server communication
• SG-C0356T151V01: HDC comm security
• SG-C0357T151V01: HDvM SN comm security
• SG-C0358T151V01: HTTP security mode
• SG-C0378T151V01: FTP server status
• SG-C0389T151V01: SSLv2 Hello status

Installation Notes for this Release

Read the Installation Procedure Chapter of the User Guide for guidance about installing StorageGuard v10.1. In addition, review the Deployment and Scanning resources for guidance about the StorageGuard infrastructure requirements and the preparations needed for scanning your datacenters.

Upgrade for this Release

An upgrade path to version 10.1 is available from the 9.2.8 release and above. If your system is currently installed with an earlier release, an upgrade to version 9.2.8 or above is mandatory before upgrading to version 10.1.

Important notes:

• The upgrade will require the complete stop of StorageGuard operations, including data collection and data analysis. While it is fully automatic, the length of the upgrade process may require several hours to complete in large environments. During this time, it is important not to restart the StorageGuard server or terminate the upgrade task. In addition, it is essential that the database used by StorageGuard be available throughout the upgrade process.
• Important – If your scanned environment includes Hitachi VSP, take particular care to review the Upgrading to StorageGuard 10.1 for Hitachi VSP Environments section to learn about changes and steps required prior to upgrading.
• Prior to upgrading, take care to read the release notes in full, and make any necessary changes to the StorageGuard infrastructure and/or to user account permissions as required, and ensure sufficient free disk space is available on the master server. It is important to review newly required read-only privileged commands and make necessary changes to sudo (or any other privilege management solution used to grant the required permissions, such as PowerBroker, UPM, sesudo) to allow StorageGuard to run the commands.
• Prior to upgrading, verify you have an up-to-date backup of the StorageGuard server disk drives using your standard backup tools, and an up to date StorageGuard database export.
• Once the upgrade on the master StorageGuard server is completed and the Tomcat service starts, StorageGuard will automatically check and upgrade the StorageGuard collectors. There is no manual collector upgrade process. For gradual collector upgrade, disable the collectors before initiating the upgrade on the master server, and gradually enable the collectors you wish to upgrade following the completion of the software upgrade on the master server.

To upgrade from version 10.0 to version 10.1:

1. Login as a local administrator to the master StorageGuard Server.
2. Run Core6Platform_10.1.exe as an administrator.
3. Click Next on the Welcome screen.
4. Select “Yes, upgrade Core6 Suite 10.0 to 10.1”.
5. Accept the License Agreement and click Next.
6. Accept the GNU License Agreement and click Next.
7. Select whether to perform a database export prior to upgrading and whether to start Tomcat after the upgrade completes and click Next. It is recommended to keep the default settings.
8. Click Install to begin the Software Upgrade process. This process may require up to several hours to complete, depending on the size of the scanned environment.
9. Click Finish.

Upgrading to StorageGuard 10.1 for Hitachi VSP Environments

StorageGuard 10.1 replaces the legacy Hitachi VSP probe with a family of dedicated new Hitachi REST data sources: Configuration Manager, OpsCenter Administrator, OpsCenter Common Services and VSP One Block. The VSP arrays themselves are collected by the Configuration Manager data source or by VSP One Block (direct to the array's SVOS REST API).

Migration steps

1. Disable the existing Hitachi VSP (legacy HiCommand) probes – do not delete them yet.
2. Add a new Hitachi data source using one of the connection options below.
3. Run Discovery on the new data source.
4. Confirm the VSP systems fall within the scope of a security policy.
5. Run a scan.
6. Run Security Analysis to evaluate checks against the new data.
7. Verify the results against the legacy data.
8. Remove the disabled legacy HiCommand probes.

Connection options

• Option A – Direct to a single array. Onboard a Configuration Manager data source – one data source per array. Use when there is no centralized OpsCenter deployment, or for a small number of arrays.
• Option B – Centralized Configuration Manager. Onboard a Configuration Manager data source pointed at a Configuration Manager server that manages multiple VSPs; Discovery adds every VSP registered on it. Use when Configuration Manager is deployed centrally but the wider OpsCenter suite is not.
• Option C – OpsCenter Common Services (recommended where available). Onboard an OpsCenter Common Services data source. This does two things:
  • Scans Common Services itself – StorageGuard collects its configuration (users, groups, LDAP/AD, identity providers, session settings) and evaluates a dedicated set of security checks against it.
  • Discovery reads the services registered with Common Services and automatically creates the OpsCenter Administrator and Configuration Manager data sources. The Configuration Manager data source discovers and collects the VSP arrays data, exactly as in Option B.

Important Notes

Database Locale requirement

The Database instance used as the backend database for the Core6 Platform must be configured with the English Locale.

Scan of Storage and Replication Management servers

It is recommended to scan all production and DR storage management servers as hosts, even if they are already configured as storage proxies. Storage proxy scans operate at the API/CLI level, while host scans of the management servers enable collection of additional configuration files and settings.

Scan of Windows hosts through WMI

Scanning of Windows hosts updated with KB3139940 might fail with an “Access Is Denied” message. To overcome this failure, please make sure that the user configured to authenticate to this server is a member of the Local Administrator group on the StorageGuard server. StorageGuard also provides an alternative method of scanning Windows servers using WMI which requires PowerShell version 5.1 or higher.

User account for technical support only

The csadmin user provides access to support tools that can cause damage if not used properly; This user is intended to be used by Core6 support engineers only. Enable and login with the csadmin user only when directed to do so by support personnel. This user is locked by default.

Recommended scan protocol for Windows hosts

StorageGuard supports a variety of scan options for Windows hosts. The recommended scan option is using WinRM over HTTPS.

NetApp ZAPI no longer supported

Before upgrading to this release, ensure you’ve enabled REST API access for the StorageGuard scan account.

Obsolete reports

The following reports are obsolete and were removed:

• Installed Software (Host)
• SAN Switch Version
• SAN Zone Details

Known Issues

The following section highlights additional notable known product issues:

Limitations

Assigning a profile to an Active Directory group

When assigning a profile to an AD Universal Group, the StorageGuard master server must have access to the Global Catalog of the AD Forest.

When assigning a profile to an AD Local Domain Group, StorageGuard will not be able to assign the Profile to AD Users from a different Domain – even though such configuration is valid within AD. In other words – an AD user can log in to StorageGuard (with all the correct profiles assigned) only if each AD Local Domain Group it belongs to is part of the same AD Domain the AD user belongs to.

Special characters are converted during object import to StorageGuard

When importing names and properties of objects from CSV/CMDB/API, special characters such as “&”, ‘no-break-space’ and certain UTF8 chars are converted to alphanumeric chars.

In specific cases scan error messages are not sufficiently informative

The Scan Troubleshooting screen occasionally presents scan error messages that include the error code, but no additional details.

Workaround: Run the erroneous command or script manually to see the full scan error message. If further assistance is required, contact Technical Support.

SSH key supports only keys with less than 4000 characters [P-6645]

CVE detection limitation

StorageGuard may report a CVE vulnerability that was either worked around or mitigated through remedial steps other than applying software updates.

CVE knowledgebase

The CVE knowledgebase is limited to advisories and CVEs that have been publicly announced by the vendor, MITRE or other source to the community.

PowerMax 5978 patch level

StorageGuard cannot determine the patch level for Dell PowerMax 5978 arrays, only the microcode.

NetApp StorageGRID model and serial number (SG-30081)

The StorageGuard inventory does not present StorageGRID model and serial number in the inventory due to API limitations.

System requirements

For more information about system requirements and software limitations, please refer to Documentation – Help Center | Core6.

Getting help

If you have a current maintenance agreement, you may access Technical Support information at www.core6.com/support.

Customer service information is available at www.core6.com/contact.

If you forget or lose the StorageGuard administrator password, contact Technical Support.

Revision History

Document revision history: