NERC v6.0 for ESM Release Notes
- 1. HPE Security ArcSight Compliance Insight Package for NERC v6.0 Software Version: ESM 6.9.1 and later Release Notes February 23, 2017
- 2. Legal Notices Warranty The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. The network information used in the examples in this document (including IP addresses and hostnames) is for illustration purposes only. HPE Security ArcSight products are highly flexible and function as you configure them. The accessibility, integrity, and confidentiality of your data is your responsibility. Implement a comprehensive security strategy and follow good security practices. This document is confidential. Restricted Rights Legend Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice © Copyright 2017 Hewlett Packard Enterprise Development, LP Follow this link to see a complete statement of copyrights and acknowledgements: https://www.protect724.hpe.com/docs/DOC-13026 Support Phone Alistof phone numbers is available on the HPE Security ArcSightTechnical Support Page: https://softwaresupport.hpe.com/documents/10180/14684/esp-support- contact-list Support Web Site https://softwaresupport.hpe.com Protect 724 Community https://www.protect724.hpe.com Contact Information Release Notes HPE Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later Page 2 of 6
- 3. Contents Compliance Insight Package for NERC v.6.0 4 Release Contents 4 Installing Solution for NERC CIP 4 Performance Impact of Solution for NERC CIP v6.0 5 Open Issue in this Release 5 Send Documentation Feedback 6 HPE Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later Page 3 of 6
- 4. Compliance Insight Package for NERC v.6.0 The mission of the North American Electric Reliability Corporation (NERC) is “to ensure the reliability of the bulk power system in North America”. To accomplish this mission, NERC defines a set of Critical Infrastructure Protection (CIP) standards to help ensure the protection of electric utility operations and cyber assets. The Compliance Insight Package for NERC v6.0 coupled with HPE ArcSight ESM can assist you in complying with the NERC v6.0 CIP Standards. For the detailed list of the covered NERC CIPs Standard versions refer to the HPE Security ArcSight Compliance Insight Package for NERC v6.0 Solution Guide. Release Contents The files in this release include: File Name Description ESM_NERC_Solution_ ReleaseNotes_v6.0.pdf Product description and open issues (this document). ESM_NERC_SolutionGuide_ v6.0.pdf HPE Security ArcSight Compliance Insight Package for NERC v6.0 Solution Guide — Product architecture, installation, configuration, and operation instructions with a description of product contents. ArcSight- ComplianceInsightPackage- NERC.6.0.2195.0.arb Installable package bundle for all operating systems. Contains all the resources of the Compliance Insight Package for NERC v6.0. Note: If you use Internet Explorer to download the ARB file, it may convert the ARB file to a ZIP file. If this occurs, rename the ZIP file back to an ARB file before importing into ArcSight ESM. Installing Solution for NERC CIP The Compliance Insight Package for NERC v6.0 (Solution for NERC CIP) is supported on the following products and later versions: l ArcSight ESM 6.9.1 Caution: You can install Solution for NERC CIPwith other solutions on the same Manager; however, HPE recommends that you do not install this solution in conjunction with the earlier versions of NERC such as CIP-002 to CIP-009 v.1.0, Due to the extensive redesign of the Compliance Insight Package for NERC 6.0, there is no migration path from earlier versions. If you are running an earlier version of NERC and you need to keep your current data, do not uninstall the Release Notes Compliance Insight Package for NERC v.6.0 HPE Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later Page 4 of 6
- 5. earlier version; instead, install the Compliance Insight Package for NERC 6.0 on a different system. Complete installation and configuration instructions for the Compliance Insight Package for NERC v6.0 are located in the guide HPE Security ArcSight Compliance Insight Package for NERC v6.0 (ESM_ NERC_SolutionGuide_v6.0.pdf). Performance Impact of Solution for NERC CIP v6.0 ArcSight Solution Packages contain data monitors, rules, and trends that can place an additional load on the ArcSight ESM Manager, which may impact the ArcSight ESM Manager performance. If your ESM system is operating at an average event per second (EPS) rate that has maximized the CPU utilization, you might experience a reduced average EPS rate after installing the Solution for NERC CIP v6.0 package. If this performance impact occurs, ArcSight recommends that you disable unwanted data monitors and rules to reduce the load on the Manager. Open Issue in this Release The following issue is open in this release. Number Description and work-around instructions SOL- 4569 Issue: The rule name for the Data Monitor Rules Attackers and Targets ( which appears on CIPS-002 to CIPS-011 Overview Dashboards) can overlap source and target nodes due to a long rule name and numerous graph nodes. Work-around: Decrease the value for Maximum Event Count. SOL- 4672 Issue: On Top Value Counts data monitors, increasing values for the Bucket Size in Numbers and the Number of Buckets fields can impact Manager performance. Work-around: Decrease the values for the Bucket Size in Numbers and the Number of Buckets fields. Release Notes Compliance Insight Package for NERC v.6.0 HPE Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later Page 5 of 6
- 6. Send Documentation Feedback If you have comments about this document, you can contact the documentation team by email. If an email client is configured on this system, click the link above and an email window opens with the following information in the subject line: Feedback on Release Notes (Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later) Just add your feedback to the email and click send. If no email client is available, copy the information above to a new message in a web mail client, and send your feedback to arc-doc@hpe.com. We appreciate your feedback! HPE Compliance Insight Package for NERC v6.0 ESM 6.9.1 and later Page 6 of 6