Reporter for Cisco Firepower Release Notes

Reporter for Cisco Firepower 1.0.0.8 (2022-02-18)

Security fix: Added extra mitigations to prevent javascript embedded in log data (such as script tags in URL query strings) from executing when viewing the log data within Fastvue Reporter’s web interface.

Added mitigations for log4j “Log4Shell” vulnerability (https://nvd.nist.gov/vuln/detail/CVE-2021-44228). Fastvue Reporter now starts Elasticsearch with the JVM property that mitigates the vulnerability in Elasticsearch 5.6.14 (the version that Fastvue Reporter uses).

Unfortunately, we cannot easily update Elasticsearch or its Log4j version at this time, so Fastvue Reporter may still trigger vulnerability scanners.

Please see our article on further mitigation steps and latest updates: How to mitigate the Log4j vulnerability on your Fastvue Reporter server.
Fixed issue where user agents were being combined into the ‘User’ field.
Fixed Security Group filtering for users with a different sAMAccountName to the user portion of their User Principal Name in Active Directory (e.g. sAMAccountName = testuser but UPN = testuser2@domain.com)
The Client Applications by Size widget no longer returns a blank row for data where no client application was logged.
Fixed issue where the YouTube Videos widget showed a blank row with ‘unknown video’ thumbnail image when exported to PDF.

Fixed the ‘Test YouTube Integration’ feature in Settings | YouTube to test a range of video IDs in case a test video is removed. This fixes the ‘Object reference not set to an instance of an object’ error that you may have seen if you used the Test YouTube Integration feature.
Added a success message to the main Settings | YouTube page if the integration is working.
Charts updated to include two more colours (yellow and purple) also moved orange and light blue around in the order.

Fixed issues receiving syslog when using IPv6 addresses.
Reduced extra CPU and RAM usage introduced in 1.0.0.4 when improving the performance of loading UI resources and API requests.

The YouTube Videos section in reports now links to the video’s watch URL in the Video Thumbnails and Video Title columns.
Exporting the YouTube Videos section to CSV now includes the video’s watch URL and excludes the Thumbnail.
Improved the performance of loading UI resources and API requests.

Fixed a rare deadlock issue that may cause the Fastvue Reporter service to lockup, and the front-end user interface to load very slowly or timeout.
Fixed issues where the data outside of the retention policy may not be deleted.
Folder paths added to the Windows registry are now quote qualified, resolving ‘unquoted service path enumeration vulnerability’ issues.
Removed the ability to change the Data Storage path in Settings | Data Storage, as doing so would cause the user interface to be unresponsive until all data had moved to the new location. This was a poor user experience and had the potential to cause further issues if the server is rebooted during the data move, potentially corrupting data. You can still change the Data Storage location, but this must be done manually. See our knowledge base article: Changing Fastvue Reporter’s Data Location.

Added YouTube integration. When configured, all YouTube URLs detected during import will be looked up using the YouTube API to retrieve the video title, category, channel and thumbnail image. This information is then presented in the Safeguarding | YouTube Videos section within Overview Reports. A Google API key is required. See our article Configuring YouTube integration to retrieve video titles, categories and channels.

Improved search term extraction to exclude non-search data from certain domains.

Historical log import and file system sources have better exception handling for non-supported zip file formats.