1. Hotfix Release Information

Resolved Known Issues

Trend Micro Apex Central™ as a Service

This Hotfix resolves the following issue(s):

Issue 1 (SEG-82010)

When administrators add Active Directory (AD) domains to the "ADSyncOUList.config" approved list without specifying the Organizational Unit (OU), Apex Central is unable to synchronize the Active Directory domains.

Solution

This hotfix resolves the issue so that users can add AD domains to the "ADSyncOUList.config" approved list without specifying the OU.

Issue 2 (SEG-82724)

When the Active Directory (AD) manager has only one reporting staff and the staff account on the AD server is disabled between synchronization tasks, Apex Central is unable to synchronize the Active Directory.

Solution

This hotfix resolves the issue so that Apex Central can synchronize the Active Directory even if a reporting staff account is disabled between synchronization tasks.

Issue 3 (SEG-79468)

Apex Central may not be able to send scheduled reports by email when there is a large number of reports.

Solution

This hotfix resolves the issue.

Issue 4 (SEG-44878)

In C&C callback event notifications, the callback address field may contain complete URLs of malicious websites which users can click.

Solution

This hotfix resolves this issue.

Issue 5 (SEG-84122)

Users encounter an error message while editing an existing user account.

Solution

This hotfix ensures that users can edit existing user accounts successfully.

Issue 6 (SEG-84979)

The SIEM server displays inaccurate information when Apex Central sends Attack Discovery logs containing JSON content.

Solution

This hotfix ensures that SIEM servers display complete and accurate information for Attack Discovery logs containing JSON content.

Issue 7 (SEG-83710)

The Trend Micro Infrastructure (TMI) service stops unexpectedly.

Solution

This hotfix resolves this issue.

Issue 8 (SEG-85722)

Apex Central is unable to deploy new components downloaded from the ActiveUpdate (AU) server.

Solution

This hotfix ensures that Apex Central can deploy newly downloaded components from the AU server.

Issue 9 (SEG-75516)

There is a typographical error in the syslog content for the following log types:

  • Virus/Malware
  • Web Violations
  • Content Violations

Solution

This hotfix corrects the typographical error.

Issue 10 (SEG-76147)

The "%vloginuser%" token does not display any information in C&C callback notifications.

Solution

This hotfix ensures that the "%vloginuser%" token displays the required information in C&C callback notifications.

Issue 11 (SEG-39822), (SEG-82550)

An issue may corrupt the "Systemconfiguration.xml" file and prevent services from starting properly.

Solution

This hotfix adds a mechanism to help protect the "Systemconfiguration.xml" file from corruption.

Issue 12 (VRTS-4428)

Some components on the Dashboard are out-of-date.

Solution

This hotfix updates the components.

Issue 13 (SEG-83240)

A database timeout issue prevents policy deployment.

Solution

This hotfix resolves this issue.

Issue 14 (SEG-82054)

An issue prevents programs in the Plug-in Program List from appearing on Manual Update and Scheduled Update program lists.

Solution

This hotfix ensures that these plug-in programs appear in the Manual Update and Scheduled Update lists.

Issue 15 (SEG-73320)

If a Root Cause Analysis does not return any matching targets, "N/A" appears in the corresponding "Users/Endpoints" field.

Solution

After applying this hotfix, "No Match" displays in the "Users/Endpoints" field for Root Cause Analysis results that do not return any matching targets.

Issue 16 (SEG-73373)

Users cannot click the "Deploy" button when creating a new policy.

Solution

This hotfix resolves the issue.

Issue 17 (SEG-83354)

User name information does not appear in Virus/Malware syslog messages.

Solution

This hotfix resolves the issue.

Issue 18 (SEG-77893)

In environments where a proxy server is required to establish the connection between Apex One and Apex Central, a communication error occurs and prevents Apex Central from deploying policies successfully.

Solution

This hotfix resolves the communication error and ensures that Apex Central successfully deploys policies when connecting to Apex One through a proxy server.

Trend Micro Apex One™ as a Service

This Hotfix resolves the following issue(s):

Issue 1 (SEG-85213), (SEG-75622)

Some directory and file names that end with an extra space disappear from the imported scan exception list.

Solution

This Hotfix updates the Apex Central server program to resolve this issue.

Issue 2

Users cannot move Security Agents to another server using the EnableMoveNATClient feature, this happens due to an enhanced security check mechanism for moving Security Agents in the previous hotfix.

Solution

This Hotfix updates the security check mechanism to ensure that you can move Security Agents using the EnableMoveNATClient feature.

Issue 3

Users cannot move agents to a specific domain on the target server using the EnableMoveNATClient feature in the following command format:

  • #moveto_<target Server IP or hostname>:HTTP port|HTTPS port\targetdomain

This happens because the backslash "\" prevents the feature from retrieving the full domain name from the SQL database.

Solution

This Hotfix updates the Apex One agent program to resolve this issue.

Issue 4 (SEG-82708)

When connecting to the VPN server, the IP changes and the firewall is re-applied. It takes time to apply all firewall rules and a timing issue may cause the exception rule to be removed before the security level policy rule. When this happens, the traffic is blocked by the high or medium firewall policy.

Solution

This Hotfix ensures that when reapplying the firewall, Apex One removes the security level policy rule first before the exception rule so that traffic is not blocked at this time.

Trend Micro Apex One™ (Mac) as a Service

This Hotfix resolves the following issue(s):

Issue 1 (PDGJIRA-2436)

The Security Agent might start a scheduled scan, even when the scheduled scan feature is disabled.

Solution

This hotfix prevents the Security Agent from starting an unscheduled scan after the upgrade.

Enhancements

Trend Micro Apex Central™ as a Service

The following enhancements are included in this Hotfix:

Enhancement 1 (PDGJIRA-7555)

The file name of the exported list of blocked Virtual Analyzer Suspicious Objects has changed to "ExportBlockedListInfo".

Enhancement 2

The web installer checks the compatibility of the target endpoints (including system requirements and conflicting applications) before automatically downloading and installing the Security Agent package from Trend Micro servers.

Enhancement 3

The Command Tracking screen on Apex Central displays whether Apex Central successfully registered to, or unregistered from, Trend Micro XDR.

Enhancement 4 (SEG-84232)

This hotfix improves IIS stability.

Enhancement 5 (SEG-79053)

This hotfix adds the "UK: RD&E Hospital Number" field to the DLP module rule template.

Enhancement 6 (SEG-76695)

This hotfix adds the "User Name" column to the Product Status log query results.

Enhancement 7 (SEG-76413)

If an Active Directory domain only has one child domain, Apex Central does not automatically a parent domain when filtering policy targets by Active Directory structure.

Enhancement 8 (SEG-78710)

This hotfix enables Apex Central to support the "Network Content Inspection Engine (3.10, Kernel mode, 64-bit, Conf: 5700)" engine component for Trend Micro Deep Discovery Inspector 5.7.

Enhancement 9 (PDGJIRA-7111)

The "System" and "SSO_User" user accounts and user roles are hidden by default.

Trend Micro Apex One™ as a Service

The following enhancements are included in this Hotfix:

Enhancement 1 (SEG-76461)

This Hotfix updates the Apex One server program to display the Data Loss Prevention(TM) (DLP) engine version of the Security Agent in Scheduled Scan Report on the Apex Central web console.

Enhancement 2

Add a promotion (blue) bar on the page to navigate users to assess XDR console.

Enhancement 3

Users can view related objects based on specific ratings on the Root Cause Analysis details panel.

Enhancement 4

This Hotfix allows administrators to move agents to a specific domain on the target server using the EnableMoveNATClient feature by creating domain hierarchy under the "#moveto_<target Server hostname>:HTTP port|HTTPS port" domain on the source server.

Procedure

To move agents to a specific domain on the target server using the EnableMoveNATClient feature:

  1. Install this hotfix (see "Installation").
  2. Open the "ofcscan.ini" file in the "\PCCSRV\" folder on the Apex One server installation directory.
  3. Add the following keys under the "Global Setting" section and set the following values:
  • [Global Setting]
  • EnableMoveNATClient=1, enables administrators to move unreachable clients between servers
  • MoveNATClientDomainPrefix=#moveto_, (default) domain prefix for moving unreachable clients
  1. Save the changes and close the file.
  2. Open the Apex One web console and go to the "Agents > Global Agent Settings" screen.
  3. Click "Save" to deploy the setting to agents. The Apex One server deploys the command to security agents and adds the following registry entries on all security agent computers:
  • Path: HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\
  • Key: EnableMoveNATClient
  • Value: 1
  • Path: HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.\
  • Key: MoveNATClientDomainPrefix
  • Value: #moveto_
  1. Open the Apex One web console and go to the "Agents > Agent Management > Manage Agent Tree > Add Domain" page.
  2. Specify the domain name "#moveto_<target Server hostname>:HTTP port|HTTPS port". For example, "#moveto_serverB:80|443".
  3. Create the domain hierarchy under "#moveto_<target Server hostname>:HTTP port|HTTPS port" domain or drop existing domain to "#moveto_<target Server hostname>:HTTP port|HTTPS port" domain. For example,

    • Apex One Server
    • ----- #moveto_serverB:80|443
    • ---------- | subdomain1 |
    • --------------- | subdomain2 |
  4. Move the agent to the specific domain in the domain hierarchy created in step 9. For example, put agent in subdomain2 domain

    • Apex One Server
    • ----- #moveto_serverB:80|443
    • ---------- | subdomain1 |
    • --------------- | subdomain2 | agent
  • NOTES: You may skip this step if you drop existing domain in step 9 and the agent has existed in the domain.
  1. The agent will be moved to the specific domain on the target server. For example,
    • Apex One Server
    • ----- | subdomain1 |
    • ---------- | subdomain2 | agent

Trend Micro Apex One™ (Mac) as a Service

The following enhancements are included in this Hotfix:

Enhancement 1 (PDGJIRA-2393)

Increased the maximum number of entries in scan exclusion list to 100.

Additional Information

Trend Micro Apex Central™ as a Service

No additional information available.

Trend Micro Apex One™ as a Service

Security Agent version: 14.0.8944

Security Agent restart: Required

Estimated size of network traffic (in terms of bandwidth) required for deployment:

  • 32-bit Security Agent hotfix = 243 MB
  • 64-bit Security Agent hotfix = 268 MB

Trend Micro Apex One™ (Mac) as a Service

Security Agent Version: 3.5.3617

Security Agent Restart Requirement: Not required

Estimated size of network traffic (in terms of bandwidth) required for deployment:

64-bit Security Agent Hotfix = 122MB

2. Documentation Set

    The document set includes:

  • Trend Micro Apex One™ as a Service documents
    • Readme: Contains a list of known issues and may also contain late-breaking product information not found in the Online Help or printed documentation.
    • Knowledge Base: An online database of problem-solving and troubleshooting information. It provides the latest information about known product issues. To access the Knowledge Base, go to the following website: http://esupport.trendmicro.com
  • Trend Micro Apex Central™ as a Service documents
    • Administrator's Guide: A PDF document that provides detailed instructions for how to configure and manage the Trend Micro Apex Central™ as a Service console and features.
    • Data Protection Lists (Chapter 1 only): A PDF document that lists predefined data identifiers and templates for Data Loss Prevention.
    • Widget and Policy Management Guide: Explains how to configure Dashboard widgets and Policy Management widgets on the Trend Micro Apex Central™ as a Service console.
    • Automation Center: Online user guides and references that explain how to use the Apex Central Automation APIs: https://automation.trendmicro.com/apex-central/home
    • Online Help: Provides "how to's", usage advice, and field-specific information. The Help is also accessible from the Trend Micro Apex Central™ as a Service console.
  • Trend Micro Apex One™ server documents
    • Administrator's Guide: A PDF document that discusses getting started information and Trend Micro Apex One™ server administration.
    • Online Help: Provides "how to's", usage advice, and field-specific information. The Help is accessible from the Trend Micro Apex One™ server, agent, and Policy Server consoles, and from the OfficeScan Master Setup.
  • Trend Micro Apex One™ (Mac) server documents
    • Administrator's Guide: A PDF document that discusses getting started information and Trend Micro Apex One™ (Mac) server administration.
    • Online Help: Provides "how to's", usage advice, and field-specific information for Trend Micro. The Help is also accessible from the Trend Micro Apex One™ as a Service console.
  • Security Agent documents
    • Trend Micro Apex One™ Security Agent Online Help: Discusses getting started information, Trend Micro Apex One™ Security Agent installation procedures, and Trend Micro Apex One™ Security Agent management.
    • Trend Micro Apex One™ Security Agent Readme: Contains a list of known issues and may also contain late-breaking product information not found in the Online Help or printed documentation.
    • Trend Micro Apex One™ (Mac) Security Agent Online Help: Discusses getting started information, Trend Micro Apex One™ (Mac) Security Agent installation procedures, and Trend Micro Apex One™ (Mac) Security Agent management.

    Download the latest versions of the PDF documents and readme at our online documentation.

3. Post-installation Configuration

No post-installation steps are required.

NOTE: Trend Micro recommends that you update your scan engine and virus pattern files immediately after installing the product.

4. Known Issues

Trend Micro Apex Central™ as a Service

There are no known issues for this Hotfix release.

Trend Micro Apex One™ as a Service

Known issues in this release:

Known issue 1

Security Agent consoles running build 13.95 display an incorrect policy name. To resolve this issue, upgrade the Security Agent to 14.0. After the Security Agent contacts the server, the policy name displays correctly.

Known issue 2

Off-premises and Security Agents in Independent mode cannot update the Certified Safe Software Pattern from external update sources.

Known issue 3

Coexist mode Security Agents on endpoints with Windows Defender may experience installation issues or be unable to upload data to the Apex One server due to a file locking issue. To resolve this issue, add Endpoint Sensor (ESEServiceShell.exe and ESClient.exe) in the exclusions list of Windows Defender to prevent the locking issue.

Known issue 4

After copying a file to a remote server using a relative path as the source, Apex One is unable to translate the relative path into the full system directory.

Known issue 5

The quality of RCA analysis chain image files is reduced when viewing the files using Windows 10 Photo Viewer.

Known issue 6

When attempting to start a Historical Investigation from the Attack Discovery Detections widget that includes Registry value name or Registry value data criteria, the Historical Investigation displays an error message if the length of the Registry value name exceeds 260 characters or the Registry value data exceeds 64 characters.

Known issue 7

After updating the Attack Discovery Pattern file (tmesadp.ptn) on Security Agents, a database schema error may occur that causes the Endpoint Sensor feature to continuously report the same detections to the server during each synchronization. This causes duplicate records to display on the Apex Central server.

Known issue 8

Root Cause Analysis email attachment results may also include temporary files created when the user saved the file.

Known issue 9

The number of matched endpoints that display on a Root Cause Analysis chain may appear to be greater than the total if the Security Agent on an endpoint was uninstalled or no longer reports to the same managing server.

Known issue 10

The Endpoint Sensor service may have high memory usage.

Known issue 11

The Endpoint Sensor may have high peak CPU usage occasionally.

Known issue 12

Endpoint Sensor has CPU peak during Windows Update phase.

Known issue 13

The user or account name in ADE detection may be empty.

Trend Micro Apex One™ (Mac) as a Service

Known issues in this release:

Known issue 1

After enabling the Scan Time Machine option for Manual Scan and Scheduled Scan, Apex One (Mac) cannot perform any actions (clean, quarantine, or delete) on detected malware threats due to a permission limitation in Mac OS. Configured scan actions are displayed as unsuccessful in the product logs.

Known issue 2

When performing a historical investigation on Apex One (Mac) endpoints, the system replaces a backslash (/) with a colon (:) in file names, preventing users from searching for file names that contain backslashes in investigation results.

To resolve this issue, use a colon (:) to search for the files.

5. Contact Information

A license to Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, you must renew Maintenance on an annual basis at Trend Micro's then-current Maintenance fees.

Contact Trend Micro via fax, phone, and email, or visit our website to download evaluation copies of Trend Micro products.

https://www.trendmicro.com/en_us/contact.html

NOTE: This information is subject to change without notice.

6. About Trend Micro

Smart, simple, security that fits

As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information.

Copyright 2020, Trend Micro Incorporated. All rights reserved.

Trend Micro, Trend Micro Apex Central, Trend Micro Apex One, Trend Micro Apex One (Mac) and the t-ball logo are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies.

7. License Agreement

View information about your license agreement with Trend Micro at: https://www.trendmicro.com/en_us/about/legal.html

Third-party licensing agreements can be viewed:

  • By selecting the "About" option in the application user interface
  • By referring to the "Legal" page of the Administrator's Guide
Back to Top