12.5.2 Upgrade Guide

Summary of the NetWitness® 12.5.2 Upgrade Guide

The Upgrade Guide explains how to plan, deploy, and maintain a NetWitness® Platform 12.5.2 environment. It covers core deployment requirements, optional architectures, high‑availability and disaster recovery, network and port requirements, site safety and environmental considerations. The guide stresses capacity planning and careful topology design before installation.

Upgrade the NetWitness Platform

This section provides information around the following prerequisites for upgrading to 12.5.2.

• Upgrade Paths Supported by 12.5.2
  
  
• Upgrade guidelines for Azure
  
  
• Running the NetWitness environment in Mixed Mode (having two different versions of the NetWitness Platform running at the same time)
  
  
• Upgrade considerations for Event Stream Analysis hosts
  
  
• Upgrading or Installing Windows Legacy Collectors
  
  
• General Terminalogy

Running Pre-Upgrade Checks

This section talks about the different pre-upgrade checklists that NetWitness® recommends running to reduce upgrade failures.

• Upgrade Checklist
  
  
• Network Checklist
  
  
• Certificate Checklist

Prepare to Upgrade the NetWitness Platform

This section provides a list of tasks that should be completed prior to performing the upgrade of the NetWitness Platform.

• Removing Legacy Package Repositories
  
  
• Preparing the Event Stream Analysis hosts for migration
  
  
• Third-party package removal
  
  
• Single Sign-On (SSO) considerations for authentication
  
  
• Disabling STIG-based FIPS Kernel Controls
  
  
• Verifying the NetWitness Platform's ability to connect to the Live Service
  
  
• Synchronizing time between the NW Admin server and all NetWitness Platform hosts

Upgrade Tasks

This section provides the various options for performing the 12.5.2 upgrade on the NetWitness Platform environment.

• Option 1: upgrading via the NetWitness Platform Live Service
  
  
• Option 2: Upgrading the NetWitness Platform in Offline mode (good for air-gapped environments)
  
  
• Option 3: Upgrade the NetWitness Platform utilizing the Command Line Interface (CLI) - Recommended only for Advanced Users

Perform Post-Upgrade Tasks

This section goes over all the post-upgrade tasks that need to be performed to confirm all systems are working as expected once the upgrade is completed.

• General tasks
  
  
• Event Stream Analysis (ESA) specific tasks
  
  
• Respond specific tasks
  
  
• User and Entity Behavior Analytics (UEBA) specific tasks
  
  
• Legacy Windows Log Collector (WLC) tasks
  
  
• Warehouse Connector tasks (used only in very specific customer environments)
  
  
• Setting the Recovery password for Lockboxes

Perform Validation Checks After the Upgrade

This section goes over critical validation checks that every customer should run, if it applies, to confirm that all systems are functioning as expected.

Installation of the 12.5.2 Relay Server

This section provides instructions for installing a standalone Relay Server when the Endpoint Log Hybrid built in Relay Server is not being used. 

Setting up External Repositories

This section provides instructions for setting up an external repository for the NetWitness Platform. This should only be handled by Advanced Users or with the assistance of NetWitness Support.

Troubleshooting Upgrade Issues

This section provides many different examples of possible issues that could arise during the upgrade, along with possible solutions. If there is an upgrade issue, it is important to stop, assess the situation, and determine if NetWitness Support should be engaged. Most upgrade issues can be worked through to finish the upgrade. Some may require a complete rebuild of the server. This is why it is always important to perform a backup on any NetWitness Platform host before starting an upgrade.

Using the NetWitness Community Portal for Assistance

This section provides information and links to important locations and features on our NetWitness Community Portal. There are instructions for how to contact NetWitness Technical Support should it be required.