About Microsoft feeds syncronization
With the recent release of version 2.3, Anchore Enterprise now supports scanning of Windows container images and the addition of a new feed source for identifying Windows vulnerabilities: Microsoft Security Response Center (MSRC).MSRCMicrosoft Security Response Center maintains reports of security vulnerabilities affecting Windows systems in its Security Update Guide. In addition to publishing this data publicly on its website, Microsoft provides programmatic access to retrieve security update details in the Common Vulnerability Reporting Format via its Microsoft Security Update API. In order to access the API, users must obtain an API key using their Microsoft TechNet account.Enabling the MSRC Feed Driver for Anchore EnterpriseIn order to configure the feed source for use with Anchore Enterprise, the on-premise Enterprise Feeds Service must be enabled with the obtained API key. For instructions on how to obtain an API key from Microsoft, visit Anchore Enterprise Feed Driver Configuration.Note: If you are upgrading an existing deployment via docker-compose, you will need to bring down the deployment WITHOUT deleting existing volume configurations (This can be completed by omitting the ‘-v’ flag via docker-compose). For Kubernetes deployments using Helm, the upgrade can be performed using the helm upgrade command.To enable the on-premise feeds service and configure the MSRC driver on deployments using docker-compose, edit the following section of the compose template:services: ... feeds: ... environment: ... - ANCHORE_ENTERPRISE_FEEDS_MSRC_DRIVER_ENABLED=true - ANCHORE_ENTERPRISE_FEEDS_MSRC_DRIVER_API_KEY=*For deployments using the config.yaml configuration file, update the following sections:services: ... feeds: ... drivers: msrc: enabled: true api_key: To enable the feeds service and the MSRC driver for Kubernetes deployments, update the following section of your custom values file:anchore-feeds-db: enabled: true ...anchoreEnterpriseFeeds: enabled: true ... # Enable microsoft feeds msrcDriverEnabled: true msrcApiKey: ...(For new deployments on Kubernetes using the stable/anchore-engine Helm chart, refer to the installation guide for instructions on deploying Anchore in your cluster).Verify New Feed is EnabledAfter bringing up the deployment, it may take a while for the feed sync to complete depending on whether or not this is a new deployment or existing upgrade. For details on checking the status of the feeds synchronization, refer to our enterprise docs.Once the feeds have finished synchronizing, verify the MSRC feeds is included in the list:- via Enterprise UI -- or via API -Adding Windows ImagesJust as with Linux containers, you can analyze a Windows container repository or tag by providing the image registry/repository/tag in the UI or via the API: anchore-cli image addViewing Compliance and
Key features of the Microsoft feeds syncronization that are enabled through these drivers include:
- no playlists after syncronization of MP3 player
- Outlook 2025 takes forever on Syncronizing
- Syncronize working directory of console and/or beanshell with
- Active Directory Syncronization Service (ADSS)
- scheduled syncronizing folders - Core FTP
- Syncronizing and merging subtitles into an AVI file
- Syncronized callbacks in ROS2 - ROS Discourse
With cluster nodes in London and New York. Due to VPN tunnels we had an issue with latency between the sites and sometimes got really poor performance. If the subscriber is out of sync for a long time, more than 24 hours, the syncronization will not re-establish automatically.In that case you have to drop the subscriber from the cluster and join again.The subscriber will continue to authenticate clients locally, but will not get any new configuration. As mentioned in this situation the function will be limited in the same way as if the Publisher is down.For global deployments of ClearPass multiple clusters are usually the best solution.You have an option to utilize the ClearPass Syncronization Service to replicate configuration data between multiple clusters. But this service have a quite high price tag, so I would only use it in very special cases.I evaluated this service for one of my customers with multiple ClearPass clusters and in total about 15 servers, but found the price tag to high.------------------------------Best RegardsJonas HammarbäckACCX #1335, ACMP, ACDP, ACNSP, ACEP, ACSAAranya ABIf you find my answer useful, consider giving kudos and/or mark as solution------------------------------ 4. RE: ClearPass Publisher-Subscriber HA Best Practice Posted Nov 15, 2022 09:22 AM Thank you both - these answers were extremely helpful!Scott 5. RE: ClearPass Publisher-Subscriber HA Best Practice Posted Nov 23, 2022 01:32 PM We had the same issue when we installed a subscriber node in Singapore as well. Publisher is in the Chicago area. Had constant out of sync issues. Someone at TAC told me to try changing one parameter to see if it helps. Resolved my issues, SG hasn't been out of sync since, 4+ years and no issues.Administration > Server Configuration > Cluster-Wide Parameters > Database > Change Replication Batch Interval from the default 5 to 15. 6.
