SNS ProTip for SIEM: How to address the "Invalid SSH key ELM host key has changed" error after upgrading or changing the device

Version 1

    After you upgrade or change a McAfee SIEM device, a red flag is generated and shown on the Receiver or the Advanced Correlation Engine with one of the following log messages:

     

    Invalid SSH Key ELM host key has changed

     

    or

     

    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" Host key verification failed. 

     

    This is caused by an out-of-date hash value in /root/.ssh/known_hosts on the Receiver or ELM. To update this value, follow the steps in KB83996 (https://kc.mcafee.com/corporate/index?page=content&id=KB83996).

     

    For more resources, visit the ServicePortal and search for related content. Also, visit the SIEM Community (https://community.mcafee.com/community/business/siem.

     

    McAfee SNS ProTips help you maximize your protection with troubleshooting, best practices, how-to tips, and links to Knowledge Center resources. To unsubscribe from ProTips or change your SNS settings, visit the SNS Subscription Center.