After you upgrade or change a McAfee SIEM device, a red flag is generated and shown on the Receiver or the Advanced Correlation Engine with one of the following log messages:
Invalid SSH Key ELM host key has changed
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" Host key verification failed.
This is caused by an out-of-date hash value in /root/.ssh/known_hosts on the Receiver or ELM. To update this value, follow the steps in KB83996 (https://kc.mcafee.com/corporate/index?page=content&id=KB83996).
For more resources, visit the ServicePortal and search for related content. Also, visit the SIEM Community (https://community.mcafee.com/community/business/siem.
McAfee SNS ProTips help you maximize your protection with troubleshooting, best practices, how-to tips, and links to Knowledge Center resources. To unsubscribe from ProTips or change your SNS settings, visit the SNS Subscription Center.