AhnLab EPP

Parser Improvements

• Added 6 CEF Log Types:

• EDR_ALERT_DETECT, EDR_INOUT_FLOW, APRM_AGENT_EVENT, APRM_PRIVACY_INFO_EVENT, APRM_PRIVACY_LEAKAGE_EVENT, APRM_PRINT_EVENT

• Added 16 JSON Log Types:

• AGENT_CONNECTION_STATUS_EVENT, AGENT_EVENT, AGENT_HW_ALL, AGENT_INSTALL_PKG_EVENT, AGENT_SW_ALL, AGENT_TASK_STATUS, APM_AGENT_EVENT, APM_PATCH, APM_SW, AUDIT_EVENT, PATCH_UPDATE_EVENT, PKG_DIST_EVENT, SERVICE_EVENT, UPDATE_EVENT, V3_INTERNET, V3_SCAN, V3_SUP

• Improved MAC address normalization

• Enhanced performance for time value/timestamp processing

• Added array handling for log_string_args

• Improved file path escape handling

• Resolved type conversion errors in code mappings

Query Command Improvements

• Added Query Commands and Enhanced Options:
• ahnlab-epp-query: Interface ID-based DB query lookup (New)
• ahnlab-epp-nodes: Added interface-id option (Modified)
• ahnlab-epp-match-node: Added interface-id option (Modified)
• ahnlab-epp-search-file-result: Added interface-id option and improved error response handling (Modified)
• Added timeout settings
• Improved resource cleanup logic
• Enhanced error handling logging

Schema / Model / Resource Improvements

• Added 6 new log schemas and applied them to the collection model
• Added APrM-related log templates

Minor modification of detection rules

• Exploit Detected rule: Added exception condition for Exploit/Win.MagicLineX
• CoinMiner Detected rule: Changed rule name
• Phishing Detected rule: Removed unnecessary exception condition from first search command

Added 13 MITRE ATT&CK TTP detection rules

Improved error when a CEF field has an empty value that requires casting

Add supported log types (log format)

• EDR_V3_DETECT (CEF)
• EDR_AGENT_EVENT (CEF)
• EDR_OS_EVENT (CEF)
• AGENT_TASK_STATUS (CEF)
• AGENT_SW_ALL (CEF)
• AGENT_HW_ALL (CEF)
• SERVICE_EVENT (JSON)
• AUDIT_EVENT (JSON)
• ESA_EVENT (JSON)
• V3_MALWARE (JSON) - Add fields

Support for profile parameter in EPP extended query commands

Changes

• Improved parser to correct CEF format inconsistencies (missing escapes) in EDR_POWER_SHELL logs to be parsed

Added parser, logger model, and dashboard.

• Support EPP 1.0.14 version.

First release. Support following commands:

• ahnlab-epp-ack-unknown
• ahnlab-epp-block-network-result
• ahnlab-epp-collect-ahnreport-result
• ahnlab-epp-collect-file-result
• ahnlab-epp-match-node
• ahnlab-epp-nodes
• ahnlab-epp-search-file-result
• ahnlab-epp-start-block-network
• ahnlab-epp-start-collect-ahnreport
• ahnlab-epp-start-collect-file
• ahnlab-epp-start-search-file
• ahnlab-epp-start-unblock-network
• ahnlab-epp-start-v3-scan
• ahnlab-epp-tasks
• ahnlab-epp-unblock-network-result
• ahnlab-epp-unknown-behaviors
• ahnlab-epp-unknown-detail
• ahnlab-epp-unknowns
• ahnlab-epp-v3-scan-result