AWS

New Features

• Added AWS Network Firewall logger model and log schema

Bug Fixes

• Fixed AWS Network Firewall logger not collecting logs when a monitoring period is set

Changes

• Optimized AWS Network Firewall logger listing for the monitoring period
• Changed AWS Network Firewall log time (_time) basis: collection time → event time
• Changed AWS Network Firewall log normalization
  • Firewall name bucket_name → firewall_name, availability zone region → availability_zone
  • bucket_name now holds the S3 bucket name and region the firewall region (logger only)
  • Normalized action values (allowed → DETECT, blocked → BLOCK), original value stored in raw_action

Upgrade Notes

• Not compatible with data collected by version 1.10.2607.1 or earlier due to normalization changes
  • bucket_name, region, and action have different meanings in 1.10.2607.1 or earlier and 1.11.2610.0 or later; existing queries and detection rules must be updated
  • Also applies when the AWS Network Firewall parser is used in a custom logger model

Logger Bug Fixes

• Fixed an issue where data was missed when the monitoring period was set to 1 day due to UTC timezone mismatch
• Relaxed the date handling criteria for the monitoring period
• Mitigated duplicate collection during abnormal situations such as collection interruptions (retained status keys for 3 days)

※ If the monitoring period is set to 1 day, a single duplicate collection may occur during the omission handling process.

Feature Improvements

• Optimize date comparison logic in S3 daily directory logger
• Fix missing region configuration in AWS Aurora MySQL Audit logger

Fixed WAF Log Parser:

• Resolved errors handling the responseCodeSent field.

Changelog

• Added AWS VPC Flow log schema and logger model

Bug fix

• Fixed requestBodySize, requestBodySizeInspectedByWAF field casting error that occurs when "Simplify output fields" option is false in AWS WAF logger
• added profile option to aws-cost command

Changelog

• Added support for CloudFront-scope response targets via AWS WAF. Select Cloudfront in region dropbox in AWS WAF target response screen. (Empty value cannot be applied)
• Added support for CloudFront in AWS WAF related commands by using region=cloudfront option.

Support VPC Endpoint for AWS cloudwatch metrics, stats query.

Improvements

• Support AWS VPC Endpoint
• Support AWS Network Firewall logs
• Support AWS CloudWatch VPC Flow custom log format
• Support AWS STS authentication
• Added log start/end regex option to AWS S3 Daily Directory watcher
• AWS S3 Daily Directory Watcher can now collect logs when some target paths contain OID and some target paths don't contain OID
• Added Date regex option for AWS S3 Daily Directory Watcher
• Support Playbook execution for AWS app commands

Added S3 Daily Directory Watch logger.

Expanded AWS WAF collection fields and added concise option.

Added support for Organization ID on AWS S3 log path.

Support New Logger and dashboard

• AWS SQS logger
• AWS Shield Advanced logger
• AWS Aurora with Database Activity Streams log integration
• AWS Shield, Aurora DB Activity dashboards

Support AWS WAF control and added 4 query commands

• aws-waf-ip-sets
• aws-waf-ip-set-addresses
• aws-waf-add-ip-set-address
• aws-waf-remove-ip-set-address

Add ECR support

• Added ECR vulnerability dashboard
• Added aws-ecr-image-scan-findings query command

Added http_proxy option to AWS connect profile and loggers.

Support Logpresso Sonat platform

• Added sonar dashboards, log schemas, loggers.