Experimental

Feature Improvements

• Added ticket sync target selection feature
• Improved rule referencing feature
• Cleaned up error messages

New query commands

• Address object management: sonar-add-address-object, sonar-remove-address-object
• Pattern addition: sonar-add-pattern
• Investigation result creation and lookup: sonar-investigate, sonar-investigate-result
• Ticket and article creation: sonar-create-ticket, sonar-create-ticket-from-event, sonar-create-article
• Ticket attribute settings: sonar-add-ticket-tags, sonar-set-ticket-tags, sonar-set-ticket-assignees, sonar-set-ticket-attack, sonar-set-ticket-incident, sonar-set-ticket-priority, sonar-set-ticket-status
• Indicator updates: sonar-ioc-update-url, sonar-ioc-update-md5, sonar-ioc-update-ip, sonar-ioc-update-domain, sonar-ioc-update-email

Feature Improvements

• Enhanced ticket synchronization in redundant environments
• Added option to select items for synchronization

Feature Improvements

• Added remote ticket synchronization feature

Enhanced Compatibility for Batch Rule Replay

• Sonar 4.0: Failed during execution due to the lack of MITRE ATTACK tagging functionality
• Sonar 5.0: Fixed an issue in the latest development version where installation failed due to duplicate components

Feature Improvements

• Stream rule validation: sonar-create-stream-rule-batch, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch
• Batch rule validation: sonar-create-batch-rule-batch, sonar-update-batch-rule-query-batch

Feature Improvements

• New commands: sonar-create-stream-rule-batch, sonar-create-batch-rule-batch, sonar-update-stream-rule-batch, sonar-update-batch-rule-batch, sonar-update-rule-mitre-batch, sonar-stream-rule-command-templates, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch, sonar-delete-stream-rule-command-batch, sonar-update-batch-rule-query-batch
• Renamed commands: sonar-clone-dashboard-batch, sonar-clone-dataset-batch, sonar-clone-widget-batch
• Support for MITRE ATT&CK fields: sonar-stream-rules, sonar-batch-rules

Feature Improvements

• Added the system-open-files command required for file leak detection
• Requires araqne-core-4.2.0-package.jar or later

New Features

• Replay batch detection at a past point in time using the sonar-replay-batch-rules command

Feature Removal

• Migrated remote file streaming interface to the File Store app

Bug Fixes

• Fixed a bug where the sonar-verify-query command failed to validate commands with multiple subqueries (e.g., the fulltext command)
• Improved the log command so that it explicitly returns an error for non-existent schemas

Added 6 ticket query commands

• sonar-ticket-repositories
• sonar-create-event-ticket
• sonar-create-markdown-ticket
• sonar-add-ticket-comment
• sonar-update-ticket-comment
• sonar-remove-ticket-comment

Added Interface for Remote File Streaming

• For example, the Microsoft Graph app supports access to OneDrive files, and the Office Scanner app can scan OneDrive files.

Bug fix

• Fix missing login name mapping in sonar-sync-employees command
• Add user_guid to output fields in sonar-employees command

Bug fixes and improvements for employee, department, and boss sync commands

• Common: Expanded required permission to company admin level and above; improved input error handling
• sonar-sync-employees: Fixed an issue where the query would not terminate when there are no employees to deactivate
• sonar-sync-departments: Departments with no changes are now included in the output (action=skip)
• sonar-sync-bosses: Department leads with no changes are now included in dry run output (action=skip)

Bug fix

• Fixed an issue where copies created by sonar-clone-dashboards, sonar-clone-datasets, and sonar-clone-widgets were deleted during app reinstallation.