Experimental

Feature Improvements

• Stream rule validation: sonar-create-stream-rule-batch, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch
• Batch rule validation: sonar-create-batch-rule-batch, sonar-update-batch-rule-query-batch

Feature Improvements

• New commands: sonar-create-stream-rule-batch, sonar-create-batch-rule-batch, sonar-update-stream-rule-batch, sonar-update-batch-rule-batch, sonar-update-rule-mitre-batch, sonar-stream-rule-command-templates, sonar-insert-stream-rule-command-batch, sonar-update-stream-rule-command-batch, sonar-delete-stream-rule-command-batch, sonar-update-batch-rule-query-batch
• Renamed commands: sonar-clone-dashboard-batch, sonar-clone-dataset-batch, sonar-clone-widget-batch
• Support for MITRE ATT&CK fields: sonar-stream-rules, sonar-batch-rules

Feature Improvements

• Added the system-open-files command required for file leak detection
• Requires araqne-core-4.2.0-package.jar or later

New Features

• Replay batch detection at a past point in time using the sonar-replay-batch-rules command

Feature Removal

• Migrated remote file streaming interface to the File Store app

Bug Fixes

• Fixed a bug where the sonar-verify-query command failed to validate commands with multiple subqueries (e.g., the fulltext command)
• Improved the log command so that it explicitly returns an error for non-existent schemas

Added 6 ticket query commands

• sonar-ticket-repositories
• sonar-create-event-ticket
• sonar-create-markdown-ticket
• sonar-add-ticket-comment
• sonar-update-ticket-comment
• sonar-remove-ticket-comment

Added Interface for Remote File Streaming

• For example, the Microsoft Graph app supports access to OneDrive files, and the Office Scanner app can scan OneDrive files.

Bug fix

• Fix missing login name mapping in sonar-sync-employees command
• Add user_guid to output fields in sonar-employees command

Bug fixes and improvements for employee, department, and boss sync commands

• Common: Expanded required permission to company admin level and above; improved input error handling
• sonar-sync-employees: Fixed an issue where the query would not terminate when there are no employees to deactivate
• sonar-sync-departments: Departments with no changes are now included in the output (action=skip)
• sonar-sync-bosses: Department leads with no changes are now included in dry run output (action=skip)

Bug fix

• Fixed an issue where copies created by sonar-clone-dashboards, sonar-clone-datasets, and sonar-clone-widgets were deleted during app reinstallation.

New Feature

• Rule export/import support in the /rule-exchange path

New commands:

• sonar-explanation-requests: List explanation requests
• sonar-explanation-categories: List explanation categories
• sonar-explanations: Retrieve explanations for a specific request
• maestro-playbooks: List playbooks
• maestro-playbook-runs: List playbook execution history
• sonar-behavior-profiles: List behavior profiles
• sonar-create-behavior-profile-batch: Create behavior profiles
• sonar-update-behavior-profile-batch: Update behavior profiles
• sonar-remove-behavior-profile-batch: Remove behavior profiles
• sonar-tags: List tags
• sonar-tenants: List tenants
• sonar-get-ticket-comments-batch: Retrieve ticket comments

Modified commands:

• sonar-batch-rules: Added id output field
• sonar-stream-rules: Added id output field

Bug Fixes

• Fixed an issue where using log command in subqueries caused a NullPointerException.
• Removed explain command that had been moved to the query optimizer app, resolving conflicts with the query optimizer app.

sonar sync commands improvements

• Added locale input to the sonar-sync-employees command
• Fixed an NPE issue 발생 when dept_code is empty
• Improved error cause reporting

Fixed compatibility issues in the sonar-users command