Genian EDR

Added Genian EDR console screens and an event search query command

Features

• Supported target: Genian Insights E console INSIGHTS-CT64-R-54360-3.0.12.1007
• Genian EDR connect profile: signs in to the Genian Insights E console with a console account for the screens and query commands; supports accounts with Google OTP two-factor authentication
• Threat Monitoring: dashboard of threats by status, TOP 10, threat detection ratio and event volume trend
• Threat Management: filters the threat list by status, detection engine and Lucene search condition, with auto refresh and a bottom detail panel
• Threat Details: General, Devices, Indicators and Attack Story Line
• Threat handling: sets status, alert decision, response policy and memo, and shows the history
• Response requests: Collect sample, Request Threat Analysis, artifact collection and file restore
• Event Investigation: endpoint behavior event search, search filters, time chart, ATT&CK matrix and process relationship tracing
• Collected Files: lists files collected from endpoints and saves them to the Logpresso file store
• Custom IOC Management: adds, edits and deletes malicious and allowed hashes and IPs, with import and Excel export
• YARA Rule: adds, edits and copies rules, checks syntax and changes the Status
• Console terms and layout: uses the console's messages, code lists, and list and form definitions as they are, shown in the user's language (Korean, English, Japanese)

Query commands

• genian-edr-search: searches endpoint events, threats, alerts and collected files with a Lucene query, and runs aggregations on the console server
• genian-alerts, genian-endpoint-logs: removed, replaced by genian-edr-search

Bug Fixes

• Fixed an issue where the configured parser delimiter was interpreted as a regular expression.

New feature

• Added delimiter configuration feature (Please use version 1.1.2609.1, as regular expression reserved words cannot be used as delimiters in this version.)

First release

• EDR Log parser
• EDR Log schemas: threat log, audit log, process log, network log, file log, DNS log, registry log, module log
• Threat detection dashboard