S2W Quaxar

Feature Improvements (S2W Development Support)

Added Attack Surface Management (ASM) CLI commands

• quaxar-asm-assets: Retrieve the attack surface asset list
• quaxar-asm-asset: Retrieve detailed information on a single asset
• quaxar-asm-certificates: Retrieve the certificate list
• quaxar-asm-certificate: Retrieve detailed information on a single certificate
• quaxar-asm-vulnerabilities: Retrieve the vulnerability list
• quaxar-asm-vulnerability: Retrieve detailed information on a single vulnerability
• quaxar-asm-seeds: Retrieve the monitoring seed list
• quaxar-asm-seed-add-batch: Add seeds based on input rows (Batch)
• quaxar-asm-seed-remove-batch: Remove seeds based on input rows (Batch)

API Migration & Connection Profile Option Expansion

• Added timeout configuration to connection profile
• Changed incremental sync criteria for Feed feature (now based on 'modified' value)
• Migrated IoC lookup API

※ Due to an API migration, older versions of the QUAXAR app are no longer supported. Please update to version 1.4.2607.0 or higher.

API Endpoint Migration

• Removed integration features for portal.quaxar.io

HTTP Proxy Support & Profile Options

• Added support for HTTP Proxy and new profile configuration options

New Commands TAP Related:

• quaxar-threat-actors
• quaxar-threat-actor-indicators
• quaxar-threat-actor-malwares
• quaxar-threat-actor-tools
• quaxar-threat-actor-ttps
• quaxar-threat-actor-vulnerabilities
• quaxar-threat-actor-reports
• batch command

Report Related:

• quaxar-threat-reports
• quaxar-indicator-reports
• (Current API method) quaxar-talon-reports
• (Current API method) quaxar-vulnerability-reports

SIGV Related:

• quaxar-snort
• quaxar-yara-rules

Removed Incompatible Commands & Dashboards

• quaxar-attack-surface-reports
• quaxar-exposed-services
• quaxar-exposure-service-stats
• quaxar-exposure-trends
• quaxar-open-indicators
• quaxar-security-news

Bug Fixes Fixed an issue where the days option in the quaxar-recent-indicators command was not functioning

Added response validation for API Key errors, Server errors, and other exceptions

Changelog

• Separately extracted the malware, tool, campaign, and vulnerability fields from the relation field in the Quaxar threat intelligence feed to facilitate data processing. Renamed the existing malware field to malware_family.
• Fixed a bug that resulted in duplicate records of the same IoC when downloading Quaxar threat intelligence feeds.
• Fixed NPE when running quaxar-attack-surface-reports, quaxar-exposed-services commands (service response changed)
• Fixed JSON parsing error when running quaxar-exposure-service-stats and quaxar-exposure-trends commands (service response changed)

Added Sonar app manifest, log schema, and dashboard.

Patch for S2W Quaxar updates:

• quaxar-attack-surface-reports
• quaxar-exposed-services

First release. Supports CTI feeds for Sonar/Maestro platform and 17 query commands including IoC search playbook command:

• quaxar-attack-surface-reports
• quaxar-domain-indicators
• quaxar-exposed-services
• quaxar-exposure-service-stats
• quaxar-exposure-trends
• quaxar-indicators
• quaxar-ip-indicators
• quaxar-md5-indicators
• quaxar-open-indicators
• quaxar-recent-indicators
• quaxar-search-indicators
• quaxar-security-news
• quaxar-sha1-indicators
• quaxar-sha256-indicators
• quaxar-talon-reports
• quaxar-url-indicators
• quaxar-vulnerability-reports