WEBFRONT

Improvements

• Support for parsing logs when some items (timestamp, year, event level) are omitted from the device syslog format
• Recognition of log timestamps in yyyy/MM/dd HH:mm:ss format

Bug Fixes

• Double quote (") remaining at the end of the last field value
• Parts of the evidence packet body (hex dump, browser information, etc.) incorrectly extracted as separate fields
• Audit log message truncated when it contains parentheses
• Evidence packets classified as attack instead of packet
• Access control logs classified as attack
• When the timestamp is omitted from the syslog format, audit/system logs classified as attack, and system logs not parsed
• Security logs with an empty port value not parsed

Changelog

• Added log_type field
• Improved WEBFRONT Audit log parsing

Changelog

• Fixed issue where data was missing when the signature field was null
• Removed data size limit (2048 bytes)
• Added support for collecting the raw_data field
• Fixed error message "version is not a supported option" when executing the webfront-block-ip command

Support for executing app query commands through forwarders.

• Logpresso Sonar 4.0.2502.0 and later is required

Preventing Null Point Exceptions during exception handling when there is a problem with Rest API communication

• Added response module
• Added 16 query commands
  • webfront-system-status
  • webfront-system-time
  • webfront-users
  • webfront-ip-blocklist
  • webfront-block-ip
  • webfront-block-ip-batch
  • webfront-unblock-ip
  • webfront-unblock-ip-batch
  • webfront-performance-license
  • webfront-warranty-license
  • webfront-programs
  • webfront-signatures
  • webfront-signature-version
  • webfront-url-regex-signatures
  • webfront-add-url-regex-signature
  • webfront-remove-url-regex-signature

First Release

• WEBFRONT-K parser, logger model, and dashboard.