- Added Microsoft Intune logger model (Devices, DeviceComplianceOrg, OperationalLogs, AuditLogs)
- Supports Entra ID `NonInteractiveUserSignInLogs`
- Fixed Azure Firewall NAT Rule routing error
ICAM 1.0.2 support
- Token issuance endpoint changed
- Event submission format changed
- `event_time` and `signature` added to the event submission query commands
Parser Improvements
- Fixed an issue where command line values were truncated if CEF extension values contained `key=value` formats (`-Xmx=..`, `PATH=${PATH}:..`).
First Release
* AlphaKey audit log parser, logger model, log schema support
* AlphaKey webhook (HTTP POST) integration method
* AlphaKey SAML 2.0 SSO authentication (Requires Logpresso Sonar version 5.0.2605.0 or higher)
Feature Improvements (**S2W Development Support**)
Added Attack Surface Management (ASM) CLI commands
- quaxar-asm-assets: Retrieve the attack surface asset list
- quaxar-asm-asset: Retrieve detailed information on a single asset
- quaxar-asm-certificates: Retrieve the certificate list
- quaxar-asm-certificate: Retrieve detailed information on a single certificate
- quaxar-asm-vulnerabilities: Retrieve the vulnerability list
- quaxar-asm-vulnerability: Retrieve detailed information on a single vulnerability
- quaxar-asm-seeds: Retrieve the monitoring seed list
- quaxar-asm-seed-add-batch: Add seeds based on input rows (Batch)
- quaxar-asm-seed-remove-batch: Remove seeds based on input rows (Batch)
API Migration & Connection Profile Option Expansion
- Added timeout configuration to connection profile
- Changed incremental sync criteria for Feed feature (now based on 'modified' value)
- Migrated IoC lookup API
※ Due to an API migration, older versions of the QUAXAR app are no longer supported. Please update to version 1.4.2607.0 or higher.
Bug Fixes
- Fixed installation failure on Sonar 4.0.2502.0 caused by a dependency version mismatch
Initial Release
- Provides logger models for Firewall events, HTTP requests, DNS, Spectrum, Account audit logs
- Ingestion via API polling and Logpush (HTTP, S3)
- Firewall events dashboard
- 7 query commands
- Log query (5): Firewall events · HTTP requests · Audit logs (v1/v2) · IP block rule list
- IP block rule management (2): add · remove
First release
- Syslog parser, log schema, logger model, dashboard, and XDR UI
AI Messenger Interface Support
- Integration with AI assistant and Agentic SOC apps.
AI Messenger Interface Support
- Integration with AI assistant and Agentic SOC apps.
Feature Improvements
- Optimize date comparison logic in S3 daily directory logger
- Fix missing region configuration in AWS Aurora MySQL Audit logger
Command Bug Fixes
* Fixed an issue where the last_scan result of the insightvm-asset command did not show the latest scan value.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
API Endpoint Migration
- Removed integration features for portal.quaxar.io
HTTP Proxy Support & Profile Options
- Added support for HTTP Proxy and new profile configuration options
New Commands
TAP Related:
- quaxar-threat-actors
- quaxar-threat-actor-indicators
- quaxar-threat-actor-malwares
- quaxar-threat-actor-tools
- quaxar-threat-actor-ttps
- quaxar-threat-actor-vulnerabilities
- quaxar-threat-actor-reports
- batch command
Report Related:
- quaxar-threat-reports
- quaxar-indicator-reports
- (Current API method) quaxar-talon-reports
- (Current API method) quaxar-vulnerability-reports
SIGV Related:
- quaxar-snort
- quaxar-yara-rules
Removed Incompatible Commands & Dashboards
- quaxar-attack-surface-reports
- quaxar-exposed-services
- quaxar-exposure-service-stats
- quaxar-exposure-trends
- quaxar-open-indicators
- quaxar-security-news
Bug Fixes
Fixed an issue where the days option in the quaxar-recent-indicators command was not functioning
Added response validation for API Key errors, Server errors, and other exceptions
First release
- Provides a logger model, log schema, and query commands for transactions and active services
Improved option validation for query commands
- `notion-pages` / `notion-blocks` / `notion-database-pages`: guidance on missing `page-id` (including empty and blank values)
- `notion-pages`: rejection of negative or non-numeric max-depth
- `notion-blocks-batch`: fix for arbitrary profile selection when the profile option was omitted with multiple Notion profiles (omission still allowed with a single profile)
- `sniper-ngfw-commit-changes`: fixed incorrect `reset-tunnels` option behavior
- Added `unknown` to logger model
New Commands & Updates to Existing Commands
* insightvm-asset: Get details of a specific asset
* insightvm-asset-softwares: Get the software list of a specific asset
* insightvm-vulnerability: Get details of a specific vulnerability
* insightvm-assets: Added 'id' to the output fields. This is a unique value assigned to an asset (device), which can be found in the URL of the asset details page and used as an option field for the insightvm-asset command.