First Release
* Provides dedicated parsers, logger model, and log schemas for logs sent by AXGATE Next-Generation Firewall (NF) over Syslog (14 types including session, IPS, application, and anti-virus)
* Provides extended commands to look up and remotely modify/apply security policies and address, service, time, and NAT objects
* Provides extended commands to manage blacklist, whitelist, and blacklist-exclude entries and to block IP/MAC addresses
* Supports block integration that blocks attacker IPs in conjunction with real-time and batch detection
Improvement of Sonar version compatibility guard for SSO feature
Improvement of sonar version compatibility guard for SSO feature
Initial Release
- Provides a dedicated parser, logger model and log schemas for FortiManager 7.0.10 logs.
- Added Microsoft Intune logger model (Devices, DeviceComplianceOrg, OperationalLogs, AuditLogs)
- Supports Entra ID `NonInteractiveUserSignInLogs`
- Fixed Azure Firewall NAT Rule routing error
ICAM 1.0.2 support
- Token issuance endpoint changed
- Event submission format changed
- `event_time` and `signature` added to the event submission query commands
Parser Improvements
- Fixed an issue where command line values were truncated if CEF extension values contained `key=value` formats (`-Xmx=..`, `PATH=${PATH}:..`).
First Release
* AlphaKey audit log parser, logger model, log schema support
* AlphaKey webhook (HTTP POST) integration method
* AlphaKey SAML 2.0 SSO authentication (Requires Logpresso Sonar version 5.0.2605.0 or higher)
Feature Improvements (**S2W Development Support**)
Added Attack Surface Management (ASM) CLI commands
- quaxar-asm-assets: Retrieve the attack surface asset list
- quaxar-asm-asset: Retrieve detailed information on a single asset
- quaxar-asm-certificates: Retrieve the certificate list
- quaxar-asm-certificate: Retrieve detailed information on a single certificate
- quaxar-asm-vulnerabilities: Retrieve the vulnerability list
- quaxar-asm-vulnerability: Retrieve detailed information on a single vulnerability
- quaxar-asm-seeds: Retrieve the monitoring seed list
- quaxar-asm-seed-add-batch: Add seeds based on input rows (Batch)
- quaxar-asm-seed-remove-batch: Remove seeds based on input rows (Batch)
API Migration & Connection Profile Option Expansion
- Added timeout configuration to connection profile
- Changed incremental sync criteria for Feed feature (now based on 'modified' value)
- Migrated IoC lookup API
※ Due to an API migration, older versions of the QUAXAR app are no longer supported. Please update to version 1.4.2607.0 or higher.
Bug Fixes
- Fixed installation failure on Sonar 4.0.2502.0 caused by a dependency version mismatch
Initial Release
- Provides logger models for Firewall events, HTTP requests, DNS, Spectrum, Account audit logs
- Ingestion via API polling and Logpush (HTTP, S3)
- Firewall events dashboard
- 7 query commands
- Log query (5): Firewall events · HTTP requests · Audit logs (v1/v2) · IP block rule list
- IP block rule management (2): add · remove
First release
- Syslog parser, log schema, logger model, dashboard, and XDR UI
AI Messenger Interface Support
- Integration with AI assistant and Agentic SOC apps.
AI Messenger Interface Support
- Integration with AI assistant and Agentic SOC apps.
Feature Improvements
- Optimize date comparison logic in S3 daily directory logger
- Fix missing region configuration in AWS Aurora MySQL Audit logger
Command Bug Fixes
* Fixed an issue where the last_scan result of the insightvm-asset command did not show the latest scan value.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
Added a timeout setting for connection profiles.
- Usage: Designed to prevent timeouts during long-running tasks, such as commit operations.
API Endpoint Migration
- Removed integration features for portal.quaxar.io
HTTP Proxy Support & Profile Options
- Added support for HTTP Proxy and new profile configuration options
New Commands
TAP Related:
- quaxar-threat-actors
- quaxar-threat-actor-indicators
- quaxar-threat-actor-malwares
- quaxar-threat-actor-tools
- quaxar-threat-actor-ttps
- quaxar-threat-actor-vulnerabilities
- quaxar-threat-actor-reports
- batch command
Report Related:
- quaxar-threat-reports
- quaxar-indicator-reports
- (Current API method) quaxar-talon-reports
- (Current API method) quaxar-vulnerability-reports
SIGV Related:
- quaxar-snort
- quaxar-yara-rules
Removed Incompatible Commands & Dashboards
- quaxar-attack-surface-reports
- quaxar-exposed-services
- quaxar-exposure-service-stats
- quaxar-exposure-trends
- quaxar-open-indicators
- quaxar-security-news
Bug Fixes
Fixed an issue where the days option in the quaxar-recent-indicators command was not functioning
Added response validation for API Key errors, Server errors, and other exceptions