Release History

Change Log * Added an warning light indicator when the TCP collector is in an abnormal state

- Fixed an NPE in query commands and loggers when the API returned an error or a value was missing - Fixed activity loggers skipping to the next day on API errors, which caused logs to be lost - Fixed members from other domains being included when using the group option of the google-workspace-users command

Reporting API loggers added - DNS activity - Cloud Firewall activity - Collect only what you need by filtering on `verdict` and `categories` Log schema changes - Added the `Cisco Umbrella Firewall` log schema - Added `threats` and `app` to the `Cisco Umbrella DNS` log schema (filled by the API logger only) Other improvements - Added Base URL and Max Requests / Second options to the `Cisco Umbrella` connect profile - Query commands now pace requests to stay within the Umbrella rate limit (5 per second) and retry on HTTP 429 - Changed `response_code` in the `umbrella-activity-logs` query command to a string, matching the log schema - Changed the refresh interval of the `Umbrella DNS 최근 로그` dashboard widget to 60 seconds

Improvements - Implemented a UI for editing dynamic criteria for Guardicore labels - Added support for the Guardicore IP blocking integration module

First Release - User Interface: Recommendations, Attack Path Analysis, Vulnerabilities, Inventory, Security Posture, Compliance - Includes manual and automated collection - Supports query commands: defender-cloud-assessments, defender-cloud-attack-paths, defender-cloud-changes, defender-cloud-compliance-assessments, defender-cloud-compliance-controls, defender-cloud-compliance-standards, defender-cloud-controls, defender-cloud-cve-findings, defender-cloud-resources

First Release - Provides a parser, logger model, log schema and dashboard for WeGuardia ITU logs.

Feature Improvements - Added remote ticket synchronization feature

Improvements - Added support for parsing CEF format logs - Added parsed fields for JSON logs: Destination IP, Destination Port, Destination Host, Destination ASN, URI, Priority, Tags, MITRE technique ID and name - Added 8 fields to the `Darktrace Model Breach` log schema: Destination IP, Destination Port, Source Hostname, Destination Host, Destination ASN, URI, Priority, Tags

Feature Improvements - Added threat intelligence capabilities for assets, employees, and departments - Added app-based IP intelligence plugin system - Grouping of IP addresses in the network topology when CIDR attributes are specified for network zones - Addition of a timeline and playback bar at the bottom of the network topology screen - Fine-grained filtering of the event period in the network topology (10 minutes, 1 hour, 6 hours, 12 hours, 24 hours) - Support for selecting connectable nodes and connection types in the Knowledge Graph Connections tab

Bug Fixes * Fixed an issue where the configured parser delimiter was interpreted as a regular expression.

New feature * Added delimiter configuration feature (Please use version 1.1.2609.1, as regular expression reserved words cannot be used as delimiters in this version.)

Add parsing support for new message codes - Severity2 (Critical): 113022, 113023 - Severity3 (Error): 752015 - Severity4 (Warning): 752012 - Severity6 (Informational): 113014, 113015, 302035, 302036 Breaking Changes - **duration Field Parsing Rule Updated:** Changed from storing as raw string (String) to converting hh:mm:ss formatted inputs into seconds (Integer).

First Release (Prototype) - For Kubernetes monitoring products - Container map, performance summary, node list, node disk list, container list, container volumes, container images, workload list, Pod list, Deployment list, Service list, Ingress list, Persistent Volume list, Persistent Volume Claim list

First Release - User interface for log viewing and configuring ChatGPT Enterprise log collection - Extended query commands for fetching ChatGPT Enterprise logs - ChatGPT Enterprise log collectors

Enhanced Compatibility for Batch Rule Replay - Sonar 4.0: Failed during execution due to the lack of MITRE ATTACK tagging functionality - Sonar 5.0: Fixed an issue in the latest development version where installation failed due to duplicate components

* Added an audit log collector that collects account configuration changes through the Cato GraphQL Audit Feed API * Added the audit log schema (Cato Networks SASE Audit) and its logger model

First Release - Provides a parser, logger model and log schema for SonicWall NGFW syslog.

Fix bug - Fixed logger failure when a zip file is encountered in Sentry Package

Add parsing support for new message codes - Severity2 (Critical): 106016 - Severity3 (Error): 210005, 216001, 305006, 713048, 713061, 713123, 713227, 713902, 746016, 751002 - Severity4 (Warning): 313009, 402116, 402119, 713903, 750003, 752010, 752011 - Severity5 (Notification): 305013, 713041, 713049, 713050, 713068, 713076, 713119, 713120, 713201, 713202, 713257, 713259, 713904, 720012, 725024, 746014, 746015, 750001, 750002, 750006, 750007, 752003, 752004, 752016 - Severity6 (Informational): 110003, 113004, 113008, 302037, 302038, 303002, 305011, 305012, 602303, 602304, 607001, 713124, 713172, 713235, 713905, 721016, 721018, 737029, 737031, 780005, 780006, 805001, 805002, 805003 Breaking Changes - **duration Field Parsing Rule Updated:** Changed from storing as raw string (String) to converting hh:mm:ss formatted inputs into seconds (Integer).

Bug Fixes: - Fixed an issue where the collection start time (from) was not updating when zero records were retrieved. - Added a guard clause to automatically adjust the collection range if it exceeds 89 days upon collector reactivation.