Bug Fix
- Fix '=' character handling error in WELF parser
First Release
* Provides parser, logger model, and log schema for BeyondTrust Endpoint Privilege Management (EPM) and Application Audit logs
* Supported categories: EPM, Application Audit
- Improved clipping of right-side stats panels (source countries, ASNs, detection rules) across screen resolutions
- Added scrolling and optimized spacing for right-side stats panels
- Fixed an issue where the globe failed to render when textures failed to load
Enhance safety of parser Boolean field casting logic
Parser Improvements
- Added parsing logic for MNX detection information (Playbook detection info) types.
Added IoC Search menu.
Initial Release
- Provides query commands for sending security events to the INITECH INI-ICAM platform.
First release
- Data from docs.logpresso.com as of 2025-02-27
KISA WHOIS Extended Commands Addition
- kisa-whois-domain: Single lookup for .kr / .한국 domain registration information.
- kisa-whois-ip: Single lookup for IP address registration and allocation information.
- kisa-whois-asn: Single lookup for AS (Autonomous System) number registration and allocation information.
- kisa-whois-domain-batch: Batch lookup for domain information using the domain column values of the input records.
- kisa-whois-ip-batch: Batch lookup for IP information using the ip column values of the input records.
- kisa-whois-asn-batch: Batch lookup for AS number information using the asn column values of the input records.
Parser Improvements
- Added parsing support for the V3_PC_MANAGEMENT log type (Classified as V3 Audit)
- Added 'clean_datas' and 'event_data' fields to the EDR_LOG type
First Release
- Add FOCS firewall and application lookup commands
- Add FOCS malicious IP lookup, add, and delete commands
Adds VNet flow logs(v4) support and new query commands
Bug fix
- Fix missing login name mapping in sonar-sync-employees command
- Add user_guid to output fields in sonar-employees command
First Release
- Provides a parser, File/SFTP logger model, log schema and dashboard for TmaxSoft JEUS Access logs.
First Release
- Provides a parser, logger model, log schema and dashboard for SNIPER APTX logs
- Supported log type : System Status Information(5), File Analysis Logs(7), Network Detection Events(9), Ransomware Detection(10), File Detection(11)
Improved log schema rules in logger model
- Added `type` condition to `IPSEC` and `SSL VPN` rules
- Refined stream query to `Unknown` rule
First Release
- Provides a parser, logger model, log schema and dashboard for TACHYON Total Security 4.0 logs
- Supported category(Server, Agent, DeviceControl, SelfProtection)
Fix parser logic
- Implemented 31 fields from the RAW log
First Release
- Provides a parser, logger model and log schema for CTILab DTI Anomaly, Auto Profiling syslog messages.
Bug fixes and improvements for employee, department, and boss sync commands
- Common: Expanded required permission to company admin level and above; improved input error handling
- `sonar-sync-employees`: Fixed an issue where the query would not terminate when there are no employees to deactivate
- `sonar-sync-departments`: Departments with no changes are now included in the output (action=skip)
- `sonar-sync-bosses`: Department leads with no changes are now included in dry run output (action=skip)