Release History

New Features * Added audit log and issue activity log collectors * Added two log schemas (Jira Audit, Jira Issue Activity) and logger models * Added HTTP proxy, connect timeout, and read timeout options to the connect profile Improvements * jira-audit-logs command * Shows the HTTP status and the cause when the API token is invalid or lacks permission * Fixes the query end time so that audit records added during a query do not shift the results * Changed the output type of the record ID (id) to a 64-bit integer

Feature Improvements - Added support for HTTP(S) URLs in query commands - Modified the `file-type` and `file-type-batch` commands to support only remote paths

Feature Improvements - Allows specifying HTTP(S) URLs in query commands

New Feature - Added WebKeeper file (CSV) log parser - Parses Web (http) and NetApp (netapps) file logs, with an SFTP directory collection model - Provides the webkeeper-http and webkeeper-netapps log schemas

New Features - Added AWS Network Firewall logger model and log schema Bug Fixes - Fixed AWS Network Firewall logger not collecting logs when a monitoring period is set Changes - Optimized AWS Network Firewall logger listing for the monitoring period - Changed AWS Network Firewall log time (`_time`) basis: collection time → event time - Changed AWS Network Firewall log normalization - Firewall name `bucket_name` → `firewall_name`, availability zone `region` → `availability_zone` - `bucket_name` now holds the S3 bucket name and `region` the firewall region (logger only) - Normalized `action` values (allowed → DETECT, blocked → BLOCK), original value stored in `raw_action` Upgrade Notes - Not compatible with data collected by version 1.10.2607.1 or earlier due to normalization changes - `bucket_name`, `region`, and `action` have different meanings in 1.10.2607.1 or earlier and 1.11.2610.0 or later; existing queries and detection rules must be updated - Also applies when the AWS Network Firewall parser is used in a custom logger model

Feature Improvements for WELF Parser - Added type conversion support for new fields introduced in BLUEMAX NGF v4.0.0 within the  syslog formats fw4_allow, fw4_deny, fw6_allow, fw6_deny, and urlblock.

New query commands * Address object management: sonar-add-address-object, sonar-remove-address-object * Pattern addition: sonar-add-pattern * Investigation result creation and lookup: sonar-investigate, sonar-investigate-result * Ticket and article creation: sonar-create-ticket, sonar-create-ticket-from-event, sonar-create-article * Ticket attribute settings: sonar-add-ticket-tags, sonar-set-ticket-tags, sonar-set-ticket-assignees, sonar-set-ticket-attack, sonar-set-ticket-incident, sonar-set-ticket-priority, sonar-set-ticket-status * Indicator updates: sonar-ioc-update-url, sonar-ioc-update-md5, sonar-ioc-update-ip, sonar-ioc-update-domain, sonar-ioc-update-email

First release **Features** - Scans for the PHP2Shell remote code execution vulnerability (CVE-2026-109618/109619) - Bulk-registers scan targets by pasting multiple URLs, and fetches each root page to detect whether the target responds and whether it uses http or https - Full scan (unscanned and vulnerable assets only), rescan of selected targets, re-probe, and scan stop - Records the verdict and the exposed PHP version, and keeps the scan result history - Shows a verdict pie chart, a PHP version treemap, and the counts of total, vulnerable, patched, and unscanned assets - Exports scan targets and scan results as CSV - All users can view; only administrators can add, scan, and delete targets - Korean, English, and Japanese UI **Query commands** - php2shell-scan: Scans a single URL on the spot - php2shell-scan-batch: Scans the URL in each input row on the spot - php2shell-targets: Lists the registered scan targets - php2shell-results: Lists the scan result history - php2shell-add-target-batch: Registers the URL in each input row as a scan target - php2shell-delete-target-batch: Deletes the scan target matching the URL in each input row

Security Improvement - Due to the API key being stored in plain text in API logger settings, the API logger now uses a connect profile for connection information - Removed Hostname, API Key, and HTTP Proxy from the API logger settings and added Connect Profile - After updating to this version, existing API loggers stop collecting; edit each logger to specify a connect profile

Oracle JDBC Thin Driver 19.31.0 version

Parser Bug Fixes - Fixed an issue where a quoted value containing `=` was truncated and the message code was extracted with a leading quote, causing logs to be stored as unknown - ivanti-vpn-tunnel: `ERR24670` and `ERR31271` logs were not classified correctly - Fixed an issue where the agent value of mobile client logs was truncated and part of it was extracted as separate fields ※ Logs already stored as unknown by earlier versions are not reclassified automatically after the app update.

Improvements - Support for parsing logs when some items (timestamp, year, event level) are omitted from the device syslog format - Recognition of log timestamps in `yyyy/MM/dd HH:mm:ss` format Bug Fixes - Double quote (`"`) remaining at the end of the last field value - Parts of the evidence packet body (hex dump, browser information, etc.) incorrectly extracted as separate fields - Audit log message truncated when it contains parentheses - Evidence packets classified as attack instead of packet - Access control logs classified as attack - When the timestamp is omitted from the syslog format, audit/system logs classified as attack, and system logs not parsed - Security logs with an empty port value not parsed

Initial release - Added query commands to retrieve asset information through Google Cloud APIs (connect profile based on a service account JSON key) - `gcp-assets`: Search cloud assets within a project, folder, or organization scope - `gcp-iam-policies`: Search IAM policies - `gcp-projects`: List projects under an organization or folder - `gcp-check-permissions`: Check whether the service account has the permissions required to run the query commands

Logger Bug Fixes - Fixed an issue where data was missed when the monitoring period was set to 1 day due to UTC timezone mismatch - Relaxed the date handling criteria for the monitoring period - Mitigated duplicate collection during abnormal situations such as collection interruptions (retained status keys for 3 days) ※ If the monitoring period is set to 1 day, a single duplicate collection may occur during the omission handling process.

Code Refactoring

Improvements - **Loggers and query commands now request only the OAuth scopes they need** - User account OAuth now supports all loggers and query commands **except Alert Center** - Customer ID and Delegated Account in the connect profile are now optional, with field descriptions added - When permissions are insufficient, the logger status and query command results show the action required Bug Fixes - Fixed an issue where Google API error details were not shown when querying spreadsheets, users, or groups - Fixed an issue where the `group` option of the `google-workspace-users` command returned empty results for a group that does not exist Notes - Existing permission settings continue to work. To remove permissions for features you do not use, reduce them **after upgrading**, referring to Required Permissions in the installation guide (reducing them before upgrading stops all features) - **Disable all Google Workspace loggers before upgrading, and enable them again after the upgrade**

First Release - Analysis of 128 types of digital forensic artifacts - Rule-based detection of MITRE ATTACK TTPs - File system, registry, logs, event viewer

Bug Fixes - Fixed an issue with applying design themes

Feature Improvements - Enhanced ticket synchronization in redundant environments - Added option to select items for synchronization

- Added support for Network Blackbox 5.0 - Added collection support for new log types - audit_log: audit - content_rule: content rule detection - content_file_third_party: third-party file scan - spread_local, spread_upload: abnormal internal asset activity - abnormal_spike: abnormal session spike - Added 5 log schemas