Added parsing and schema for new log types
- Authentication-based defense (auth_base_defense)
- Blacklist block (blacklist_block)
- HA status (ha_status_cnt)
Added support for parsing key-value format logs
Add connection profile timeout options
Added `profile` option to the `github-audit-logs` query command
First release
- Support dedicated log parser, log schemas, logger model
Add Slack Audit Log Collector and Dashboard
- Requires auditlogs:read in Slack User OAuth Scope
Add Slack Account Dashboard
- Requires users:read, users:read.email, and team:read in Slack User OAuth Scope
- If users:read.email or team:read is not granted, email and team name will display as null
Logger start time option added
- When running the collector for the first time or after initialization, logs are retrieved starting from start time option base.
- Incremental collection continues from previous collection time upon relaunch
- If not entered, retrieves oldest log based on current subscription settings
New FCTI Dashboards
- News, Alerts, Threat Reports, Advisories, Early Warnings, Notices, IP Feed, URL Feed, Domain Feed, MD5 Feed, SHA256 Feed
Changelog
* Added spl option for splunk-search query command.
**Feature for 1.5.2511.0 version that allowed variables in splunk-search SPL query has been disabled. Instead, use Logpresso query to create SPL query string and use splunk-search spl option.**
**This version might not have query working correctly when using set variable, use 1.5.2511.1 instead.**
Changelog
- Added support for variables in SPL query in `splunk-search` command
First release
- Support alert, upload, health, rpc, audit log types
- Support dedicated log parser, log schemas, logger model, datasets, dashboards, and detection rules.
Improvements
- Added option to include original logs in collectors and extended commands
- Fixed error message display
Added raw log inclusion option to activity log-related extended commands
- Added raw option to google-workspace-admin-logs, google-workspace-drive-logs, google-workspace-login-logs, google-workspace-meet-logs, google-workspace-chat-logs commands
- When enabled, raw data is included in the line field as a JSON string
Added option to include raw logs in the Activity Log Collector
- Added `include_event_raw` option to control whether raw logs are collected
When reinstalling the app, please deactivate the Google Workspace app first before proceeding with the upgrade.
Improvements
- Improved error display when API key authentication fails
- Changed connect profile option to optional when executing batch commands
Improved compatibility with Sonar
- Requires experimental app version 1.6.2510.0 or higher (uses log command)
- Requires **Logpresso Sonar 4.0.2502.0** or higher
Support #react2shell tagging
- Requires experimental app version 1.6.2510.0 or higher (uses log command)
- Requires **Logpresso Sonar 4.0.2507.0** or higher
Fix false positives for #command_injection related to simple template variable references
- Requires experimental app version 1.6.2510.0 or higher (uses log command)
- Requires **Logpresso Sonar 4.0.2507.0** or higher
Support Beacon Traffic Detection
- Requires experimental app version 1.6.2510.0 or higher (uses log command)
- Added ml-beaconing-connections command
- Added ml-beacon-sessions command
Requires **Logpresso Sonar 4.0.2507.0** or higher
First release
* apivoid-check-domain
* apivoid-check-domain-batch
* apivoid-check-ip
* apivoid-check-ip-batch
* apivoid-domain-info
* apivoid-domain-info-batch
* apivoid-reverse-ip
Minor modification of detection rules
- Exploit Detected rule: Added exception condition for Exploit/Win.MagicLineX
- CoinMiner Detected rule: Changed rule name
- Phishing Detected rule: Removed unnecessary exception condition from first search command
sonar sync commands improvements
- Added locale input to the sonar-sync-employees command
- Fixed an NPE issue 발생 when dept_code is empty
- Improved error cause reporting