Improve performance of Elastic log parser
Notes
- When upgrading from versions earlier than 1.4.2511.0, please review the steps below.
- For proper incremental collection, follow this sequence:
Disable the existing logger → Apply the app patch → Restore the index name in the logger settings → Enable the logger.
First release
- Support react2shell-scan-batch query command.
Improvements
- Add support for decimal values in the cpu_usage, mem_usage, disk_usage, and temperature fields for the Controller_resource and Sensor_resource log types.
Bug Fixes
- Fix a parsing failure that occurs when the msg field contains a comma (,) in the Admin_log, Ha_log, Controller_log, and Sensor_log log types.
New features
* Added mat-threads query command and support for mat-build discard-ratio option
New feature
- Google Workspace Group command and schema has been added
- Google Workspace User command has new "group" option
- Added support for Google Workspace playbook execution
Google Workspace drive activity collector bug patch
- Missing error handling for empty list responses for Google Drive activity logs
Improvements
- Added 4 detection rules
* Admin Role Assigned (T1098.003)
* Executable File Download (T1204.002)
* New Trusted Domain Added (T1562.007)
* User Unsuspended (T1078.004)
Improvements
- Added originating_app_name when collecting Google Drive activity logs.
- Added google-workspace-drive-apps, google-workspace-drive-app extended query commands.
Grant new scope for domain-wide delegation
* https://www.googleapis.com/auth/drive.apps.readonly
New feature
- Added Google Chat activity log schema, logger model, and dashboard.
- Google Workspace dashboards now support time filter in the dashboard panel.
Bug patch
- Fixed infinite loading bug of Google Workspace Alert Center collector.
- Fixed an issue where google-workspace-users command output is limited to 100 users
Support Google Workspace alert center
- Added phishing mail, alert center, service notice dashboards.
Grant new scope for domain-wide delegation
- https://www.googleapis.com/auth/apps.alerts
Added 13 MITRE ATT&CK TTP detection rules
First release
Bug Fixes
- Fixed an issue where the logger did not operate correctly in a forward-server configuration environment.
Upgrade Instructions
- Before installing the app, back up the index name from the existing Elasticsearch logger settings.
- Upgrade the app.
- After the upgrade, the index name of the existing logger will be reset, so restore it using the backed-up value.
Notes
- For proper incremental collection, follow this sequence:
Disable the existing logger → Apply the app patch → Restore the index name in the logger settings → Enable the logger.
Add an option to include the decoded original log field (decoded_raw) in the logger and the akamai-security-events extended command.
Added 6 MITRE ATT&CK TTP detection rules.
First Release
- Supports sending message to Microsoft Teams channels via query commands.
First release
Changelog
- Added support for HTTP proxy options
- Changed the "Chat ID" field in the Telegram connection profile from mandatory to optional
- Added "chat-ids" option to the telegram-send extended command, allowing simultaneous message delivery to multiple chat rooms (takes precedence over the “Chat ID” in the connection profile)
- In the telegram-send-batch extended command, each row’s text and chat_id fields are now read to send messages individually to each chat room
Bug fix
- Fixed NPE that occurred when running command in remote mode
First release
- Support V3 alert and agent audit logger model for AhnLab Policy Center.
- Support 13 TTP detection rules.