Support M365 exchange, general and mail flow logs
- Added log schemas, logger models, and dashboards
- Added m365-exchange-mail-flows query command.
First release
- Support response module for BLUEMAX TAMS.
- Support 13 extended query commands for BLUEMAX TAMS
Troubleshoot parsing errors due to unintentional sharing while parsing time information
Troubleshoot parsing errors due to unintentional sharing while parsing time information
First Release
- Menlo Security Web Access, Audit logger models.
- menlo-web-logs, menlo-audit-logs query commands.
- Web Access and Audit dashboards.
- Phishing and malware download detection rules.
- Tested on Menlo Security Admin Portal 2.90.0-133004.
Support web log feature generation command.
- web-log-features
Extended query commands:
- chatgpt-ask
- chatgpt-ask-batch
- chatgpt-summarize-campaign-report
Automatic resumption after various connection errors
First release
- Dedicated log parser, log schema, logger model, dashboard
Support ECS 8.11 normalization (20 field set, 225 fields)
- [ECS normalization reference link](https://docs.logpresso.com/ko/ecs-normalization)
Supported query commands:
* ctx-get-file-report-batch
* ctx-get-domain-report
* ctx-get-similar-files
* ctx-get-domain-report-batch
* ctx-get-file-report
* ctx-get-file-relations
* ctx-get-ip-report-batch
* ctx-get-ip-report
Preventing NullPointerException during exception handling when there is a problem with Rest API communication
First Release
- Log parser with support for stripping ANSI escape codes
- Log schema, logger model, and dashboards
- 6 TTP detection scenarios
First release
- Supports dedicated log parser, log schemas, logger models, and dashboards.
First release
- Validated against platform version 2.5.5.6.6, analytics engine 4.6.11.3, mail engine version 2.4.8.20
- MARS SLE log parser, logger model, dashboards (Mail, File, URL)
- MITRE ATTACK TTP detection rules (T1566.001, T1566.002)
- Extended query commands for playbook
Receive logs in CEF format and support detection rules
- Malware Hit Found
- IOC Hit Found
- FireEye Acquisition Started
- FireEye Acquisition Queued
- FireEye Acquisition Completed
- FireEye Quarantine Request
- FireEye Quarantine Failed
- FireEye Quarantine Completed
- FireEye Security Content Updated
- Tamper Protection TP hit found
Verified on Trellix Endpoint Security 5.3.1
Support BLUEMAX WIPS v1.5.0
- WIPS log parser
- Logger model and log schemas
- Event, performance, operation, audit dashboards
Preventing Null Point Exceptions during exception handling when there is a problem with Rest API communication
Support for _type metafield for lower versions of Elasticsearch
First release
* Disable Windows Service (T1562.001)
* Install Windows Service (T1569.002)
* RDP Lateral Movement (T1021.001)
* Remote PsExec Command (T1569.002)
Support app installation on linux environment.