Expanded AWS WAF collection fields and added concise option.
Added support for Organization ID on AWS S3 log path.
Fix ECS normalization typemapping error
Add supported log types (log format)
- EDR_V3_DETECT (CEF)
- EDR_AGENT_EVENT (CEF)
- EDR_OS_EVENT (CEF)
- AGENT_TASK_STATUS (CEF)
- AGENT_SW_ALL (CEF)
- AGENT_HW_ALL (CEF)
- SERVICE_EVENT (JSON)
- AUDIT_EVENT (JSON)
- ESA_EVENT (JSON)
- V3_MALWARE (JSON) - Add fields
Support for profile parameter in EPP extended query commands
Support New Logger and dashboard
- AWS SQS logger
- AWS Shield Advanced logger
- AWS Aurora with Database Activity Streams log integration
- AWS Shield, Aurora DB Activity dashboards
Added support for Java 21
Support four additional formats of V3.5.1 firmware
- HA event logs (ha_event)
- Oversubscription statistics log (oversubscription_cnt)
- Daemon monitor logs (daemon_cnt)
- Performance logs (resource_cnt)
- Alertlogs (alert)
Apply directionality when deleting (unblocking) an address group
First release
- Okta system log collector
- Okta dashboards: User, Device, Audit
- Okta query commands
Changed MNX log format.
Added new Google Workspace loggers and dashboards
- Added Google Workspace login logger
- Added Google Workspace admin activity logger
- Added Google Drive activity logger
- Added Google Meet activity logger
- Added Google Workspace login dashboard
- Added Google Workspace admin dashboard
- Updated Google Workspace user dashboard: Support 2FA KPI
- Updated Google Drive dashboard
- Updated Google Meet dashboard
Added users and dependabot dashboards
- Added github-dependabot-alerts command
- Added github-users command
- Added github-admins command
- Added github-2fa-disabled-users command
Support web bot classification and WAF alert analysis model
Support Azure Kubernetes audit logs.
- Logger model, log schema, and 3 dashboards
First release
- Provides ping status collection and dashboards (Support for CentOS 8 and Rocky 8)
First release
- Support HTTP, DNS meta parsers and dashboards.
First release
- Support securitytrails-usage, securitytrails-query commands.
First release
- Support kakaowork messaging
First release
- Support Kakao Agit webhook.
- Support for HTTP proxy settings
- Troubleshooting internal behavior around connection profiles
First release
- Azure Event Hubs connect profile and logger factory.
- Azure Firewall log schemas, logger model, dashboards
- Azure WAF log schemas, logger model, dashboards, TTP detection rules.
- Azure Activity log schemas, logger model, dashboards, TTP detection rules.
- Microsoft Entra ID log schemas, logger model, dashboards, TTP detection rules.
Fix issue where each log type was stored duplicate with the `unknown` log schema