Support ECS 8.11 normalization (20 field set, 225 fields)
- [ECS normalization reference link](https://docs.logpresso.com/ko/ecs-normalization)
Supported query commands:
* ctx-get-file-report-batch
* ctx-get-domain-report
* ctx-get-similar-files
* ctx-get-domain-report-batch
* ctx-get-file-report
* ctx-get-file-relations
* ctx-get-ip-report-batch
* ctx-get-ip-report
Preventing NullPointerException during exception handling when there is a problem with Rest API communication
First Release
- Log parser with support for stripping ANSI escape codes
- Log schema, logger model, and dashboards
- 6 TTP detection scenarios
First release
- Supports dedicated log parser, log schemas, logger models, and dashboards.
First release
- Validated against platform version 2.5.5.6.6, analytics engine 4.6.11.3, mail engine version 2.4.8.20
- MARS SLE log parser, logger model, dashboards (Mail, File, URL)
- MITRE ATTACK TTP detection rules (T1566.001, T1566.002)
- Extended query commands for playbook
Receive logs in CEF format and support detection rules
- Malware Hit Found
- IOC Hit Found
- FireEye Acquisition Started
- FireEye Acquisition Queued
- FireEye Acquisition Completed
- FireEye Quarantine Request
- FireEye Quarantine Failed
- FireEye Quarantine Completed
- FireEye Security Content Updated
- Tamper Protection TP hit found
Verified on Trellix Endpoint Security 5.3.1
Support BLUEMAX WIPS v1.5.0
- WIPS log parser
- Logger model and log schemas
- Event, performance, operation, audit dashboards
Preventing Null Point Exceptions during exception handling when there is a problem with Rest API communication
Support for _type metafield for lower versions of Elasticsearch
First release
* Disable Windows Service (T1562.001)
* Install Windows Service (T1569.002)
* RDP Lateral Movement (T1021.001)
* Remote PsExec Command (T1569.002)
Support app installation on linux environment.
Support BLUEMAX NGF v3.5.1 firmware.
- Added fw_rule_dir field when parsing fw4_allow, fw4_deny, fw6_allow, fw6_deny log types.
- Changed start_time, end_time field types to date type.
- Changed device_ip field type to IP address type.
Support Genian NAC REST API changes
- Field name changes: IP -> NL_IPSTR, MAC -> NL_MAC, SS_STATUS -> NL_STATUS, Hostname -> NL_FQDN, PLATFORM -> NL_PLATFORM, NODEPOLICY -> NL_NODESYSTEM, LASTACTIVE -> NL_LASTACTIVE
- Cache node list to improve dashboard performance (updated every 5 minutes)
Added ATT&CK TTP rules
Support for collecting syslog methods
* Add syslog collection model
Added ssl.log collection target
* ssl.log
Improved parser behavior when field values contain “=” or “,”
Support for profile option in extended command parameters and output
Support for profile option in extended command parameters and output
MySQL Connector/J 8.0.33 version
Supported event ID
- 1: ProcessCreate
- 2: FileCreateTime
- 3: NetworkConnect
- 5: ProcessTerminate
- 7: ImageLoad
- 10: ProcessAccess
- 11: FileCreate
- 12, 13, 14: RegistryEvent
- 15: FileCreateStreamHash
- 22: DNSQuery