Bug Fix
- Skip hostname verification when SSL certificate validation is disabled
First release
- Support slide report generation
#### Key Features
- Secure credential management via connect profiles (no credentials exposed in queries)
- Auth types: Bearer, Basic, custom header, None
- All HTTP methods including PATCH, HEAD, OPTIONS
- `brex`/`erex` multiline streaming for large responses
- Auto body assembly in batch commands
#### Query Commands (12)
Driver commands (7):
- `http-get` - Send HTTP GET request.
- `http-post` - Send HTTP POST request.
- `http-put` - Send HTTP PUT request.
- `http-patch` - Send HTTP PATCH request.
- `http-delete` - Send HTTP DELETE request.
- `http-head` - Send HTTP HEAD request.
- `http-options` - Send HTTP OPTIONS request.
Batch commands (5):
- `http-get-batch` - Send HTTP GET requests for each input row.
- `http-post-batch` - Send HTTP POST requests for each input row.
- `http-put-batch` - Send HTTP PUT requests for each input row.
- `http-patch-batch` - Send HTTP PATCH requests for each input row.
- `http-delete-batch` - Send HTTP DELETE requests for each input row.
New Feature
- Rule export/import support in the /rule-exchange path
New commands:
* sonar-explanation-requests: List explanation requests
* sonar-explanation-categories: List explanation categories
* sonar-explanations: Retrieve explanations for a specific request
* maestro-playbooks: List playbooks
* maestro-playbook-runs: List playbook execution history
* sonar-behavior-profiles: List behavior profiles
* sonar-create-behavior-profile-batch: Create behavior profiles
* sonar-update-behavior-profile-batch: Update behavior profiles
* sonar-remove-behavior-profile-batch: Remove behavior profiles
* sonar-tags: List tags
* sonar-tenants: List tenants
* sonar-get-ticket-comments-batch: Retrieve ticket comments
Modified commands:
* sonar-batch-rules: Added id output field
* sonar-stream-rules: Added id output field
Added missing dashboard resources.
First release
- askurl-fraud-alerts
- askurl-phishing-alerts
- askurl-scan-sms
- askurl-scan-sms-batch
- askurl-scan-url
- askurl-scan-url-batch
Changelog
- Added cisco-meraki-attack log schema (security_event ids_alerted)
Add the `ahnlab-tip-related-actors-batch` command
- Use IoC information to look up related threat actor information.
Changelog
- Supports Syslog BSD date format (MMM d HH:mm:ss, MMM dd HH:mm:ss)
- 2 log schemas added
- nexg-fw-ssh-auth
- nexg-fw-audit
Bugfix
- Fixed typo in stream rule queries
Changelog
- SNIPER TMS-Plus IP block integration support using address groups
- 18 new Commands added
- sniper-tms-ipv4-blocklist
- sniper-tms-ipv6-blocklist
- sniper-tms-block-ip
- sniper-tms-block-ip-batch
- sniper-tms-unblock-ip
- sniper-tms-unblock-ip-batch
- sniper-tms-ipv4-allowlist
- sniper-tms-ipv6-allowlist
- sniper-tms-allow-ip
- sniper-tms-allow-ip-batch
- sniper-tms-remove-allow-ip
- sniper-tms-remove-allow-ip-batch
- sniper-tms-devices
- sniper-tms-sensor-block-ips
- sniper-tms-snort-rules
- sniper-tms-pattern-blocks
- sniper-tms-users
- sniper-tms-deploy
- 2 new Log-Schemas added
- sniper-tms-plus-resource (Resource Log)
- sniper-tms-plus-firewall-session (Firewall Session Log)
First release
- tenable-sc-cve-findings
- tenable-sc-hosts
- tenable-sc-vulnerabilities
- tenable-sc-vulnerability-details
- tenable-sc-solution-hosts
- tenable-sc-scans
- tenable-sc-scan-results
- tenable-sc-repositories
- tenable-sc-assets
- tenable-sc-filter
- tenable-sc-solutions
- tenable-sc-scanners
- tenable-sc-plugins
- tenable-sc-users
- tenable-sc-license
- tenable-sc-scan-zones
Changelog
- Added AWS VPC Flow log schema and logger model
Bug fix
- Fixed requestBodySize, requestBodySizeInspectedByWAF field casting error that occurs when "Simplify output fields" option is false in AWS WAF logger
- added profile option to aws-cost command
Changelog
- Added 9 new log schemas
- bluemax-ips-system (alert)
- bluemax-ips-audit (config_audit, connection_audit)
- bluemax-ips-iface (system_interface_traffic)
- bluemax-ips-domain-stats (traffic_domain_cnt)
- bluemax-ips-framesize-stats (traffic_framesize_cnt)
- bluemax-ips-inout-stats (traffic_inout_cnt)
- bluemax-ips-interface-stasts (traffic_interface_cnt)
- bluemax-ips-protocol-stats (traffic_protocol_cnt)
- bluemax-ips-service-stats (traffic_service_cnt)
- Fixed BLUEMAX IPS logger model to map "attack" log schema instead of "bluemax-ips-threat" for attack logs
- Also fixed BLUMAX IPS 침입탐지 query to search for "attack" log schema
```note
Before updating the app, delete "침입탐지" stream rule then update
```
Fix for changing the date format in Menlo Security API response values.
First Release
- Supports Fasoo FED-M log schema, logger model, and dashboard
First Release
- Supports Fasoo FXM log schema, logger model, and dashboard
First Release
- Supports Fasoo FDR log schema, logger model, and dashboard
First Release
- Supports Fasoo FSP log schema, logger model, and dashboard