Initial release
- Provides a JDBC logger model, log schemas, and a dashboard for DOCTORSOFT NETCLIENT PC security logs.
Add a Slack online status collector and a dedicated app menu
Remote File Scanning Support
- Requires [Experimental app](/en/apps/experimental) version 2.0.2607.0 or later
- Requires installation of an app that supports remote file streaming (such as the [Microsoft Graph app](/en/apps/ms-graph))
- Please note that, starting with this version, scanning of local files on the server is no longer supported due to security concerns
OneDrive File Streaming
- Requires [Experimental](/en/apps/experimental) app version 2.0.2607.0 or later
- Note: Installation will fail due to dependency errors if the latest version of Experimental app is not installed
Added 6 ticket query commands
- sonar-ticket-repositories
- sonar-create-event-ticket
- sonar-create-markdown-ticket
- sonar-add-ticket-comment
- sonar-update-ticket-comment
- sonar-remove-ticket-comment
Added Interface for Remote File Streaming
- For example, the Microsoft Graph app supports access to OneDrive files, and the Office Scanner app can scan OneDrive files.
Improvements
- Support for parsing CDR-related fields and added schema fields
- Refined dataset queries so the dashboard time filter is applied
- Corrected the display name of the `mail_to` field in the `url-scan` schema
Improvements
- Support for parsing CDR-related fields and added schema fields
- Refined dataset queries so the dashboard time filter is applied
Initial Release
- Provides a parser, logger model, log schema and dashboard for Netwrix Endpoint Protector logs.
Improvements
- Normalize action, result fields for `USERAUTH` log type
Bug Fix
- Fix '=' character handling error in WELF parser
First Release
* Provides parser, logger model, and log schema for BeyondTrust Endpoint Privilege Management (EPM) and Application Audit logs
* Supported categories: EPM, Application Audit
- Improved clipping of right-side stats panels (source countries, ASNs, detection rules) across screen resolutions
- Added scrolling and optimized spacing for right-side stats panels
- Fixed an issue where the globe failed to render when textures failed to load
Enhance safety of parser Boolean field casting logic
Added IoC Search menu.
Initial Release
- Provides query commands for sending security events to the INITECH INI-ICAM platform.
First release
- Data from docs.logpresso.com as of 2025-02-27
KISA WHOIS Extended Commands Addition
- kisa-whois-domain: Single lookup for .kr / .한국 domain registration information.
- kisa-whois-ip: Single lookup for IP address registration and allocation information.
- kisa-whois-asn: Single lookup for AS (Autonomous System) number registration and allocation information.
- kisa-whois-domain-batch: Batch lookup for domain information using the domain column values of the input records.
- kisa-whois-ip-batch: Batch lookup for IP information using the ip column values of the input records.
- kisa-whois-asn-batch: Batch lookup for AS number information using the asn column values of the input records.
Parser Improvements
- Added parsing support for the V3_PC_MANAGEMENT log type (Classified as V3 Audit)
- Added 'clean_datas' and 'event_data' fields to the EDR_LOG type
First Release
- Add FOCS firewall and application lookup commands
- Add FOCS malicious IP lookup, add, and delete commands
Adds VNet flow logs(v4) support and new query commands