Feature Enhancement (Requires **Logpresso Sonar version 5.0.2603.0**)
- Added support for Okta SAML 2.0 Single Sign-On (SSO)
Parser Improvements
- Added 6 CEF Log Types:
- EDR_ALERT_DETECT, EDR_INOUT_FLOW, APRM_AGENT_EVENT, APRM_PRIVACY_INFO_EVENT, APRM_PRIVACY_LEAKAGE_EVENT, APRM_PRINT_EVENT
- Added 16 JSON Log Types:
- AGENT_CONNECTION_STATUS_EVENT, AGENT_EVENT, AGENT_HW_ALL, AGENT_INSTALL_PKG_EVENT, AGENT_SW_ALL, AGENT_TASK_STATUS, APM_AGENT_EVENT, APM_PATCH, APM_SW, AUDIT_EVENT, PATCH_UPDATE_EVENT, PKG_DIST_EVENT, SERVICE_EVENT, UPDATE_EVENT, V3_INTERNET, V3_SCAN, V3_SUP
- Improved MAC address normalization
- Enhanced performance for time value/timestamp processing
- Added array handling for log_string_args
- Improved file path escape handling
- Resolved type conversion errors in code mappings
Query Command Improvements
- Added Query Commands and Enhanced Options:
- ahnlab-epp-query: Interface ID-based DB query lookup (New)
- ahnlab-epp-nodes: Added interface-id option (Modified)
- ahnlab-epp-match-node: Added interface-id option (Modified)
- ahnlab-epp-search-file-result: Added interface-id option and improved error response handling (Modified)
- Added timeout settings
- Improved resource cleanup logic
- Enhanced error handling logging
Schema / Model / Resource Improvements
- Added 6 new log schemas and applied them to the collection model
- Added APrM-related log templates
First Release
- Provides a parser, logger model for Cisco Secure Firewall Threat Defense syslog messages.
- Supports Messages:
- Severity2 (Critical): 106007, 106017
- Severity3 (Error): 106014 and 5 others
- Severity4 (Warning): 113019 and 10 others
- Severity5 (Notification): 109201 and 20 others
- Severity6 (Info): 110002 and 30 others
First Release
- Provides a parser, logger model and log schema for Cisco Firepower syslog messages.
Enhancements
- Supports parsing and log schema for `block_log` of U 2.1 model
- Added `unknown` in the logger model
First release
- Support Events Feed logger.
Improvements
- Added support for `RT_SCREEN_IP` log parsing
- Added support for `JunOS 21` session deny log parsing
Bug Fixes
- Fixed `session_id` field type (string → 64-bit int)
- Normalized action field values to uppercase
Improvements
- Supports parsing of new syslog format (e.g. node=... srcip=... role=... sessionid=...)
- Added normalized message codes
- ivanti-vpn-auth: `ADM20664`
- ivanti-vpn-tunnel: `NWC32001`
- Added query commands `eprism-add-user-rule`, `eprism-delete-user-rule`
- Fixed parsing error for field values enclosed in quotes
Improvements
- Added DAG IP management commands and block integration
- paloalto-ngfw-register-ip: Register a single IP tag (Block)
- paloalto-ngfw-unregister-ip: Unregister a single IP tag
- paloalto-ngfw-registered-ips: View the list of registered IPs
- paloalto-ngfw-register-ip-batch: Bulk register IPs based on input records
- paloalto-ngfw-unregister-ip-batch: Bulk unregister IPs based on input records
- Added HTTP proxy configuration options
Enhancements
- Handle undefined fields to prevent total parsing failure
- Optimize parser performance
Fix query failure when using field function
First Release
- Supports log schema, JDBC logger model, and dashboard for ADT CAPS Access Control Log
Added 13 extended commands for Flow collaboration tool integration
- flow-bots: Retrieve a list of notification bots
- flow-departments: Retrieve a list of departments
- flow-employees: Retrieve a list of members
- flow-send-notification: Send a single notification
- flow-send-notification-batch: Send notifications in batch
- flow-activate-employee: Activate a member
- flow-activate-employee-batch: Activate members in batch
- flow-deactivate-employee: Deactivate a member
- flow-deactivate-employee-batch: Deactivate members in batch
- flow-create-post: Create a post
- flow-create-post-batch: Create posts in batch
- flow-create-task: Create a task
- flow-create-task-batch: Create tasks in batch
Bug fix
- Fixed an issue where copies created by sonar-clone-dashboards, sonar-clone-datasets, and sonar-clone-widgets were deleted during app reinstallation.
Added Endpoint Filters for SentinelOne Application Risk
- Endpoint Name, Endpoint UUID
Support for SentinelOne Cloud Funnel log collector and a dedicated UI
- New log schemas: sentinelone-application-endpoint, sentinelone-application-risk, sentinelone-cross-process-event, sentinelone-dns-event, sentinelone-file-event, sentinelone-group-event, sentinelone-indicator-event, sentinelone-login-event, sentinelone-process-event, sentinelone-registry-event, sentinelone-scheduled-task-event, sentinelone-session, sentinelone-threat, sentinelone-threat-notes, sentinelone-threat-timeline, sentinelone-vuln-event, sentinelone-webfilter
- New query commands: sentinelone-add-threat-note, sentinelone-app-cves, sentinelone-app-endpoints, sentinelone-app-risks, sentinelone-delete-threat-note, sentinelone-events, sentinelone-query, sentinelone-star-custom-rules, sentinelone-threat-notes, sentinelone-threat-timeline, sentinelone-threats, sentinelone-update-threat-note
Fixed WAF Log Parser:
- Resolved errors handling the **responseCodeSent** field.
Feature Improvements
- New Event Support: Added support for the system_monitor event type.
- Audit Log Expansion: Extended the fields for system_event audit logs.
- Resource Monitoring: Implemented per-core CPU usage parsing for system_resource.
- Schema Update: Added new fields for Event Log v1.1.7.
- Stability Enhancements: Improved logger model structure and parser stability.
- Data Integrity: Enhanced field type accuracy and standardized (normalized) field names.
- UI/UX: Updated the dashboard.
Support for commands to search for employees and departments