New-Scale Security Operations PlatformNew-Scale Content Package Release Notes

Added new parsers for CrowdStrike Falcon logs: crowdstrike-falcon-json-app-login-streamstarted-auditlogv3, crowdstrike-falcon-json-app-logout-streamstopped-auditlogv3, crowdstrike-falcon-json-app-login-apirequest-logged.

Updated varonis-dsp-json-alert-trigger-success-varonisdacloud parser conditions to parse broader category of Varonis DA alert logs.

Added new parser for Cisco Duo logs: cisco-duo-json-app-activity-success-mgmtsyssync

Updated network as platform for the event_builders with subjects: http & network

Added new parsers for Microsoft Azure Monitor logs: microsoft-azuremon-csv-http-request-session-frontdooraccesslog, microsoft-azuremon-csv-http-request-success-frontdoorwaf, microsoft-azuremon-csv-app-notification-success-frontdoorhealthprobe.

Added new parsers for Aqua Security Workload Protection: aquasecurity-wp-json-app-activity-success-scan, aquasecurity-wp-json-app-activity-success-policyfailure, aquasecurity-wp-json-alert-trigger-success-alert, aquasecurity-wp-json-app-activity-success-catchall

Added new parser for Microsoft Azure Synapse Analytics logs: microsoft-azuresynapseanalytics-csv-app-activity-sqlsecurityauditevents

Added new parsers for One Identity Safeguard logs.

Updated CIM field descriptions.

Updated pingidentity-pi-json-app-activity-apipingone parser conditions to parse broader category of Ping Identity logs.

Added new parser for Extrahop Reveal(x) logs: extrahop-revealx-json-alert-trigger-success-detection-1

Updated microsoft-evsecurity-kv-endpoint-login-fail-4625-4, microsoft-evsecurity-kv-endpoint-spanish-4624 parser conditions to parse broader category of Microsoft Event Viewer - Security logs. Added new parsers for Microsoft Event Viewer - Security logs: microsoft-evsecurity-kv-user-privilege-assign-success-4672-1, microsoft-evsecurity-kv-user-switch-success-4648-6, microsoft-evsecurity-kv-group-modify-success-4735-1, microsoft-evsecurity-kv-rdp-traffic-success-4778-2

Added Extract uri_path, uri_query and uri from url field using extractUriPath(),extractUriQuery() and extractUri() function in event enricher.

Added new parsers for VMware vCenter logs.

Updated event-builder for parser: microsoft-o365-json-email-send-receive-internentmessageid

Activity Types Removed: case-modify, case-create, case-delete, case-read, detection_group_rule-create, detection_group_rule-modify, detection_group_rule-delete, detection_group_rule-enable, detection_group_rule-disable, parser-create, parser-delete, parser-modify, parser-import, parser-enable, parser-disable, log-search, log-download, log-export, log_source-remove, log_source-enable, log_source-disable, log_source-add, log_source-modify, log_account-create, log_account-delete, log_account-modify, context_table-create, context_table-modify, context_table-delete, site_collector-create, site_collector-delete, site_collector-enable, site_collector-disable, site_collector-modify, collector-create, collector-modify, collector-delete, collector-enable, collector-disable, template-delete, template-create, template-modify, visualization-create, visualization-delete, visualization-download, visualization-export, visualization-schedule, visualization-publish, visualization-modify, dashboard-create, dashboard-delete, dashboard-download, dashboard-export, dashboard-schedule, dashboard-modify, dashboard-publish. Subjects Removed: detection_group_rule, site_collector, collector, template, log_account, context_table, log_source, parser, dashboard, visualization.

Reclassified categories for multiple vendors and products.

Updated additional_info field and added dest_host, count field extractions for parser qualys-q-json-app-activity-success-scan.

Updated additional_info field extraction for parser: sophos-ep-json-alert-trigger-success-applicationblocked

Updated conditions for Cisco parsers: cisco-websec-str-app-activity-info and cisco-websec-str-app-activity-warning.

Added new parsers microsoft-mssql-xml-database-activity-success-dbactivity

Updated time field extraction for parser: mcafee-wg-str-http-session-denied.

Updated src_ip field extraction for parser: atlassian-atlassian-json-app-activity-success

Added dest_user, user, dest_domain, domain fields extraction for parser: sentinelone-singularityp-json-process-create-success-process.

Updated email_address, dest_email_address, risk_score, bytes_in, rule_count, new_ip, dest_ip, src_email_address, bytes,risk_level, bytes_out, src_ip, origin_ip, src_port and packets field extractions for Netskope Security Cloud logs.

Updated alert_description and alert_name field extractions for Netskope Security Cloud logs.

Added new parsers for Palo Alto NGFW logs.

Updated parser conditions for Microsoft 365 Defender logs.

Update the time, additional_info field extraction for parser amazon-awsshield-mix-alert-trigger-success-attackmitigation

Added new timeformat for parser: pingidentity-pi-json-app-authentication-fail-invalidpasscode.

Added new Event Builder condition for parser microsoft-o365-cef-user-password-reset-selfservice

Updated operation, bucket_name, http_response_code, src_ip and auth_type field extractions for parser: amazon-s3-str-http-session-success-accesslog

Updated resource_path, object, operation_type, authorization_scope, identifier field extraction for parser: github-g-json-app-activity-success-apirequest

Updated process_path, process_dir, process_command_line and path field extractions for parser: microsoft-evsecurity-mix-process-create-success-created.

Updated failure_reason, policy_name and host field extraction for parser: azure-azuremfa-json-app-login-success-mfarequirementsatisfied.

Updated Event Builder conditions that utilize the http_response_code field.

Updated json field extractions and parser matching conditions for parser: google-gcscc-json-alert-trigger-successs-notificationconfig

Updated dest_email_address, dest_email_domain field extractions for parser: cisco-ie-str-email-success-dcid.

Added file_ext field extraction for parser: proofpoint-tap-sk4-email-receive-threatdetected. Updated email_attachments field extraction for parser: proofpoint-tap-sk4-email-receive-threatdetected

Updated host field extraction for parser: unix-unix-kv-process-create-success-command.

Updated parser's condition for microsoft-azurefw-json-dns-request-success-azfwdnsquery , microsoft-azurefw-json-network-session-azfwapplicationrule and microsoft-azurefw-json-network-session-azfwnetworkrule parser.

Updated bucket_arn field extraction for Amazon AWS CloudTrail parsers.

Updated threat_id field extraction for parser: pan-ngfw-csv-http-session-9999

Updated host field extraction for Microsoft parsers with syslog-format logs.

Updated Dnsmasq parsers: barracuda-waf-str-dns-request-dnsmasqquery, dnsmasq-dnsmasq-str-dns-response-dnsmasqcached.

Updated aws_account field extraction for parser: amazon-awscloudtrail-json-role-assume-success-assumerole.

Added rule field extraction for parser: aws-waf-json-http-session-httprequest. Added json support for parser aws-waf-json-http-session-httprequest.

Updated file_name, file_type field extractions for parser: anthropic-claude-json-ai_agent-request-success-messages.

Updated alert_type, domain, category field extraction for parser - checkpoint-hs-json-alert-trigger-success-event-security.

Added the new parser for VMware vCenter logs: vmware-vcenter-str-list-read-sucess-ssoadminserver.

Added new event builders for parsers: unix-unix-kv-process-create-success-execve & unix-unix-kv-process-create-success-exe

Added a new parser for vendor Upwind: upwind-upw-json-alert-trigger-success-apisecurity, upwind-upw-json-alert-trigger-success-cloudlogs, upwind-upw-json-alert-trigger-success-fileevents, upwind-upw-json-alert-trigger-success-network, upwind-upw-json-alert-trigger-success-process

Moved zeek-zeek-str-network-traffic-syslog and zeek-z-str-email-success-smtplog to lower precedence.

Updated host field extraction for Microsoft Event Viewer - Security parsers.

Updated parser condition for parser microsoft-o365-json-mail-access-mailitemsaccessed.

Updated actOnCondition for rules Fact-PC-Chmod-Setgid & Fact-PC-Chmod-Setuid.