You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: blog-cse/2024/12-31.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,6 +16,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
16
16
17
17
This is an archive of 2024 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive).
18
18
19
+
<!--truncate-->
20
+
19
21
---
20
22
### December 20, 2024 - Content Release
21
23
@@ -852,7 +854,7 @@ Other changes are enumerated below.
852
854
853
855
This release reverts a change to our AWS CloudTrail default (catch all) mapper for how `user_username` is mapped. This is being reverted due to reports of breaking rule tuning and missing user context for some `AssumedRole` events.
854
856
855
-
AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](/release-notes-cse/#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.
857
+
AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.
856
858
857
859
AWS best practices suggest defining `sourceIdentity` to allow for the originating user for a role assumption to be identifiable. This is the best path to avoid false positive generation, as our mapper will favor `sourceIdentity` if it is present in CloudTrail logs. If it is not present, then `userIdentity.arn` will be used and the `resource-id` will be mapped to `user_username`, creating potential for false positives from dynamic session identifiers. See [Viewing source identity in CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-ct) in the AWS documentation for more information.
- Parsing and mapping support for Azure DevOps Auditing via EventHubs, and Pfsense Firewall.
17
+
- Parsing and mapping additions and updates for Cisco ISE, Cloudflare, Check Point Firewall, and Linux OS Syslog.
18
+
19
+
:::note
20
+
In two weeks, MATCH-S00604 "OneLogin - API Credentials - Key Used from Untrusted Location" will be deleted from the out-of-the-box Cloud SIEM rules due to unmanageable deny list logic and low adoption. To retain this rule, a duplicate must be made prior to the deletion.
21
+
:::
22
+
23
+
## Log Mappers
24
+
-[New] Azure DevOps Auditing Catch All
25
+
-[New] Check Point Application Control URL Filtering
26
+
-[New] Cisco ISE Radius Diagnostics
27
+
-[New] Linux OS Syslog - KRB5 Child - Authentication Failure
28
+
-[New] Linux OS Syslog - Process systemd - Systemd Session
29
+
-[New] Linux OS Syslog - Process systemd - Systemd Session Scope
30
+
-[New] Linux OS Syslog - Process systemd - session logout
- Adds mapping for `dns_query`, `http_hostname`, `http_response_contentLength`, `http_response_contentType`, and an alternative value for `ipProtocol`.
42
+
-[Updated] Linux OS Syslog - Process sshd - SSH Session Closed|disconnect
43
+
- Adds mapping for `normalizedActio`n
44
+
-[Updated] Linux OS Syslog - Process systemd - Systemd Session Start and Systemd File Configuration
45
+
- Added support for additional events and mapping of `file_path`
46
+
47
+
## Parsers
48
+
-[New] /Parsers/System/Pfsense/Pfsense Firewall
49
+
-[Updated] /Parsers/System/Check Point/Check Point Firewall JSON
Copy file name to clipboardExpand all lines: blog-csoar/2024/12-31.md
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
14
14
15
15
This is an archive of 2024 Cloud SOAR release notes. To view the full archive, [click here](/release-notes-csoar/archive).
16
16
17
+
<!--truncate-->
18
+
17
19
---
18
20
### December 31, 2024 - Application Update
19
21
@@ -312,7 +314,7 @@ This release introduces three new integrations, as well as several updates.
312
314
---
313
315
### March 12, 2024 - Content Release
314
316
315
-
Our Cloud SOAR [application update](/release-notes-csoar/#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.
317
+
Our Cloud SOAR [application update](#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.
316
318
317
319
The Python upgrade impacts a total of 38 integrations. These integrations will require updates to ensure compatibility with the new Python version.
318
320
@@ -369,7 +371,7 @@ We strongly encourage all users to review the provided documentation and prepare
369
371
### March 12, 2024 - Application Update
370
372
371
373
#### Changes and Enhancements
372
-
* Python version updated. If you experience any issues, refer to our [content release note](/release-notes-csoar/#march-12-2024---content-release).
374
+
* Python version updated. If you experience any issues, refer to our [content release note](#march-12-2024---content-release).
373
375
374
376
##### Cloud SOAR
375
377
* Playbooks: Test feature now permits you to use internal Incident ID.
Copy file name to clipboardExpand all lines: docs/api/search-job.md
+20-6Lines changed: 20 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -343,6 +343,7 @@ This is the formatted result document:
343
343
344
344
```json
345
345
{
346
+
"warning":"",
346
347
"state":"DONE GATHERING RESULTS",
347
348
"messageCount":90,
348
349
"histogramBuckets":[
@@ -356,7 +357,6 @@ This is the formatted result document:
356
357
"count":1,
357
358
"startTimestamp":1359405480000
358
359
},
359
-
...
360
360
{
361
361
"length":60000,
362
362
"count":1,
@@ -367,7 +367,10 @@ This is the formatted result document:
367
367
],
368
368
"pendingWarnings":[
369
369
],
370
-
"recordCount":1
370
+
"recordCount":1,
371
+
"usageDetails":{
372
+
"dataScannedInBytes":0
373
+
}
371
374
}
372
375
```
373
376
@@ -385,12 +388,16 @@ Notice that the state of the sample search job is DONE GATHERING RESULTS. The fo
385
388
386
389
#### More about results
387
390
391
+
The **warnings** value contains the detailed information about the warning while obtaining the current status of a search job.
392
+
388
393
The **messageCount** and **recordCount** values indicate the number of messages and records found or produced so far. Messages are raw log messages and records are aggregated data.
389
394
390
395
For queries that do not contain an aggregation operator, only messages are returned. If the query contains an aggregation, for example, **count by _sourceCategory**, then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return).
391
396
392
397
The **pendingErrors** and **pendingWarnings** values contain any pending error or warning strings that have accumulated since the last time the status was requested.
393
398
399
+
The **usageDetails** value contains the amount of data scanned in bytes details.
400
+
394
401
Errors and warnings are not cumulative. If you need to retain the errors and warnings, store them locally.
395
402
396
403
The **histogramBuckets** value returns a list of histogram buckets. A histogram bucket is defined by its timestamp, which is the start timestamp (in milliseconds) of the bucket, and a length, also in milliseconds, that expressed the width of the bucket. The **timestampplus** length is the end timestamp of the bucket, so the count is the number of messages in the bucket.
The result contains two lists, **fields** and **messages**.
597
605
606
+
****warnings** contains the detailed information about the warning while paging through the messages found by a search job.
598
607
***fields** contains a list of all the fields defined for each of the messages returned. For each field, the field name and field type are returned.
599
608
***messages** contains a list of maps, one map per message. Each **map** maps from the fields described in the fields list to the actual value for the message.
600
609
@@ -666,6 +675,7 @@ This is the formatted result document:
666
675
667
676
```json
668
677
{
678
+
"warning": "",
669
679
"fields":[
670
680
{
671
681
"name":"_sourceCategory",
@@ -691,6 +701,8 @@ This is the formatted result document:
691
701
692
702
The returned document is similar to the one returned for the message paging API. The schema of the records returned is described by the list of fields as part of the fields element. The records themselves are a list of maps.
693
703
704
+
The ***warnings** contains the detailed information about the warning while paging through the records found by a Search Job.
705
+
694
706
</details>
695
707
696
708
## POST Methods
@@ -828,10 +840,12 @@ Example error response:
828
840
829
841
```json
830
842
{
831
-
"status" : 400,
832
-
"id" : "IUUQI-DGH5I-TJ045",
833
-
"code" : "searchjob.invalid.timestamp.from",
834
-
"message" : "The 'from' field contains an invalid time."
843
+
"warning": "A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request",
If you're collecting from a Cisco Umbrella bucket, SNS Subscription Endpoint is not supported. For more information, see important note on using the [Sumo Logic Amazon S3 source for the Cisco-Managed S3 bucket](/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source/#cisco-umbrella)
61
-
:::
59
+
Collection from a Cisco-managed S3 bucket has the following limitations:
60
+
61
+
* AWS versioned APIs are not supported. The **Use AWS versioned APIs** setting on the Source must be disabled.
62
+
* S3 Event Notifications Integration is not supported, so you cannot use an SNS subscription endpoint.
63
+
* Access must be provided with an Access ID and Key. Role-based access is not supported.
64
+
* Use a prefix in the path expression so it doesn't point to the root directory.
65
+
* Ensure that your path expression ends in `/*`. Otherwise, you will get a ListBucket error. For example:
66
+
* Bucket Name: `cisco-managed-us-east-1`
67
+
* Path Expression: `987654321_12e34c..../*`
68
+
62
69
63
70
By having all your logs uploaded to an S3 bucket, you can then download logs automatically to keep in perpetuity in backup storage. Or, ingest the logs through your SIEM or another security tool to determine if any security events in these Umbrella logs coincide with events in other security tools.
64
71
@@ -99,4 +106,4 @@ import AppUpdate from '../../reuse/apps/app-update.md';
99
106
100
107
import AppUninstall from '../../reuse/apps/app-uninstall.md';
Follow the instructions provided to set up [Cloud-to-Cloud Integration for Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Jamf app is properly integrated and configured to collect and analyze your Jamf data.
867
+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
868
868
869
-
## Installing the Jamf app
869
+
<CollectionConfiguration/>
870
870
871
-
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
871
+
:::important
872
+
Use the [Cloud-to-Cloud Integration for Jamf Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/jamf-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Jamf app is properly integrated and configured to collect and analyze your Jamf data.
873
+
:::
874
+
875
+
### Create a new collector and install the app
876
+
877
+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
878
+
879
+
<AppCollectionOPtion1/>
880
+
881
+
### Use an existing collector and install the app
882
+
883
+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
884
+
885
+
<AppCollectionOPtion2/>
886
+
887
+
### Use an existing source and install the app
888
+
889
+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
To set up the [Cloud-to-Cloud Integration for Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/), follow the instructions provided. These instructions will guide you through the process of creating a source using the Symantec Endpoint Security Source category, which you will need to use when installing the app. By following these steps, you can ensure that your Symantec Endpoint Security app is properly integrated and configured to collect and analyze your Symantec Endpoint Security data.
214
+
import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';
215
215
216
-
## Installing the Symantec Endpoint Security app
216
+
<CollectionConfiguration/>
217
217
218
-
import AppInstall2 from '../../reuse/apps/app-install-v2.md';
218
+
:::important
219
+
Use the [Cloud-to-Cloud Integration for Symantec Endpoint Security Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/symantec-endpoint-security-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Symantec Endpoint Security app is properly integrated and configured to collect and analyze your Symantec Endpoint Security data.
220
+
:::
221
+
222
+
### Create a new collector and install the app
223
+
224
+
import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';
225
+
226
+
<AppCollectionOPtion1/>
227
+
228
+
### Use an existing collector and install the app
229
+
230
+
import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';
231
+
232
+
<AppCollectionOPtion2/>
233
+
234
+
### Use an existing source and install the app
235
+
236
+
import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';
219
237
220
-
<AppInstall2/>
238
+
<AppCollectionOPtion3/>
221
239
222
240
## Viewing the Symantec Endpoint Security dashboards
Copy file name to clipboardExpand all lines: docs/manage/content-sharing/index.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ description: Content Sharing allows you to selectively share and collaborate on
6
6
7
7
import useBaseUrl from '@docusaurus/useBaseUrl';
8
8
9
-
Content Sharing allows you to selectively share and collaborate on apps, dashboards, and searches with specific users or roles. As an Admin, you can use content sharing to transfer ownership of searches and dashboards, or to highlight key content to specific users and groups. As a user, you can now choose how widely shared your content is within your Org.
9
+
Content Sharing allows you to selectively share and collaborate on apps, dashboards, and searches with specific users or roles. As an Admin, you can use content sharing to share ownership of searches and dashboards, or to highlight key content to specific users and groups. As a user, you have the flexibility to control how broadly your content is shared within your organization.
10
10
11
11
You can share log searches, metric searches, dashboards, and folders with a user, a role, or combinations of the two. You can edit the sharing permissions at any time and share and revoke as needed from the **Share** dialog:
12
12
@@ -56,15 +56,15 @@ To share content from the left navigation bar or the Library:
Sumo provides a few ways to navigate your content based on what you want to view.
62
62
63
63
import UiElements from '../../reuse/ui-elements.md';
64
64
65
65
<UiElements/>
66
66
67
-
## Available Permission Levels
67
+
## Available permission levels
68
68
69
69
You can share your content with specific users or roles. As a best practice we recommend sharing at the search or dashboard level, or if you want to share a folder, share a subfolder. All contents of the folder are shared, you can’t exclude a particular content item in a folder as private content.
0 commit comments