Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion blog-cse/2024/12-31.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

This is an archive of 2024 Cloud SIEM release notes. To view the full archive, [click here](/release-notes-cse/archive).

<!--truncate-->

---
### December 20, 2024 - Content Release

Expand Down Expand Up @@ -852,7 +854,7 @@ Other changes are enumerated below.

This release reverts a change to our AWS CloudTrail default (catch all) mapper for how `user_username` is mapped. This is being reverted due to reports of breaking rule tuning and missing user context for some `AssumedRole` events.

AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](/release-notes-cse/#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.
AWS `AssumedRole` events can contain service and user role assumptions. Oftentimes service role assumptions will contain a dynamic session identifier instead of a static user identifer which contains the originating identity. Prior to the change we are now reverting, this was causing certain services to generate user entities from these sessions, creating false positives. This behavior changed with the [August 5th, 2024 content release](#august-5-2024---content-release) to handle role assumptions to instead map the role as user to prevent false positives from dynamic service sessions. While this decreased the number of false positives from dynamic service sessions, it also eliminated visibility into user role assumptions, creating potential for false negatives.

AWS best practices suggest defining `sourceIdentity` to allow for the originating user for a role assumption to be identifiable. This is the best path to avoid false positive generation, as our mapper will favor `sourceIdentity` if it is present in CloudTrail logs. If it is not present, then `userIdentity.arn` will be used and the `resource-id` will be mapped to `user_username`, creating potential for false positives from dynamic session identifiers. See [Viewing source identity in CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-ct) in the AWS documentation for more information.

Expand Down
14 changes: 13 additions & 1 deletion blog-cse/2025/01-14.md → blog-cse/2025-01-14-content.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,16 @@
### January 14, 2025 - Content Release
---
title: January 14, 2025 - Content Release
image: https://help.sumologic.com/img/sumo-square.png
keywords:
- rules
- log mappers
- parsers
hide_table_of_contents: true
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<a href="https://help.sumologic.com/release-notes-cse/rss.xml"><img src={useBaseUrl('img/release-notes/rss-orange2.png')} alt="icon" width="50"/></a>

This content release includes:
- Parsing and mapping support for Azure DevOps Auditing via EventHubs, and Pfsense Firewall.
Expand Down
6 changes: 4 additions & 2 deletions blog-csoar/2024/12-31.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

This is an archive of 2024 Cloud SOAR release notes. To view the full archive, [click here](/release-notes-csoar/archive).

<!--truncate-->

---
### December 31, 2024 - Application Update

Expand Down Expand Up @@ -312,7 +314,7 @@ This release introduces three new integrations, as well as several updates.
---
### March 12, 2024 - Content Release

Our Cloud SOAR [application update](/release-notes-csoar/#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.
Our Cloud SOAR [application update](#march-12-2024---application-update) features an important upgrade to Python 3.12 for our Lambda functions. This enhancement is part of our ongoing commitment to security, performance, and the latest technological standards.

The Python upgrade impacts a total of 38 integrations. These integrations will require updates to ensure compatibility with the new Python version.

Expand Down Expand Up @@ -369,7 +371,7 @@ We strongly encourage all users to review the provided documentation and prepare
### March 12, 2024 - Application Update

#### Changes and Enhancements
* Python version updated. If you experience any issues, refer to our [content release note](/release-notes-csoar/#march-12-2024---content-release).
* Python version updated. If you experience any issues, refer to our [content release note](#march-12-2024---content-release).

##### Cloud SOAR
* Playbooks: Test feature now permits you to use internal Incident ID.
Expand Down
Loading