ADDED: New Content Packs & Features

  • Symantec Proxysg (419)

    Added alert_severity_level mapping based on event_action where applicable.

  • Checkpoint FW (2917)

    Added support for additional vendor_event_action values, including encrypt ， decrypt. Restructured existing vendor fields to better align with log output: vendor_event_outcome is now vendor_event_action; vendor_event_outcome_reason is now vendor_event_action_reason; vendor_event_action is now vendor_event_operation.

  • Bitdefender GravityZone (3059)

    Added support for New Extended Incident logs. Included basic parsing for RPC formatted GravityZone logs for possible future extension via Filebeat testing.

  • Windows Security (2836)

    Added support for status code 0xC0000413 – STATUS_AUTHENTICATION_FIREWALL_DENIED.

  • Microsoft IIS Content Pack (1067)

    New content pack for Microsoft IIS (Internet Information Services), which is used for hosting web applications and services on Windows. Integrates tightly with ASP.NET and Windows Server ecosystem.

  • AWS Kinesis Content Pack (3076)

    New pack for Amazon Kinesis, supporting the parsing and categorization of AWS VPC Flow logs via AWS Kinesis for real-time data streaming and analysis. Future support for other log types may be added.

  • 1password Content Pack (2993)

    New content pack for 1Password logs, supporting the centralized storage and management of credentials, API keys, and sensitive information for improved security and simplified credential management.

  • Cisco Business 350 Series (CBS) (2263)

    New content pack for Cisco Business 350 Series Switches, supporting managed Layer 3 network switches designed for small and medium-sized businesses.

  • F5 BIG-IP (1137)

    Added a Content Pack that supports the AFM and ASM module.

FIXED: Bugs and Issues

  • NetFlow (2851)

    Fixed IPFIX message identification and added support for different set fields.

  • Bitdefender (3115)

    Fixed wrong input name.

  • Cisco ISE (3004)

    Modified base extraction regex to make syslog header info optional, enabling sending to a syslog or raw tcp input.

  • Symantec ProxySG (3125)

    Moved alert_severity_level lookup data to its own .csv to address lookup complaint of duplicate values.

  • Linux Auditbeat (2928)

    Corrected issue mapping vendor_event_type: changed-promiscuous-mode-on-device.

  • Cisco ISE (3019)

    Fixed CmdSet parsing so the full command is returned as vendor_cmdset, dropping CmdAV and CmdArgAV.

  • Bitdefender GravityZone (3007)

    Fixed wrong search path in the New Incidents Count widget.

  • Curated Alerts (2583)

    Improved rule: Illuminate – Windows Security – Active Directory Database Snapshot Via ADExplorer. The detector now covers execution of the 64-bit variant of ADExplorer.

  • Core DNS Processing (2675)

    Fixed filter causing inconsistent results in the dashboard.

CHANGED: Updates and Streamlining

  • NetFlow (3074)

    Changed NetFlow IPv4/IPv6 renames and field types.

  • Cisco IOS (2823)

    Streamlined identification rule logic to be more efficient.

  • PowerShell, Postfix, Meraki, SEPM, Sophos, Sonicwall, Cisco Meraki, Symantec Endpoint (Multiple IDs)

    Converted the use of multiple grok patterns per rule to use multi_grok for efficiency. Also, standardized gim_event_type_code mappings to align with detection categories and reclassified subtypes from alert to detection across multiple packs (e.g., Defender, Snort, Stormshield, Palo Alto, Fortigate, etc.).

  • Palo Alto (2824)

    Renamed spotlight title.

  • Schema (1940)

    Modified index templates to copy hash related fields (e.g., hash_md5, file_hash_) to associated_hash. This provides additional context to hash objects.

  • Palo Alto 11 (687)

    Updated colors for widgets that reference event_action to reflect schema.

  • AWS Security Lake (2314)

    Changed gim_event_category from alert to detection. The dashboard now supports both categories.

  • Bitdefender Telemetry (2950)

    Changed GIM codes for network events from 129999 (default) to 120200 (open) and 120300 (close).

  • Illuminate Core (3008)

    Disabled dynamic date detection for all Illuminate indices to fix mapping errors caused by inconsistent field formats.

  • Zeek (2618)

    Changed DNS request categorization to exclude NBSTAT.

  • Core (1711)

    Added support for MITRE ATT&CK Enterprise attacks_technique_uid & attacks_tactic_uid string values.

REMOVED / DEPRECATED Content

  • o365 (2957)

    Removed redundant type assignment in 22-o365_scc_categorize_alerts rule.

  • Bitdefender GravityZone (3058)

    Removed a possible leading forward slash for the source field (fixes issue when hostname is empty).

  • Compliance Content (2959)

    Removed deprecated ‘Compliance Content Spotlight (Deprecated)’ spotlight.

  • Palo Alto 9.1x (2716)

    DEPRECATED: The Palo Alto 9.1x Spotlight and associated processing content have been deprecated. Users should transition to the Palo Alto 11 Content Pack.

關於 Graylog 

Graylog 通過完整的 SIEM、企業日誌管理和 API 安全解決方案，提升公司企業網絡安全能力。Graylog 集中監控攻擊面並進行深入調查，提供卓越的威脅檢測和事件回應。公司獨特結合 AI / ML 技術、先進的分析和直觀的設計，簡化了網絡安全操作。與競爭對手複雜且昂貴的設置不同，Graylog 提供強大且經濟實惠的解決方案，幫助公司企業輕鬆應對安全挑戰。Graylog 成立於德國漢堡，目前總部位於美國休斯頓，服務覆蓋超過 180 個國家。

關於 Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。
透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區，客戶來自各行各業，包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。