These Release Notes document security content updates from content package c2010.6 (i55) to c2102.5 (i56).
The security content updates listed below include changes to the following areas:
In the lists below, each item represents a specific parser, model, or rule that has been added, updated, or deprecated. To facilitate finding every data source where the changed content items are referenced, a content library query has been created for each changed parser, model, or rule. To view the results of each query, click on the link for the relevant content item.
-
admanager-activity
-
armis-network-alert
-
armis-security-alert
-
azure-email-notification
-
cef-defender-atp-logon
-
cef-sophos-dlp-alert-1
-
cef-sophos-dlp-alert-10
-
cef-sophos-dlp-alert-11
-
cef-sophos-dlp-alert-12
-
cef-sophos-dlp-alert-3
-
cef-sophos-dlp-alert-4
-
cef-sophos-dlp-alert-5
-
cef-sophos-dlp-alert-9
-
cef-sophos-security-alert-16
-
cef-sophos-security-alert-20
-
cef-sophos-security-alert-21
-
cef-sophos-security-alert-22
-
cef-sophos-security-alert-23
-
cef-sophos-security-alert-24
-
cef-sophos-security-alert-25
-
cef-sophos-security-alert-27
-
cef-sophos-security-alert-28
-
cef-sophos-security-alert-29
-
cef-sophos-security-alert-31
-
cef-sophos-security-alert-9
-
cef-sysmon-file-write-2
-
cisco-wifi-login
-
crowdstrike-file-process-alert
-
mcafee-ips-network-alert-1
-
mimecast-dlp-email
-
s-aws-app-activity
-
s-aws-cloudtrail-activity-access-json
-
s-aws-cloudtrail-activity-delete-json
-
s-aws-cloudtrail-activity-upload-json
-
s-examworkspace-file-read
-
s-windows-event-4611
-
sonicwall-network-alert-10
-
sonicwall-network-alert-11
-
sonicwall-network-alert-12
-
sonicwall-network-alert-13
-
sonicwall-network-alert-14
-
sonicwall-network-alert-15
-
sonicwall-network-alert-16
-
sonicwall-network-alert-17
-
sonicwall-network-alert-18
-
sonicwall-network-alert-19
-
sonicwall-network-alert-5
-
sonicwall-network-alert-6
-
sonicwall-network-alert-7
-
sonicwall-network-alert-8
-
sonicwall-network-alert-9
-
sophos-dlp-alert-2
-
sysmon-registry-set
-
sysmon-registry-set-2
-
A-EPA-CSC – Tracks csc activity for the asset.
-
A-EPA-MSBuild – Tracks MSBuild activity with unknown file arguments
-
A-EPA-REG-WU – Models reg query activity for windows update on the assets.
-
A-EPA-Rundll-FTP – Rundll actions for FTP port blocking/unblocking on the asset
-
A-FW-ProcessName-FileName – File creations for process
-
A-NETFLOW-RDP-DestHost – Asset accessing RDP services.
-
A-NTDS-Access – Models the amount of accesses to paths that are related to NTDS
-
A-PC-InstallUtil-exe – EXE file parameter passed to InstallUtil.exe on the asset.
-
A-PC-MSBuild-Csproj – CSPROJ file parameter passed to MSBuild.exe on the asset in the organization.
-
A-PC-MSBuild-xml – XML file parameter passed to MSBuild.exe on the asset in the organization.
-
A-PC-Mshta-Hta – HTA file parameter passed to Mshta.exe on the asset in the organization.
-
A-PC-ParentName-ProcessName – Processes for parent parent processes.
-
A-PC-Process-Hash – Hashes used to create processes on the asset.
-
A-PC-Regsvr32-sct – SCT file parameter passed to Regsvr32.exe on the asset in the organization.
-
A-SA-AN-ALERT-IOT – Security alert names on IOT/OT devices
-
A-SA-OA-ALERT-IOT – IOT/OT devices triggering security alerts in the organization
-
A-ServiceName-ServiceCmdline – Service Executable Files on the asset
-
B-CS-Bucket-Activity – Activities per storage container/bucket
-
B-CS-Bucket-Bytes – Bytes sent from bucket
-
B-CS-Bucket-UA – User agents per bucket
-
B-CS-Bucket-Users – Users per storage container/bucket
-
B-CS-Buckets – Buckets seen in the organization
-
B-CS-IType – User Identity types per cloud storage container
-
CS-Admin-Activity – Cloud administrative activities performed by user
-
CS-Bucket-C-D – Users who create or delete storage containers
-
CS-Critical-Activities – Users who perform critical IAM activites
-
CS-O-UA – User agents in the organization accessing cloud storage
-
CS-P-UA – User agents accessing cloud storage per peer group
-
CS-Policies – Cloud Policies seen in the organization
-
CS-Storage-Activity – Cloud storage activities for the user
-
CS-Universal-Policy – Users creating universal '*' policies
-
CS-User-Creation – Users who create users/accounts in the cloud
-
CS-Users – Users accessing cloud storage in the org
-
DB-OPCOUNT-NEW – Count of distinct database operations for user
-
DB-OPCOUNT-TOTAL – Count of total database operations for user
-
DB-URSum-New – Sum of response sizes in database queries
-
FA-UA-UI-new – ISP of users during file activity
-
PC-InstallUtil-dll – DLL file parameter passed to Installutil.exe
-
PC-InstallUtil-exe – EXE file parameter passed to Installutil.exe
-
PC-MSBuild-Csproj – CSPROJ file parameter passed to MSBuild.exe
-
PC-MSBuild-xml – XML file parameter passed to MSBuild.exe
-
PC-Mshta-Hta – HTA file parameter passed to Mshta.exe
-
PC-ParentName-ProcessName – Child processes created by a parent process
-
PC-Process-Hash – Hashes used to create processes.
-
PC-Regsvr32-sct – SCT file parameter passed to Regsvr32.exe
-
ParentProcess-P – Parent processes for peer group
-
UA-UI-new – ISP of users during application activity
-
AL-HT-PRIV – Privilege Users Assets
-
APP-AT-PRIV – Privileged application activities
-
APP-ObT-PRIV – Privileged application objects
-
DS-APRIV – Privileged user attributes
-
DS-OA – Non-privileged attributes in the organization
-
DS-UA – Attributes per privileged user
-
EPA-OG-SYSVOL – SYSVOL domain group policy access by group in the organization
-
FA-FT-PRIV – Privileged Folders
-
FA-UR – Number of file accesses from repository by privileged user
-
UA-GC – Countries for peer groups
-
UA-UC – Countries for user activity
-
WEB-UBytesSum-In-FS-PU – Sum of bytes read/downloaded from file sharing sites in a day by privileged user
-
WEB-UBytesSum-In-FS – Sum of bytes read/downloaded from file sharing sites in a day by non-privileged user
There are no deprecated models in this release.
There are no new rules in this release.
There are no updated rules in this release.
There are no deprecated rules in this release.