ASIM Authentication Parser: Enhanced SSH Authentication Method Detection
SSH authentication parser now accurately identifies logon methods (password, PKI, PAM) and adds improved field mappings for better authentication visibility. Read More →
ASIM
ASIM NetworkSession Parser: Critical IP Address Mapping Fix for Azure NSG Flow Data
Azure NTANetAnalytics parser now correctly maps source and destination IP addresses from PublicIPs fields when primary IP fields are empty, closing a data fidelity blind spot. Read More →
Fortigate ASIM Parser: Field Name Consistency Fix for Network Session Schema
Field name inconsistencies in Fortigate ASIM parsers corrected to ensure proper schema compliance and data normalization. Read More →
ASIM WebSession Parser: Fixed Broken Azure Firewall Template Reference
Corrected case-sensitive path reference that was preventing Azure Firewall WebSession parser deployment. Read More →
Azure Firewall ASIM Parsers: Enhanced Detection Coverage for Six New Log Types
New ASIM normalisation parsers added for six Azure Firewall log tables, expanding detection coverage for network sessions, DNS queries, and web traffic analysis. Read More →
Solutions Analyzer Tool: Automated Connector Documentation Generation
Solutions Analyzer tool enhanced to generate markdown documentation files for all 1000+ connectors in addition to CSV output. Read More →
Google Threat Intelligence: Enhanced Threat Hunting with MITRE ATT&CK Integration
Updated threat hunting rules add MITRE ATT&CK mappings and fix parser function calls for improved threat detection coverage. Read More →
ASIM Authentication Parsers: Hostname Resolution and Alias Fixes
Fixes SrcHostname resolution logic and IpAddr aliases in Microsoft Windows Event and SSH authentication parsers. Read More →
Microsoft 365 Defender ASIM: Fixed Field Compatibility Issue in Authentication Parsers
M365 Defender authentication parsers updated to handle optional _ItemId field, resolving parser failures in some client environments. Read More →
Salesforce Service Cloud Connector: Column Name Bug Fix Plus Multi-Solution Updates
Fixed critical column name mapping bug in Salesforce Service Cloud CCF connector preventing proper data ingestion. Read More →
Open Systems Solution: New Multi-Product Security Platform with ASIM Parsers
New Open Systems solution enables ingestion from multiple security products via Logstash with ASIM parsers for authentication, firewall, and proxy logs. Read More →
Zscaler ZIA ASIM Parser: Device Model Field Parsing Fix Restores Visibility
ASIM WebSession parser for Zscaler ZIA corrected devicemodel parsing logic that was preventing proper device categorization. Read More →
Business Email Compromise: Fixed Alert Display Variable Reference
Corrected alert display format to use correct variable name CountOfDocs instead of non-existent number_of_files_accessed. Read More →
VirtualMetric DataStream Solution: New Multi-Path Data Ingestion Platform for Sentinel
New VirtualMetric DataStream solution provides comprehensive data ingestion capabilities with ASIM support and multiple deployment options for Sentinel and data lake environments. Read More →
Threat Intelligence DNS Detection: Alert Description Field Mapping Fix Enables Threat Context
Threat Intelligence imDns_IPEntity_DnsEvents rule updated to fix alert description field mapping from non-existent Type to ThreatType, restoring threat classification in DNS alerts. Read More →
Threat Intelligence Detection: Alert Description Field Mapping Fix Restores Dynamic Content
Threat Intelligence DomainEntity_imWebSession rule updated to fix alert description field mapping, replacing non-existent Type field with ThreatType for proper alert context. Read More →
Zscaler Private Access Parser: Enhanced Field Coverage Improves Network Session Visibility
ZPAEvent parser updated to version 1.0.3 with additional fields for SessionID, IPProtocol, and ClientCountryCode, improving zero-trust network monitoring capabilities. Read More →