If you're having trouble at any stage please contact us at support@skyformation.com.
Preface
The below table details the SkyFormation app changes per release (aka release notes).
Cloud Connectors (formally SkyFormation) Release Notes
Version: 2.5.257 (September 14 2021)
| Fixes | |
| SentinelOne | Added configuration per data source to specify whether to send both update and creation events or only creation events. |
| Snowflake | Enabled the cloud connector to specify the source of the event per table/view, such that downstream parsers can correctly extract information. |
| Armis | Fixed an issue where responses of events from Armis with malformed timestamp causes sync errors. |
Version: 2.5.254 (September 12 2021)
| Fixes | |
| Okta | Fixed an issue with the sync logic to optimize API utilization. With this fix, environments with heavy volume now see a drop of 90% in the number of API calls and maintain no lag in data retrieval. |
Version: 2.5.253 (August 31 2021)
| Fixes | |
| AWS - CloudWatch Logs |
Changed exported report object deleting logic from S3 buckets. Now deleting an object after finished to iterate it successfully. |
| Shared Libraries |
Fixed an unclosed iterator in the MultiClosableReadOnlyIterator class. |
Version: 2.5.252 (August 18 2021)
| Fixes | |
| Custom Connector & Crowdstrike FDR |
Add support for Gov cloud backend in AWS |
| Armis |
Add retry mechanism to overcome frequent API errors |
| Tomcat (UI Server service) |
Upgrade to Tomcat version 8.5.70 to include all latest fixes and CVEs fixes |
Version: 2.5.246 (August 16 2021)
| Fixes | |
| AWS - GuardDuty |
Correctly handle sync failures to resume at correct position. Minor |
| Tomcat (UI) container |
Don't expose any server details on port 8445 |
Version: 2.5.245 (August 12 2021)
| Enhancements | |
| AWS - all dynamic endpoints |
Allow discovery of only part of the regions (while some do not have permissions) |
| AWS - GuardDuty |
Use alerts' updated time as the event's timestamp |
| Armis |
Handle undocumented timestamp formats (seen in the wild) |
Version: 2.5.243 (August 9 2021)
| Enhancements | |
| Office365 - Graph Directory Audit logs / Graph Sign-In logs |
Allow the user to use the beta graph API rather than the default v1.0 |
| AWS - CloudWatch Logs |
Allow discovery of only part of the regions (while some do not have permissions) |
Version: 2.5.236 (July 21 2021)
| Enhancements | |
| Tenable.io |
Fix connector response to failure due to 429(Too Many Requests) |
Version: 2.5.235 (July 19 2021)
| Enhancements | |
| Cisco Umbrella connector |
Code changed to prevent skipping files written in the same 10min time window |
Version: 2.5.234 (July 15 2021)
| Enhancements | |
| Netskope connector |
Add 2 optional filter fields to allows users to filter Alerts such that only matching alerts will be ingested. The filter is via Netskope query language, and a type. See the Netskope documetation for additional info: https://support.skyformation.com/hc/en-us/articles/360013524013-Adding-Netskope-Connector-to-SkyFormation-platform |
| All connectors with Dynamic endpoints | Change to report directly to SIEM without buffering in local storage. Fixed issue where connectors with many dynamic endpoints overwhelmed the buffer |
Version: 2.5.231 (July 4 2021)
| Fixes | |
| ETCD | Increase the maximum configuration size that can be fetched from the ETCD service to 5MB to support accounts with large configuration sizes (usually a lot of endpoints). |
Version: 2.5.230 (July 4 2021)
| Fixes | |
| SentinelOne - DeepVisibility- Log Data Enrichment |
SentinelOne Deep Visibility endpoint has been enhanced to include the event metadata in addition to the event itself, and to provide 3 new fields: Destination Hostname, OS and User Agent. |
| Kafka Connector |
Fix a potential resource leakage and bug fixes. |
Version: 2.5.228 (June 13 2021)
| Fixes | |
| SentinelOne - DeepVisibility - revert raw data format |
Revert the raw data format back to the 'encoded' protobuf (revert parsing change introduced in 2.5.216) |
| Armis - fix a potential resource leakage |
Fix a potential resource leakage |
Version: 2.5.225 (June 9 2021)
| Fixes | |
| SentinelOne - DeepVisibility - fix Kafka record value type |
Kafka record type was casted to Event rather than be casted to Packet |
| Tomcat (frontend service microservice) update to 8.5.66 |
Upgrade Tomcat version from 8.5.51 to 8.5.66 to resolve some CVEs |
Version: 2.5.222 (June 3 2021)
| Fixes | |
| SentinelOne - DeepVisibility - fix UnsupportedOperationException |
Fix UnsupportedOperationException regression introduced in 2.5.216 |
| SentinelOne - Deep Visibility and GCP PubSub - improve performace | Send SYSLOG over multiple concurrent TCP connections in a single sync. This change was made to increase EPS when the SYSLOG receiver can't process high EPS via a single connection |
Version: 2.5.219 (May 31 2021)
| Fixes | |
| Salesforce - fix serialization and deserialization of custom settings |
Fix custom settings serialization and deserialization |
| Custom Connector - Kafka Datasource - fix NPE in test connection |
Fix NullPointerException in test connection of Custom connector - Kafka datasource |
Version: 2.5.216 (May 27 2021)
| Fixes | |
| Proofpoint - Log API - fix failed status when sync 'uses' its entire allowed sync time |
Fixing CancellationException error message in the endpoint status |
| Custom Connector - Kafka Datasource and SentinelOne - Deep Visibility - performance optimization |
Switch to from sync to async, use a single concurrent connector with multiple Kafka consumers rather than multiple concurrent connectors, in SentinelOne - send raw data as decoded json (with human readable property names) instead of sending the encoded protobuf json Important - still have two minor bugs in Custom Connector - Kafka Datasource
|
| AWS Connector - CloudTrail - fix parsing session context |
Session issuer was put by mistake under sessionContext instead of sessionIssuer |
| Task Management - fix updating task definition following a sync strategy change |
In 2.5.201 a sync strategy change of Office365 - exchange-admin-reports-mail-detail-* endpoints was applied. Without this fix, sync strategy change can't be applied to already existing definitions |
Version: 2.5.209 (May 5 2021)
| Fixes | |
| AWS Connector - fix missing attributes in raw event of CloudTrail |
A regression introduced in v2.5.93 where some attributes of the raw event of CloudTrail were not present in the output event cs6 CEF field |
| Armis Cloud Connector |
New Armis Cloud Connector. Documentation and onboarding guide |
Version: 2.5.206 (May 3 2021)
| Fixes | |
| Custom Connector - Kafka Datasource - fix "missing username" error |
Fix Kafka datasource as part of the custom connector |
| Cybereason - fix request body |
Requests to GET MALOPS (https://nest.cybereason.com/documentation/api-documentation/all-versions/get-malops) - set templateContext to be OVERVIEW instead of FULL (which returned a server error) |
| UI Client - improve performance | Make UI client more robust when list of connectors and/or endpoints is long (over 200) |
Version: 2.5.201 (April 27 2021)
| Fixes | |
| Office365 - exchange-admin-reports-mail-detail-* - change sync strategy from time range to cursor |
In order to be able to pull events as soon as they are available and given that the events availability delay from Office365 side can be up to 24hrs, the sync strategy of the following endpoints has changed from a time range to a cursor:
|
| GCP Pub/Sub - send not ack in test connection | Send not acked in test connection and in case of failure. Add ilstener to failures and log |
Version: 2.5.192 (April 24 2021)
| Fixes | |
| Server - fix general code for async events pull | Change is-alive check during async events pull to block and prevent thread leakage |
| GCP Pub/Sub - send not ack in test connection | Send not acked in test connection and in case of failure. Add ilstener to failures and log |
| Prometheus - public port closed |
Do not expose the metrics service app externall. Used to be open on port 9090 |
| Enhancements | |
| HSTS enabled |
Enable HSTS (info) by default on the client. Applies to new installations only. Upgrades need to enable manually |
Version: 2.5.187 (April 13 2021)
| Fixes | |
| Azure - EventHubs - isolate EventHubs discovery for each of the discovered subscription | Prevent failure in EventHubs discovery for one of the subscriptions to fail EventHubs discovery in other subscriptions |
Version: 2.5.186 (April 13 2021)
| Fixes | |
| Azure - EventHub - extend session timeout | Extend session timeout to 60 sec to avoid rebalance errors |
| AWS - CloudTrail - apply API rate limit | Apply API rate limit of 1 call per second |
| Azure - OMS Workspace - reduce default max sync period | Reduce default max sync period from 10 to 1 min |
| Tenable - fix NullPointerException | Fix possible NPE in persona an goups sync |
| General - optimized number of Kafka topics | Avoid creating Kafka topics for internal endpoints which bring no data |
Version: 2.5.160 (Mar 19 2021)
| Fixes | |
| Internal regression |
Regression introduced in 2.5.157 had frozen accounts and prevented regular syncs, now resolved |
Version: 2.5.157 (Mar 17 2021)
NO LONGER AVAILABLE DUE TO REGRESSION; 2.5.160 contains the below features
| Enhancements / New Features | |
| Resource allocation service |
A system-internal microservice that learns that resource requirements of each connector and automatically balances the system resources between the connectors |
| Fixes | |
| Office 365 - MCAS |
Prevent data duplication in data retrieval |
Version: 2.5.152 (Mar 9 2021)
| Fixes | |
| GCP - Change default state of auto discovered Stackdriver endpoints from active to non active | New discovered Stackdriver endpoint will be added from now on as a non active endpoint |
| Enhancements / New Features | |
| Google Cloud Pub/Sub Connector | Allow the user to sync Pub/Sub messages given a project ID, a subscription ID and a service account JSON key with the proper permissions |
| Resource Allocation Micro Service |
The objective of the service is to try to adjust how threads are allocated amongst the connectors running on the CC instance. Please refer to Resource Allocation Preview for further explanation |
Version: 2.5.139 (Feb 24 2021)
| Fixes | |
| Cloudflare - Remove deprecated Fireall Events endpoints |
Firewall events endpoints have been deprecated and are no longer supported by Cloudflare |
| GCP - Fix status for Stackdriver - Sinks Explorer | Partial success in discovering project's sinks are now considered as a successful |
| AWS CloudWatch Logs - Separate to 3 distinct endpoints |
The CloudWatch Logs endpoint has been split to 3 different endpoints, all 3 endpoints must be active in order to pull data. Please refer to the CWL setup guide for further explanation |
Version: 2.5.134 (Feb 16 2021)
| Fixes | |
| Symantec SEP Mobile - Fix API POST |
Fix API call to /organizations/<org-id>/security_events/store_security_events that in some organization resulted in 411 error |
| Code42 - Fix - add support to regions other than the US default | Allow the user to select one of the following regions
|
| Egnyte - Fix - add an optional client-secret | When a client secret is provided with the API key it is required for authentication |
Version: 2.5.130 (Feb 13 2021)
| Fixes | |
| Egnyte - add optional client-secret authentication property |
Egnyte customer when creating an application key is now getting also a client-secret If such a client secret was generated it is a mandatory paramter for token request |
| ETCD Settings - Fix persistency of CefTransformationSettings | For customers who customized the content of their CEF events - please upgrade |
Version: 2.5.128 (Feb 09 2021)
| Fixes | |
| Proofpoint - Fix API throttling in SIEM endpoint |
API calls were not throttled |
| CrowdStrike - Fix streaming endpoint - prevent thread leakage | CrowdStrike client was not properly closed. In extreame senarios when connector was frequently restarted threads pools were left open |
| AWS - Fix CloudWatch endpoints - close export tasks upon error |
In case an exception was thrown during an export task, the task must be closed to prevent the next export task from exceeding the limit of a single concurrent export task allowed |
Version: 2.5.126 (Feb 03 2021)
| Fixes | |
| Custom Application Connector - Fix regression in Azure backend |
When Custom connector was used to pull data from Azure Storage it produced an error; regression was introduced between 2.5.66 - 2.5.120 |
| Client - mitigate XSS | Some fields in the account settings used to render html content w/o proper escaping |
| Enhancements / New Features | |
| Snowflake - internal enhancements to make the integration more robust |
Also prevents data duplication. Users of the Snowflake integration are advised to upgrade |
Version: 2.5.120 (Jan 12 2021)
| Enhancements | |
| Palo Alto Aperture - support EMEA and APAC | Till now the Aperture connector only supported the United States region. |
| Fixes | |
| Enhancements / New Features | |
| Proofpoint connector - new data source |
Proofpoint on Demand (PoD)'s LogAPI data source, which brings detailed log of exchange activity. In Preview - parsers/content for this data source is not yet available |
Version: 2.5.118 (Jan 6 2021)
| Enhancements | |
| Fixes | |
| SIEM Consumer - Use a single group ID for health information queries triggered by Prometheus, try to avoid failure to fetch metadata by the consumer |
https://docs.google.com/document/d/13LLYGbNiTXzhAkD9gIV0nE83jQdlQzwuXIeuMyOBRfI/edit?usp=sharing |
Version: 2.5.116 (Dec 28 2020)
| Enhancements | |
|
AWS - endpoints of type "CloudWatch Events (via SQS)" now run periodically, and poll until the SQS queue is empty or 10min. timeout |
|
| GCP - search for sinks to pull from in all reachable GCP projects (vs. only in the project where the service account is configured) | Requires CloudResource Manager to be enabled; enable per project via: https://console.developers.google.com/apis/api/cloudresourcemanager.googleapis.com/overview?project=PROJECT_ID_HERE |
| Fixes | |
| Aperture - Test connection now reflects any underlying errors (if any) |
|
| Workday - when a http proxy is used then use correct port (i.e. not fallback to 443) |
Version: 2.5.115 (Dec 14 2020)
| Fixes | |
|
dependency collision fix with aws sdk |
applicable to all connectors using AWS backend |
| audit log addition | CC audit log can now be found in the logs directory , the file name is auditlog.log |
| thread leak in AWS redshift fix |
Version: 2.5.112 (Dec 8 2020)
| Fixes | |
|
ETCD Client bug fixes |
If you are on version 2.5.106 OR 2.5.110 please upgrade to this release or later (2.5.112) |
|
LDAP integration settings - remove redundant attributes from UI screen |
|
Version: 2.5.110 (Dec 6 2020)
| Fixes | |
|
ETCD - new client |
|
| Infra - invalidate caches on credentials change so that credentials change take immediate effect |
Version: 2.5.107 (Dec 2 2020)
| Fixes | |
|
ETCD - fix bug in ETCD's client retry mechanism |
|
| AWS MT - properly ignore and delete S3 test message from SQS |
Version: 2.5.106 (Nov 29 2020)
| Fixes | |
| Office365 + Azure : fix regression in certificate authentication | |
|
Github - basic authentication removed |
|
| ETCD - Add timeout and retry mechanism for ETCD server requests | |
| Kafka - upgrade to 2.6.0 | |
| zookeeper - upgrade to 3.5.8 |
Version: 2.5.98 (Nov 18 2020)
| Fixes | |
|
GCP connector - use new SDK; resolves issue of DEADLINE_EXCEEDED |
Critical for GCP users |
|
Enhancements / New Features |
|
|
New Prometheus metrics that monitor CPU and disk usage |
On-prem only |
Version: 2.5.93 (Nov 16 2020)
| Enhancements / New Features | |
| Snowflake augmentation and cloud connector | |
| Tomcat security enhancements |
SSL - support version 1.2 or later Do not show tomcat information on failure |
| Configuration of LDAP/AD integration for authenticating to CC UI is now available via the UI |
Configure Active Directory Authentication See advanced-->LDAP/AD tab |
|
New source - VMware carbon black threat hunter (Cloud Enterprise EDR) - EARLY ACCESS If you wish to add this source, please contact support. |
Version: 2.5.92 (Nov 12 2020)
| Fixes | |
| Cloudflare connector : add a new endpoint "Firewall Activity Log" which replaces the deprecated "Firewall Events" endpoint. | See https://support.skyformation.com/hc/en-us/articles/360017477139 for details. |
Version: 2.5.86 (Oct 26 2020)
| Fixes | |
| Azure connector: Eventhub - fix event duplication, memory and resource leaks; requires minimum level of Eventhub of "Standard", as we use the capability accessing EH as Kafka consumers | |
| Remove the Console/Audit panel from the CC UI |
Version: 2.5.77 (Oct 15 2020)
| Fixes | |
| Office365 connector - endpooints exchange-admin-reports-mail-detail-spam exchange-admin-reports-mail-detail-malware exchange-admin-reports-mail-detail-dlp-policy Initial sync time changed from 1 day to 2 days to avoid possible deadlock |
|
| Mimecast connector - better handling of invalid domain names | |
Version: 2.5.72 (Oct 4 2020)
| Fixes | |
| Okta connector - always send "Exabeam" user agent in api call | |
| Gsuite connector - fix test connection | |
| AWS MT connector - performance improvements |
Version: 2.5.66 (Sep 23 2020)
| Fixes | |
| Code42 connector : fetch events by insertion time in order not to miss any event per Code42 team reccomendation | |
| SymantecWss connector - increase polling interval to make the time delta smaller, Also fix edge case of disk space leak | |
|
Azure - EventHub - fix resources leak occurring when multiple EHs are run in heavy load |
Version: 2.5.60 (Sep 16 2020)
| Fixes | |
| Crowdstrike FDR connector: properly handle unparsable events coming from crowdstrike | |
| Custom connector (Azure backend): fix task deletion logic which prevented new events to be synced | |
|
AWS connector: decrease the amount of threads and cache threads for large amount of accounts |
Version: 2.5.55 (Sep 8 2020)
| Fixes | |
| GCP connector : 1) Adapt to new SDK which fixed Goggle's API break 2) Process the event body to be a readable Json |
|
| Infrastruacture: Fix starvation in task management which caused delays in synchronization of some endpoints |
Version: 2.5.50 (Sep 3 2020)
| Fixes | |
| Code42 Connector : fix "400 Bad Request" error - connector stops working after several hours | |
| AWS: fix resource leak | |
| General: add saftey mechanism to remove stale resources |
Version: 2.5.49 (August 27 2020)
| Fixes | |
| Custom Connector (Azure Storage), Cisco Umbrella Connector, CrowdStrike Connector : fix failure to test connection | SFRuntimeException: Failed to get task owner for account [dummy-account-id], data management not found |
| Office365 Connector : fix false positive "failed logins" in Sign in logs |
Version: 2.5.48 (August 26 2020)
| Fixes | |
| Mimecast connector : fix users enrichment | Before the fix, even if one domain was returned incorrectly from mimecast, all users syncs stopped and reported failures. With the fix the wrong domain is ignored and the rest continue. |
| Enhancements / New features | |
| Infrastructure change: health reports are now sent via nats messaging service and not kafka (no impact) |
Version: 2.5.47 (August 10 2020)
| Fixes | |
| Slack connector: critical fix - fix duplicated events |
Version: 2.5.46 (August 9 2020)
| Fixes | |
| Duo connector - add api throttling support | |
| Enhancements / New features | |
| New connector - code42 |
Cloud Connector guide: overview configuration Parsers: Code42_ContentDoc |
Version: 2.5.42 (August 5 2020)
| Fixes | |
| AWS connector - fix resource leak in error flow of cloudwatch alarms | Highly recommended if you have multiple AWS accounts |
| Enhancements / New features | |
| Gsuite connector (Google Apps) -
Gmail Logs - optimize query processing costs, query only relevant daily tables |
Version: 2.5.34 (July 29 2020)
| Fixes | |
| CloudFlare connector - fix the issue where cs6 (raw event) was not sent to AA/DL so parsers did not work correctly |
Version: 2.5.33 (July 22 2020)
| Fixes | |
| SymantecWss connector - performance improvement and other fixes to remove duplicate events | |
| CloudFlare connector - Bug fix: in case of multiple zones, failure in one endpoint mistakenly affected other endpoints. | |
| Migration improvements: introduced a UI button to export/import the account configuration + an automated script to perform the entire procedure automatically |
Version: 2.5.30 (July 6 2020)
| Fixes | |
| Critical : Fixed resource leak in task management cache which may cause event duplication and in rare cases also endpoint starvation. | The issue was introduced in 2.5.27. If you are on this version, please update. |
| Cylance Connector - fix "400 - bad request" error |
Version: 2.5.27 (June 30 2020)
| Enhancements / New Features | |
|
Performance Improvement: - Introduce Task Management Caching - For Multi-Tenant deployments introduce db per tenant |
|
| Fixes | |
| Critical : Fixed resource leak in health reporting which consumes CPU resources up to 100% | The issue was introduced in 2.4.264. If you are in this release or higher, please update. |
| Office365 connector - audit API returned unexpected new value that caused processing to stop and events were not received | |
| GCP connector - client used for detecting sinks for dynamic e.p. was prematurely closed causing an error and no events received | |
| Slack connector - introduce api throttling to adhere to rate limitation by slack | |
| Gsuite connector - fix GMailLogs null pointer exception | |
| SymantecWss - change decompression technology to adjust to new compression by Wss | Critical for SymantecWss users |
| SentinelOne deep visibility endpoint - tune consumer parameters and fix commit error |
Version: 2.5.0 (June 9 2020)
| Enhancements / New Features | |
| Infrastructure change : move configuration data from zookeeper to etcd | |
|
Zoom connector - added support for oauth type authentication |
|
| Fixes | |
|
Office365 connector - management-exchange endpoint - fix regression where message type (mapped to CEF fileType field) was detected by parent folder full match, instead of prefix |
|
| Gsuite connector - fix null pointer exception in GMailLogs endpoint | |
| Cylance connector - fix handling of empty response from Cylance + add debug information to further debug the issue |
Version: 2.4.264 (May 22 2020)
| Enhancements / New Features | |
| Azure connector EventHub endpoint - Improve the data ingestion EPS rate in more then 5X | Could ingest high rate EPS environments with 25K EPS and above |
| Crowdstrike connector - Support the new API gateway | |
| AWS connector - Improve the errors' readability, sent to the webapp's user | |
| Slack connector - Changed the default "past sync time" value to | |
|
New event metrics sent to the SkyFormation health monitor cloud service at report.skyformation.net:
|
See: https://support.skyformation.com/hc/en-us/articles/115000591005-SkyFormation-Cloud-Endpoints For more information on the events details and structure.
|
| Fixes | |
Version: 2.4.259 (May 6 2020)
| Enhancements / New Features | |
| New connector - Zoom connector | |
| New endpoint - Azure connector - Support Graph Security Alerts endpoint | |
| New endpoint - SentinelOne connector - Support deep visibility endpoint | |
| Azure connector Eventhub endpoint - Add support for national clouds | |
| Azure connector Log Analytics endpoint - Improve ingestion speed, reduce memory footprint | |
| Azure connector Eventhub endpoint - Improve ingestion speed | |
| Fixes | |
| Azure connector Log Analytics endpoint - Collect events from partial response/disconnects | |
| Office 365 connector,Activity Management endpoints - Fallback on invalid/unknown events to still generate audit event with some significant fields | |
| Proofpoint connector - Rate limiting. Align the request throttling with the Proofpoint docs | Throttling policy - 1 API call/ min |
Version: 2.4.248 (Apr 27 2020)
| Fixes | |
|
Azure connector - Dynamic endpoints with errors disappear from connector |
e.g. Log An analytics |
|
CloudFlare connector - Out of memory |
|
|
Mimecast connector - Timeout extended to 10 minutes (from 2) |
|
|
Custom connector - Improve performance where AWS S3/SQS in use |
|
| Sale cloud connector EventLogFile endpoint - Separate the events into multiple endpoints per event type generated in the account | see: https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_eventlogfile_supportedeventtypes.htm |
Version: 2.4.244 (Apr 21 2020)
| Fixes | |
| Azure connector - Memory leaks | |
| Crowdstrike connector - Date parsing |
Version: 2.4.236 (Apr 13 2020)
| Enhancements / New Features | |
| Changes internal metrics monitoring system. | Information is available at http://localhost:8089 instead of http://localhost:9090 |
Version: 2.4.235 (Mar 29 2020)
| Enhancements / New Features | |
| Azure connector Log Analytics endpoint - Add the option to provide a filter query (Default is no filter). | |
| Fixes | |
| Cylance connector - Fix the 2.4.233 Cylance fix | |
| Symantec Wss connector - Unlicensed certificate will no longer be classified as a security threat as it appears in a very large portion of the events. |
Version: 2.4.233 (Mar 25 2020)
| Enhancements / New Features | |
| Cylance connector - Support new endpoint “Memory Protection” | |
| AWS MT connector - Support non default S3 region | |
| Fixes | |
| Cylance connector - Critical fix in the events retrieval mechanism |
Version: 2.4.232 (Mar 23 2020)
| Fixes | |
| Azure connector - Ensure uniqueness in Storage Accounts cache to prevent memory bloat | |
| Azure connector eventhubs endpoint - Memory bloat due to incorrect in-memory data store use | |
| Office 365 connector - Improve handling of errors due to API throttling | |
| AWS connector - Allow use of China regions use of STS authn |
Version: 2.4.230 (Mar 15 2020)
| Fixes | |
| * Critical fix in entire connectors * - A regression causing all failures of all types to be translated to “task timed out”. |
The regression was entered to release 2.4.226. Please upgrade to the latest version in case you are using version |
| Office 365 connector - Remove deprecated graph identity protection endpoints | See: https://developer.microsoft.com/en-us/office/blogs/deprecatation-of-the-identityriskevents-api/ |
| Salesforce connector - Fix EmailMessage processing |
Version: 2.4.224 (Feb 24 2020)
| Enhancements / New Features | |
| New connector - Ping |
Connector's overview page: https://support.skyformation.com/hc/en-us/articles/360011689220-Exabeam-Cloud-Connector-for-Ping Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Workday |
Connector's overview page: Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Cloudflare |
Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| GCP connector - Allow collection of events from global sink | |
| Platform - Add to the webapp next to the connector/account settings raw a link to the connector's guide | |
| Fixes | |
| Custom connector - Azure backend - handle explicitly error of failure to read blob while it is being written to | |
| Crowdstrike connector - Reduce the period of time where the connector attempt to recover lost events in queue. | |
| Azure connector - Pull events in iterations from eventhub |
|
| Crowdstrike connector - Recover the log collection cursor on crash to the last cursor position. |
|
| Azure connector - Delete downloaded data blob if no advance in data pull |
Version: 2.4.206 (Jan 22 2020)
| Enhancements / New Features | Notes |
| New Exabeam AA/LMS parser for Cybereason cloud connector |
The CloudConnector is available since SkyFormation 2.4.194 (see below). This is only an indication that the Exabeam parser for the cloud connector is now available for download in here: |
| Entire connectors - Manual connector's sync reset |
Using the webapp you could now reset a connector's (aka account) sync history and cause the connector to start its sync attempts as if it was just onboarded (ignore sync history tasks). The sync reset is also available in a more granular endpoint level (not the entire connector's endpoints). This action should be used with care because it might bring duplicated events for time slots already synced pre reset in case they did. For example in a case where the connector already synced the entire events up until 3 hours and the reset button will be used, if the specific connector's settings is to start events sync from the previous 24 hours the entire events from 24 to 3 previous hours will be synced again (if re-sync supported by the connector) hence duplicated events result . Consult with us for more information. |
| New cloud connector - Fidelis |
Please see: https://support.skyformation.com/hc/en-us/articles/360011429839-Adding-Fidelis-Cloud-Connector for onboarding instructions.
Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| General - Support encrypted AD user info in configuration file |
You could now use encrypted AD user's info in the shiro configuration file. See: https://support.skyformation.com/hc/en-us/articles/115000999074-How-to-Configure-SkyFormation-Authentication-to-Use-ActiveDirectory-Server for more information |
| Fixes | |
| Google Cloud Platform (GCP) connector - Limit the retrieved page size |
Change page (pagination mechanism) size retrieved to 1,000 from 10,000. Larger page size caused retrieval issues on some large scale GCP deployments. |
| General (High) - Race condition in internal cache fixed |
Such condition will result in missing endpoints in connectors that have dynamic endpoints |
Version: 2.4.204 (Jan 17 2020)
| Enhancements / New Features | |
| *** Deprecation notice *** - Github connector - Basic Authentication support with the Github APIs used by our cloud connector when configured to, will soon be removed by Github. |
We recommend on using the cloud connector personal token method supported instead of the Basic Authentication one in case you use it. |
| New connector - SentinelOne | |
| CrowdStrike connector - Support V2 of the api + oauth2 authentication | |
| Fixes | |
| Custom connector with Azure backend - Connection pool is now elastic instead of fixed | |
| Symantec email cloud - Critical fix |
Version: 2.4.200 (Dec 22 2019)
| Enhancements / New Features | |
| *** New connector *** - SentinelOne |
To add SentinelOne connector to your SkyFormation app see: https://support.skyformation.com/hc/en-us/articles/360010560159-Adding-SentinelOne-Cloud-Connector- Connector's content package for Exabeam DL & AA available at: |
Version: 2.4.198 (Dec 15 2019)
| Enhancements / New Features | |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Consume less memory and improve sync reliability. | |
| Office 365 connector MCAS endpoints - Expose configuration that allows for setting initial sync time to other than the default 24hr. | |
| Fixes | |
|
SymantecWss connector (Critical) - Fixed duplicated events caused by wrong events collection.
|
If you are using this connector please upgrade |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Avoid failing the entire endpoint when enrichment fails. | |
| Office365 connector exchange-admin-reports-message-trace endpoint - Enrichment supports special characters scenario. | |
| Office 365 connector management-general endpoint - Handle values not in the spec in events of type alert and model them as security-alert events. |
Version: 2.4.194 (Nov 30 2019)
| Enhancements / New Features | |
| New cloud connector - Cybereason |
Please look in this page for a downloadable Exabeam content/parser for Exabeam AA/LMS for this cloud connector. We will upload the Exabeam related parser in here as soon as it is available. |
| *** AWS Cloud Connector **** - Major refactor to allow automatic resources discovery and monitor across multiple AWS regions. |
Your careful attention and actions are required if you are using AWS Connector today. Please follow this guide to understand the update implications and recommended action: |
| Egnyte Connector - Move to public APIs only | |
| Fixes | |
| CrowdStrike connector Streaming API endpoint (Medium) - Handle empty response better | Prevent data duplication error |
| Azure connector - Reduce the number of calls to retrieve storage account keys | Relevant for customers that received error codes from the Azure Storage Analytics and Azure Activity Log endpoint for over using listKeys action. |
Version: 2.4.183 (Nov 10 2019)
| Enhancements / New Features | |
| Custom connector - Support Azure Storage as data source | |
| Office 365 - Support Risk Detection API | See: https://docs.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-beta |
| GCP connector - Improve parallel data consumption | |
| GCP connector - Support GCP sink level control | |
| Egnyte connector - Allow setting of API throttling | |
| New endpoint - Gmail Logs in G-Suite connector | Support via BigQuery. See: https://support.google.com/a/answer/7233312?hl=en |
| Fixes | |
| Office 365 MCAS endpoint - Handle events without users/location etc | |
| Office 365 MCAS endpoint (Medium) - Prevent event duplication due to wrong time parsing | |
| GCP connector (Medium) - Fix thread leak | |
| * Any connector (High) - Prevent numerous retrieval of the same events time frame (events duplication), in case of API limit or error | Will affect mostly specific endpoints with restrictive API thresholds and will likely to recover at last. Events duplication will occur. |
| Slack connector - Keep the connector's authentication credentials after set | |
| Rapid7 connector (High) - Handling aborted sync request | |
| CarbonBlack connector (High) - Handle event retrieval dropping | |
| Egnyte connector - Fix API throttling | |
Version: 2.4.165 (Sep 24 2019)
| Enhancements / New Features | |
|
Custom Application Connector - add Azure Storage as data source.
|
|
| Event Modeling | |
| Fixes | |
|
AWS connector - close AWS CloudWatch Logs Groups and Redshift resources when sync. completes.
Fixes bloat in open files
|
|
| AWS MultiTenant connector - reflect errors in sync. to task's status, UI and OpenAPI (vs. today that they're only logged) | |
|
Office365 connector - Graph endpoints - Make consecutive search use inclusive on start, exclusive on end (vs. exclusive on both today)
|
|
|
Azure connector - NSG Flow Logs - add safety handling for malformed Flow Logs in V2 where number of packets is not present
|
|
|
Azure connector - EventHub - close more resources on failures, prevent thread and resource leaks on edge cases. Also, reflect errors in sync. to UI, OpenAPI
|
|
|
Symantec WSS - Allow up to 10 min. of connection to download larger payloads
|
|
Version: 2.4.162 (Sep 15 2019)
| Enhancements / New Features | |
| *** New connector *** - Symantec CloudSOC |
See more information at: Connector's content package for Exabeam DL & AA available at:
|
| *** New connector *** - Cisco Meraki |
See more information at: Connector's content package for Exabeam DL & AA available at: |
| Event Modeling | |
| Azure connector - Support Azure NSG flow logs V2 | |
| Fixes | |
| Carbon Black connector - Handle Carbon Black API 10000 per call limit with self paging | |
| Office 365 connector MCAS service - Fix in iterative data fetch mechanism | |
| AWS connector CloudWatch Logs endpoints (High) - Fix a memory leak | |
Version: 2.4.156 (Aug 15 2019)
| Enhancements / New Features | |
| Cisco Umbrella - Support Proxy and IP Logs services | |
| Event Modeling | |
| AWS Guard Duty service - Additional dimension to existing events | |
| Fixes | |
| Symantec WSS connector - Improve retrieval logic | |
|
Azure connector - Support very large Azure deployments |
Relevant to Azure deployment with hundreds of endpoints (e.g. Storage analytics/ Workspaces / NSG flaw logs data source) or above |
|
Azure connector - Storage analytics endpoints events sent directly to SIEM by default |
|
|
Bitglass connector - Add raw events (cs6 CEF field) to event where was missing |
|
Version: 2.4.146 (Aug 8 2019)
| Enhancements / New Features | |
| Tomcat version used by the product upgraded from 8.5.39 to 8.5.43 |
See the Tomcat release notes with the CVE related fixes at: |
| AWS connector - Support additional regions added to AWS | |
| Crowdstrike connector - Performance improvement to the file collector and downloader endpoints | |
| Event Modeling | |
| AWS connector - Additional CloudTrail events modeling | |
| AWS connector Guard Duty service - Alerts are modelled now as unified event security-alert-detected with much more details per event. | Alerts will be sent twice once in former unified model (general-alert) and once in the new form for backwards compatibility. |
| Bitglass connector - Additional events modeling | |
| Fixes | |
| Crowdstrike connector - handle events with the timestamp field as Date not epoch millis | |
| Cisco Umbrella connector - Make the prefix field optional to support customers with managed AWS bucket option where no prefix exist | |
| Office 365 MCAS endpoint (High) - Fix bug of missing alerts and improve events retrieval frequency |
Missing Alert type events fix. Highly recommend to update if Office 365 connector is in use with MCAS service. Frequency is down from ~5 minutes to ~2 minutes |
| Crowdstrike FDR and Custom connectors (Medium) - Connection leakage issue fixed | |
| AWS Multi-tenant connector (High) - Handle validation messages in CloudTrail | Only relevant if "send validation messages" is enabled for the monitored CloudTrails |
Version: 2.4.135 (Jul 4 2019)
| Fixes | |
| (Critical) Error when running behind a proxy | If you have a SkyFormation app version 2.4.x running behind a proxy please upgrade to this version. |
Version: 2.4.134 (Jul 2 2019)
| Enhancements / New Features | |
| *** New connector *** Mimecast Email Security | See: https://support.skyformation.com/hc/en-us/articles/360026065773-SkyFormation-for-Mimecast-Email-Security-Connector-Overview |
Version: 2.4.122 (Jun 25 2019)
| Enhancements / New Features | |
| *** New connector *** Bitglass | See: https://support.skyformation.com/hc/en-us/articles/360025471673-SkyFormation-for-Bitglass-Connector-Overview |
| Event Modeling | |
| Fixes | |
| Azure NSG - support NSGs where the storage and the NSG are on different subscriptions | |
| Fix rare race conditions where the health reporter caused out of memory when its files are incorrectly missing | |
|
Crowdstrike connector - Reduce options to authenticate for FDR endpoint to only Access key and Secret, as this is what Crowdstrike provides |
|
Version: 2.4.113 (Jun 14 2019)
| Fixes | |
|
OpenAPI / Accounts create and update - support account authn. Adding structure of 2.3.x as well as 2.4.x in requests input for backwards compatibility (response is always 2.4.x format) |
|
Version: 2.4.112 (Jun 12 2019)
This is a major release with important SkyFormation platform internal/infrastructure changes.
We highly recommend on reading this https://support.skyformation.com/hc/en-us/articles/360024437653-New-SkyFormation-platform-2-4-X-changes-additions-overview 2.4 major changes overview page before you upgrade your SkyFormation instance to this new version.
| Enhancements / New Features | |
| *** New connector *** - Tenable IO | See : https://support.skyformation.com/hc/en-us/articles/360024409554-SkyFormation-for-Tenable-io-Connector-Overview |
| *** New connector *** - Symantec SEP mobile | See: https://support.skyformation.com/hc/en-us/articles/360022937514-SkyFormation-for-Symantec-Endpoint-Protection-Mobile-SEP-Mobile-Connector-Overview |
| *** New connector *** - Cisco Umbrella connector using the Cisco managed S3 bucket | For customers with their own AWS the SkyFormation Custom connector with Cisco Umbrella parser is recommended for high volume deployments. Please contact support@skyformation.com for more information |
| *** New connector *** - Palo Alto Aperture (CASB) | See: https://support.skyformation.com/hc/en-us/articles/360022203334-SkyFormation-for-Palo-Alto-Aperture-Connector-Overview |
| AWS connector - Support assume-role and instance-profile authentication methods | See: https://support.skyformation.com/hc/en-us/articles/211318969-Adding-AWS-Connector-To-SkyFormation-Platform for information on how to use any of these two new authentication methods. |
| Centrify connector - Support automatic token renewal in authentication scheme | Different authentication credentials are needed |
| Office365 connector - New Graph endpoints for Azure AD events (read carefully the notes section at the right side) |
Background
Two audit sources (aka endpoints) supported for a long time by the Office365 connector are:
* sigins-events
* audit-events
These endpoints include the main Azure AD important events as the login events and many others.
Microsoft have decided to add two new endpoints that would eventually replace the former for the Azure AD events. The new endpoints names are identical to the former and are available as part of the Graph API.
Meanwhile the former endpoints are still working but it seems they will be removed at some point (already removed from the Office 365 docs).
To make the two sets of endpoints (former and new) easily distinguished (having the same names) the new Office 365 connector renamed the former endpoints to:
* sigins-events deprecated
* audit-events deprecated
and the new one are named as-is, like the former.
Events compatibility challenge and SkyFormation fix
The two new endpoints do not keep events structure compatibility with the two former endpoints.
SkyFormation Office 365 connector however includes mapping of the new Azure AD events from the new two endpoints into the same events SkyFormation unified events structure used in two former endpoints.
It means for you that if your detection rules/monitors are using the SkyFormation unified events fields for events coming from these endpoints switching between the two former endpoints with the new one will have no impact on your rules/monitors!!!
Events duplication challenge and recommended solution
Since the new connector supports both former and new set of endpoints, if you will enable both sets you will get duplicated Azure AD events at your SIEM.
So we recommend on doing the following:
a. Give the needed permissions (see below)
* The two new endpoints are enabled by default and they will start working as soon as permission is granted
b. Disable the two old endpoints
c. Validate your rules/monitors using the Azure AD events works as expected.
You could do this process at your convenience but knowing the former endpoints could and would probably be removed we recommend on doing this switch soon.
How to enable the two new endpoints
To be able to get events from the two new endpoints you should add a new Graph API permission (
Microsoft Graph -> AuditLog.Read.All) to the Azure app used by the Office 365 connector.
see:
|
| Azure connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211322249-Adding-Azure-Connector-To-SkyFormation-Platform |
| Office365 connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211709705-Adding-Office-365-Connector-To-SkyFormation-Platform |
| GCP connector - Support GCP security center service | New audit endpoint |
| AWS connector - Support Shield and Inspector services | Using two new audit endpoints |
| Event Modeling | |
|
** Breaking compatibility change ** Adding to the entire SkyFormation events two new dimensions of: |
The CEF fields used now for these two new dimensions have been used in the following two SkyFormation unified events only: 1) Security Threat Detected 2) Traffic Flow Event So in case your detection rules/monitors are using any of the above two events at the specific connectors detailed above for each please consult with us at support@skyformation.com and we will guide you on how to upgrade safely and have no compatibility issues. |
|
New Skyformation Open-Api : version |
https://support.skyformation.com/hc/en-us/articles/360024610413-Version-API |
Version: 2.3.148
| Enhancements / New Features | |
| Azure connector/Azure Storage Analytics endpoint - Split the single endpoint into endpoint per storage account for granular control | |
| Event Modeling | |
| Okta connector - Map additional user type "AppUser" | |
| Fixes | |
| Office 365 connector/Graph identity protection endpoint - Handle cases where location field is missing or broken | High if the endpoint is in use in your environment |
| Office 365 connector - If an error occur while process an event the original JSON will be sent to SIEM in cs6 | In some cases instead of the original event in cs6 the java class error would be placed as raw |
| Office 365/Azure AD events - Handle multiple event formats for same event | |
| Azure connector/Azure Storage Analytics endpoint - Support national cloud | |
| Symantec WSS connector (High) - Better handle the API throttling restrictions | |
| Carbon Black connector (Critical) - Comply with the API throttling restrictions | |
Version: 2.3.140
| Enhancements / New Features | |
| AWS connector - Support Redshift events |
|
Version: 2.3.139
| Enhancements / New Features | |
| Custom connector:pass-through processor only -Add an option to filter out (not send to SIEM) some retrieved events, using config file |
|
| Symantec WSS - Add to the webapp an option to filter out (not send to SIEM) some retrieved events |
|
| Event Modeling | |
| Rapid7 InsightVM connector - Mapping the string "vulnerability detected" to CEF flexString1 field (native action name field) | |
| Custom connector - Cisco Umbrella processor - Support the new Cisco Umbrella data structure (version 4) | |
| Fixes | |
| Azure connector (high) - Support SSL in the iaas-storage-analytics |
If any of your storage accounts is configured to force SSL connection you must update to our latest version. |
Version: 2.3.137
| Enhancements / New Features | |
| New connector - Rapid7 InsightVM |
For more information see: |
| Event Modeling | |
| Fixes | |
| AWS connector - Handle invalid/unknown values | |
Version: 2.3.135
| Enhancements / New Features | |
| New connector - CB (Carbon Black) Defense | For more information see: https://support.skyformation.com/hc/en-us/articles/360019656833-SkyFormation-for-CB-Carbon-Black-Defense-Connector-Overview |
| AWS connector - Add CloudWatch Logs retrieval using S3 bucket | |
| Reduce default "max recovery period" settings from 7 days to 1 day | |
| Azure connector - Azure Security Center alerts retrieved via iaas-events (aka Activity Log) endpoint | Also accessible via EventHub if the Activity Log (iaas-events API) is forwarded to it and fetched. |
| Custom connector - Allow pre-processing of events using Sawmill syntax | See https://github.com/logzio/sawmill/wiki for syntax information |
| Event Modeling | |
| WSS connector - Network flows events modeled | |
| Fixes | |
| G-Suite - Handle too large response (responseTooLarge) API error | |
| DUO connector - Handle users pagination | |
Version: 2.3.130
| Enhancements / New Features | |
|
Support Azure National Clouds (aka Sovereign clouds) () Azure AD for US Government () Azure AD Germany () Azure AD China operated by 21Vianet |
Any existing SkyFormation for Azure connectors will keep on using the default Azure AD (Global service) and will have no impact. The default Azure National Clouds choose in a new SkyFormation for Azure connectors is the standard Azure AD (Global service).
For information on how to configure your SkyFormation for Azure connector to support any of the Azure National Clouds (not the global service) please refer to: |
| New connector - Symantec Web Security Service (WSS) | Connector Overview: https://support.skyformation.com/hc/en-us/articles/360018684393-SkyFormation-for-Symantec-Web-Security-Service-WSS-Connector-Overview |
| Custom connector - Support Parquet file format | |
| Fixes | |
| AWS connector - Handle undocumented entities | |
| DUO connector - Users sync | |
| (Medium) All connectors - Event duplication | Low probability |
Version: 2.3.120
| Enhancements / New Features | |
| New connector - Symantec Email Security.cloud (aka MessageLabs) | Connector overview: https://support.skyformation.com/hc/en-us/articles/360018542394-SkyFormation-for-Symantec-Email-Security-cloud-Connector-Overview |
| Fixes | |
| CrowdStrike FDR - Streamline performance | Bucket region automatically detected |
| Platform - Restrict concurrency | |
Version: 2.3.111
| Enhancements / New Features | |
| New Connector - CylanceProtect |
Connector overview: How-to add the connector guide:
|
| New Connector - Slack Enterprise Grid |
Connector overview: How-to add the connector guide: |
| CrowdStrike FDR - New endpoint in the CrowdStrike connector | |
| G-Suite connector - Allow settings of page size in endpoint level | Email support@skyformation.com for settings steps if needed. |
| Open API - Support setting to send all events collected by connectors directly to SIEM and bypass SkyFormation internal database. |
NOTE: Feature added for improved performance but will remove the SkyFormation app console feature. To use the new setting see the new ConnectorSyncSettings needed at: And how to use it guide at: |
| Reduce number of license validation calls to SkyFormation cloud service | |
| Add the indication of the tenant id in SkyFormation web app | Relevant for the SkyFormation multi-tenant edition and is available in the tenant settings page in the SkyFormation web app. |
| Events Modeling | |
|
Breaking compatibility change ! Replace the policy-checked unified event with a new security-threat-detected event. |
Impact background: 1. policy-checked event was introduced in SkyFormation version 2.3.84 released at 2. Impacted connectors/endpoints For a more detailed explanation on the change please see: |
| CrowdStrike connector - Parse the source event time and action name to the unified events | |
| Fixes | |
| All connectors - Extension fields with whitespace in name not sent | |
| AWS connector - Fix the AWS Macie endpoint (added SQS URL configuration) | |
| Remove the htaccess file from the deployment | The file is a remaining of an old web server not used for a long time and has no security implications when exist. |
| Office 365 connector - Fix parsing of events collected from few graph APIs with security threats and anomalies alerts |
|
Version: 2.3.92
| Fixes | |
| Okta connector security vulnerability is fixed. |
The fix was introduced in SkyFormation 2.3.84 version. The vulnerability is that the Okta token is sent to the Okta cloud service for authentication in the HTTP user-agent which might be stored by intermediate devices as proxies. In case your SkyFormation app version used is 2.3.84 or higher and you use a SkyFormation for Okta cloud connector we recommend on doing the following: a. Upgrade your SkyFormation app instance to the latest version b. Create a new Okta API key and configure your Okta cloud connector to use the new token. Invalidate the former token. |
Version: 2.3.91
| Enhancements / New Features | |
| New connector - Prooftpoint ATP | See: SkyFormation for Proofpoint ATP Connector Overview |
| Events Modeling | |
| Cisco AMP: Add modeling for "install started", "install failed", "multiple injected files" | |
| Sophos cloud: Model additional alerts and events | |
| Fixes | |
| Cisco AMP: Add region to the connector's credentials when not US region account is used | |
Version: 2.3.87
|
Fixes
|
|
| G-Suite connector - Changing the way we retrieve events from the APIs (from time ranges to cursor) for better stability | NOTE: After upgrading the last 24hours events will be synced again once. |
Version: 2.3.86
|
Enhancements / New Features |
|
| New connector - Netskope |
See the overview page in here. See the "how-to-add" guide in here. |
|
Events Modeling |
|
| LastPass connector - New event modeling - Require Password Change, Destroy All Sessions, Remove from Group, Account lockout, | |
|
Fixes |
|
| Updated existing connectors with new endpoints will now show-up | |
| Handle the case where connectors with cursors when API return null cursor | |
Version: 2.3.84
|
Enhancements / New Features |
|
| New connector - LastPass Enterprise |
For more information please see: |
| New connector - Cisco AMP |
For more information please see: |
| New connector - Centrify Cloud | For more information please see: https://support.skyformation.com/hc/en-us/articles/360012448994-SkyFormation-for-Centrify-Connector-Overview |
| Okta - New API (aka endpoint) "System Logs" support added (*** Endpoints are all disabled by default. Please enable the one you need) |
Important note on your API change impact: SkyFormation ensure the events retrieved from the new API in case same event as the one retrieved from the former API are mapped to the same SkyFormation unified events structure. If you already have any detection rules/monitor/analysis runing on the Okta event from the former API most likely you will see minimal to no impact. Please validate after using the new API to make sure. Currently none active by default (endpoint). It comes to replace the former API "Events" that is about to be deprecated soon. Important note on migration to new API: 2) For customers with Okta accounts: Please enable the API/endpoint you need. |
|
Events Modelling |
|
| content-inspected SkyFormation unified event (mostly for Malware & DLP events) is now modelled as policy-checked. |
Events changed by connector: |
|
Fixes |
|
| Salesforce connector - Reduce memory consumption when collecting Event Log File API/endpoint events. | |
Version: 2.3.82
|
Enhancements / New Features |
|
| Citrix ShareFile connector - Support oAuth2 interactive authorization | |
|
Events Modelling |
|
| Salesforce connector - Model suOrgAdminLogin event | |
|
Salesforce connector - fix processing of loginHistory event via mobile app |
|
|
Fixes |
|
| Salesforce connector - Fix field history processing | |
| AWS connector - Event retrieved from GuardDuty are also the updated findings (not only the created findings) | |
Version: 2.3.77
|
Enhancements / New Features |
|
| tenant id is now sent to the SkyFormation health service from SkyFormation apps | |
| Improving the connectors concurrency handling | Better performance and lower risk of event lose |
| Support AWS Kinesis for events retrieval of CloudWatch logs | NOTE: existing CloudWatch Logs endpoints will fail upon upgrade. See to this guide for required setup process |
| Support AWS SQS for event retrieval in the custom connector | Full events should reside in the SQS |
|
Events Modelling |
|
| Align with the new Office 365 management API modeling changes | |
| web-app added as a resource type in resource-event | |
| AWS GuardDuty alert description is mapped into the SkyFormation general alert description event | |
| AWS GaurdDuty raw event (CEF cs6 field) is coming as JSON | |
| Azure blob object is not mapped as file type not blob (CEF fileType) | |
| Adding native action name to the Azure storage analytics events (e.g. blob events) | In CEF flexString1 |
| Azure blob events present now the blob name without its full path | |
|
Fixes |
|
| Office 365 login-success with action named "saassuccess" were incorrectly mapped to login-failure | |
| Office 365 API error handling improvements | More resilient to API break |
| Office 365/OneDrive filename parsing error in ACL update events | |
| Custom connector when using Windows processor an empty JSON is not required now | |
Version: 2.3.53
|
Enhancements / New Features |
|
| Task management better handle large number of accounts (aka connectors). | |
|
Events Modeling |
|
| Azure NSG rule change event include new fields. | |
|
Fixes |
|
| Citrix ShareFile event date parsing. | |
| Start/Stop account's endpoint button behaviour. | |
Version: 2.3.51
|
Enhancements / New Features |
|
|
New Sophos Central connector |
See more details at: |
|
New Citrix ShareFile connector |
See more details at: |
|
Support account (aka connector) export and import via OpenAPI |
Allow SkyFormation account migration between SkyFormation instances. |
|
Events Modeling |
|
| Azure NSG rules modelled when target is also ASG | |
|
Fixes |
|
| Azure flow logs data retrieval error. | |
| Azure enrichment failure on Azure apps due to API changes. |
|
| Office 365 file share event aligned with new Microsoft event structure. | |
| Azure AD role assigned and unassigned share event aligned with new Microsoft event structure. | |
| Fix session timeout. | |
Version: 2.3.40
|
Events Modeling |
|
| New event's "Properties Bag" added to the entire SkyFormation's events. |
The "Properties Bag" includes the entire raw key/values automatically parsed and added as key-value pairs at the end of the events. Please make sure to carefully read our "Properties Bag" overview guide before start using it for monitoring/detection. |
|
Fixes |
|
| Entire connectors (Medium): Better handle connection closing. | Mostly affect Office 365 and Azure connectors in heavy load deployments. |
| When SIEM integration in SkyFormation is configured to send events as JSON some endpoints still used CEF encoding |
|
Version: 2.3.35
|
Enhancements / New Features |
|
|
G-Suite connector: Open API allows scopes to be optional (using default scopes now). |
|
|
SkyFormation webapp: Allow "cancel" in account edit page. |
|
|
Events Modeling |
|
| G-Suite connector: Model Google Group permission changed | |
| Box connector: SkyFormation events from Box will now extract from the Box events the user identity type to "email" type and not "username". | |
|
Box connector: SkyFormation events from Box when source user is "unknown" but exist in raw event will be correctly extracted. |
Exist in some login success and failed events. |
| Box connector: Model FILE_MARKED_MALICIOUS event as "content-inspected". | |
| Box connector: Model ITEM_SHARED_UPDATE event as "resource-acl-updated". | |
| Box connector: Enrich file related events with the file exposure scope (e.g. public exposed, password protected...). | |
| Box connector: Model COLLABORATION_REMOVE and COLLABORATION_ROLE_CHANGE events | |
| Box connector: Raw data (cs6) is now send as JSON object not string. | |
| Box connector: Model MOVE event. | |
| G-Suite connector: Model CREATE_DATA_TRANSFER_REQUEST, ENABLE_API_ACCESS, ADD_DOMAIN_ALIAS, CHANGE_ORGANIZATION_NAME, TOGGLE_SERVICE_ENABLED, FAILED_PASSWORD_ATTEMPTS_EVENT |
|
| G-Suite connector: Raw data (cs6) is now send as JSON object not string. | |
| G-Suite connector: Add ClientInformation.Device.model in CEF. | |
| Okta connector: Fix extraction of source user in a failed login events where source user is specified in a different place. | |
|
Fixes |
|
| G-Suite: SkyFormation Open API history tables enabled is now optional. | |
| (Critical bug fixed) Office 365 connector: Fix regression introduced at v2.3.31 that could cause events lose in Management Activity API in high load. |
|
| Office 365 connector: Fix pagination handling. | |
| SkyFormation webapp: Fix account deletion freeze in UI. | |
| SkyFormation webapp: Fix UI failure if "test connection" is pressed before "Done" when adding /editing account. | |
| SkyFormation webapp: When creating new account choosing "tenant" and "application" is now mandatory before account is created. | |
Version: 2.3.31
|
Enhancements / New Features |
|
|
Office 365: Support Microsoft Cloud App Security API (MCAS) |
|
|
Box connector: Change time to retrieve event to 10 minutes |
Due to API limits on business edition |
|
Events Modeling |
|
| Azure connector: Add subscription id andname to the Azure iaas-events, OMS, NSF flow logs and iaas-storage endpoints/audit sources | |
| Azure connector: Model event of audit policy changed on Azure SQL server | |
| Azure connector: Add name of service principle | |
| Azure connector: Model key vault events | |
| Box connector: Extract source event type | |
|
Fixes |
|
| Fix the SkyFormation support in proxy mode (deploy and run behind proxy) | |
| Fix timeout issue in Azure Event Hub endpoint | |
| Handle duplicated Office 365 events | Caused by the bug introduced at some of Office 365 management activity API |
Version: 2.3.23
|
Enhancements / New Features |
|
|
G-Suite connector: Reduce the permissions needed by the connector. |
For service account configuration guide with reduced scope please see: https://skyformation.zendesk.com/hc/en-us/articles/360000951194-Creating-a-Service-Credentials-Json-file- |
| Azure connector: Adding new mechanism to aggregate information across correlated events (e.g. start, accepted, ended) and send all in final event |
All intermediate events will be sent as audit-events, a final, modelled, event will be send with all the data collected for it. |
| Azure connector: Add support of Event Hub with source input from Activity Log, to parse and model Azure Security Center events as general-alert events | |
| Box connector: Improve events retrieval time |
Reduced from 15 to 3 minutes * Increase API call frequency from 10 minutes to 2 minutes intervals. |
|
Events Modeling |
|
| Azure connector: New identity enrichment mechanism | Enrich all identity types via their respective objectId to deduce it types (User, Group, Application, Service Account) and add their full info |
| Azure connector: New events modelling: SQL server admin created/deleted/updated, SQL server, SQL server auditing policy change, SQL server firewall rules write | |
| Azure connector: Accepted status in events translated now to SkyFormation InProgress status. | |
| G-Suite: Model the G-Suite event names to SkyFormation flexString1 CEF field | |
| G-Suite: New events modeling: group created/deleted/rename, enable/disable allow external members, | |
|
G-Suite: New event modeling: USERS_BULK_UPLOAD, USERS_BULK_UPLOAD, REVOKE_3LO_DEVICE_TOKENS, |
|
| Fix: All connectors: In user-updated events where information about the change is missing a modelled event will be sent. | |
| SkyFormation cs6 field is now the last one in event message | Reduce likelihood of other fields truncation |
| Box connector: Model the Box event type to SkyFormation flexString1 CEF field | |
| Github connector: Support authentication using token | |
| Azure connector: Put app ID in suser for Azure Service Principle when app name does not exist/available | When actions are triggered by a Service Principal the action's CEF suser will be occupied by the SP's id |
|
Fixes |
|
| Google Cloud, Box and G-Suite connectors: Account JWT JSON not sent to client now. Presented as password. | |
| Azure connector: Increase events retrieval time in Azure iaas-events endpoint from 1 minute to 10 minutes due to some late arriving events in endpoint | |
| CrowdStrike connector (Critical): Connector stopped syncing after first sync | |
| Event modeling events: In user-updated events where user information about the change does not exist N/A | |
Version: 2.3.8
|
Enhancements / New Features |
|
|
New cloud connector for GitHub version control service |
|
|
Azure connector: Support Azure Event Hub |
|
|
Office 365 connector: Improve events retrieval time of Office DLP management API endpoint |
Reduced from 15 to 5 minutes |
|
Office 365 connector: Improve events retrieval time in signin-events and Management Active Directory endpoints |
Reduced from 15 to 10 minutes |
|
Office 365 connector: Changed the events retrieval time in Management Active Directory endpoint to meet higher API latency encountered |
Changed from 15 to 25 minutes |
|
Egnyte connector: Reduce API calls |
To better handle the provider's API limitations |
|
Azure connector: Improve events retrieval time in Azure storage endpoints |
Reduced from "up to 1 hour" to 10 minutes |
|
Azure connector: Improve events retrieval time in Azure iaas-events endpoints |
Reduced from 15 minutes to 1 minute |
|
G-Suite connector: New endpoints added with un-modeled events: "mobile","calendar","groups","gplus","rules","saml" |
Events are sent as audit-events |
|
G-Suite connector: New endpoint "token" added with modeled events |
Token lifecycle events |
|
DLP enrichment: Adding support in Office 365 |
Classify files uploaded with existing DLP systems |
|
Sales Cloud connector: Optimize number of API calls usage |
|
|
Events Modeling |
|
| Entire events: New property of the app source event ID added to SkyFormation events (deviceInboundInterface in CEF) | Reflect the app source event ID |
| Entire events: General modeling change: New type of grantee added to reflect permissions granted based on another existing permission (e.g. edit file ACL permission granted to anyone with edit file permission) | |
| Entire events:Add to the SkyFormation modeled events the event's end-time timestamp in a new dedicated CEF field called end (aka End Time). | Added for better compatibility with Arcsight CEF parser. Same event timestamp exist already in the event syslog header. |
| SkyFormation Content Inspection event: Includes now the policy violation information in JSON. | |
| Azure: New events modeling: Azure log analytics now include in action field the source action | |
| Office 365: New SAML events modeling: login via ADFS federated token (SAML login type in SkyFormation events) | |
| Office 365: New exchange events modeling: send as, send on behalf, add/remove mailbox permissions, add/remove/modify folder permissions, set permissions to send on behalf, set mailbox forwarding, Add/Set-MailboxRule | |
| Office 365: New exchange modeling: Model another type of malware event from the Exchange Email Protection | |
| SkyFormation login-success event:Add CEF filed with keep-user-signed-in indication. | Added to Office 365 Management Active Diretory endpoint signin event. Add to CEF cn1 |
| G-Suite: New events modeling: Login challenge, create/revoke token, file move, change ACL | |
| G-Suite: Fix events modeling: G-Suite events modeling: change_user_access is modelled now as sk4-resource_acl_updated (and not sk4-permission-update as was before) | Breaking compatibility change !!! |
| G-Suite: Extend modeled events: Modeling change in G-Suite: change_acl_editors event is now modelled as sk4-acl-updated with the new permission grantee described above | |
| G-Suite: Improve noise events handling. For example: file being shared, falsely generates file edit (secondary) event in addition to the (primary) ACL update event | |
| Box: New events modeling: application created, disable/enable two-factor, file locked/unlocked | |
|
Fixes |
|
| Office 365 connector: Fix in the Microsoft API failures handling | |
| Office 365 connector: Fix Exchange endpoints Spam, Malware and DLP policy endpoints. | Only relevant for customers with fresh install of SkyFormation version 2.2.17 and configured the Exchange endpoints |
| Office 365 connector: Fix parsing of Role assign/ un-assign events due to API changes | No changes in the resulted SkyFormation unified events delivered |
| Azure connector: Fix in NSG flow logs | |
| Azure connector: Azure Log Analytics: Optimize raw events size | |
| Azure connector: Fix wrong timestamp parsing in iaas-events endpoint | |
| Sales Cloud connector: handle timeout during get SObject count query | |
| Okta connector: Fix missing source IP in some event scenarios | |
| Platform: Fix bug in endpoint activate and deactivate | |
| Platform: Fix bug: Handling large sized origin/raw events with truncating | SkyFormation events exceeding 12kb |
| Platform: Fix bug: Handling large sized events with truncating | SkyFormation events exceeding 16kb |
Version: 2.2.17
|
Enhancements / New Features |
||
|
Support proxy with Basic authentication |
||
|
Events Modeling |
||
| New modeling: G-Suite - Make a spreadsheet copy | ||
| New modeling: G-Suite - Remove/Add member from/to group | ||
| New modeling: G-Suite - Authorize/Remove API client access | ||
|
Fixes |
||
| Office 365: Fix parsing error with exchange DLP events | ||
| Fix critical regression bug introduced in 2.2.14 in task management | ||
Version: 2.2.14
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Enhancements / New Features |
||
|
Improving the platform task management performance |
||
|
Events Modeling |
||
| New modeling: DropBox - Reset password to all users | ||
| New modeling: DropBox - Download file via shared link | ||
| New modeling: DropBox - Showcase change in sharing policy, change in download policy | ||
| New modeling: DropBox - File request change policy | ||
| New modeling: DropBox - Group user management change policy | ||
| New modeling: DropBox - Enable/Disable Google Identity Service | ||
| New modeling: DropBox - Team activity create report | ||
| New modeling: DropBox - Paper admin export start | ||
| New modeling: DropBox - Export members report | ||
| New modeling: DropBox - Smart synch create admin privilege report | ||
| New modeling: DropBox - Showcase - add remove members, CRUD operations | ||
| Fix modeling: Office 365 - Login failure from the management AD endpoint | ||
Version: 2.2.12
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Events Modeling |
||
| New modeling: Salesforce add/remove IP restriction from profile | ||
|
Bug Fixes |
||
| Box connector: Handling pagination in data retrieval process | ||
| AWS connector: Fix issue with SQS URL setting param introduced in 2.2.10 | SQS Url connector configuration setting was a mandatory parameter, although is only optional. Without it the connector initialization failed | |
| Azure connector: Handle user deleted username w/ prefix of guid | ||
|
General Notes & Changes |
||
| Default historic sync when on-boarding a connector is now 24 hours (was 7 days) | ||
| Office365 connector - Microsoft have remove the exchange report UrlTrace API hence the connector correlated endpoint is no longer available | ||
Version: 2.2.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New cloud connector - Add Dropbox for Business cloud connector | ||
| New data protection capability - Add file public exposure indication to file CRUD events | New detection mechanism will add to file CRUD events a new indication if the file is publicly exposed or not (supported in AWS S3 in current version). | |
| New DLP integration - Add new integration to the SkyFormation DLP Extender with Google DLP API | Customers with DLP Extender license could now integrate SkyFormation DLP Extender to a Google DLP API account and have their files uploaded to their SkyFormation cloud connectors inspected for DLP violations (supported in Egnyte, Box, ServiceNow, Sales Cloud connectors in current version) | |
| New AWS connector audit source - Add new audit source of S3 data events (e.g. file viewed, deleted, uploaded etc) using SQS | ||
| S3 connector (aka Custom connector) - Add option to whitelist/blacklist windows events by type | ||
| Azure connector - Improve performance of NSG Flow Logs, OMS | ||
| Azure connector - Improve detection of Flow Logs endpoints | ||
| Azure connector - Update API calls used for enrichment align with Microsoft API changes | ||
| Office 365 connector - Break oAuth login process into two steps of redirect phase and login success/failure | ||
| Fix bug introduced in version 2.2.7 of missing raw data (aka cs6) in events |
Version: 2.2.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New SkyFormation for CrowdStrike Falcon Connector |
New cloud connector for CrowdStrike Falcon. |
To see how to install it go to: Adding CrowdStrike Falcon Connector to SkyFormation Platform |
| Google Cloud Platform connector - Fix bug in thread management (High) | ||
| Custom connector - Fix bug in handle S3 object names with special chars (Medium) |
Version: 2.2.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| To see the Egnyte events covered in the new connector go to here | To see how to install it go to: Adding Egnyte Connector to SkyFormation Platform |
|
|
Support Webhook in |
Adding to the SkyFormation for OneLogin Connector an option to work with the Webhook (in addition to the exiting supported API method) | The two different methods retrieve in some cases different data dimension for the same event. Consult SkyFormation support for more information and to help you deploy the new method if needed |
| Fix the SkyFormation for Office 365 identity protection endpoints | Change the way the connector communicate with the endpoints to support the new Microsoft Office 365 endpoints API | Update to make your SkyFormation for Office 365 work with the Identity protection end points |
| Bug fixed of sending audit event correctly in cs6 if modeling fails | ||
| Support new syslog JSON message format | An option to send the events over syslog using JSON format (in addition to the current CEF encoding). |
Version: 2.2.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| (Fix) OneLogin connector handle users with missing email property | OneLogin - handle users with missing email property | |
| New remediation API | Adding new remediation Open API. See: SkyFormation Remediation API |
|
| (Fix) ServiceNow connector - handle application user with missing username | ||
| (Fix) Box connector test connection | ||
| New monitoring API | Adding new monitoring Open API. See: SkyFormation Monitoring API |
|
| Google G Suite connector (aka Google Apps) - Adding authentication method | Adding authentication method of service account in addition to the OAuth. see here | Could be used via Open API only if desired (no interactive OAuth needed) |
|
Box connector - Migrating to the new authentication mechanism * * Not backward compatible |
Migrating to the new recommended Box authentication mechanism. | Upgrade will move the Box connector to error state, then you will need to follow the instruction here to make it work again. |
| (Fix) Office 365 - Workaround for Microsoft API bug | Microsoft Office 365 API bug in get subscriptions is bypassed. | |
| Open API - support Json value in authentication field | ||
| (Fix) Moving the connectors initialization process to asynchronous |
Version: 2.2.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Office 365 connector - Fix paging handling (High) | Fix the way Office 365 connector handles paging when high volume of data retrieved from API | |
| Azure connector - Fix threads leakage (High) | Fix the mechanism handles multi threads in Azure connector | |
|
Office 365 connector - Fix API limit |
Send the customer's Office 365 tenant ID as the publisher ID to get separate API quota per customer | |
| Salesforce connector - Fix field history sync mechanism (Medium) | Fix the modeling of events coming from the field history | |
| Salesforce connector - Bypass a Salesforce API bug (High) | A Salesforce API might return empty response in some scenarios | |
| Adding connector level error | Connector that fails in initialization phase will be locked and return error | Please contact support@skyformation.com for more technical information |
| Salesforce connector - Reduce the amount of API calls (Medium) | SkyFormation Salesforce connector reduces API calls by optimizing calls for metadata | |
| Improve connector error messaging | Error message will present a simpler root cause message | |
| ServiceNow connector - Fix error handling (Low) | Fix error handling |
Version: 2.2.0
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix threads management bug (High) in SkyFormation for Azure Cloud Connector. |
Handle a scenario where the Azure threads handler does not close threads. |
|
|
Fix endpoint sync report data bug (Low) in SkyFormation for Azure Cloud Connector. |
Fix an error where the Azure sync manager in some sync scenarios will returned latest sync results as empty list although exist. |
|
|
Improve the SkyFormation for Azure Cloud Connector event sync performance |
Adding more caching mechanism to the connector to allow faster event sync |
Version: 2.1.24
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of Azure NSG flow logs | Add support of Azure Network Security Group (NSG) flow logs by ingesting them directly from Azure storage account in SkyFormation for Azure Cloud Connector. | Once you configure your Azure to send flow logs to any Azure storage account, your SkyFormation Azure connector will automatically detect and add it as a new disabled end-point in the running Azure connector. If you want to start ingesting the Azure flow-logs in a specific end-point go to the specific SkyFormation for Azure Cloud Connector end-points settings and start it. |
| Fix bug (High) in SkyFormation for AWS Cloud Connector cache pool management |
Fix a bug in the SkyFormation for AWS Cloud Connector where in some cases threads left in cache as idle for infinity. |
|
| Fix regression bug (Critical) of data retrieval management |
Fix a critical bug introduced in SkyFormation version 2.1.23 which causes events retrieval manager to fail ingesting events from cloud connectors. |
If you have installed SkyFormation 2.1.23 you must upgrade to 2.1.24 or above |
| Add a new key named security-group to the SkyFormation flow logs unified model |
Add a new key to the SkyFormation unified model for flow log events, named security-group. The new key will contain the security group or network security group relate to the flow log event (if exist) |
See the SkyFormation Unified Events Overview for more information |
Version: 2.1.23
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of AWS GuardDuty alerts | Add support to SkyFormation for AWS Cloud Connector for the new AWS GuardDuty alerts |
To enable it you will need to add the permissions defined at our AWS connector guide first. Next you will see a new end-point in the AWS running connector dynamically being added. The new GuardDuty end-point is enabled by default. |
Version: 2.1.22
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of syslog for RSA NetWitness | Add support of SkyFormation SIEM integration with RSA NetWitness |
Configure the RFC 3164 SHORT option in SIEM Integration settings |
|
Add new General Alert event to the SkyFormation Unified Events |
Add new unified event that resemble general (e.g. security) alert ingested from underlying cloud applications/services, i.e. an Azure log-analytics custom alert rule was triggered. |
Please refer to General Alert for more information |
| Add client indication of the SkyFormation App Version | Add the SkyFormation App Version indication in the SkyFormation web application. |
See Get Your SkyFormation App Version guide |
| Add new severity attribute to CEF | Add new severity attribute to the SkyFormation Header Fields general header of the SkyFormation Unified Events CEF (CEF key dvcpid). |
Version: 2.1.21
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| APIs to manage brand logo and name | Allow a replacement of the SkyFormation logo and name for white-label needs using APIs of set,get,reset |
|
| Upgrade to the new Log Analytics API in SkyFormation Azure Connector | Upgrade to the new Log Analytics API | |
|
Adding Field History log collection to SkyFormation Salesforce Connector
|
SkyFormation Salesforce connector will now dynamically create new sets of end-points for each SObject with field history enabled. | The end-points added will be inactive by default and could be activated in the connector's settings |
|
Fix: Synchronization of users in all cloud connectors |
Fix of duplicated users reported | |
|
Adding docker compose to SkyFormation app |
Adding to the SkyFormation application infrastructure the docker compose module to improve the SkyFormation app self management capabilities |
Version: 2.1.19
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Error parsing timestamp in OMS Logs Analytics Data in Azure Connector |
Timestamp parsing in some OMS Log Analytics events failed. |
Version: 2.1.18
| SKIPPED |
|---|
Version: 2.1.17
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Support to SQS events coming from SNS in custom connector added |
Support events coming into the SQS in the custom connector from SNS (in addition to SQS events coming directly to SQS). |
Version: 2.1.16
| Enhancement/Fix | Summary | Notes | ||||||
|---|---|---|---|---|---|---|---|---|
|
Adding properties to Exchange message flow events |
Adding properties to resource-event in case of mail messages sent (e.g. Exchange message trace). |
Properties added are: message size, sender (cs1), recipient (cs2) | ||||||
|
Fix: Resync events to SIEM bug fixed |
Resync Open API didn't run |
|||||||
|
Improve the Office 365 and Azure connectors test connection |
Removing obsolete connection tests from the connectors to improve response time | |||||||
|
Adding optional query param to Delete a Tenant API |
Add an optional "force" query param with default value of "false" | |||||||
|
Open API - Add ability to activate/deactivate health reports |
Allow health reports to be activated/deactivated via Open API | Docs | ||||||
|
Allow static endpoints activate and deactivate before account initialization |
Classifying account endpoints to static and dynamic to allow, via the open API, to activate or deactivate static endpoints even before account initialization is complete | |||||||
|
New events modeled to |
|
For the planned events please look at: |
||||||
|
Pass raw user agent header to CEF |
Pass raw user agent header, if exists, to CEF |
Version: 2.1.15
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improving the Account Status performance |
Improve the accounts status response time |
|
|
Fix: Azure end-point showed not relevant |
Remove irrelevant end-points from Azure connector |
|
|
Improve Salesforce connector handling of API limit response |
Adding proactive test to ignore the API limit response from Salesforce connector | |
|
Fix: Accounts settings in UI not persistent in some cases |
Update account settings in persistence on any change |
Version: 2.1.14
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to |
|
For the planned events please look at: |
||||||||||||||||||||||
|
Existing Modeled Office 365 Events Adjusted |
In order to meet the new APIs (see below the API changes description) some already modeled events have been adjusted with new API information
|
|||||||||||||||||||||||
|
Adding read only support for Open API |
Support role with read only permissions for the SkyFormation Open API. |
|||||||||||||||||||||||
|
Reduce the Office 365 Exchange reports events ingestion latency |
The latency of the Exchange Advance Threat Defense reports as Malware, Spam, Spoof and others reduced from ~24-48 hours to 10-15 minutes |
|||||||||||||||||||||||
|
Adding Content Inspected event to the SkyFormation Unified Model |
A new event added to the SkyFormation Unified Model represent content being inspected by additional security systems. | |||||||||||||||||||||||
|
Support the new Office 365 APIs replacing the deprecated /reports API |
Microsoft announced its plan to deprecate the Azure AD reports API under https://graph.windows. |
In case you are using the SkyFormation Office 365 information in the CEF cs6 key please consult SkyFormation support on compatibility issues to expect | ||||||||||||||||||||||
|
New UI indication on endpoints status and ability to start/stop each |
Each cloud connector's end-point status is now presented in details in the UI, and an ability to stop/start each end-point is supported in the UI. |
Same capabilities already supported using the SkyFormation Open API in former version | ||||||||||||||||||||||
|
Office 365 |
Adding subtypes to SkyFormation audit-event ingested from Office 365 as actors, targets |
|||||||||||||||||||||||
|
Add SIEM Open API return the SIEM connection |
When calling add SIEM connection via the open API the new SIEM connection together with its generated ID is being returned | |||||||||||||||||||||||
|
Adding "noop" processor to the customer connector |
Allow a "noop" (no process) processor to the custom connector | To ingest unknown or undefined data sources | ||||||||||||||||||||||
|
Fix: Duo processor wrong json handler |
Fix a problem with handling corrupted json processed at the Duo processor used by the custom connector | |||||||||||||||||||||||
|
Office 365 message trace enrichment with advance threats information |
When Exchange message trace event indicate malware, spam or spoof indication the connector will enrich the event with advance threat information from the Exchange ATD service | |||||||||||||||||||||||
|
Fix:Wrong old errors showed in status API |
Remove wrong error indications from the status API | |||||||||||||||||||||||
|
New open API to re-send events to a tenant's SIEM |
New Open API allows the admin to trigger events already sent to the tenant's SIEM to be re-sent | |||||||||||||||||||||||
|
Fix: When user agent header parsing fail send valid data |
When parsing user agent header fails - return client information with user agent header only | |||||||||||||||||||||||
|
Fix: OKTA events parsing resulted in anonymous |
Adding the existing suser information to the OKTA login failed and self reset password events instead of the anonymous indication |
Version: 2.1.13
| Enhancement/Fix | Summary | Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||
|
Adding list of mail traffic event types |
Mail traffic event types are now: Malware, TransportRuleHits, SpamIPBlock, SpamDBEBFilter, |
|||||||||
|
Adjust exchange reports retrieval time |
Set the Exchange admin reports (Spam, Malware, DLP policy) retrieval time to 24 hours, to align with their creation time |
|||||||||
|
Fix: High CPU usage |
High CPU consumed by postgress | |||||||||
|
Fix: Open API activate and deactivate failure for endpoint |
Open API activate resulted in deactivated |
Version: 2.1.12
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||||||||||||||||
|
Adding Health Report |
Adding additional information sent to the SkyFormation health service on server version, end-point level sync status and more |
|||||||||||||||||||||||
|
Add Open API for SIEM management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Add Open API for Tenant Management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Fix: Event report-anomalous-signin modeling |
Fix the modeling problem in the event | |||||||||||||||||||||||
|
Fix: Events synced but do not sent to SIEM |
In high volume deployments (over 20K events waiting to be send to SIEM) some events were not sent to the SIEM. |
Version: 2.1.11
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Some API calls not working (Severity: High) |
Some API calls not working due to incorrect way of configuration settings persistence |
Version: 2.1.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Events synced but not sent to SIEM (Severity: High) |
In high EPS deployments (mostly when IaaS connectors involved) some synced events would not be sent to SIEM. |
Version: 2.1.9
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improvement in the AWS connector API throttling mechanism |
Improving the API throttling mechanism used by the AWS connectors |
Version: 2.1.8
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Adding integration identifier to Duo Security connector |
Adding integration identifier to the Duo Security connector |
Version: 2.1.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Add clean/suspicious/infected as an action CEF value |
Adding to the CEF model the file infection level as returned from the malware/content inspection system when using the Malware Extender module. The dimension is added to the malware alert unified event | |
|
Fix: Race condition bug fix in event sync (Severity: Medium) |
Fix a race condition scenario when events are synced with the same millisecond value and are handled by different threads | |
|
Improve performance of syslog sending |
Improvement in syslog send task achieved by caching the SIEM definition | |
|
Fix: Event loss in Office 365/Azure connectors when connection is lost (Severity: High) |
Re-attempting mechanism fix in Office 365 and Azure connectors when sync is failing due to connectivity issues | |
|
Add configurable header to OKTA connector |
Attach to OKTA API calls header to identify SkyFormation platform | Allow partnership optimization with OKTA |
Version: 2.1.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: OKTA and SNOW connectors encryption property handling (Severity: Medium) |
Fix handling of authn property value to encrypted rather than clear text in Okta and SNOW |
Version: 2.1.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: CPU utilization bug (Severity: High) |
CPU utilization reach 100% in some scenarios |
looks like related to data eviction calls |
|
New Malware alert event |
Introducing new event for Malware detected as part of the new Malware extension module |
|
|
New Malware Extender module |
Introduce new module called "Malware Extender" that integrates with sandbox/content inspection systems and extend their coverage on cloud scenarios |
Support McAfee ATD at release |
Version: 2.1.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Open API for accounts |
Adding SkyFormation Open API to manage cloud connectors (aka accounts), get their running and health status and more. Please see: |
|
|
Bug fix (Severity: High) |
AWS Cloud Connector CloudTrail events wrongly processed because of incorrect ARN process |
Few events were incorrectly processed |
|
Bug fix |
On TCP connection dropped with SIEM, events were missing. A fix to the retry mechanism implemented. |
App will retry 10 consecutive tries to send existing event and if all fail will drop the task, which will be later picked again by tha pp for processing. |
Version: 2.1.3
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
New event OKTA events modeling |
The following OKTA events were modeled: Successful Okta Verify Push factor attempt, Successful Google Authenticator factor attempt, User Locked Out, Successful Okta Verify factor attempt, Rich client authentication failed, User logged in to the Admin app,User provisioned to app, User deprovisioned from app, Session created for user using API token, User updated their Okta password, User failed to update their okta password, User added to group All Employees by admin, Self-service password reset attempt denied, Read only admin privileges granted, Okta User profile updated, Okta user has been activated, Failed Google Authenticator factor attempt, Failed Okta Verify factor attempt,User removed from group All Employees by admin, Implicitly revoked tokens for client, API Token created, API Token created for client application Okta Mobile Client, App configuration updated |
|
|
Adding "Suspend User" and "Unsuspend User" support to Office 365 Remediation |
Office 365 cloud connector support now additional actions of "suspend user" and "unsuspend user" in the SkyFormation Remediation API |
Version: 2.5.0 (June 9 2020)
| Enhancements / New Features | |
| Infrastructure change : move configuration data from zookeeper to etcd | |
|
Zoom connector - added support for oauth type authentication |
|
| Fixes | |
|
Office365 connector - management-exchange endpoint - fix regression where message type (mapped to CEF fileType field) was detected by parent folder full match, instead of prefix |
|
| Gsuite connector - fix null pointer exception in GMailLogs endpoint | |
| Cylance connector - fix handling of empty response from Cylance + add debug information to further debug the issue |
Version: 2.4.264 (May 22 2020)
| Enhancements / New Features | |
| Azure connector EventHub endpoint - Improve the data ingestion EPS rate in more then 5X | Could ingest high rate EPS environments with 25K EPS and above |
| Crowdstrike connector - Support the new API gateway | |
| AWS connector - Improve the errors' readability, sent to the webapp's user | |
| Slack connector - Changed the default "past sync time" value to | |
|
New event metrics sent to the SkyFormation health monitor cloud service at report.skyformation.net:
|
See: https://support.skyformation.com/hc/en-us/articles/115000591005-SkyFormation-Cloud-Endpoints For more information on the events details and structure.
|
| Fixes | |
Version: 2.4.259 (May 6 2020)
| Enhancements / New Features | |
| New connector - Zoom connector | |
| New endpoint - Azure connector - Support Graph Security Alerts endpoint | |
| New endpoint - SentinelOne connector - Support deep visibility endpoint | |
| Azure connector Eventhub endpoint - Add support for national clouds | |
| Azure connector Log Analytics endpoint - Improve ingestion speed, reduce memory footprint | |
| Azure connector Eventhub endpoint - Improve ingestion speed | |
| Fixes | |
| Azure connector Log Analytics endpoint - Collect events from partial response/disconnects | |
| Office 365 connector,Activity Management endpoints - Fallback on invalid/unknown events to still generate audit event with some significant fields | |
| Proofpoint connector - Rate limiting. Align the request throttling with the Proofpoint docs | Throttling policy - 1 API call/ min |
Version: 2.4.248 (Apr 27 2020)
| Fixes | |
|
Azure connector - Dynamic endpoints with errors disappear from connector |
e.g. Log An analytics |
|
CloudFlare connector - Out of memory |
|
|
Mimecast connector - Timeout extended to 10 minutes (from 2) |
|
|
Custom connector - Improve performance where AWS S3/SQS in use |
|
| Sale cloud connector EventLogFile endpoint - Separate the events into multiple endpoints per event type generated in the account | see: https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_eventlogfile_supportedeventtypes.htm |
Version: 2.4.244 (Apr 21 2020)
| Fixes | |
| Azure connector - Memory leaks | |
| Crowdstrike connector - Date parsing |
Version: 2.4.236 (Apr 13 2020)
| Enhancements / New Features | |
| Changes internal metrics monitoring system. | Information is available at http://localhost:8089 instead of http://localhost:9090 |
Version: 2.4.235 (Mar 29 2020)
| Enhancements / New Features | |
| Azure connector Log Analytics endpoint - Add the option to provide a filter query (Default is no filter). | |
| Fixes | |
| Cylance connector - Fix the 2.4.233 Cylance fix | |
| Symantec Wss connector - Unlicensed certificate will no longer be classified as a security threat as it appears in a very large portion of the events. |
Version: 2.4.233 (Mar 25 2020)
| Enhancements / New Features | |
| Cylance connector - Support new endpoint “Memory Protection” | |
| AWS MT connector - Support non default S3 region | |
| Fixes | |
| Cylance connector - Critical fix in the events retrieval mechanism |
Version: 2.4.232 (Mar 23 2020)
| Fixes | |
| Azure connector - Ensure uniqueness in Storage Accounts cache to prevent memory bloat | |
| Azure connector eventhubs endpoint - Memory bloat due to incorrect in-memory data store use | |
| Office 365 connector - Improve handling of errors due to API throttling | |
| AWS connector - Allow use of China regions use of STS authn |
Version: 2.4.230 (Mar 15 2020)
| Fixes | |
| * Critical fix in entire connectors * - A regression causing all failures of all types to be translated to “task timed out”. |
The regression was entered to release 2.4.226. Please upgrade to the latest version in case you are using version |
| Office 365 connector - Remove deprecated graph identity protection endpoints | See: https://developer.microsoft.com/en-us/office/blogs/deprecatation-of-the-identityriskevents-api/ |
| Salesforce connector - Fix EmailMessage processing |
Version: 2.4.224 (Feb 24 2020)
| Enhancements / New Features | |
| New connector - Ping |
Connector's overview page: https://support.skyformation.com/hc/en-us/articles/360011689220-Exabeam-Cloud-Connector-for-Ping Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Workday |
Connector's overview page: Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Cloudflare |
Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| GCP connector - Allow collection of events from global sink | |
| Platform - Add to the webapp next to the connector/account settings raw a link to the connector's guide | |
| Fixes | |
| Custom connector - Azure backend - handle explicitly error of failure to read blob while it is being written to | |
| Crowdstrike connector - Reduce the period of time where the connector attempt to recover lost events in queue. | |
| Azure connector - Pull events in iterations from eventhub |
|
| Crowdstrike connector - Recover the log collection cursor on crash to the last cursor position. |
|
| Azure connector - Delete downloaded data blob if no advance in data pull |
Version: 2.4.206 (Jan 22 2020)
| Enhancements / New Features | Notes |
| New Exabeam AA/LMS parser for Cybereason cloud connector |
The CloudConnector is available since SkyFormation 2.4.194 (see below). This is only an indication that the Exabeam parser for the cloud connector is now available for download in here: |
| Entire connectors - Manual connector's sync reset |
Using the webapp you could now reset a connector's (aka account) sync history and cause the connector to start its sync attempts as if it was just onboarded (ignore sync history tasks). The sync reset is also available in a more granular endpoint level (not the entire connector's endpoints). This action should be used with care because it might bring duplicated events for time slots already synced pre reset in case they did. For example in a case where the connector already synced the entire events up until 3 hours and the reset button will be used, if the specific connector's settings is to start events sync from the previous 24 hours the entire events from 24 to 3 previous hours will be synced again (if re-sync supported by the connector) hence duplicated events result . Consult with us for more information. |
| New cloud connector - Fidelis |
Please see: https://support.skyformation.com/hc/en-us/articles/360011429839-Adding-Fidelis-Cloud-Connector for onboarding instructions.
Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| General - Support encrypted AD user info in configuration file |
You could now use encrypted AD user's info in the shiro configuration file. See: https://support.skyformation.com/hc/en-us/articles/115000999074-How-to-Configure-SkyFormation-Authentication-to-Use-ActiveDirectory-Server for more information |
| Fixes | |
| Google Cloud Platform (GCP) connector - Limit the retrieved page size |
Change page (pagination mechanism) size retrieved to 1,000 from 10,000. Larger page size caused retrieval issues on some large scale GCP deployments. |
| General (High) - Race condition in internal cache fixed |
Such condition will result in missing endpoints in connectors that have dynamic endpoints |
Version: 2.4.204 (Jan 17 2020)
| Enhancements / New Features | |
| *** Deprecation notice *** - Github connector - Basic Authentication support with the Github APIs used by our cloud connector when configured to, will soon be removed by Github. |
We recommend on using the cloud connector personal token method supported instead of the Basic Authentication one in case you use it. |
| New connector - SentinelOne | |
| CrowdStrike connector - Support V2 of the api + oauth2 authentication | |
| Fixes | |
| Custom connector with Azure backend - Connection pool is now elastic instead of fixed | |
| Symantec email cloud - Critical fix |
Version: 2.4.200 (Dec 22 2019)
| Enhancements / New Features | |
| *** New connector *** - SentinelOne |
To add SentinelOne connector to your SkyFormation app see: https://support.skyformation.com/hc/en-us/articles/360010560159-Adding-SentinelOne-Cloud-Connector- Connector's content package for Exabeam DL & AA available at: |
Version: 2.4.198 (Dec 15 2019)
| Enhancements / New Features | |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Consume less memory and improve sync reliability. | |
| Office 365 connector MCAS endpoints - Expose configuration that allows for setting initial sync time to other than the default 24hr. | |
| Fixes | |
|
SymantecWss connector (Critical) - Fixed duplicated events caused by wrong events collection.
|
If you are using this connector please upgrade |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Avoid failing the entire endpoint when enrichment fails. | |
| Office365 connector exchange-admin-reports-message-trace endpoint - Enrichment supports special characters scenario. | |
| Office 365 connector management-general endpoint - Handle values not in the spec in events of type alert and model them as security-alert events. |
Version: 2.4.194 (Nov 30 2019)
| Enhancements / New Features | |
| New cloud connector - Cybereason |
Please look in this page for a downloadable Exabeam content/parser for Exabeam AA/LMS for this cloud connector. We will upload the Exabeam related parser in here as soon as it is available. |
| *** AWS Cloud Connector **** - Major refactor to allow automatic resources discovery and monitor across multiple AWS regions. |
Your careful attention and actions are required if you are using AWS Connector today. Please follow this guide to understand the update implications and recommended action: |
| Egnyte Connector - Move to public APIs only | |
| Fixes | |
| CrowdStrike connector Streaming API endpoint (Medium) - Handle empty response better | Prevent data duplication error |
| Azure connector - Reduce the number of calls to retrieve storage account keys | Relevant for customers that received error codes from the Azure Storage Analytics and Azure Activity Log endpoint for over using listKeys action. |
Version: 2.4.183 (Nov 10 2019)
| Enhancements / New Features | |
| Custom connector - Support Azure Storage as data source | |
| Office 365 - Support Risk Detection API | See: https://docs.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-beta |
| GCP connector - Improve parallel data consumption | |
| GCP connector - Support GCP sink level control | |
| Egnyte connector - Allow setting of API throttling | |
| New endpoint - Gmail Logs in G-Suite connector | Support via BigQuery. See: https://support.google.com/a/answer/7233312?hl=en |
| Fixes | |
| Office 365 MCAS endpoint - Handle events without users/location etc | |
| Office 365 MCAS endpoint (Medium) - Prevent event duplication due to wrong time parsing | |
| GCP connector (Medium) - Fix thread leak | |
| * Any connector (High) - Prevent numerous retrieval of the same events time frame (events duplication), in case of API limit or error | Will affect mostly specific endpoints with restrictive API thresholds and will likely to recover at last. Events duplication will occur. |
| Slack connector - Keep the connector's authentication credentials after set | |
| Rapid7 connector (High) - Handling aborted sync request | |
| CarbonBlack connector (High) - Handle event retrieval dropping | |
| Egnyte connector - Fix API throttling | |
Version: 2.4.165 (Sep 24 2019)
| Enhancements / New Features | |
|
Custom Application Connector - add Azure Storage as data source.
|
|
| Event Modeling | |
| Fixes | |
|
AWS connector - close AWS CloudWatch Logs Groups and Redshift resources when sync. completes.
Fixes bloat in open files
|
|
| AWS MultiTenant connector - reflect errors in sync. to task's status, UI and OpenAPI (vs. today that they're only logged) | |
|
Office365 connector - Graph endpoints - Make consecutive search use inclusive on start, exclusive on end (vs. exclusive on both today)
|
|
|
Azure connector - NSG Flow Logs - add safety handling for malformed Flow Logs in V2 where number of packets is not present
|
|
|
Azure connector - EventHub - close more resources on failures, prevent thread and resource leaks on edge cases. Also, reflect errors in sync. to UI, OpenAPI
|
|
|
Symantec WSS - Allow up to 10 min. of connection to download larger payloads
|
|
Version: 2.4.162 (Sep 15 2019)
| Enhancements / New Features | |
| *** New connector *** - Symantec CloudSOC |
See more information at: Connector's content package for Exabeam DL & AA available at:
|
| *** New connector *** - Cisco Meraki |
See more information at: Connector's content package for Exabeam DL & AA available at: |
| Event Modeling | |
| Azure connector - Support Azure NSG flow logs V2 | |
| Fixes | |
| Carbon Black connector - Handle Carbon Black API 10000 per call limit with self paging | |
| Office 365 connector MCAS service - Fix in iterative data fetch mechanism | |
| AWS connector CloudWatch Logs endpoints (High) - Fix a memory leak | |
Version: 2.4.156 (Aug 15 2019)
| Enhancements / New Features | |
| Cisco Umbrella - Support Proxy and IP Logs services | |
| Event Modeling | |
| AWS Guard Duty service - Additional dimension to existing events | |
| Fixes | |
| Symantec WSS connector - Improve retrieval logic | |
|
Azure connector - Support very large Azure deployments |
Relevant to Azure deployment with hundreds of endpoints (e.g. Storage analytics/ Workspaces / NSG flaw logs data source) or above |
|
Azure connector - Storage analytics endpoints events sent directly to SIEM by default |
|
|
Bitglass connector - Add raw events (cs6 CEF field) to event where was missing |
|
Version: 2.4.146 (Aug 8 2019)
| Enhancements / New Features | |
| Tomcat version used by the product upgraded from 8.5.39 to 8.5.43 |
See the Tomcat release notes with the CVE related fixes at: |
| AWS connector - Support additional regions added to AWS | |
| Crowdstrike connector - Performance improvement to the file collector and downloader endpoints | |
| Event Modeling | |
| AWS connector - Additional CloudTrail events modeling | |
| AWS connector Guard Duty service - Alerts are modelled now as unified event security-alert-detected with much more details per event. | Alerts will be sent twice once in former unified model (general-alert) and once in the new form for backwards compatibility. |
| Bitglass connector - Additional events modeling | |
| Fixes | |
| Crowdstrike connector - handle events with the timestamp field as Date not epoch millis | |
| Cisco Umbrella connector - Make the prefix field optional to support customers with managed AWS bucket option where no prefix exist | |
| Office 365 MCAS endpoint (High) - Fix bug of missing alerts and improve events retrieval frequency |
Missing Alert type events fix. Highly recommend to update if Office 365 connector is in use with MCAS service. Frequency is down from ~5 minutes to ~2 minutes |
| Crowdstrike FDR and Custom connectors (Medium) - Connection leakage issue fixed | |
| AWS Multi-tenant connector (High) - Handle validation messages in CloudTrail | Only relevant if "send validation messages" is enabled for the monitored CloudTrails |
Version: 2.4.135 (Jul 4 2019)
| Fixes | |
| (Critical) Error when running behind a proxy | If you have a SkyFormation app version 2.4.x running behind a proxy please upgrade to this version. |
Version: 2.4.134 (Jul 2 2019)
| Enhancements / New Features | |
| *** New connector *** Mimecast Email Security | See: https://support.skyformation.com/hc/en-us/articles/360026065773-SkyFormation-for-Mimecast-Email-Security-Connector-Overview |
Version: 2.4.122 (Jun 25 2019)
| Enhancements / New Features | |
| *** New connector *** Bitglass | See: https://support.skyformation.com/hc/en-us/articles/360025471673-SkyFormation-for-Bitglass-Connector-Overview |
| Event Modeling | |
| Fixes | |
| Azure NSG - support NSGs where the storage and the NSG are on different subscriptions | |
| Fix rare race conditions where the health reporter caused out of memory when its files are incorrectly missing | |
|
Crowdstrike connector - Reduce options to authenticate for FDR endpoint to only Access key and Secret, as this is what Crowdstrike provides |
|
Version: 2.4.113 (Jun 14 2019)
| Fixes | |
|
OpenAPI / Accounts create and update - support account authn. Adding structure of 2.3.x as well as 2.4.x in requests input for backwards compatibility (response is always 2.4.x format) |
|
Version: 2.4.112 (Jun 12 2019)
This is a major release with important SkyFormation platform internal/infrastructure changes.
We highly recommend on reading this https://support.skyformation.com/hc/en-us/articles/360024437653-New-SkyFormation-platform-2-4-X-changes-additions-overview 2.4 major changes overview page before you upgrade your SkyFormation instance to this new version.
| Enhancements / New Features | |
| *** New connector *** - Tenable IO | See : https://support.skyformation.com/hc/en-us/articles/360024409554-SkyFormation-for-Tenable-io-Connector-Overview |
| *** New connector *** - Symantec SEP mobile | See: https://support.skyformation.com/hc/en-us/articles/360022937514-SkyFormation-for-Symantec-Endpoint-Protection-Mobile-SEP-Mobile-Connector-Overview |
| *** New connector *** - Cisco Umbrella connector using the Cisco managed S3 bucket | For customers with their own AWS the SkyFormation Custom connector with Cisco Umbrella parser is recommended for high volume deployments. Please contact support@skyformation.com for more information |
| *** New connector *** - Palo Alto Aperture (CASB) | See: https://support.skyformation.com/hc/en-us/articles/360022203334-SkyFormation-for-Palo-Alto-Aperture-Connector-Overview |
| AWS connector - Support assume-role and instance-profile authentication methods | See: https://support.skyformation.com/hc/en-us/articles/211318969-Adding-AWS-Connector-To-SkyFormation-Platform for information on how to use any of these two new authentication methods. |
| Centrify connector - Support automatic token renewal in authentication scheme | Different authentication credentials are needed |
| Office365 connector - New Graph endpoints for Azure AD events (read carefully the notes section at the right side) |
Background
Two audit sources (aka endpoints) supported for a long time by the Office365 connector are:
* sigins-events
* audit-events
These endpoints include the main Azure AD important events as the login events and many others.
Microsoft have decided to add two new endpoints that would eventually replace the former for the Azure AD events. The new endpoints names are identical to the former and are available as part of the Graph API.
Meanwhile the former endpoints are still working but it seems they will be removed at some point (already removed from the Office 365 docs).
To make the two sets of endpoints (former and new) easily distinguished (having the same names) the new Office 365 connector renamed the former endpoints to:
* sigins-events deprecated
* audit-events deprecated
and the new one are named as-is, like the former.
Events compatibility challenge and SkyFormation fix
The two new endpoints do not keep events structure compatibility with the two former endpoints.
SkyFormation Office 365 connector however includes mapping of the new Azure AD events from the new two endpoints into the same events SkyFormation unified events structure used in two former endpoints.
It means for you that if your detection rules/monitors are using the SkyFormation unified events fields for events coming from these endpoints switching between the two former endpoints with the new one will have no impact on your rules/monitors!!!
Events duplication challenge and recommended solution
Since the new connector supports both former and new set of endpoints, if you will enable both sets you will get duplicated Azure AD events at your SIEM.
So we recommend on doing the following:
a. Give the needed permissions (see below)
* The two new endpoints are enabled by default and they will start working as soon as permission is granted
b. Disable the two old endpoints
c. Validate your rules/monitors using the Azure AD events works as expected.
You could do this process at your convenience but knowing the former endpoints could and would probably be removed we recommend on doing this switch soon.
How to enable the two new endpoints
To be able to get events from the two new endpoints you should add a new Graph API permission (
Microsoft Graph -> AuditLog.Read.All) to the Azure app used by the Office 365 connector.
see:
|
| Azure connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211322249-Adding-Azure-Connector-To-SkyFormation-Platform |
| Office365 connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211709705-Adding-Office-365-Connector-To-SkyFormation-Platform |
| GCP connector - Support GCP security center service | New audit endpoint |
| AWS connector - Support Shield and Inspector services | Using two new audit endpoints |
| Event Modeling | |
|
** Breaking compatibility change ** Adding to the entire SkyFormation events two new dimensions of: |
The CEF fields used now for these two new dimensions have been used in the following two SkyFormation unified events only: 1) Security Threat Detected 2) Traffic Flow Event So in case your detection rules/monitors are using any of the above two events at the specific connectors detailed above for each please consult with us at support@skyformation.com and we will guide you on how to upgrade safely and have no compatibility issues. |
|
New Skyformation Open-Api : version |
https://support.skyformation.com/hc/en-us/articles/360024610413-Version-API |
Version: 2.3.148
| Enhancements / New Features | |
| Azure connector/Azure Storage Analytics endpoint - Split the single endpoint into endpoint per storage account for granular control | |
| Event Modeling | |
| Okta connector - Map additional user type "AppUser" | |
| Fixes | |
| Office 365 connector/Graph identity protection endpoint - Handle cases where location field is missing or broken | High if the endpoint is in use in your environment |
| Office 365 connector - If an error occur while process an event the original JSON will be sent to SIEM in cs6 | In some cases instead of the original event in cs6 the java class error would be placed as raw |
| Office 365/Azure AD events - Handle multiple event formats for same event | |
| Azure connector/Azure Storage Analytics endpoint - Support national cloud | |
| Symantec WSS connector (High) - Better handle the API throttling restrictions | |
| Carbon Black connector (Critical) - Comply with the API throttling restrictions | |
Version: 2.3.140
| Enhancements / New Features | |
| AWS connector - Support Redshift events |
|
Version: 2.3.139
| Enhancements / New Features | |
| Custom connector:pass-through processor only -Add an option to filter out (not send to SIEM) some retrieved events, using config file |
|
| Symantec WSS - Add to the webapp an option to filter out (not send to SIEM) some retrieved events |
|
| Event Modeling | |
| Rapid7 InsightVM connector - Mapping the string "vulnerability detected" to CEF flexString1 field (native action name field) | |
| Custom connector - Cisco Umbrella processor - Support the new Cisco Umbrella data structure (version 4) | |
| Fixes | |
| Azure connector (high) - Support SSL in the iaas-storage-analytics |
If any of your storage accounts is configured to force SSL connection you must update to our latest version. |
Version: 2.3.137
| Enhancements / New Features | |
| New connector - Rapid7 InsightVM |
For more information see: |
| Event Modeling | |
| Fixes | |
| AWS connector - Handle invalid/unknown values | |
Version: 2.3.135
| Enhancements / New Features | |
| New connector - CB (Carbon Black) Defense | For more information see: https://support.skyformation.com/hc/en-us/articles/360019656833-SkyFormation-for-CB-Carbon-Black-Defense-Connector-Overview |
| AWS connector - Add CloudWatch Logs retrieval using S3 bucket | |
| Reduce default "max recovery period" settings from 7 days to 1 day | |
| Azure connector - Azure Security Center alerts retrieved via iaas-events (aka Activity Log) endpoint | Also accessible via EventHub if the Activity Log (iaas-events API) is forwarded to it and fetched. |
| Custom connector - Allow pre-processing of events using Sawmill syntax | See https://github.com/logzio/sawmill/wiki for syntax information |
| Event Modeling | |
| WSS connector - Network flows events modeled | |
| Fixes | |
| G-Suite - Handle too large response (responseTooLarge) API error | |
| DUO connector - Handle users pagination | |
Version: 2.3.130
| Enhancements / New Features | |
|
Support Azure National Clouds (aka Sovereign clouds) () Azure AD for US Government () Azure AD Germany () Azure AD China operated by 21Vianet |
Any existing SkyFormation for Azure connectors will keep on using the default Azure AD (Global service) and will have no impact. The default Azure National Clouds choose in a new SkyFormation for Azure connectors is the standard Azure AD (Global service).
For information on how to configure your SkyFormation for Azure connector to support any of the Azure National Clouds (not the global service) please refer to: |
| New connector - Symantec Web Security Service (WSS) | Connector Overview: https://support.skyformation.com/hc/en-us/articles/360018684393-SkyFormation-for-Symantec-Web-Security-Service-WSS-Connector-Overview |
| Custom connector - Support Parquet file format | |
| Fixes | |
| AWS connector - Handle undocumented entities | |
| DUO connector - Users sync | |
| (Medium) All connectors - Event duplication | Low probability |
Version: 2.3.120
| Enhancements / New Features | |
| New connector - Symantec Email Security.cloud (aka MessageLabs) | Connector overview: https://support.skyformation.com/hc/en-us/articles/360018542394-SkyFormation-for-Symantec-Email-Security-cloud-Connector-Overview |
| Fixes | |
| CrowdStrike FDR - Streamline performance | Bucket region automatically detected |
| Platform - Restrict concurrency | |
Version: 2.3.111
| Enhancements / New Features | |
| New Connector - CylanceProtect |
Connector overview: How-to add the connector guide:
|
| New Connector - Slack Enterprise Grid |
Connector overview: How-to add the connector guide: |
| CrowdStrike FDR - New endpoint in the CrowdStrike connector | |
| G-Suite connector - Allow settings of page size in endpoint level | Email support@skyformation.com for settings steps if needed. |
| Open API - Support setting to send all events collected by connectors directly to SIEM and bypass SkyFormation internal database. |
NOTE: Feature added for improved performance but will remove the SkyFormation app console feature. To use the new setting see the new ConnectorSyncSettings needed at: And how to use it guide at: |
| Reduce number of license validation calls to SkyFormation cloud service | |
| Add the indication of the tenant id in SkyFormation web app | Relevant for the SkyFormation multi-tenant edition and is available in the tenant settings page in the SkyFormation web app. |
| Events Modeling | |
|
Breaking compatibility change ! Replace the policy-checked unified event with a new security-threat-detected event. |
Impact background: 1. policy-checked event was introduced in SkyFormation version 2.3.84 released at 2. Impacted connectors/endpoints For a more detailed explanation on the change please see: |
| CrowdStrike connector - Parse the source event time and action name to the unified events | |
| Fixes | |
| All connectors - Extension fields with whitespace in name not sent | |
| AWS connector - Fix the AWS Macie endpoint (added SQS URL configuration) | |
| Remove the htaccess file from the deployment | The file is a remaining of an old web server not used for a long time and has no security implications when exist. |
| Office 365 connector - Fix parsing of events collected from few graph APIs with security threats and anomalies alerts |
|
Version: 2.3.92
| Fixes | |
| Okta connector security vulnerability is fixed. |
The fix was introduced in SkyFormation 2.3.84 version. The vulnerability is that the Okta token is sent to the Okta cloud service for authentication in the HTTP user-agent which might be stored by intermediate devices as proxies. In case your SkyFormation app version used is 2.3.84 or higher and you use a SkyFormation for Okta cloud connector we recommend on doing the following: a. Upgrade your SkyFormation app instance to the latest version b. Create a new Okta API key and configure your Okta cloud connector to use the new token. Invalidate the former token. |
Version: 2.3.91
| Enhancements / New Features | |
| New connector - Prooftpoint ATP | See: SkyFormation for Proofpoint ATP Connector Overview |
| Events Modeling | |
| Cisco AMP: Add modeling for "install started", "install failed", "multiple injected files" | |
| Sophos cloud: Model additional alerts and events | |
| Fixes | |
| Cisco AMP: Add region to the connector's credentials when not US region account is used | |
Version: 2.3.87
|
Fixes
|
|
| G-Suite connector - Changing the way we retrieve events from the APIs (from time ranges to cursor) for better stability | NOTE: After upgrading the last 24hours events will be synced again once. |
Version: 2.3.86
|
Enhancements / New Features |
|
| New connector - Netskope |
See the overview page in here. See the "how-to-add" guide in here. |
|
Events Modeling |
|
| LastPass connector - New event modeling - Require Password Change, Destroy All Sessions, Remove from Group, Account lockout, | |
|
Fixes |
|
| Updated existing connectors with new endpoints will now show-up | |
| Handle the case where connectors with cursors when API return null cursor | |
Version: 2.3.84
|
Enhancements / New Features |
|
| New connector - LastPass Enterprise |
For more information please see: |
| New connector - Cisco AMP |
For more information please see: |
| New connector - Centrify Cloud | For more information please see: https://support.skyformation.com/hc/en-us/articles/360012448994-SkyFormation-for-Centrify-Connector-Overview |
| Okta - New API (aka endpoint) "System Logs" support added (*** Endpoints are all disabled by default. Please enable the one you need) |
Important note on your API change impact: SkyFormation ensure the events retrieved from the new API in case same event as the one retrieved from the former API are mapped to the same SkyFormation unified events structure. If you already have any detection rules/monitor/analysis runing on the Okta event from the former API most likely you will see minimal to no impact. Please validate after using the new API to make sure. Currently none active by default (endpoint). It comes to replace the former API "Events" that is about to be deprecated soon. Important note on migration to new API: 2) For customers with Okta accounts: Please enable the API/endpoint you need. |
|
Events Modelling |
|
| content-inspected SkyFormation unified event (mostly for Malware & DLP events) is now modelled as policy-checked. |
Events changed by connector: |
|
Fixes |
|
| Salesforce connector - Reduce memory consumption when collecting Event Log File API/endpoint events. | |
Version: 2.3.82
|
Enhancements / New Features |
|
| Citrix ShareFile connector - Support oAuth2 interactive authorization | |
|
Events Modelling |
|
| Salesforce connector - Model suOrgAdminLogin event | |
|
Salesforce connector - fix processing of loginHistory event via mobile app |
|
|
Fixes |
|
| Salesforce connector - Fix field history processing | |
| AWS connector - Event retrieved from GuardDuty are also the updated findings (not only the created findings) | |
Version: 2.3.77
|
Enhancements / New Features |
|
| tenant id is now sent to the SkyFormation health service from SkyFormation apps | |
| Improving the connectors concurrency handling | Better performance and lower risk of event lose |
| Support AWS Kinesis for events retrieval of CloudWatch logs | NOTE: existing CloudWatch Logs endpoints will fail upon upgrade. See to this guide for required setup process |
| Support AWS SQS for event retrieval in the custom connector | Full events should reside in the SQS |
|
Events Modelling |
|
| Align with the new Office 365 management API modeling changes | |
| web-app added as a resource type in resource-event | |
| AWS GuardDuty alert description is mapped into the SkyFormation general alert description event | |
| AWS GaurdDuty raw event (CEF cs6 field) is coming as JSON | |
| Azure blob object is not mapped as file type not blob (CEF fileType) | |
| Adding native action name to the Azure storage analytics events (e.g. blob events) | In CEF flexString1 |
| Azure blob events present now the blob name without its full path | |
|
Fixes |
|
| Office 365 login-success with action named "saassuccess" were incorrectly mapped to login-failure | |
| Office 365 API error handling improvements | More resilient to API break |
| Office 365/OneDrive filename parsing error in ACL update events | |
| Custom connector when using Windows processor an empty JSON is not required now | |
Version: 2.3.53
|
Enhancements / New Features |
|
| Task management better handle large number of accounts (aka connectors). | |
|
Events Modeling |
|
| Azure NSG rule change event include new fields. | |
|
Fixes |
|
| Citrix ShareFile event date parsing. | |
| Start/Stop account's endpoint button behaviour. | |
Version: 2.3.51
|
Enhancements / New Features |
|
|
New Sophos Central connector |
See more details at: |
|
New Citrix ShareFile connector |
See more details at: |
|
Support account (aka connector) export and import via OpenAPI |
Allow SkyFormation account migration between SkyFormation instances. |
|
Events Modeling |
|
| Azure NSG rules modelled when target is also ASG | |
|
Fixes |
|
| Azure flow logs data retrieval error. | |
| Azure enrichment failure on Azure apps due to API changes. |
|
| Office 365 file share event aligned with new Microsoft event structure. | |
| Azure AD role assigned and unassigned share event aligned with new Microsoft event structure. | |
| Fix session timeout. | |
Version: 2.3.40
|
Events Modeling |
|
| New event's "Properties Bag" added to the entire SkyFormation's events. |
The "Properties Bag" includes the entire raw key/values automatically parsed and added as key-value pairs at the end of the events. Please make sure to carefully read our "Properties Bag" overview guide before start using it for monitoring/detection. |
|
Fixes |
|
| Entire connectors (Medium): Better handle connection closing. | Mostly affect Office 365 and Azure connectors in heavy load deployments. |
| When SIEM integration in SkyFormation is configured to send events as JSON some endpoints still used CEF encoding |
|
Version: 2.3.35
|
Enhancements / New Features |
|
|
G-Suite connector: Open API allows scopes to be optional (using default scopes now). |
|
|
SkyFormation webapp: Allow "cancel" in account edit page. |
|
|
Events Modeling |
|
| G-Suite connector: Model Google Group permission changed | |
| Box connector: SkyFormation events from Box will now extract from the Box events the user identity type to "email" type and not "username". | |
|
Box connector: SkyFormation events from Box when source user is "unknown" but exist in raw event will be correctly extracted. |
Exist in some login success and failed events. |
| Box connector: Model FILE_MARKED_MALICIOUS event as "content-inspected". | |
| Box connector: Model ITEM_SHARED_UPDATE event as "resource-acl-updated". | |
| Box connector: Enrich file related events with the file exposure scope (e.g. public exposed, password protected...). | |
| Box connector: Model COLLABORATION_REMOVE and COLLABORATION_ROLE_CHANGE events | |
| Box connector: Raw data (cs6) is now send as JSON object not string. | |
| Box connector: Model MOVE event. | |
| G-Suite connector: Model CREATE_DATA_TRANSFER_REQUEST, ENABLE_API_ACCESS, ADD_DOMAIN_ALIAS, CHANGE_ORGANIZATION_NAME, TOGGLE_SERVICE_ENABLED, FAILED_PASSWORD_ATTEMPTS_EVENT |
|
| G-Suite connector: Raw data (cs6) is now send as JSON object not string. | |
| G-Suite connector: Add ClientInformation.Device.model in CEF. | |
| Okta connector: Fix extraction of source user in a failed login events where source user is specified in a different place. | |
|
Fixes |
|
| G-Suite: SkyFormation Open API history tables enabled is now optional. | |
| (Critical bug fixed) Office 365 connector: Fix regression introduced at v2.3.31 that could cause events lose in Management Activity API in high load. |
|
| Office 365 connector: Fix pagination handling. | |
| SkyFormation webapp: Fix account deletion freeze in UI. | |
| SkyFormation webapp: Fix UI failure if "test connection" is pressed before "Done" when adding /editing account. | |
| SkyFormation webapp: When creating new account choosing "tenant" and "application" is now mandatory before account is created. | |
Version: 2.3.31
|
Enhancements / New Features |
|
|
Office 365: Support Microsoft Cloud App Security API (MCAS) |
|
|
Box connector: Change time to retrieve event to 10 minutes |
Due to API limits on business edition |
|
Events Modeling |
|
| Azure connector: Add subscription id andname to the Azure iaas-events, OMS, NSF flow logs and iaas-storage endpoints/audit sources | |
| Azure connector: Model event of audit policy changed on Azure SQL server | |
| Azure connector: Add name of service principle | |
| Azure connector: Model key vault events | |
| Box connector: Extract source event type | |
|
Fixes |
|
| Fix the SkyFormation support in proxy mode (deploy and run behind proxy) | |
| Fix timeout issue in Azure Event Hub endpoint | |
| Handle duplicated Office 365 events | Caused by the bug introduced at some of Office 365 management activity API |
Version: 2.3.23
|
Enhancements / New Features |
|
|
G-Suite connector: Reduce the permissions needed by the connector. |
For service account configuration guide with reduced scope please see: https://skyformation.zendesk.com/hc/en-us/articles/360000951194-Creating-a-Service-Credentials-Json-file- |
| Azure connector: Adding new mechanism to aggregate information across correlated events (e.g. start, accepted, ended) and send all in final event |
All intermediate events will be sent as audit-events, a final, modelled, event will be send with all the data collected for it. |
| Azure connector: Add support of Event Hub with source input from Activity Log, to parse and model Azure Security Center events as general-alert events | |
| Box connector: Improve events retrieval time |
Reduced from 15 to 3 minutes * Increase API call frequency from 10 minutes to 2 minutes intervals. |
|
Events Modeling |
|
| Azure connector: New identity enrichment mechanism | Enrich all identity types via their respective objectId to deduce it types (User, Group, Application, Service Account) and add their full info |
| Azure connector: New events modelling: SQL server admin created/deleted/updated, SQL server, SQL server auditing policy change, SQL server firewall rules write | |
| Azure connector: Accepted status in events translated now to SkyFormation InProgress status. | |
| G-Suite: Model the G-Suite event names to SkyFormation flexString1 CEF field | |
| G-Suite: New events modeling: group created/deleted/rename, enable/disable allow external members, | |
|
G-Suite: New event modeling: USERS_BULK_UPLOAD, USERS_BULK_UPLOAD, REVOKE_3LO_DEVICE_TOKENS, |
|
| Fix: All connectors: In user-updated events where information about the change is missing a modelled event will be sent. | |
| SkyFormation cs6 field is now the last one in event message | Reduce likelihood of other fields truncation |
| Box connector: Model the Box event type to SkyFormation flexString1 CEF field | |
| Github connector: Support authentication using token | |
| Azure connector: Put app ID in suser for Azure Service Principle when app name does not exist/available | When actions are triggered by a Service Principal the action's CEF suser will be occupied by the SP's id |
|
Fixes |
|
| Google Cloud, Box and G-Suite connectors: Account JWT JSON not sent to client now. Presented as password. | |
| Azure connector: Increase events retrieval time in Azure iaas-events endpoint from 1 minute to 10 minutes due to some late arriving events in endpoint | |
| CrowdStrike connector (Critical): Connector stopped syncing after first sync | |
| Event modeling events: In user-updated events where user information about the change does not exist N/A | |
Version: 2.3.8
|
Enhancements / New Features |
|
|
New cloud connector for GitHub version control service |
|
|
Azure connector: Support Azure Event Hub |
|
|
Office 365 connector: Improve events retrieval time of Office DLP management API endpoint |
Reduced from 15 to 5 minutes |
|
Office 365 connector: Improve events retrieval time in signin-events and Management Active Directory endpoints |
Reduced from 15 to 10 minutes |
|
Office 365 connector: Changed the events retrieval time in Management Active Directory endpoint to meet higher API latency encountered |
Changed from 15 to 25 minutes |
|
Egnyte connector: Reduce API calls |
To better handle the provider's API limitations |
|
Azure connector: Improve events retrieval time in Azure storage endpoints |
Reduced from "up to 1 hour" to 10 minutes |
|
Azure connector: Improve events retrieval time in Azure iaas-events endpoints |
Reduced from 15 minutes to 1 minute |
|
G-Suite connector: New endpoints added with un-modeled events: "mobile","calendar","groups","gplus","rules","saml" |
Events are sent as audit-events |
|
G-Suite connector: New endpoint "token" added with modeled events |
Token lifecycle events |
|
DLP enrichment: Adding support in Office 365 |
Classify files uploaded with existing DLP systems |
|
Sales Cloud connector: Optimize number of API calls usage |
|
|
Events Modeling |
|
| Entire events: New property of the app source event ID added to SkyFormation events (deviceInboundInterface in CEF) | Reflect the app source event ID |
| Entire events: General modeling change: New type of grantee added to reflect permissions granted based on another existing permission (e.g. edit file ACL permission granted to anyone with edit file permission) | |
| Entire events:Add to the SkyFormation modeled events the event's end-time timestamp in a new dedicated CEF field called end (aka End Time). | Added for better compatibility with Arcsight CEF parser. Same event timestamp exist already in the event syslog header. |
| SkyFormation Content Inspection event: Includes now the policy violation information in JSON. | |
| Azure: New events modeling: Azure log analytics now include in action field the source action | |
| Office 365: New SAML events modeling: login via ADFS federated token (SAML login type in SkyFormation events) | |
| Office 365: New exchange events modeling: send as, send on behalf, add/remove mailbox permissions, add/remove/modify folder permissions, set permissions to send on behalf, set mailbox forwarding, Add/Set-MailboxRule | |
| Office 365: New exchange modeling: Model another type of malware event from the Exchange Email Protection | |
| SkyFormation login-success event:Add CEF filed with keep-user-signed-in indication. | Added to Office 365 Management Active Diretory endpoint signin event. Add to CEF cn1 |
| G-Suite: New events modeling: Login challenge, create/revoke token, file move, change ACL | |
| G-Suite: Fix events modeling: G-Suite events modeling: change_user_access is modelled now as sk4-resource_acl_updated (and not sk4-permission-update as was before) | Breaking compatibility change !!! |
| G-Suite: Extend modeled events: Modeling change in G-Suite: change_acl_editors event is now modelled as sk4-acl-updated with the new permission grantee described above | |
| G-Suite: Improve noise events handling. For example: file being shared, falsely generates file edit (secondary) event in addition to the (primary) ACL update event | |
| Box: New events modeling: application created, disable/enable two-factor, file locked/unlocked | |
|
Fixes |
|
| Office 365 connector: Fix in the Microsoft API failures handling | |
| Office 365 connector: Fix Exchange endpoints Spam, Malware and DLP policy endpoints. | Only relevant for customers with fresh install of SkyFormation version 2.2.17 and configured the Exchange endpoints |
| Office 365 connector: Fix parsing of Role assign/ un-assign events due to API changes | No changes in the resulted SkyFormation unified events delivered |
| Azure connector: Fix in NSG flow logs | |
| Azure connector: Azure Log Analytics: Optimize raw events size | |
| Azure connector: Fix wrong timestamp parsing in iaas-events endpoint | |
| Sales Cloud connector: handle timeout during get SObject count query | |
| Okta connector: Fix missing source IP in some event scenarios | |
| Platform: Fix bug in endpoint activate and deactivate | |
| Platform: Fix bug: Handling large sized origin/raw events with truncating | SkyFormation events exceeding 12kb |
| Platform: Fix bug: Handling large sized events with truncating | SkyFormation events exceeding 16kb |
Version: 2.2.17
|
Enhancements / New Features |
||
|
Support proxy with Basic authentication |
||
|
Events Modeling |
||
| New modeling: G-Suite - Make a spreadsheet copy | ||
| New modeling: G-Suite - Remove/Add member from/to group | ||
| New modeling: G-Suite - Authorize/Remove API client access | ||
|
Fixes |
||
| Office 365: Fix parsing error with exchange DLP events | ||
| Fix critical regression bug introduced in 2.2.14 in task management | ||
Version: 2.2.14
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Enhancements / New Features |
||
|
Improving the platform task management performance |
||
|
Events Modeling |
||
| New modeling: DropBox - Reset password to all users | ||
| New modeling: DropBox - Download file via shared link | ||
| New modeling: DropBox - Showcase change in sharing policy, change in download policy | ||
| New modeling: DropBox - File request change policy | ||
| New modeling: DropBox - Group user management change policy | ||
| New modeling: DropBox - Enable/Disable Google Identity Service | ||
| New modeling: DropBox - Team activity create report | ||
| New modeling: DropBox - Paper admin export start | ||
| New modeling: DropBox - Export members report | ||
| New modeling: DropBox - Smart synch create admin privilege report | ||
| New modeling: DropBox - Showcase - add remove members, CRUD operations | ||
| Fix modeling: Office 365 - Login failure from the management AD endpoint | ||
Version: 2.2.12
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Events Modeling |
||
| New modeling: Salesforce add/remove IP restriction from profile | ||
|
Bug Fixes |
||
| Box connector: Handling pagination in data retrieval process | ||
| AWS connector: Fix issue with SQS URL setting param introduced in 2.2.10 | SQS Url connector configuration setting was a mandatory parameter, although is only optional. Without it the connector initialization failed | |
| Azure connector: Handle user deleted username w/ prefix of guid | ||
|
General Notes & Changes |
||
| Default historic sync when on-boarding a connector is now 24 hours (was 7 days) | ||
| Office365 connector - Microsoft have remove the exchange report UrlTrace API hence the connector correlated endpoint is no longer available | ||
Version: 2.2.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New cloud connector - Add Dropbox for Business cloud connector | ||
| New data protection capability - Add file public exposure indication to file CRUD events | New detection mechanism will add to file CRUD events a new indication if the file is publicly exposed or not (supported in AWS S3 in current version). | |
| New DLP integration - Add new integration to the SkyFormation DLP Extender with Google DLP API | Customers with DLP Extender license could now integrate SkyFormation DLP Extender to a Google DLP API account and have their files uploaded to their SkyFormation cloud connectors inspected for DLP violations (supported in Egnyte, Box, ServiceNow, Sales Cloud connectors in current version) | |
| New AWS connector audit source - Add new audit source of S3 data events (e.g. file viewed, deleted, uploaded etc) using SQS | ||
| S3 connector (aka Custom connector) - Add option to whitelist/blacklist windows events by type | ||
| Azure connector - Improve performance of NSG Flow Logs, OMS | ||
| Azure connector - Improve detection of Flow Logs endpoints | ||
| Azure connector - Update API calls used for enrichment align with Microsoft API changes | ||
| Office 365 connector - Break oAuth login process into two steps of redirect phase and login success/failure | ||
| Fix bug introduced in version 2.2.7 of missing raw data (aka cs6) in events |
Version: 2.2.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New SkyFormation for CrowdStrike Falcon Connector |
New cloud connector for CrowdStrike Falcon. |
To see how to install it go to: Adding CrowdStrike Falcon Connector to SkyFormation Platform |
| Google Cloud Platform connector - Fix bug in thread management (High) | ||
| Custom connector - Fix bug in handle S3 object names with special chars (Medium) |
Version: 2.2.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| To see the Egnyte events covered in the new connector go to here | To see how to install it go to: Adding Egnyte Connector to SkyFormation Platform |
|
|
Support Webhook in |
Adding to the SkyFormation for OneLogin Connector an option to work with the Webhook (in addition to the exiting supported API method) | The two different methods retrieve in some cases different data dimension for the same event. Consult SkyFormation support for more information and to help you deploy the new method if needed |
| Fix the SkyFormation for Office 365 identity protection endpoints | Change the way the connector communicate with the endpoints to support the new Microsoft Office 365 endpoints API | Update to make your SkyFormation for Office 365 work with the Identity protection end points |
| Bug fixed of sending audit event correctly in cs6 if modeling fails | ||
| Support new syslog JSON message format | An option to send the events over syslog using JSON format (in addition to the current CEF encoding). |
Version: 2.2.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| (Fix) OneLogin connector handle users with missing email property | OneLogin - handle users with missing email property | |
| New remediation API | Adding new remediation Open API. See: SkyFormation Remediation API |
|
| (Fix) ServiceNow connector - handle application user with missing username | ||
| (Fix) Box connector test connection | ||
| New monitoring API | Adding new monitoring Open API. See: SkyFormation Monitoring API |
|
| Google G Suite connector (aka Google Apps) - Adding authentication method | Adding authentication method of service account in addition to the OAuth. see here | Could be used via Open API only if desired (no interactive OAuth needed) |
|
Box connector - Migrating to the new authentication mechanism * * Not backward compatible |
Migrating to the new recommended Box authentication mechanism. | Upgrade will move the Box connector to error state, then you will need to follow the instruction here to make it work again. |
| (Fix) Office 365 - Workaround for Microsoft API bug | Microsoft Office 365 API bug in get subscriptions is bypassed. | |
| Open API - support Json value in authentication field | ||
| (Fix) Moving the connectors initialization process to asynchronous |
Version: 2.2.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Office 365 connector - Fix paging handling (High) | Fix the way Office 365 connector handles paging when high volume of data retrieved from API | |
| Azure connector - Fix threads leakage (High) | Fix the mechanism handles multi threads in Azure connector | |
|
Office 365 connector - Fix API limit |
Send the customer's Office 365 tenant ID as the publisher ID to get separate API quota per customer | |
| Salesforce connector - Fix field history sync mechanism (Medium) | Fix the modeling of events coming from the field history | |
| Salesforce connector - Bypass a Salesforce API bug (High) | A Salesforce API might return empty response in some scenarios | |
| Adding connector level error | Connector that fails in initialization phase will be locked and return error | Please contact support@skyformation.com for more technical information |
| Salesforce connector - Reduce the amount of API calls (Medium) | SkyFormation Salesforce connector reduces API calls by optimizing calls for metadata | |
| Improve connector error messaging | Error message will present a simpler root cause message | |
| ServiceNow connector - Fix error handling (Low) | Fix error handling |
Version: 2.2.0
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix threads management bug (High) in SkyFormation for Azure Cloud Connector. |
Handle a scenario where the Azure threads handler does not close threads. |
|
|
Fix endpoint sync report data bug (Low) in SkyFormation for Azure Cloud Connector. |
Fix an error where the Azure sync manager in some sync scenarios will returned latest sync results as empty list although exist. |
|
|
Improve the SkyFormation for Azure Cloud Connector event sync performance |
Adding more caching mechanism to the connector to allow faster event sync |
Version: 2.1.24
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of Azure NSG flow logs | Add support of Azure Network Security Group (NSG) flow logs by ingesting them directly from Azure storage account in SkyFormation for Azure Cloud Connector. | Once you configure your Azure to send flow logs to any Azure storage account, your SkyFormation Azure connector will automatically detect and add it as a new disabled end-point in the running Azure connector. If you want to start ingesting the Azure flow-logs in a specific end-point go to the specific SkyFormation for Azure Cloud Connector end-points settings and start it. |
| Fix bug (High) in SkyFormation for AWS Cloud Connector cache pool management |
Fix a bug in the SkyFormation for AWS Cloud Connector where in some cases threads left in cache as idle for infinity. |
|
| Fix regression bug (Critical) of data retrieval management |
Fix a critical bug introduced in SkyFormation version 2.1.23 which causes events retrieval manager to fail ingesting events from cloud connectors. |
If you have installed SkyFormation 2.1.23 you must upgrade to 2.1.24 or above |
| Add a new key named security-group to the SkyFormation flow logs unified model |
Add a new key to the SkyFormation unified model for flow log events, named security-group. The new key will contain the security group or network security group relate to the flow log event (if exist) |
See the SkyFormation Unified Events Overview for more information |
Version: 2.1.23
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of AWS GuardDuty alerts | Add support to SkyFormation for AWS Cloud Connector for the new AWS GuardDuty alerts |
To enable it you will need to add the permissions defined at our AWS connector guide first. Next you will see a new end-point in the AWS running connector dynamically being added. The new GuardDuty end-point is enabled by default. |
Version: 2.1.22
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of syslog for RSA NetWitness | Add support of SkyFormation SIEM integration with RSA NetWitness |
Configure the RFC 3164 SHORT option in SIEM Integration settings |
|
Add new General Alert event to the SkyFormation Unified Events |
Add new unified event that resemble general (e.g. security) alert ingested from underlying cloud applications/services, i.e. an Azure log-analytics custom alert rule was triggered. |
Please refer to General Alert for more information |
| Add client indication of the SkyFormation App Version | Add the SkyFormation App Version indication in the SkyFormation web application. |
See Get Your SkyFormation App Version guide |
| Add new severity attribute to CEF | Add new severity attribute to the SkyFormation Header Fields general header of the SkyFormation Unified Events CEF (CEF key dvcpid). |
Version: 2.1.21
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| APIs to manage brand logo and name | Allow a replacement of the SkyFormation logo and name for white-label needs using APIs of set,get,reset |
|
| Upgrade to the new Log Analytics API in SkyFormation Azure Connector | Upgrade to the new Log Analytics API | |
|
Adding Field History log collection to SkyFormation Salesforce Connector
|
SkyFormation Salesforce connector will now dynamically create new sets of end-points for each SObject with field history enabled. | The end-points added will be inactive by default and could be activated in the connector's settings |
|
Fix: Synchronization of users in all cloud connectors |
Fix of duplicated users reported | |
|
Adding docker compose to SkyFormation app |
Adding to the SkyFormation application infrastructure the docker compose module to improve the SkyFormation app self management capabilities |
Version: 2.1.19
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Error parsing timestamp in OMS Logs Analytics Data in Azure Connector |
Timestamp parsing in some OMS Log Analytics events failed. |
Version: 2.1.18
| SKIPPED |
|---|
Version: 2.1.17
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Support to SQS events coming from SNS in custom connector added |
Support events coming into the SQS in the custom connector from SNS (in addition to SQS events coming directly to SQS). |
Version: 2.1.16
| Enhancement/Fix | Summary | Notes | ||||||
|---|---|---|---|---|---|---|---|---|
|
Adding properties to Exchange message flow events |
Adding properties to resource-event in case of mail messages sent (e.g. Exchange message trace). |
Properties added are: message size, sender (cs1), recipient (cs2) | ||||||
|
Fix: Resync events to SIEM bug fixed |
Resync Open API didn't run |
|||||||
|
Improve the Office 365 and Azure connectors test connection |
Removing obsolete connection tests from the connectors to improve response time | |||||||
|
Adding optional query param to Delete a Tenant API |
Add an optional "force" query param with default value of "false" | |||||||
|
Open API - Add ability to activate/deactivate health reports |
Allow health reports to be activated/deactivated via Open API | Docs | ||||||
|
Allow static endpoints activate and deactivate before account initialization |
Classifying account endpoints to static and dynamic to allow, via the open API, to activate or deactivate static endpoints even before account initialization is complete | |||||||
|
New events modeled to |
|
For the planned events please look at: |
||||||
|
Pass raw user agent header to CEF |
Pass raw user agent header, if exists, to CEF |
Version: 2.1.15
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improving the Account Status performance |
Improve the accounts status response time |
|
|
Fix: Azure end-point showed not relevant |
Remove irrelevant end-points from Azure connector |
|
|
Improve Salesforce connector handling of API limit response |
Adding proactive test to ignore the API limit response from Salesforce connector | |
|
Fix: Accounts settings in UI not persistent in some cases |
Update account settings in persistence on any change |
Version: 2.1.14
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to |
|
For the planned events please look at: |
||||||||||||||||||||||
|
Existing Modeled Office 365 Events Adjusted |
In order to meet the new APIs (see below the API changes description) some already modeled events have been adjusted with new API information
|
|||||||||||||||||||||||
|
Adding read only support for Open API |
Support role with read only permissions for the SkyFormation Open API. |
|||||||||||||||||||||||
|
Reduce the Office 365 Exchange reports events ingestion latency |
The latency of the Exchange Advance Threat Defense reports as Malware, Spam, Spoof and others reduced from ~24-48 hours to 10-15 minutes |
|||||||||||||||||||||||
|
Adding Content Inspected event to the SkyFormation Unified Model |
A new event added to the SkyFormation Unified Model represent content being inspected by additional security systems. | |||||||||||||||||||||||
|
Support the new Office 365 APIs replacing the deprecated /reports API |
Microsoft announced its plan to deprecate the Azure AD reports API under https://graph.windows. |
In case you are using the SkyFormation Office 365 information in the CEF cs6 key please consult SkyFormation support on compatibility issues to expect | ||||||||||||||||||||||
|
New UI indication on endpoints status and ability to start/stop each |
Each cloud connector's end-point status is now presented in details in the UI, and an ability to stop/start each end-point is supported in the UI. |
Same capabilities already supported using the SkyFormation Open API in former version | ||||||||||||||||||||||
|
Office 365 |
Adding subtypes to SkyFormation audit-event ingested from Office 365 as actors, targets |
|||||||||||||||||||||||
|
Add SIEM Open API return the SIEM connection |
When calling add SIEM connection via the open API the new SIEM connection together with its generated ID is being returned | |||||||||||||||||||||||
|
Adding "noop" processor to the customer connector |
Allow a "noop" (no process) processor to the custom connector | To ingest unknown or undefined data sources | ||||||||||||||||||||||
|
Fix: Duo processor wrong json handler |
Fix a problem with handling corrupted json processed at the Duo processor used by the custom connector | |||||||||||||||||||||||
|
Office 365 message trace enrichment with advance threats information |
When Exchange message trace event indicate malware, spam or spoof indication the connector will enrich the event with advance threat information from the Exchange ATD service | |||||||||||||||||||||||
|
Fix:Wrong old errors showed in status API |
Remove wrong error indications from the status API | |||||||||||||||||||||||
|
New open API to re-send events to a tenant's SIEM |
New Open API allows the admin to trigger events already sent to the tenant's SIEM to be re-sent | |||||||||||||||||||||||
|
Fix: When user agent header parsing fail send valid data |
When parsing user agent header fails - return client information with user agent header only | |||||||||||||||||||||||
|
Fix: OKTA events parsing resulted in anonymous |
Adding the existing suser information to the OKTA login failed and self reset password events instead of the anonymous indication |
Version: 2.1.13
| Enhancement/Fix | Summary | Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||
|
Adding list of mail traffic event types |
Mail traffic event types are now: Malware, TransportRuleHits, SpamIPBlock, SpamDBEBFilter, |
|||||||||
|
Adjust exchange reports retrieval time |
Set the Exchange admin reports (Spam, Malware, DLP policy) retrieval time to 24 hours, to align with their creation time |
|||||||||
|
Fix: High CPU usage |
High CPU consumed by postgress | |||||||||
|
Fix: Open API activate and deactivate failure for endpoint |
Open API activate resulted in deactivated |
Version: 2.1.12
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||||||||||||||||
|
Adding Health Report |
Adding additional information sent to the SkyFormation health service on server version, end-point level sync status and more |
|||||||||||||||||||||||
|
Add Open API for SIEM management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Add Open API for Tenant Management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Fix: Event report-anomalous-signin modeling |
Fix the modeling problem in the event | |||||||||||||||||||||||
|
Fix: Events synced but do not sent to SIEM |
In high volume deployments (over 20K events waiting to be send to SIEM) some events were not sent to the SIEM. |
Version: 2.1.11
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Some API calls not working (Severity: High) |
Some API calls not working due to incorrect way of configuration settings persistence |
Version: 2.1.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Events synced but not sent to SIEM (Severity: High) |
In high EPS deployments (mostly when IaaS connectors involved) some synced events would not be sent to SIEM. |
Version: 2.1.9
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improvement in the AWS connector API throttling mechanism |
Improving the API throttling mechanism used by the AWS connectors |
Version: 2.1.8
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Adding integration identifier to Duo Security connector |
Adding integration identifier to the Duo Security connector |
Version: 2.1.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Add clean/suspicious/infected as an action CEF value |
Adding to the CEF model the file infection level as returned from the malware/content inspection system when using the Malware Extender module. The dimension is added to the malware alert unified event | |
|
Fix: Race condition bug fix in event sync (Severity: Medium) |
Fix a race condition scenario when events are synced with the same millisecond value and are handled by different threads | |
|
Improve performance of syslog sending |
Improvement in syslog send task achieved by caching the SIEM definition | |
|
Fix: Event loss in Office 365/Azure connectors when connection is lost (Severity: High) |
Re-attempting mechanism fix in Office 365 and Azure connectors when sync is failing due to connectivity issues | |
|
Add configurable header to OKTA connector |
Attach to OKTA API calls header to identify SkyFormation platform | Allow partnership optimization with OKTA |
Version: 2.1.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: OKTA and SNOW connectors encryption property handling (Severity: Medium) |
Fix handling of authn property value to encrypted rather than clear text in Okta and SNOW |
Version: 2.1.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: CPU utilization bug (Severity: High) |
CPU utilization reach 100% in some scenarios |
looks like related to data eviction calls |
|
New Malware alert event |
Introducing new event for Malware detected as part of the new Malware extension module |
|
|
New Malware Extender module |
Introduce new module called "Malware Extender" that integrates with sandbox/content inspection systems and extend their coverage on cloud scenarios |
Support McAfee ATD at release |
Version: 2.1.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Open API for accounts |
Adding SkyFormation Open API to manage cloud connectors (aka accounts), get their running and health status and more. Please see: |
|
|
Bug fix (Severity: High) |
AWS Cloud Connector CloudTrail events wrongly processed because of incorrect ARN process |
Few events were incorrectly processed |
|
Bug fix |
On TCP connection dropped with SIEM, events were missing. A fix to the retry mechanism implemented. |
App will retry 10 consecutive tries to send existing event and if all fail will drop the task, which will be later picked again by tha pp for processing. |
Version: 2.1.3
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
New event OKTA events modeling |
The following OKTA events were modeled: Successful Okta Verify Push factor attempt, Successful Google Authenticator factor attempt, User Locked Out, Successful Okta Verify factor attempt, Rich client authentication failed, User logged in to the Admin app,User provisioned to app, User deprovisioned from app, Session created for user using API token, User updated their Okta password, User failed to update their okta password, User added to group All Employees by admin, Self-service password reset attempt denied, Read only admin privileges granted, Okta User profile updated, Okta user has been activated, Failed Google Authenticator factor attempt, Failed Okta Verify factor attempt,User removed from group All Employees by admin, Implicitly revoked tokens for client, API Token created, API Token created for client application Okta Mobile Client, App configuration updated |
|
|
Adding "Suspend User" and "Unsuspend User" support to Office 365 Remediation |
Office 365 cloud connector support now additional actions of "suspend user" and "unsuspend user" in the SkyFormation Remediation API |
Version: 2.5.0 (June 9 2020)
| Enhancements / New Features | |
| Infrastructure change : move configuration data from zookeeper to etcd | |
|
Zoom connector - added support for oauth type authentication |
|
| Fixes | |
|
Office365 connector - management-exchange endpoint - fix regression where message type (mapped to CEF fileType field) was detected by parent folder full match, instead of prefix |
|
| Gsuite connector - fix null pointer exception in GMailLogs endpoint | |
| Cylance connector - fix handling of empty response from Cylance + add debug information to further debug the issue |
Version: 2.4.264 (May 22 2020)
| Enhancements / New Features | |
| Azure connector EventHub endpoint - Improve the data ingestion EPS rate in more then 5X | Could ingest high rate EPS environments with 25K EPS and above |
| Crowdstrike connector - Support the new API gateway | |
| AWS connector - Improve the errors' readability, sent to the webapp's user | |
| Slack connector - Changed the default "past sync time" value to | |
|
New event metrics sent to the SkyFormation health monitor cloud service at report.skyformation.net:
|
See: https://support.skyformation.com/hc/en-us/articles/115000591005-SkyFormation-Cloud-Endpoints For more information on the events details and structure.
|
| Fixes | |
Version: 2.4.259 (May 6 2020)
| Enhancements / New Features | |
| New connector - Zoom connector | |
| New endpoint - Azure connector - Support Graph Security Alerts endpoint | |
| New endpoint - SentinelOne connector - Support deep visibility endpoint | |
| Azure connector Eventhub endpoint - Add support for national clouds | |
| Azure connector Log Analytics endpoint - Improve ingestion speed, reduce memory footprint | |
| Azure connector Eventhub endpoint - Improve ingestion speed | |
| Fixes | |
| Azure connector Log Analytics endpoint - Collect events from partial response/disconnects | |
| Office 365 connector,Activity Management endpoints - Fallback on invalid/unknown events to still generate audit event with some significant fields | |
| Proofpoint connector - Rate limiting. Align the request throttling with the Proofpoint docs | Throttling policy - 1 API call/ min |
Version: 2.4.248 (Apr 27 2020)
| Fixes | |
|
Azure connector - Dynamic endpoints with errors disappear from connector |
e.g. Log An analytics |
|
CloudFlare connector - Out of memory |
|
|
Mimecast connector - Timeout extended to 10 minutes (from 2) |
|
|
Custom connector - Improve performance where AWS S3/SQS in use |
|
| Sale cloud connector EventLogFile endpoint - Separate the events into multiple endpoints per event type generated in the account | see: https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_objects_eventlogfile_supportedeventtypes.htm |
Version: 2.4.244 (Apr 21 2020)
| Fixes | |
| Azure connector - Memory leaks | |
| Crowdstrike connector - Date parsing |
Version: 2.4.236 (Apr 13 2020)
| Enhancements / New Features | |
| Changes internal metrics monitoring system. | Information is available at http://localhost:8089 instead of http://localhost:9090 |
Version: 2.4.235 (Mar 29 2020)
| Enhancements / New Features | |
| Azure connector Log Analytics endpoint - Add the option to provide a filter query (Default is no filter). | |
| Fixes | |
| Cylance connector - Fix the 2.4.233 Cylance fix | |
| Symantec Wss connector - Unlicensed certificate will no longer be classified as a security threat as it appears in a very large portion of the events. |
Version: 2.4.233 (Mar 25 2020)
| Enhancements / New Features | |
| Cylance connector - Support new endpoint “Memory Protection” | |
| AWS MT connector - Support non default S3 region | |
| Fixes | |
| Cylance connector - Critical fix in the events retrieval mechanism |
Version: 2.4.232 (Mar 23 2020)
| Fixes | |
| Azure connector - Ensure uniqueness in Storage Accounts cache to prevent memory bloat | |
| Azure connector eventhubs endpoint - Memory bloat due to incorrect in-memory data store use | |
| Office 365 connector - Improve handling of errors due to API throttling | |
| AWS connector - Allow use of China regions use of STS authn |
Version: 2.4.230 (Mar 15 2020)
| Fixes | |
| * Critical fix in entire connectors * - A regression causing all failures of all types to be translated to “task timed out”. |
The regression was entered to release 2.4.226. Please upgrade to the latest version in case you are using version |
| Office 365 connector - Remove deprecated graph identity protection endpoints | See: https://developer.microsoft.com/en-us/office/blogs/deprecatation-of-the-identityriskevents-api/ |
| Salesforce connector - Fix EmailMessage processing |
Version: 2.4.224 (Feb 24 2020)
| Enhancements / New Features | |
| New connector - Ping |
Connector's overview page: https://support.skyformation.com/hc/en-us/articles/360011689220-Exabeam-Cloud-Connector-for-Ping Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Workday |
Connector's overview page: Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| New connector - Cloudflare |
Connector's onboard page: Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| GCP connector - Allow collection of events from global sink | |
| Platform - Add to the webapp next to the connector/account settings raw a link to the connector's guide | |
| Fixes | |
| Custom connector - Azure backend - handle explicitly error of failure to read blob while it is being written to | |
| Crowdstrike connector - Reduce the period of time where the connector attempt to recover lost events in queue. | |
| Azure connector - Pull events in iterations from eventhub |
|
| Crowdstrike connector - Recover the log collection cursor on crash to the last cursor position. |
|
| Azure connector - Delete downloaded data blob if no advance in data pull |
Version: 2.4.206 (Jan 22 2020)
| Enhancements / New Features | Notes |
| New Exabeam AA/LMS parser for Cybereason cloud connector |
The CloudConnector is available since SkyFormation 2.4.194 (see below). This is only an indication that the Exabeam parser for the cloud connector is now available for download in here: |
| Entire connectors - Manual connector's sync reset |
Using the webapp you could now reset a connector's (aka account) sync history and cause the connector to start its sync attempts as if it was just onboarded (ignore sync history tasks). The sync reset is also available in a more granular endpoint level (not the entire connector's endpoints). This action should be used with care because it might bring duplicated events for time slots already synced pre reset in case they did. For example in a case where the connector already synced the entire events up until 3 hours and the reset button will be used, if the specific connector's settings is to start events sync from the previous 24 hours the entire events from 24 to 3 previous hours will be synced again (if re-sync supported by the connector) hence duplicated events result . Consult with us for more information. |
| New cloud connector - Fidelis |
Please see: https://support.skyformation.com/hc/en-us/articles/360011429839-Adding-Fidelis-Cloud-Connector for onboarding instructions.
Parser for Exabeam LMS/AA for this cloud connector will soon be published. Please look in https://support.skyformation.com/hc/en-us/articles/115001270413-SkyFormation-Supported-Cloud-Connectors (our supported cloud connectors page) to check for the parser availability. Once the parse is available we will add it to the relevant cloud connector's raw for download. |
| General - Support encrypted AD user info in configuration file |
You could now use encrypted AD user's info in the shiro configuration file. See: https://support.skyformation.com/hc/en-us/articles/115000999074-How-to-Configure-SkyFormation-Authentication-to-Use-ActiveDirectory-Server for more information |
| Fixes | |
| Google Cloud Platform (GCP) connector - Limit the retrieved page size |
Change page (pagination mechanism) size retrieved to 1,000 from 10,000. Larger page size caused retrieval issues on some large scale GCP deployments. |
| General (High) - Race condition in internal cache fixed |
Such condition will result in missing endpoints in connectors that have dynamic endpoints |
Version: 2.4.204 (Jan 17 2020)
| Enhancements / New Features | |
| *** Deprecation notice *** - Github connector - Basic Authentication support with the Github APIs used by our cloud connector when configured to, will soon be removed by Github. |
We recommend on using the cloud connector personal token method supported instead of the Basic Authentication one in case you use it. |
| New connector - SentinelOne | |
| CrowdStrike connector - Support V2 of the api + oauth2 authentication | |
| Fixes | |
| Custom connector with Azure backend - Connection pool is now elastic instead of fixed | |
| Symantec email cloud - Critical fix |
Version: 2.4.200 (Dec 22 2019)
| Enhancements / New Features | |
| *** New connector *** - SentinelOne |
To add SentinelOne connector to your SkyFormation app see: https://support.skyformation.com/hc/en-us/articles/360010560159-Adding-SentinelOne-Cloud-Connector- Connector's content package for Exabeam DL & AA available at: |
Version: 2.4.198 (Dec 15 2019)
| Enhancements / New Features | |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Consume less memory and improve sync reliability. | |
| Office 365 connector MCAS endpoints - Expose configuration that allows for setting initial sync time to other than the default 24hr. | |
| Fixes | |
|
SymantecWss connector (Critical) - Fixed duplicated events caused by wrong events collection.
|
If you are using this connector please upgrade |
| Office 365 connector exchange-admin-reports-message-trace endpoint - Avoid failing the entire endpoint when enrichment fails. | |
| Office365 connector exchange-admin-reports-message-trace endpoint - Enrichment supports special characters scenario. | |
| Office 365 connector management-general endpoint - Handle values not in the spec in events of type alert and model them as security-alert events. |
Version: 2.4.194 (Nov 30 2019)
| Enhancements / New Features | |
| New cloud connector - Cybereason |
Please look in this page for a downloadable Exabeam content/parser for Exabeam AA/LMS for this cloud connector. We will upload the Exabeam related parser in here as soon as it is available. |
| *** AWS Cloud Connector **** - Major refactor to allow automatic resources discovery and monitor across multiple AWS regions. |
Your careful attention and actions are required if you are using AWS Connector today. Please follow this guide to understand the update implications and recommended action: |
| Egnyte Connector - Move to public APIs only | |
| Fixes | |
| CrowdStrike connector Streaming API endpoint (Medium) - Handle empty response better | Prevent data duplication error |
| Azure connector - Reduce the number of calls to retrieve storage account keys | Relevant for customers that received error codes from the Azure Storage Analytics and Azure Activity Log endpoint for over using listKeys action. |
Version: 2.4.183 (Nov 10 2019)
| Enhancements / New Features | |
| Custom connector - Support Azure Storage as data source | |
| Office 365 - Support Risk Detection API | See: https://docs.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-beta |
| GCP connector - Improve parallel data consumption | |
| GCP connector - Support GCP sink level control | |
| Egnyte connector - Allow setting of API throttling | |
| New endpoint - Gmail Logs in G-Suite connector | Support via BigQuery. See: https://support.google.com/a/answer/7233312?hl=en |
| Fixes | |
| Office 365 MCAS endpoint - Handle events without users/location etc | |
| Office 365 MCAS endpoint (Medium) - Prevent event duplication due to wrong time parsing | |
| GCP connector (Medium) - Fix thread leak | |
| * Any connector (High) - Prevent numerous retrieval of the same events time frame (events duplication), in case of API limit or error | Will affect mostly specific endpoints with restrictive API thresholds and will likely to recover at last. Events duplication will occur. |
| Slack connector - Keep the connector's authentication credentials after set | |
| Rapid7 connector (High) - Handling aborted sync request | |
| CarbonBlack connector (High) - Handle event retrieval dropping | |
| Egnyte connector - Fix API throttling | |
Version: 2.4.165 (Sep 24 2019)
| Enhancements / New Features | |
|
Custom Application Connector - add Azure Storage as data source.
|
|
| Event Modeling | |
| Fixes | |
|
AWS connector - close AWS CloudWatch Logs Groups and Redshift resources when sync. completes.
Fixes bloat in open files
|
|
| AWS MultiTenant connector - reflect errors in sync. to task's status, UI and OpenAPI (vs. today that they're only logged) | |
|
Office365 connector - Graph endpoints - Make consecutive search use inclusive on start, exclusive on end (vs. exclusive on both today)
|
|
|
Azure connector - NSG Flow Logs - add safety handling for malformed Flow Logs in V2 where number of packets is not present
|
|
|
Azure connector - EventHub - close more resources on failures, prevent thread and resource leaks on edge cases. Also, reflect errors in sync. to UI, OpenAPI
|
|
|
Symantec WSS - Allow up to 10 min. of connection to download larger payloads
|
|
Version: 2.4.162 (Sep 15 2019)
| Enhancements / New Features | |
| *** New connector *** - Symantec CloudSOC |
See more information at: Connector's content package for Exabeam DL & AA available at:
|
| *** New connector *** - Cisco Meraki |
See more information at: Connector's content package for Exabeam DL & AA available at: |
| Event Modeling | |
| Azure connector - Support Azure NSG flow logs V2 | |
| Fixes | |
| Carbon Black connector - Handle Carbon Black API 10000 per call limit with self paging | |
| Office 365 connector MCAS service - Fix in iterative data fetch mechanism | |
| AWS connector CloudWatch Logs endpoints (High) - Fix a memory leak | |
Version: 2.4.156 (Aug 15 2019)
| Enhancements / New Features | |
| Cisco Umbrella - Support Proxy and IP Logs services | |
| Event Modeling | |
| AWS Guard Duty service - Additional dimension to existing events | |
| Fixes | |
| Symantec WSS connector - Improve retrieval logic | |
|
Azure connector - Support very large Azure deployments |
Relevant to Azure deployment with hundreds of endpoints (e.g. Storage analytics/ Workspaces / NSG flaw logs data source) or above |
|
Azure connector - Storage analytics endpoints events sent directly to SIEM by default |
|
|
Bitglass connector - Add raw events (cs6 CEF field) to event where was missing |
|
Version: 2.4.146 (Aug 8 2019)
| Enhancements / New Features | |
| Tomcat version used by the product upgraded from 8.5.39 to 8.5.43 |
See the Tomcat release notes with the CVE related fixes at: |
| AWS connector - Support additional regions added to AWS | |
| Crowdstrike connector - Performance improvement to the file collector and downloader endpoints | |
| Event Modeling | |
| AWS connector - Additional CloudTrail events modeling | |
| AWS connector Guard Duty service - Alerts are modelled now as unified event security-alert-detected with much more details per event. | Alerts will be sent twice once in former unified model (general-alert) and once in the new form for backwards compatibility. |
| Bitglass connector - Additional events modeling | |
| Fixes | |
| Crowdstrike connector - handle events with the timestamp field as Date not epoch millis | |
| Cisco Umbrella connector - Make the prefix field optional to support customers with managed AWS bucket option where no prefix exist | |
| Office 365 MCAS endpoint (High) - Fix bug of missing alerts and improve events retrieval frequency |
Missing Alert type events fix. Highly recommend to update if Office 365 connector is in use with MCAS service. Frequency is down from ~5 minutes to ~2 minutes |
| Crowdstrike FDR and Custom connectors (Medium) - Connection leakage issue fixed | |
| AWS Multi-tenant connector (High) - Handle validation messages in CloudTrail | Only relevant if "send validation messages" is enabled for the monitored CloudTrails |
Version: 2.4.135 (Jul 4 2019)
| Fixes | |
| (Critical) Error when running behind a proxy | If you have a SkyFormation app version 2.4.x running behind a proxy please upgrade to this version. |
Version: 2.4.134 (Jul 2 2019)
| Enhancements / New Features | |
| *** New connector *** Mimecast Email Security | See: https://support.skyformation.com/hc/en-us/articles/360026065773-SkyFormation-for-Mimecast-Email-Security-Connector-Overview |
Version: 2.4.122 (Jun 25 2019)
| Enhancements / New Features | |
| *** New connector *** Bitglass | See: https://support.skyformation.com/hc/en-us/articles/360025471673-SkyFormation-for-Bitglass-Connector-Overview |
| Event Modeling | |
| Fixes | |
| Azure NSG - support NSGs where the storage and the NSG are on different subscriptions | |
| Fix rare race conditions where the health reporter caused out of memory when its files are incorrectly missing | |
|
Crowdstrike connector - Reduce options to authenticate for FDR endpoint to only Access key and Secret, as this is what Crowdstrike provides |
|
Version: 2.4.113 (Jun 14 2019)
| Fixes | |
|
OpenAPI / Accounts create and update - support account authn. Adding structure of 2.3.x as well as 2.4.x in requests input for backwards compatibility (response is always 2.4.x format) |
|
Version: 2.4.112 (Jun 12 2019)
This is a major release with important SkyFormation platform internal/infrastructure changes.
We highly recommend on reading this https://support.skyformation.com/hc/en-us/articles/360024437653-New-SkyFormation-platform-2-4-X-changes-additions-overview 2.4 major changes overview page before you upgrade your SkyFormation instance to this new version.
| Enhancements / New Features | |
| *** New connector *** - Tenable IO | See : https://support.skyformation.com/hc/en-us/articles/360024409554-SkyFormation-for-Tenable-io-Connector-Overview |
| *** New connector *** - Symantec SEP mobile | See: https://support.skyformation.com/hc/en-us/articles/360022937514-SkyFormation-for-Symantec-Endpoint-Protection-Mobile-SEP-Mobile-Connector-Overview |
| *** New connector *** - Cisco Umbrella connector using the Cisco managed S3 bucket | For customers with their own AWS the SkyFormation Custom connector with Cisco Umbrella parser is recommended for high volume deployments. Please contact support@skyformation.com for more information |
| *** New connector *** - Palo Alto Aperture (CASB) | See: https://support.skyformation.com/hc/en-us/articles/360022203334-SkyFormation-for-Palo-Alto-Aperture-Connector-Overview |
| AWS connector - Support assume-role and instance-profile authentication methods | See: https://support.skyformation.com/hc/en-us/articles/211318969-Adding-AWS-Connector-To-SkyFormation-Platform for information on how to use any of these two new authentication methods. |
| Centrify connector - Support automatic token renewal in authentication scheme | Different authentication credentials are needed |
| Office365 connector - New Graph endpoints for Azure AD events (read carefully the notes section at the right side) |
Background
Two audit sources (aka endpoints) supported for a long time by the Office365 connector are:
* sigins-events
* audit-events
These endpoints include the main Azure AD important events as the login events and many others.
Microsoft have decided to add two new endpoints that would eventually replace the former for the Azure AD events. The new endpoints names are identical to the former and are available as part of the Graph API.
Meanwhile the former endpoints are still working but it seems they will be removed at some point (already removed from the Office 365 docs).
To make the two sets of endpoints (former and new) easily distinguished (having the same names) the new Office 365 connector renamed the former endpoints to:
* sigins-events deprecated
* audit-events deprecated
and the new one are named as-is, like the former.
Events compatibility challenge and SkyFormation fix
The two new endpoints do not keep events structure compatibility with the two former endpoints.
SkyFormation Office 365 connector however includes mapping of the new Azure AD events from the new two endpoints into the same events SkyFormation unified events structure used in two former endpoints.
It means for you that if your detection rules/monitors are using the SkyFormation unified events fields for events coming from these endpoints switching between the two former endpoints with the new one will have no impact on your rules/monitors!!!
Events duplication challenge and recommended solution
Since the new connector supports both former and new set of endpoints, if you will enable both sets you will get duplicated Azure AD events at your SIEM.
So we recommend on doing the following:
a. Give the needed permissions (see below)
* The two new endpoints are enabled by default and they will start working as soon as permission is granted
b. Disable the two old endpoints
c. Validate your rules/monitors using the Azure AD events works as expected.
You could do this process at your convenience but knowing the former endpoints could and would probably be removed we recommend on doing this switch soon.
How to enable the two new endpoints
To be able to get events from the two new endpoints you should add a new Graph API permission (
Microsoft Graph -> AuditLog.Read.All) to the Azure app used by the Office 365 connector.
see:
|
| Azure connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211322249-Adding-Azure-Connector-To-SkyFormation-Platform |
| Office365 connector - Support authentication using ClientID + Certificate | See https://support.skyformation.com/hc/en-us/articles/211709705-Adding-Office-365-Connector-To-SkyFormation-Platform |
| GCP connector - Support GCP security center service | New audit endpoint |
| AWS connector - Support Shield and Inspector services | Using two new audit endpoints |
| Event Modeling | |
|
** Breaking compatibility change ** Adding to the entire SkyFormation events two new dimensions of: |
The CEF fields used now for these two new dimensions have been used in the following two SkyFormation unified events only: 1) Security Threat Detected 2) Traffic Flow Event So in case your detection rules/monitors are using any of the above two events at the specific connectors detailed above for each please consult with us at support@skyformation.com and we will guide you on how to upgrade safely and have no compatibility issues. |
|
New Skyformation Open-Api : version |
https://support.skyformation.com/hc/en-us/articles/360024610413-Version-API |
Version: 2.3.148
| Enhancements / New Features | |
| Azure connector/Azure Storage Analytics endpoint - Split the single endpoint into endpoint per storage account for granular control | |
| Event Modeling | |
| Okta connector - Map additional user type "AppUser" | |
| Fixes | |
| Office 365 connector/Graph identity protection endpoint - Handle cases where location field is missing or broken | High if the endpoint is in use in your environment |
| Office 365 connector - If an error occur while process an event the original JSON will be sent to SIEM in cs6 | In some cases instead of the original event in cs6 the java class error would be placed as raw |
| Office 365/Azure AD events - Handle multiple event formats for same event | |
| Azure connector/Azure Storage Analytics endpoint - Support national cloud | |
| Symantec WSS connector (High) - Better handle the API throttling restrictions | |
| Carbon Black connector (Critical) - Comply with the API throttling restrictions | |
Version: 2.3.140
| Enhancements / New Features | |
| AWS connector - Support Redshift events |
|
Version: 2.3.139
| Enhancements / New Features | |
| Custom connector:pass-through processor only -Add an option to filter out (not send to SIEM) some retrieved events, using config file |
|
| Symantec WSS - Add to the webapp an option to filter out (not send to SIEM) some retrieved events |
|
| Event Modeling | |
| Rapid7 InsightVM connector - Mapping the string "vulnerability detected" to CEF flexString1 field (native action name field) | |
| Custom connector - Cisco Umbrella processor - Support the new Cisco Umbrella data structure (version 4) | |
| Fixes | |
| Azure connector (high) - Support SSL in the iaas-storage-analytics |
If any of your storage accounts is configured to force SSL connection you must update to our latest version. |
Version: 2.3.137
| Enhancements / New Features | |
| New connector - Rapid7 InsightVM |
For more information see: |
| Event Modeling | |
| Fixes | |
| AWS connector - Handle invalid/unknown values | |
Version: 2.3.135
| Enhancements / New Features | |
| New connector - CB (Carbon Black) Defense | For more information see: https://support.skyformation.com/hc/en-us/articles/360019656833-SkyFormation-for-CB-Carbon-Black-Defense-Connector-Overview |
| AWS connector - Add CloudWatch Logs retrieval using S3 bucket | |
| Reduce default "max recovery period" settings from 7 days to 1 day | |
| Azure connector - Azure Security Center alerts retrieved via iaas-events (aka Activity Log) endpoint | Also accessible via EventHub if the Activity Log (iaas-events API) is forwarded to it and fetched. |
| Custom connector - Allow pre-processing of events using Sawmill syntax | See https://github.com/logzio/sawmill/wiki for syntax information |
| Event Modeling | |
| WSS connector - Network flows events modeled | |
| Fixes | |
| G-Suite - Handle too large response (responseTooLarge) API error | |
| DUO connector - Handle users pagination | |
Version: 2.3.130
| Enhancements / New Features | |
|
Support Azure National Clouds (aka Sovereign clouds) () Azure AD for US Government () Azure AD Germany () Azure AD China operated by 21Vianet |
Any existing SkyFormation for Azure connectors will keep on using the default Azure AD (Global service) and will have no impact. The default Azure National Clouds choose in a new SkyFormation for Azure connectors is the standard Azure AD (Global service).
For information on how to configure your SkyFormation for Azure connector to support any of the Azure National Clouds (not the global service) please refer to: |
| New connector - Symantec Web Security Service (WSS) | Connector Overview: https://support.skyformation.com/hc/en-us/articles/360018684393-SkyFormation-for-Symantec-Web-Security-Service-WSS-Connector-Overview |
| Custom connector - Support Parquet file format | |
| Fixes | |
| AWS connector - Handle undocumented entities | |
| DUO connector - Users sync | |
| (Medium) All connectors - Event duplication | Low probability |
Version: 2.3.120
| Enhancements / New Features | |
| New connector - Symantec Email Security.cloud (aka MessageLabs) | Connector overview: https://support.skyformation.com/hc/en-us/articles/360018542394-SkyFormation-for-Symantec-Email-Security-cloud-Connector-Overview |
| Fixes | |
| CrowdStrike FDR - Streamline performance | Bucket region automatically detected |
| Platform - Restrict concurrency | |
Version: 2.3.111
| Enhancements / New Features | |
| New Connector - CylanceProtect |
Connector overview: How-to add the connector guide:
|
| New Connector - Slack Enterprise Grid |
Connector overview: How-to add the connector guide: |
| CrowdStrike FDR - New endpoint in the CrowdStrike connector | |
| G-Suite connector - Allow settings of page size in endpoint level | Email support@skyformation.com for settings steps if needed. |
| Open API - Support setting to send all events collected by connectors directly to SIEM and bypass SkyFormation internal database. |
NOTE: Feature added for improved performance but will remove the SkyFormation app console feature. To use the new setting see the new ConnectorSyncSettings needed at: And how to use it guide at: |
| Reduce number of license validation calls to SkyFormation cloud service | |
| Add the indication of the tenant id in SkyFormation web app | Relevant for the SkyFormation multi-tenant edition and is available in the tenant settings page in the SkyFormation web app. |
| Events Modeling | |
|
Breaking compatibility change ! Replace the policy-checked unified event with a new security-threat-detected event. |
Impact background: 1. policy-checked event was introduced in SkyFormation version 2.3.84 released at 2. Impacted connectors/endpoints For a more detailed explanation on the change please see: |
| CrowdStrike connector - Parse the source event time and action name to the unified events | |
| Fixes | |
| All connectors - Extension fields with whitespace in name not sent | |
| AWS connector - Fix the AWS Macie endpoint (added SQS URL configuration) | |
| Remove the htaccess file from the deployment | The file is a remaining of an old web server not used for a long time and has no security implications when exist. |
| Office 365 connector - Fix parsing of events collected from few graph APIs with security threats and anomalies alerts |
|
Version: 2.3.92
| Fixes | |
| Okta connector security vulnerability is fixed. |
The fix was introduced in SkyFormation 2.3.84 version. The vulnerability is that the Okta token is sent to the Okta cloud service for authentication in the HTTP user-agent which might be stored by intermediate devices as proxies. In case your SkyFormation app version used is 2.3.84 or higher and you use a SkyFormation for Okta cloud connector we recommend on doing the following: a. Upgrade your SkyFormation app instance to the latest version b. Create a new Okta API key and configure your Okta cloud connector to use the new token. Invalidate the former token. |
Version: 2.3.91
| Enhancements / New Features | |
| New connector - Prooftpoint ATP | See: SkyFormation for Proofpoint ATP Connector Overview |
| Events Modeling | |
| Cisco AMP: Add modeling for "install started", "install failed", "multiple injected files" | |
| Sophos cloud: Model additional alerts and events | |
| Fixes | |
| Cisco AMP: Add region to the connector's credentials when not US region account is used | |
Version: 2.3.87
|
Fixes
|
|
| G-Suite connector - Changing the way we retrieve events from the APIs (from time ranges to cursor) for better stability | NOTE: After upgrading the last 24hours events will be synced again once. |
Version: 2.3.86
|
Enhancements / New Features |
|
| New connector - Netskope |
See the overview page in here. See the "how-to-add" guide in here. |
|
Events Modeling |
|
| LastPass connector - New event modeling - Require Password Change, Destroy All Sessions, Remove from Group, Account lockout, | |
|
Fixes |
|
| Updated existing connectors with new endpoints will now show-up | |
| Handle the case where connectors with cursors when API return null cursor | |
Version: 2.3.84
|
Enhancements / New Features |
|
| New connector - LastPass Enterprise |
For more information please see: |
| New connector - Cisco AMP |
For more information please see: |
| New connector - Centrify Cloud | For more information please see: https://support.skyformation.com/hc/en-us/articles/360012448994-SkyFormation-for-Centrify-Connector-Overview |
| Okta - New API (aka endpoint) "System Logs" support added (*** Endpoints are all disabled by default. Please enable the one you need) |
Important note on your API change impact: SkyFormation ensure the events retrieved from the new API in case same event as the one retrieved from the former API are mapped to the same SkyFormation unified events structure. If you already have any detection rules/monitor/analysis runing on the Okta event from the former API most likely you will see minimal to no impact. Please validate after using the new API to make sure. Currently none active by default (endpoint). It comes to replace the former API "Events" that is about to be deprecated soon. Important note on migration to new API: 2) For customers with Okta accounts: Please enable the API/endpoint you need. |
|
Events Modelling |
|
| content-inspected SkyFormation unified event (mostly for Malware & DLP events) is now modelled as policy-checked. |
Events changed by connector: |
|
Fixes |
|
| Salesforce connector - Reduce memory consumption when collecting Event Log File API/endpoint events. | |
Version: 2.3.82
|
Enhancements / New Features |
|
| Citrix ShareFile connector - Support oAuth2 interactive authorization | |
|
Events Modelling |
|
| Salesforce connector - Model suOrgAdminLogin event | |
|
Salesforce connector - fix processing of loginHistory event via mobile app |
|
|
Fixes |
|
| Salesforce connector - Fix field history processing | |
| AWS connector - Event retrieved from GuardDuty are also the updated findings (not only the created findings) | |
Version: 2.3.77
|
Enhancements / New Features |
|
| tenant id is now sent to the SkyFormation health service from SkyFormation apps | |
| Improving the connectors concurrency handling | Better performance and lower risk of event lose |
| Support AWS Kinesis for events retrieval of CloudWatch logs | NOTE: existing CloudWatch Logs endpoints will fail upon upgrade. See to this guide for required setup process |
| Support AWS SQS for event retrieval in the custom connector | Full events should reside in the SQS |
|
Events Modelling |
|
| Align with the new Office 365 management API modeling changes | |
| web-app added as a resource type in resource-event | |
| AWS GuardDuty alert description is mapped into the SkyFormation general alert description event | |
| AWS GaurdDuty raw event (CEF cs6 field) is coming as JSON | |
| Azure blob object is not mapped as file type not blob (CEF fileType) | |
| Adding native action name to the Azure storage analytics events (e.g. blob events) | In CEF flexString1 |
| Azure blob events present now the blob name without its full path | |
|
Fixes |
|
| Office 365 login-success with action named "saassuccess" were incorrectly mapped to login-failure | |
| Office 365 API error handling improvements | More resilient to API break |
| Office 365/OneDrive filename parsing error in ACL update events | |
| Custom connector when using Windows processor an empty JSON is not required now | |
Version: 2.3.53
|
Enhancements / New Features |
|
| Task management better handle large number of accounts (aka connectors). | |
|
Events Modeling |
|
| Azure NSG rule change event include new fields. | |
|
Fixes |
|
| Citrix ShareFile event date parsing. | |
| Start/Stop account's endpoint button behaviour. | |
Version: 2.3.51
|
Enhancements / New Features |
|
|
New Sophos Central connector |
See more details at: |
|
New Citrix ShareFile connector |
See more details at: |
|
Support account (aka connector) export and import via OpenAPI |
Allow SkyFormation account migration between SkyFormation instances. |
|
Events Modeling |
|
| Azure NSG rules modelled when target is also ASG | |
|
Fixes |
|
| Azure flow logs data retrieval error. | |
| Azure enrichment failure on Azure apps due to API changes. |
|
| Office 365 file share event aligned with new Microsoft event structure. | |
| Azure AD role assigned and unassigned share event aligned with new Microsoft event structure. | |
| Fix session timeout. | |
Version: 2.3.40
|
Events Modeling |
|
| New event's "Properties Bag" added to the entire SkyFormation's events. |
The "Properties Bag" includes the entire raw key/values automatically parsed and added as key-value pairs at the end of the events. Please make sure to carefully read our "Properties Bag" overview guide before start using it for monitoring/detection. |
|
Fixes |
|
| Entire connectors (Medium): Better handle connection closing. | Mostly affect Office 365 and Azure connectors in heavy load deployments. |
| When SIEM integration in SkyFormation is configured to send events as JSON some endpoints still used CEF encoding |
|
Version: 2.3.35
|
Enhancements / New Features |
|
|
G-Suite connector: Open API allows scopes to be optional (using default scopes now). |
|
|
SkyFormation webapp: Allow "cancel" in account edit page. |
|
|
Events Modeling |
|
| G-Suite connector: Model Google Group permission changed | |
| Box connector: SkyFormation events from Box will now extract from the Box events the user identity type to "email" type and not "username". | |
|
Box connector: SkyFormation events from Box when source user is "unknown" but exist in raw event will be correctly extracted. |
Exist in some login success and failed events. |
| Box connector: Model FILE_MARKED_MALICIOUS event as "content-inspected". | |
| Box connector: Model ITEM_SHARED_UPDATE event as "resource-acl-updated". | |
| Box connector: Enrich file related events with the file exposure scope (e.g. public exposed, password protected...). | |
| Box connector: Model COLLABORATION_REMOVE and COLLABORATION_ROLE_CHANGE events | |
| Box connector: Raw data (cs6) is now send as JSON object not string. | |
| Box connector: Model MOVE event. | |
| G-Suite connector: Model CREATE_DATA_TRANSFER_REQUEST, ENABLE_API_ACCESS, ADD_DOMAIN_ALIAS, CHANGE_ORGANIZATION_NAME, TOGGLE_SERVICE_ENABLED, FAILED_PASSWORD_ATTEMPTS_EVENT |
|
| G-Suite connector: Raw data (cs6) is now send as JSON object not string. | |
| G-Suite connector: Add ClientInformation.Device.model in CEF. | |
| Okta connector: Fix extraction of source user in a failed login events where source user is specified in a different place. | |
|
Fixes |
|
| G-Suite: SkyFormation Open API history tables enabled is now optional. | |
| (Critical bug fixed) Office 365 connector: Fix regression introduced at v2.3.31 that could cause events lose in Management Activity API in high load. |
|
| Office 365 connector: Fix pagination handling. | |
| SkyFormation webapp: Fix account deletion freeze in UI. | |
| SkyFormation webapp: Fix UI failure if "test connection" is pressed before "Done" when adding /editing account. | |
| SkyFormation webapp: When creating new account choosing "tenant" and "application" is now mandatory before account is created. | |
Version: 2.3.31
|
Enhancements / New Features |
|
|
Office 365: Support Microsoft Cloud App Security API (MCAS) |
|
|
Box connector: Change time to retrieve event to 10 minutes |
Due to API limits on business edition |
|
Events Modeling |
|
| Azure connector: Add subscription id andname to the Azure iaas-events, OMS, NSF flow logs and iaas-storage endpoints/audit sources | |
| Azure connector: Model event of audit policy changed on Azure SQL server | |
| Azure connector: Add name of service principle | |
| Azure connector: Model key vault events | |
| Box connector: Extract source event type | |
|
Fixes |
|
| Fix the SkyFormation support in proxy mode (deploy and run behind proxy) | |
| Fix timeout issue in Azure Event Hub endpoint | |
| Handle duplicated Office 365 events | Caused by the bug introduced at some of Office 365 management activity API |
Version: 2.3.23
|
Enhancements / New Features |
|
|
G-Suite connector: Reduce the permissions needed by the connector. |
For service account configuration guide with reduced scope please see: https://skyformation.zendesk.com/hc/en-us/articles/360000951194-Creating-a-Service-Credentials-Json-file- |
| Azure connector: Adding new mechanism to aggregate information across correlated events (e.g. start, accepted, ended) and send all in final event |
All intermediate events will be sent as audit-events, a final, modelled, event will be send with all the data collected for it. |
| Azure connector: Add support of Event Hub with source input from Activity Log, to parse and model Azure Security Center events as general-alert events | |
| Box connector: Improve events retrieval time |
Reduced from 15 to 3 minutes * Increase API call frequency from 10 minutes to 2 minutes intervals. |
|
Events Modeling |
|
| Azure connector: New identity enrichment mechanism | Enrich all identity types via their respective objectId to deduce it types (User, Group, Application, Service Account) and add their full info |
| Azure connector: New events modelling: SQL server admin created/deleted/updated, SQL server, SQL server auditing policy change, SQL server firewall rules write | |
| Azure connector: Accepted status in events translated now to SkyFormation InProgress status. | |
| G-Suite: Model the G-Suite event names to SkyFormation flexString1 CEF field | |
| G-Suite: New events modeling: group created/deleted/rename, enable/disable allow external members, | |
|
G-Suite: New event modeling: USERS_BULK_UPLOAD, USERS_BULK_UPLOAD, REVOKE_3LO_DEVICE_TOKENS, |
|
| Fix: All connectors: In user-updated events where information about the change is missing a modelled event will be sent. | |
| SkyFormation cs6 field is now the last one in event message | Reduce likelihood of other fields truncation |
| Box connector: Model the Box event type to SkyFormation flexString1 CEF field | |
| Github connector: Support authentication using token | |
| Azure connector: Put app ID in suser for Azure Service Principle when app name does not exist/available | When actions are triggered by a Service Principal the action's CEF suser will be occupied by the SP's id |
|
Fixes |
|
| Google Cloud, Box and G-Suite connectors: Account JWT JSON not sent to client now. Presented as password. | |
| Azure connector: Increase events retrieval time in Azure iaas-events endpoint from 1 minute to 10 minutes due to some late arriving events in endpoint | |
| CrowdStrike connector (Critical): Connector stopped syncing after first sync | |
| Event modeling events: In user-updated events where user information about the change does not exist N/A | |
Version: 2.3.8
|
Enhancements / New Features |
|
|
New cloud connector for GitHub version control service |
|
|
Azure connector: Support Azure Event Hub |
|
|
Office 365 connector: Improve events retrieval time of Office DLP management API endpoint |
Reduced from 15 to 5 minutes |
|
Office 365 connector: Improve events retrieval time in signin-events and Management Active Directory endpoints |
Reduced from 15 to 10 minutes |
|
Office 365 connector: Changed the events retrieval time in Management Active Directory endpoint to meet higher API latency encountered |
Changed from 15 to 25 minutes |
|
Egnyte connector: Reduce API calls |
To better handle the provider's API limitations |
|
Azure connector: Improve events retrieval time in Azure storage endpoints |
Reduced from "up to 1 hour" to 10 minutes |
|
Azure connector: Improve events retrieval time in Azure iaas-events endpoints |
Reduced from 15 minutes to 1 minute |
|
G-Suite connector: New endpoints added with un-modeled events: "mobile","calendar","groups","gplus","rules","saml" |
Events are sent as audit-events |
|
G-Suite connector: New endpoint "token" added with modeled events |
Token lifecycle events |
|
DLP enrichment: Adding support in Office 365 |
Classify files uploaded with existing DLP systems |
|
Sales Cloud connector: Optimize number of API calls usage |
|
|
Events Modeling |
|
| Entire events: New property of the app source event ID added to SkyFormation events (deviceInboundInterface in CEF) | Reflect the app source event ID |
| Entire events: General modeling change: New type of grantee added to reflect permissions granted based on another existing permission (e.g. edit file ACL permission granted to anyone with edit file permission) | |
| Entire events:Add to the SkyFormation modeled events the event's end-time timestamp in a new dedicated CEF field called end (aka End Time). | Added for better compatibility with Arcsight CEF parser. Same event timestamp exist already in the event syslog header. |
| SkyFormation Content Inspection event: Includes now the policy violation information in JSON. | |
| Azure: New events modeling: Azure log analytics now include in action field the source action | |
| Office 365: New SAML events modeling: login via ADFS federated token (SAML login type in SkyFormation events) | |
| Office 365: New exchange events modeling: send as, send on behalf, add/remove mailbox permissions, add/remove/modify folder permissions, set permissions to send on behalf, set mailbox forwarding, Add/Set-MailboxRule | |
| Office 365: New exchange modeling: Model another type of malware event from the Exchange Email Protection | |
| SkyFormation login-success event:Add CEF filed with keep-user-signed-in indication. | Added to Office 365 Management Active Diretory endpoint signin event. Add to CEF cn1 |
| G-Suite: New events modeling: Login challenge, create/revoke token, file move, change ACL | |
| G-Suite: Fix events modeling: G-Suite events modeling: change_user_access is modelled now as sk4-resource_acl_updated (and not sk4-permission-update as was before) | Breaking compatibility change !!! |
| G-Suite: Extend modeled events: Modeling change in G-Suite: change_acl_editors event is now modelled as sk4-acl-updated with the new permission grantee described above | |
| G-Suite: Improve noise events handling. For example: file being shared, falsely generates file edit (secondary) event in addition to the (primary) ACL update event | |
| Box: New events modeling: application created, disable/enable two-factor, file locked/unlocked | |
|
Fixes |
|
| Office 365 connector: Fix in the Microsoft API failures handling | |
| Office 365 connector: Fix Exchange endpoints Spam, Malware and DLP policy endpoints. | Only relevant for customers with fresh install of SkyFormation version 2.2.17 and configured the Exchange endpoints |
| Office 365 connector: Fix parsing of Role assign/ un-assign events due to API changes | No changes in the resulted SkyFormation unified events delivered |
| Azure connector: Fix in NSG flow logs | |
| Azure connector: Azure Log Analytics: Optimize raw events size | |
| Azure connector: Fix wrong timestamp parsing in iaas-events endpoint | |
| Sales Cloud connector: handle timeout during get SObject count query | |
| Okta connector: Fix missing source IP in some event scenarios | |
| Platform: Fix bug in endpoint activate and deactivate | |
| Platform: Fix bug: Handling large sized origin/raw events with truncating | SkyFormation events exceeding 12kb |
| Platform: Fix bug: Handling large sized events with truncating | SkyFormation events exceeding 16kb |
Version: 2.2.17
|
Enhancements / New Features |
||
|
Support proxy with Basic authentication |
||
|
Events Modeling |
||
| New modeling: G-Suite - Make a spreadsheet copy | ||
| New modeling: G-Suite - Remove/Add member from/to group | ||
| New modeling: G-Suite - Authorize/Remove API client access | ||
|
Fixes |
||
| Office 365: Fix parsing error with exchange DLP events | ||
| Fix critical regression bug introduced in 2.2.14 in task management | ||
Version: 2.2.14
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Enhancements / New Features |
||
|
Improving the platform task management performance |
||
|
Events Modeling |
||
| New modeling: DropBox - Reset password to all users | ||
| New modeling: DropBox - Download file via shared link | ||
| New modeling: DropBox - Showcase change in sharing policy, change in download policy | ||
| New modeling: DropBox - File request change policy | ||
| New modeling: DropBox - Group user management change policy | ||
| New modeling: DropBox - Enable/Disable Google Identity Service | ||
| New modeling: DropBox - Team activity create report | ||
| New modeling: DropBox - Paper admin export start | ||
| New modeling: DropBox - Export members report | ||
| New modeling: DropBox - Smart synch create admin privilege report | ||
| New modeling: DropBox - Showcase - add remove members, CRUD operations | ||
| Fix modeling: Office 365 - Login failure from the management AD endpoint | ||
Version: 2.2.12
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Events Modeling |
||
| New modeling: Salesforce add/remove IP restriction from profile | ||
|
Bug Fixes |
||
| Box connector: Handling pagination in data retrieval process | ||
| AWS connector: Fix issue with SQS URL setting param introduced in 2.2.10 | SQS Url connector configuration setting was a mandatory parameter, although is only optional. Without it the connector initialization failed | |
| Azure connector: Handle user deleted username w/ prefix of guid | ||
|
General Notes & Changes |
||
| Default historic sync when on-boarding a connector is now 24 hours (was 7 days) | ||
| Office365 connector - Microsoft have remove the exchange report UrlTrace API hence the connector correlated endpoint is no longer available | ||
Version: 2.2.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New cloud connector - Add Dropbox for Business cloud connector | ||
| New data protection capability - Add file public exposure indication to file CRUD events | New detection mechanism will add to file CRUD events a new indication if the file is publicly exposed or not (supported in AWS S3 in current version). | |
| New DLP integration - Add new integration to the SkyFormation DLP Extender with Google DLP API | Customers with DLP Extender license could now integrate SkyFormation DLP Extender to a Google DLP API account and have their files uploaded to their SkyFormation cloud connectors inspected for DLP violations (supported in Egnyte, Box, ServiceNow, Sales Cloud connectors in current version) | |
| New AWS connector audit source - Add new audit source of S3 data events (e.g. file viewed, deleted, uploaded etc) using SQS | ||
| S3 connector (aka Custom connector) - Add option to whitelist/blacklist windows events by type | ||
| Azure connector - Improve performance of NSG Flow Logs, OMS | ||
| Azure connector - Improve detection of Flow Logs endpoints | ||
| Azure connector - Update API calls used for enrichment align with Microsoft API changes | ||
| Office 365 connector - Break oAuth login process into two steps of redirect phase and login success/failure | ||
| Fix bug introduced in version 2.2.7 of missing raw data (aka cs6) in events |
Version: 2.2.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| New SkyFormation for CrowdStrike Falcon Connector |
New cloud connector for CrowdStrike Falcon. |
To see how to install it go to: Adding CrowdStrike Falcon Connector to SkyFormation Platform |
| Google Cloud Platform connector - Fix bug in thread management (High) | ||
| Custom connector - Fix bug in handle S3 object names with special chars (Medium) |
Version: 2.2.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| To see the Egnyte events covered in the new connector go to here | To see how to install it go to: Adding Egnyte Connector to SkyFormation Platform |
|
|
Support Webhook in |
Adding to the SkyFormation for OneLogin Connector an option to work with the Webhook (in addition to the exiting supported API method) | The two different methods retrieve in some cases different data dimension for the same event. Consult SkyFormation support for more information and to help you deploy the new method if needed |
| Fix the SkyFormation for Office 365 identity protection endpoints | Change the way the connector communicate with the endpoints to support the new Microsoft Office 365 endpoints API | Update to make your SkyFormation for Office 365 work with the Identity protection end points |
| Bug fixed of sending audit event correctly in cs6 if modeling fails | ||
| Support new syslog JSON message format | An option to send the events over syslog using JSON format (in addition to the current CEF encoding). |
Version: 2.2.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| (Fix) OneLogin connector handle users with missing email property | OneLogin - handle users with missing email property | |
| New remediation API | Adding new remediation Open API. See: SkyFormation Remediation API |
|
| (Fix) ServiceNow connector - handle application user with missing username | ||
| (Fix) Box connector test connection | ||
| New monitoring API | Adding new monitoring Open API. See: SkyFormation Monitoring API |
|
| Google G Suite connector (aka Google Apps) - Adding authentication method | Adding authentication method of service account in addition to the OAuth. see here | Could be used via Open API only if desired (no interactive OAuth needed) |
|
Box connector - Migrating to the new authentication mechanism * * Not backward compatible |
Migrating to the new recommended Box authentication mechanism. | Upgrade will move the Box connector to error state, then you will need to follow the instruction here to make it work again. |
| (Fix) Office 365 - Workaround for Microsoft API bug | Microsoft Office 365 API bug in get subscriptions is bypassed. | |
| Open API - support Json value in authentication field | ||
| (Fix) Moving the connectors initialization process to asynchronous |
Version: 2.2.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Office 365 connector - Fix paging handling (High) | Fix the way Office 365 connector handles paging when high volume of data retrieved from API | |
| Azure connector - Fix threads leakage (High) | Fix the mechanism handles multi threads in Azure connector | |
|
Office 365 connector - Fix API limit |
Send the customer's Office 365 tenant ID as the publisher ID to get separate API quota per customer | |
| Salesforce connector - Fix field history sync mechanism (Medium) | Fix the modeling of events coming from the field history | |
| Salesforce connector - Bypass a Salesforce API bug (High) | A Salesforce API might return empty response in some scenarios | |
| Adding connector level error | Connector that fails in initialization phase will be locked and return error | Please contact support@skyformation.com for more technical information |
| Salesforce connector - Reduce the amount of API calls (Medium) | SkyFormation Salesforce connector reduces API calls by optimizing calls for metadata | |
| Improve connector error messaging | Error message will present a simpler root cause message | |
| ServiceNow connector - Fix error handling (Low) | Fix error handling |
Version: 2.2.0
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix threads management bug (High) in SkyFormation for Azure Cloud Connector. |
Handle a scenario where the Azure threads handler does not close threads. |
|
|
Fix endpoint sync report data bug (Low) in SkyFormation for Azure Cloud Connector. |
Fix an error where the Azure sync manager in some sync scenarios will returned latest sync results as empty list although exist. |
|
|
Improve the SkyFormation for Azure Cloud Connector event sync performance |
Adding more caching mechanism to the connector to allow faster event sync |
Version: 2.1.24
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of Azure NSG flow logs | Add support of Azure Network Security Group (NSG) flow logs by ingesting them directly from Azure storage account in SkyFormation for Azure Cloud Connector. | Once you configure your Azure to send flow logs to any Azure storage account, your SkyFormation Azure connector will automatically detect and add it as a new disabled end-point in the running Azure connector. If you want to start ingesting the Azure flow-logs in a specific end-point go to the specific SkyFormation for Azure Cloud Connector end-points settings and start it. |
| Fix bug (High) in SkyFormation for AWS Cloud Connector cache pool management |
Fix a bug in the SkyFormation for AWS Cloud Connector where in some cases threads left in cache as idle for infinity. |
|
| Fix regression bug (Critical) of data retrieval management |
Fix a critical bug introduced in SkyFormation version 2.1.23 which causes events retrieval manager to fail ingesting events from cloud connectors. |
If you have installed SkyFormation 2.1.23 you must upgrade to 2.1.24 or above |
| Add a new key named security-group to the SkyFormation flow logs unified model |
Add a new key to the SkyFormation unified model for flow log events, named security-group. The new key will contain the security group or network security group relate to the flow log event (if exist) |
See the SkyFormation Unified Events Overview for more information |
Version: 2.1.23
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of AWS GuardDuty alerts | Add support to SkyFormation for AWS Cloud Connector for the new AWS GuardDuty alerts |
To enable it you will need to add the permissions defined at our AWS connector guide first. Next you will see a new end-point in the AWS running connector dynamically being added. The new GuardDuty end-point is enabled by default. |
Version: 2.1.22
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Add support of syslog for RSA NetWitness | Add support of SkyFormation SIEM integration with RSA NetWitness |
Configure the RFC 3164 SHORT option in SIEM Integration settings |
|
Add new General Alert event to the SkyFormation Unified Events |
Add new unified event that resemble general (e.g. security) alert ingested from underlying cloud applications/services, i.e. an Azure log-analytics custom alert rule was triggered. |
Please refer to General Alert for more information |
| Add client indication of the SkyFormation App Version | Add the SkyFormation App Version indication in the SkyFormation web application. |
See Get Your SkyFormation App Version guide |
| Add new severity attribute to CEF | Add new severity attribute to the SkyFormation Header Fields general header of the SkyFormation Unified Events CEF (CEF key dvcpid). |
Version: 2.1.21
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| APIs to manage brand logo and name | Allow a replacement of the SkyFormation logo and name for white-label needs using APIs of set,get,reset |
|
| Upgrade to the new Log Analytics API in SkyFormation Azure Connector | Upgrade to the new Log Analytics API | |
|
Adding Field History log collection to SkyFormation Salesforce Connector
|
SkyFormation Salesforce connector will now dynamically create new sets of end-points for each SObject with field history enabled. | The end-points added will be inactive by default and could be activated in the connector's settings |
|
Fix: Synchronization of users in all cloud connectors |
Fix of duplicated users reported | |
|
Adding docker compose to SkyFormation app |
Adding to the SkyFormation application infrastructure the docker compose module to improve the SkyFormation app self management capabilities |
Version: 2.1.19
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Error parsing timestamp in OMS Logs Analytics Data in Azure Connector |
Timestamp parsing in some OMS Log Analytics events failed. |
Version: 2.1.18
| SKIPPED |
|---|
Version: 2.1.17
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Support to SQS events coming from SNS in custom connector added |
Support events coming into the SQS in the custom connector from SNS (in addition to SQS events coming directly to SQS). |
Version: 2.1.16
| Enhancement/Fix | Summary | Notes | ||||||
|---|---|---|---|---|---|---|---|---|
|
Adding properties to Exchange message flow events |
Adding properties to resource-event in case of mail messages sent (e.g. Exchange message trace). |
Properties added are: message size, sender (cs1), recipient (cs2) | ||||||
|
Fix: Resync events to SIEM bug fixed |
Resync Open API didn't run |
|||||||
|
Improve the Office 365 and Azure connectors test connection |
Removing obsolete connection tests from the connectors to improve response time | |||||||
|
Adding optional query param to Delete a Tenant API |
Add an optional "force" query param with default value of "false" | |||||||
|
Open API - Add ability to activate/deactivate health reports |
Allow health reports to be activated/deactivated via Open API | Docs | ||||||
|
Allow static endpoints activate and deactivate before account initialization |
Classifying account endpoints to static and dynamic to allow, via the open API, to activate or deactivate static endpoints even before account initialization is complete | |||||||
|
New events modeled to |
|
For the planned events please look at: |
||||||
|
Pass raw user agent header to CEF |
Pass raw user agent header, if exists, to CEF |
Version: 2.1.15
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improving the Account Status performance |
Improve the accounts status response time |
|
|
Fix: Azure end-point showed not relevant |
Remove irrelevant end-points from Azure connector |
|
|
Improve Salesforce connector handling of API limit response |
Adding proactive test to ignore the API limit response from Salesforce connector | |
|
Fix: Accounts settings in UI not persistent in some cases |
Update account settings in persistence on any change |
Version: 2.1.14
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to |
|
For the planned events please look at: |
||||||||||||||||||||||
|
Existing Modeled Office 365 Events Adjusted |
In order to meet the new APIs (see below the API changes description) some already modeled events have been adjusted with new API information
|
|||||||||||||||||||||||
|
Adding read only support for Open API |
Support role with read only permissions for the SkyFormation Open API. |
|||||||||||||||||||||||
|
Reduce the Office 365 Exchange reports events ingestion latency |
The latency of the Exchange Advance Threat Defense reports as Malware, Spam, Spoof and others reduced from ~24-48 hours to 10-15 minutes |
|||||||||||||||||||||||
|
Adding Content Inspected event to the SkyFormation Unified Model |
A new event added to the SkyFormation Unified Model represent content being inspected by additional security systems. | |||||||||||||||||||||||
|
Support the new Office 365 APIs replacing the deprecated /reports API |
Microsoft announced its plan to deprecate the Azure AD reports API under https://graph.windows. |
In case you are using the SkyFormation Office 365 information in the CEF cs6 key please consult SkyFormation support on compatibility issues to expect | ||||||||||||||||||||||
|
New UI indication on endpoints status and ability to start/stop each |
Each cloud connector's end-point status is now presented in details in the UI, and an ability to stop/start each end-point is supported in the UI. |
Same capabilities already supported using the SkyFormation Open API in former version | ||||||||||||||||||||||
|
Office 365 |
Adding subtypes to SkyFormation audit-event ingested from Office 365 as actors, targets |
|||||||||||||||||||||||
|
Add SIEM Open API return the SIEM connection |
When calling add SIEM connection via the open API the new SIEM connection together with its generated ID is being returned | |||||||||||||||||||||||
|
Adding "noop" processor to the customer connector |
Allow a "noop" (no process) processor to the custom connector | To ingest unknown or undefined data sources | ||||||||||||||||||||||
|
Fix: Duo processor wrong json handler |
Fix a problem with handling corrupted json processed at the Duo processor used by the custom connector | |||||||||||||||||||||||
|
Office 365 message trace enrichment with advance threats information |
When Exchange message trace event indicate malware, spam or spoof indication the connector will enrich the event with advance threat information from the Exchange ATD service | |||||||||||||||||||||||
|
Fix:Wrong old errors showed in status API |
Remove wrong error indications from the status API | |||||||||||||||||||||||
|
New open API to re-send events to a tenant's SIEM |
New Open API allows the admin to trigger events already sent to the tenant's SIEM to be re-sent | |||||||||||||||||||||||
|
Fix: When user agent header parsing fail send valid data |
When parsing user agent header fails - return client information with user agent header only | |||||||||||||||||||||||
|
Fix: OKTA events parsing resulted in anonymous |
Adding the existing suser information to the OKTA login failed and self reset password events instead of the anonymous indication |
Version: 2.1.13
| Enhancement/Fix | Summary | Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||
|
Adding list of mail traffic event types |
Mail traffic event types are now: Malware, TransportRuleHits, SpamIPBlock, SpamDBEBFilter, |
|||||||||
|
Adjust exchange reports retrieval time |
Set the Exchange admin reports (Spam, Malware, DLP policy) retrieval time to 24 hours, to align with their creation time |
|||||||||
|
Fix: High CPU usage |
High CPU consumed by postgress | |||||||||
|
Fix: Open API activate and deactivate failure for endpoint |
Open API activate resulted in deactivated |
Version: 2.1.12
| Enhancement/Fix | Summary | Notes | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
New events modeled to the SkyFormation Unified Model |
The following events were added:
|
For the planned events please look at: |
||||||||||||||||||||||
|
Adding Health Report |
Adding additional information sent to the SkyFormation health service on server version, end-point level sync status and more |
|||||||||||||||||||||||
|
Add Open API for SIEM management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Add Open API for Tenant Management |
Be able to create, read, update and remove SIEM configuration in SkyFormation | |||||||||||||||||||||||
|
Fix: Event report-anomalous-signin modeling |
Fix the modeling problem in the event | |||||||||||||||||||||||
|
Fix: Events synced but do not sent to SIEM |
In high volume deployments (over 20K events waiting to be send to SIEM) some events were not sent to the SIEM. |
Version: 2.1.11
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Some API calls not working (Severity: High) |
Some API calls not working due to incorrect way of configuration settings persistence |
Version: 2.1.10
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: Events synced but not sent to SIEM (Severity: High) |
In high EPS deployments (mostly when IaaS connectors involved) some synced events would not be sent to SIEM. |
Version: 2.1.9
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Improvement in the AWS connector API throttling mechanism |
Improving the API throttling mechanism used by the AWS connectors |
Version: 2.1.8
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Adding integration identifier to Duo Security connector |
Adding integration identifier to the Duo Security connector |
Version: 2.1.7
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Add clean/suspicious/infected as an action CEF value |
Adding to the CEF model the file infection level as returned from the malware/content inspection system when using the Malware Extender module. The dimension is added to the malware alert unified event | |
|
Fix: Race condition bug fix in event sync (Severity: Medium) |
Fix a race condition scenario when events are synced with the same millisecond value and are handled by different threads | |
|
Improve performance of syslog sending |
Improvement in syslog send task achieved by caching the SIEM definition | |
|
Fix: Event loss in Office 365/Azure connectors when connection is lost (Severity: High) |
Re-attempting mechanism fix in Office 365 and Azure connectors when sync is failing due to connectivity issues | |
|
Add configurable header to OKTA connector |
Attach to OKTA API calls header to identify SkyFormation platform | Allow partnership optimization with OKTA |
Version: 2.1.6
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: OKTA and SNOW connectors encryption property handling (Severity: Medium) |
Fix handling of authn property value to encrypted rather than clear text in Okta and SNOW |
Version: 2.1.5
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
Fix: CPU utilization bug (Severity: High) |
CPU utilization reach 100% in some scenarios |
looks like related to data eviction calls |
|
New Malware alert event |
Introducing new event for Malware detected as part of the new Malware extension module |
|
|
New Malware Extender module |
Introduce new module called "Malware Extender" that integrates with sandbox/content inspection systems and extend their coverage on cloud scenarios |
Support McAfee ATD at release |
Version: 2.1.4
| Enhancement/Fix | Summary | Notes |
|---|---|---|
| Open API for accounts |
Adding SkyFormation Open API to manage cloud connectors (aka accounts), get their running and health status and more. Please see: |
|
|
Bug fix (Severity: High) |
AWS Cloud Connector CloudTrail events wrongly processed because of incorrect ARN process |
Few events were incorrectly processed |
|
Bug fix |
On TCP connection dropped with SIEM, events were missing. A fix to the retry mechanism implemented. |
App will retry 10 consecutive tries to send existing event and if all fail will drop the task, which will be later picked again by tha pp for processing. |
Version: 2.1.3
| Enhancement/Fix | Summary | Notes |
|---|---|---|
|
New event OKTA events modeling |
The following OKTA events were modeled: Successful Okta Verify Push factor attempt, Successful Google Authenticator factor attempt, User Locked Out, Successful Okta Verify factor attempt, Rich client authentication failed, User logged in to the Admin app,User provisioned to app, User deprovisioned from app, Session created for user using API token, User updated their Okta password, User failed to update their okta password, User added to group All Employees by admin, Self-service password reset attempt denied, Read only admin privileges granted, Okta User profile updated, Okta user has been activated, Failed Google Authenticator factor attempt, Failed Okta Verify factor attempt,User removed from group All Employees by admin, Implicitly revoked tokens for client, API Token created, API Token created for client application Okta Mobile Client, App configuration updated |
|
|
Adding "Suspend User" and "Unsuspend User" support to Office 365 Remediation |
Office 365 cloud connector support now additional actions of "suspend user" and "unsuspend user" in the SkyFormation Remediation API |
Comments
0 comments
Article is closed for comments.