1940 lines
84 KiB
HTML
1940 lines
84 KiB
HTML
<!DOCTYPE html>
|
|
<html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang="">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="generator" content="pandoc" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
|
|
<meta name="dcterms.date" content="2024-06-04" />
|
|
<title>FY24Q4 Report</title>
|
|
<style>
|
|
html {
|
|
color: #1a1a1a;
|
|
background-color: #fdfdfd;
|
|
}
|
|
body {
|
|
margin: 0 auto;
|
|
max-width: 36em;
|
|
padding-left: 50px;
|
|
padding-right: 50px;
|
|
padding-top: 50px;
|
|
padding-bottom: 50px;
|
|
hyphens: auto;
|
|
overflow-wrap: break-word;
|
|
text-rendering: optimizeLegibility;
|
|
font-kerning: normal;
|
|
}
|
|
@media (max-width: 600px) {
|
|
body {
|
|
font-size: 0.9em;
|
|
padding: 12px;
|
|
}
|
|
h1 {
|
|
font-size: 1.8em;
|
|
}
|
|
}
|
|
@media print {
|
|
html {
|
|
background-color: white;
|
|
}
|
|
body {
|
|
background-color: transparent;
|
|
color: black;
|
|
font-size: 12pt;
|
|
}
|
|
p, h2, h3 {
|
|
orphans: 3;
|
|
widows: 3;
|
|
}
|
|
h2, h3, h4 {
|
|
page-break-after: avoid;
|
|
}
|
|
}
|
|
p {
|
|
margin: 1em 0;
|
|
}
|
|
a {
|
|
color: #1a1a1a;
|
|
}
|
|
a:visited {
|
|
color: #1a1a1a;
|
|
}
|
|
img {
|
|
max-width: 100%;
|
|
}
|
|
svg {
|
|
height: auto;
|
|
max-width: 100%;
|
|
}
|
|
h1, h2, h3, h4, h5, h6 {
|
|
margin-top: 1.4em;
|
|
}
|
|
h5, h6 {
|
|
font-size: 1em;
|
|
font-style: italic;
|
|
}
|
|
h6 {
|
|
font-weight: normal;
|
|
}
|
|
ol, ul {
|
|
padding-left: 1.7em;
|
|
margin-top: 1em;
|
|
}
|
|
li > ol, li > ul {
|
|
margin-top: 0;
|
|
}
|
|
blockquote {
|
|
margin: 1em 0 1em 1.7em;
|
|
padding-left: 1em;
|
|
border-left: 2px solid #e6e6e6;
|
|
color: #606060;
|
|
}
|
|
code {
|
|
font-family: Menlo, Monaco, Consolas, 'Lucida Console', monospace;
|
|
font-size: 85%;
|
|
margin: 0;
|
|
hyphens: manual;
|
|
}
|
|
pre {
|
|
margin: 1em 0;
|
|
overflow: auto;
|
|
}
|
|
pre code {
|
|
padding: 0;
|
|
overflow: visible;
|
|
overflow-wrap: normal;
|
|
}
|
|
.sourceCode {
|
|
background-color: transparent;
|
|
overflow: visible;
|
|
}
|
|
hr {
|
|
background-color: #1a1a1a;
|
|
border: none;
|
|
height: 1px;
|
|
margin: 1em 0;
|
|
}
|
|
table {
|
|
margin: 1em 0;
|
|
border-collapse: collapse;
|
|
width: 100%;
|
|
overflow-x: auto;
|
|
display: block;
|
|
font-variant-numeric: lining-nums tabular-nums;
|
|
}
|
|
table caption {
|
|
margin-bottom: 0.75em;
|
|
}
|
|
tbody {
|
|
margin-top: 0.5em;
|
|
border-top: 1px solid #1a1a1a;
|
|
border-bottom: 1px solid #1a1a1a;
|
|
}
|
|
th {
|
|
border-top: 1px solid #1a1a1a;
|
|
padding: 0.25em 0.5em 0.25em 0.5em;
|
|
}
|
|
td {
|
|
padding: 0.125em 0.5em 0.25em 0.5em;
|
|
}
|
|
header {
|
|
margin-bottom: 4em;
|
|
text-align: center;
|
|
}
|
|
#TOC li {
|
|
list-style: none;
|
|
}
|
|
#TOC ul {
|
|
padding-left: 1.3em;
|
|
}
|
|
#TOC > ul {
|
|
padding-left: 0;
|
|
}
|
|
#TOC a:not(:hover) {
|
|
text-decoration: none;
|
|
}
|
|
code{white-space: pre-wrap;}
|
|
span.smallcaps{font-variant: small-caps;}
|
|
div.columns{display: flex; gap: min(4vw, 1.5em);}
|
|
div.column{flex: auto; overflow-x: auto;}
|
|
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
|
|
/* The extra [class] is a hack that increases specificity enough to
|
|
override a similar rule in reveal.js */
|
|
ul.task-list[class]{list-style: none;}
|
|
ul.task-list li input[type="checkbox"] {
|
|
font-size: inherit;
|
|
width: 0.8em;
|
|
margin: 0 0.8em 0.2em -1.6em;
|
|
vertical-align: middle;
|
|
}
|
|
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
|
|
</style>
|
|
<style>
|
|
body { font-family: monospace; font-size: 14px; line-height: 1.5em; max-width: 60em; margin: 0 auto; padding-top: 0; }
|
|
h1,h2,h3,h4 { margin: 0.25em 0; }
|
|
header { margin-bottom: 0; }
|
|
header h1 { border: none; }
|
|
h1 { border-top: solid 10px; border-bottom: solid 10px; margin-bottom: 1em; padding: 0.5em 0; width: 100%; text-align: center;}
|
|
h2 { border-top: solid; text-align: center; margin-top: 1em; padding-top: 1em; }
|
|
h3 { margin-left: 1em; color: #cb4b16; }
|
|
h4 { margin-left: 2em; }
|
|
u { display: inline-block; margin-left: 2.75em; opacity: 0.3; }
|
|
hr { opacity: 0; }
|
|
a { color: #06a;}
|
|
ul { margin-left: 3em; }
|
|
#TOC ul { margin-left: 0.5em; }
|
|
li { clear: both; }
|
|
li > a { float: right; }
|
|
nav li a { float: none; }
|
|
blockquote { opacity: 0.7; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header id="title-block-header">
|
|
<h1 class="title">FY24Q4 Report</h1>
|
|
<p class="subtitle">logs goes 7 month back</p>
|
|
<p class="date">2024-06-04</p>
|
|
</header>
|
|
<nav id="TOC" role="doc-toc">
|
|
<ul>
|
|
<li><a href="#iroh" id="toc-iroh">IROH</a>
|
|
<ul>
|
|
<li><a href="#lead" id="toc-lead">lead</a>
|
|
<ul>
|
|
<li><a href="#guillaume-buisson-13"
|
|
id="toc-guillaume-buisson-13">Guillaume Buisson [13]</a>
|
|
<ul>
|
|
<li><a href="#ctia-2" id="toc-ctia-2">ctia [2]</a></li>
|
|
<li><a href="#iroh-9" id="toc-iroh-9">iroh [9]</a></li>
|
|
<li><a href="#tenzin-config-2" id="toc-tenzin-config-2">tenzin-config
|
|
[2]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
<li><a href="#data" id="toc-data">data</a>
|
|
<ul>
|
|
<li><a href="#mario-aquino-40" id="toc-mario-aquino-40">Mario Aquino
|
|
[40]</a>
|
|
<ul>
|
|
<li><a href="#iroh-30" id="toc-iroh-30">iroh [30]</a></li>
|
|
<li><a href="#tenzin-config-10" id="toc-tenzin-config-10">tenzin-config
|
|
[10]</a></li>
|
|
</ul></li>
|
|
<li><a href="#guillaume-erétéo-52"
|
|
id="toc-guillaume-erétéo-52">Guillaume Erétéo [52]</a>
|
|
<ul>
|
|
<li><a href="#ctia-11" id="toc-ctia-11">ctia [11]</a></li>
|
|
<li><a href="#iroh-38" id="toc-iroh-38">iroh [38]</a></li>
|
|
<li><a href="#tenzin-config-3" id="toc-tenzin-config-3">tenzin-config
|
|
[3]</a></li>
|
|
</ul></li>
|
|
<li><a href="#ambrose-bonnaire-sergeant-41"
|
|
id="toc-ambrose-bonnaire-sergeant-41">Ambrose Bonnaire-Sergeant [41]</a>
|
|
<ul>
|
|
<li><a href="#ctia-13" id="toc-ctia-13">ctia [13]</a></li>
|
|
<li><a href="#iroh-24" id="toc-iroh-24">iroh [24]</a></li>
|
|
<li><a href="#tenzin-config-4" id="toc-tenzin-config-4">tenzin-config
|
|
[4]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
<li><a href="#integrations" id="toc-integrations">integrations</a>
|
|
<ul>
|
|
<li><a href="#matthieu-sprunck-20" id="toc-matthieu-sprunck-20">Matthieu
|
|
Sprunck [20]</a>
|
|
<ul>
|
|
<li><a href="#iroh-16" id="toc-iroh-16">iroh [16]</a></li>
|
|
<li><a href="#tenzin-config-4-1"
|
|
id="toc-tenzin-config-4-1">tenzin-config [4]</a></li>
|
|
</ul></li>
|
|
<li><a href="#kirill-chernyshov-42" id="toc-kirill-chernyshov-42">Kirill
|
|
Chernyshov [42]</a>
|
|
<ul>
|
|
<li><a href="#iroh-35" id="toc-iroh-35">iroh [35]</a></li>
|
|
<li><a href="#tenzin-config-7" id="toc-tenzin-config-7">tenzin-config
|
|
[7]</a></li>
|
|
</ul></li>
|
|
<li><a href="#shafiq-33" id="toc-shafiq-33">Shafiq [33]</a>
|
|
<ul>
|
|
<li><a href="#iroh-30-1" id="toc-iroh-30-1">iroh [30]</a></li>
|
|
<li><a href="#tenzin-config-3-1"
|
|
id="toc-tenzin-config-3-1">tenzin-config [3]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
<li><a href="#auth" id="toc-auth">auth</a>
|
|
<ul>
|
|
<li><a href="#bartuka-54" id="toc-bartuka-54">bartuka [54]</a>
|
|
<ul>
|
|
<li><a href="#iroh-46" id="toc-iroh-46">iroh [46]</a></li>
|
|
<li><a href="#tenzin-config-8" id="toc-tenzin-config-8">tenzin-config
|
|
[8]</a></li>
|
|
</ul></li>
|
|
<li><a href="#yann-esposito-118" id="toc-yann-esposito-118">Yann
|
|
Esposito [118]</a>
|
|
<ul>
|
|
<li><a href="#iroh-51" id="toc-iroh-51">iroh [51]</a></li>
|
|
<li><a href="#iroh-scripts-36" id="toc-iroh-scripts-36">iroh-scripts
|
|
[36]</a></li>
|
|
<li><a href="#oauth2-client-demo-3"
|
|
id="toc-oauth2-client-demo-3">oauth2-client-demo [3]</a></li>
|
|
<li><a href="#ring-jwt-middleware-3"
|
|
id="toc-ring-jwt-middleware-3">ring-jwt-middleware [3]</a></li>
|
|
<li><a href="#scopula-6" id="toc-scopula-6">scopula [6]</a></li>
|
|
<li><a href="#tenzin-config-14" id="toc-tenzin-config-14">tenzin-config
|
|
[14]</a></li>
|
|
<li><a href="#xdr-provisioning-5"
|
|
id="toc-xdr-provisioning-5">xdr-provisioning [5]</a></li>
|
|
</ul></li>
|
|
<li><a href="#olivier-barbeau-47" id="toc-olivier-barbeau-47">Olivier
|
|
Barbeau [47]</a>
|
|
<ul>
|
|
<li><a href="#iroh-31" id="toc-iroh-31">iroh [31]</a></li>
|
|
<li><a href="#tenzin-config-16" id="toc-tenzin-config-16">tenzin-config
|
|
[16]</a></li>
|
|
</ul></li>
|
|
<li><a href="#yogsototh-52" id="toc-yogsototh-52">(Yogsototh) [52]</a>
|
|
<ul>
|
|
<li><a href="#iroh-scripts-36-1" id="toc-iroh-scripts-36-1">iroh-scripts
|
|
[36]</a></li>
|
|
<li><a href="#oauth2-client-demo-3-1"
|
|
id="toc-oauth2-client-demo-3-1">oauth2-client-demo [3]</a></li>
|
|
<li><a href="#ring-jwt-middleware-2"
|
|
id="toc-ring-jwt-middleware-2">ring-jwt-middleware [2]</a></li>
|
|
<li><a href="#scopula-6-1" id="toc-scopula-6-1">scopula [6]</a></li>
|
|
<li><a href="#xdr-provisioning-5-1"
|
|
id="toc-xdr-provisioning-5-1">xdr-provisioning [5]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
<li><a href="#iroh-ops" id="toc-iroh-ops">iroh-ops</a>
|
|
<ul>
|
|
<li><a href="#jerome-schneider-1" id="toc-jerome-schneider-1">Jerome
|
|
Schneider [1]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-1" id="toc-tenzin-config-1">tenzin-config
|
|
[1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#patrick-patat-1" id="toc-patrick-patat-1">Patrick Patat
|
|
[1]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-1-1"
|
|
id="toc-tenzin-config-1-1">tenzin-config [1]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
<li><a href="#other" id="toc-other">Other</a>
|
|
<ul>
|
|
<li><a href="#other-1" id="toc-other-1">Other</a>
|
|
<ul>
|
|
<li><a href="#robert-levy-7" id="toc-robert-levy-7">Robert Levy [7]</a>
|
|
<ul>
|
|
<li><a href="#iroh-6" id="toc-iroh-6">iroh [6]</a></li>
|
|
<li><a href="#tenzin-config-1-2"
|
|
id="toc-tenzin-config-1-2">tenzin-config [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#eric-gierach-4" id="toc-eric-gierach-4">Eric Gierach
|
|
[4]</a>
|
|
<ul>
|
|
<li><a href="#iroh-1" id="toc-iroh-1">iroh [1]</a></li>
|
|
<li><a href="#tenzin-config-3-2"
|
|
id="toc-tenzin-config-3-2">tenzin-config [3]</a></li>
|
|
</ul></li>
|
|
<li><a href="#ii-21" id="toc-ii-21">II [21]</a>
|
|
<ul>
|
|
<li><a href="#iroh-17" id="toc-iroh-17">iroh [17]</a></li>
|
|
<li><a href="#tenzin-config-4-2"
|
|
id="toc-tenzin-config-4-2">tenzin-config [4]</a></li>
|
|
</ul></li>
|
|
<li><a href="#devin-walters-8" id="toc-devin-walters-8">Devin Walters
|
|
[8]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-8-1"
|
|
id="toc-tenzin-config-8-1">tenzin-config [8]</a></li>
|
|
</ul></li>
|
|
<li><a href="#mia-7" id="toc-mia-7">Mia [7]</a>
|
|
<ul>
|
|
<li><a href="#iroh-7" id="toc-iroh-7">iroh [7]</a></li>
|
|
</ul></li>
|
|
<li><a href="#martin-bruchanov-3" id="toc-martin-bruchanov-3">Martin
|
|
Bruchanov [3]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-3-3"
|
|
id="toc-tenzin-config-3-3">tenzin-config [3]</a></li>
|
|
</ul></li>
|
|
<li><a href="#james-moser-1" id="toc-james-moser-1">James Moser [1]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-1-3"
|
|
id="toc-tenzin-config-1-3">tenzin-config [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#section" id="toc-section">[21]</a>
|
|
<ul>
|
|
<li><a href="#iroh-17-1" id="toc-iroh-17-1">iroh [17]</a></li>
|
|
<li><a href="#tenzin-config-4-3"
|
|
id="toc-tenzin-config-4-3">tenzin-config [4]</a></li>
|
|
</ul></li>
|
|
<li><a href="#martin-bruchanov-1" id="toc-martin-bruchanov-1">Martin
|
|
Bruchanov [1]</a>
|
|
<ul>
|
|
<li><a href="#iroh-1-1" id="toc-iroh-1-1">iroh [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#ruslan-yemelianov-2" id="toc-ruslan-yemelianov-2">Ruslan
|
|
Yemelianov [2]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-2-1"
|
|
id="toc-tenzin-config-2-1">tenzin-config [2]</a></li>
|
|
</ul></li>
|
|
<li><a href="#andrew-parisi-2" id="toc-andrew-parisi-2">Andrew Parisi
|
|
[2]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-2-2"
|
|
id="toc-tenzin-config-2-2">tenzin-config [2]</a></li>
|
|
</ul></li>
|
|
<li><a href="#scott-mcleod-7" id="toc-scott-mcleod-7">Scott McLeod
|
|
[7]</a>
|
|
<ul>
|
|
<li><a href="#iroh-6-1" id="toc-iroh-6-1">iroh [6]</a></li>
|
|
<li><a href="#tenzin-config-1-4"
|
|
id="toc-tenzin-config-1-4">tenzin-config [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#sam-waggoner-3" id="toc-sam-waggoner-3">Sam Waggoner
|
|
[3]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-3-4"
|
|
id="toc-tenzin-config-3-4">tenzin-config [3]</a></li>
|
|
</ul></li>
|
|
<li><a href="#t2sw-2" id="toc-t2sw-2">t2sw [2]</a>
|
|
<ul>
|
|
<li><a href="#ctia-1" id="toc-ctia-1">ctia [1]</a></li>
|
|
<li><a href="#iroh-1-2" id="toc-iroh-1-2">iroh [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#brooke-swanson-24" id="toc-brooke-swanson-24">Brooke
|
|
Swanson [24]</a>
|
|
<ul>
|
|
<li><a href="#ctia-2-1" id="toc-ctia-2-1">ctia [2]</a></li>
|
|
<li><a href="#iroh-8" id="toc-iroh-8">iroh [8]</a></li>
|
|
<li><a href="#tenzin-config-14-1"
|
|
id="toc-tenzin-config-14-1">tenzin-config [14]</a></li>
|
|
</ul></li>
|
|
<li><a href="#yurii-ivanisenko-1" id="toc-yurii-ivanisenko-1">Yurii
|
|
Ivanisenko [1]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-1-5"
|
|
id="toc-tenzin-config-1-5">tenzin-config [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#james-brock-1" id="toc-james-brock-1">James Brock [1]</a>
|
|
<ul>
|
|
<li><a href="#easy-purescript-nix-1"
|
|
id="toc-easy-purescript-nix-1">easy-purescript-nix [1]</a></li>
|
|
</ul></li>
|
|
<li><a href="#ryemelia-9" id="toc-ryemelia-9">ryemelia [9]</a>
|
|
<ul>
|
|
<li><a href="#tenzin-config-9" id="toc-tenzin-config-9">tenzin-config
|
|
[9]</a></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
</ul></li>
|
|
</ul>
|
|
</nav>
|
|
<h1 id="iroh">IROH</h1>
|
|
<h2 id="lead">lead</h2>
|
|
<h3 id="guillaume-buisson-13">Guillaume Buisson [13]</h3>
|
|
<h4 id="ctia-2">ctia [2]</h4>
|
|
<ul>
|
|
<li>Properly filter Relationships to assemble a Feed View <a
|
|
href="https://github.com/threatgrid/ctia/pull/1421">#1421</a></li>
|
|
<li>Filter out some infrastructure details from Error API Responses <a
|
|
href="https://github.com/threatgrid/ctia/pull/1412">#1412</a></li>
|
|
</ul>
|
|
<h4 id="iroh-9">iroh [9]</h4>
|
|
<ul>
|
|
<li>Logging improvements <a
|
|
href="https://github.com/advthreat/iroh/pull/9241">#9241</a></li>
|
|
<li>fix a flaky test in iroh-web <a
|
|
href="https://github.com/advthreat/iroh/pull/9250">#9250</a></li>
|
|
<li>Don't use pp-str to log the request in the rate limiter service <a
|
|
href="https://github.com/advthreat/iroh/pull/9249">#9249</a></li>
|
|
<li>Fix iroh-kafka* logs <a
|
|
href="https://github.com/advthreat/iroh/pull/9240">#9240</a></li>
|
|
<li>Update the json appender to rename the output level key <a
|
|
href="https://github.com/advthreat/iroh/pull/9187">#9187</a></li>
|
|
<li>update the logstash-v2 logging preset <a
|
|
href="https://github.com/advthreat/iroh/pull/9178">#9178</a></li>
|
|
<li>Don't fire disabled webhooks <a
|
|
href="https://github.com/advthreat/iroh/pull/8741">#8741</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>upgrade ctia-investigate to use transit+json instead of edn <a
|
|
href="https://github.com/advthreat/iroh/pull/8623">#8623</a></li>
|
|
<li>A new script to update a record :created in ES <a
|
|
href="https://github.com/advthreat/iroh/pull/8574">#8574</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-2">tenzin-config [2]</h4>
|
|
<ul>
|
|
<li>setup the IROH json logging appender</li>
|
|
<li>Re-apply the default rate limit for the NGFW Incident promotion
|
|
client <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1063">#1063</a></li>
|
|
</ul>
|
|
<h2 id="data">data</h2>
|
|
<h3 id="mario-aquino-40">Mario Aquino [40]</h3>
|
|
<h4 id="iroh-30">iroh [30]</h4>
|
|
<ul>
|
|
<li>Constrain judgements included with threat hunt incident bundles <a
|
|
href="https://github.com/advthreat/iroh/pull/9279">#9279</a></li>
|
|
<li>Threat hunt integration tests <a
|
|
href="https://github.com/advthreat/iroh/pull/9218">#9218</a></li>
|
|
<li>Threat hunt module instance pagination <a
|
|
href="https://github.com/advthreat/iroh/pull/9200">#9200</a></li>
|
|
<li>iroh-async Telemetry Identity Data <a
|
|
href="https://github.com/advthreat/iroh/pull/9166">#9166</a></li>
|
|
<li>Xdr 1086/crud store fields filtering <a
|
|
href="https://github.com/advthreat/iroh/pull/9147">#9147</a></li>
|
|
<li>iroh-async task (metric) tag <a
|
|
href="https://github.com/advthreat/iroh/pull/9123">#9123</a></li>
|
|
<li>iroh-metrics in default bootstrap <a
|
|
href="https://github.com/advthreat/iroh/pull/9118">#9118</a></li>
|
|
<li>Metrics Service (micrometer) <a
|
|
href="https://github.com/advthreat/iroh/pull/9029">#9029</a></li>
|
|
<li>Disable color logging for test execution <a
|
|
href="https://github.com/advthreat/iroh/pull/9097">#9097</a></li>
|
|
<li>Carmine & Timbre upgrade v2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9005">#9005</a></li>
|
|
<li>Loosen Risk Score Incident validation <a
|
|
href="https://github.com/advthreat/iroh/pull/9013">#9013</a></li>
|
|
<li>Apply risk score valid ranges to incident schemas <a
|
|
href="https://github.com/advthreat/iroh/pull/8976">#8976</a></li>
|
|
<li>Revert "Upgrade carmine version (#8888)" <a
|
|
href="https://github.com/advthreat/iroh/pull/9003">#9003</a></li>
|
|
<li>Log Tuning <a
|
|
href="https://github.com/advthreat/iroh/pull/8978">#8978</a></li>
|
|
<li>Upgrade carmine version <a
|
|
href="https://github.com/advthreat/iroh/pull/8888">#8888</a></li>
|
|
<li>Fix flaky test <a
|
|
href="https://github.com/advthreat/iroh/pull/8956">#8956</a></li>
|
|
<li>iroh-async high-traffic adjustments <a
|
|
href="https://github.com/advthreat/iroh/pull/8835">#8835</a></li>
|
|
<li>Fix disabled threat-hunt test <a
|
|
href="https://github.com/advthreat/iroh/pull/8814">#8814</a></li>
|
|
<li>Update incident_time when updating incident status <a
|
|
href="https://github.com/advthreat/iroh/pull/8801">#8801</a></li>
|
|
<li>incident enrichment activity diagram <a
|
|
href="https://github.com/advthreat/iroh/pull/8712">#8712</a></li>
|
|
<li>Separate Risk score & incident enrichment <a
|
|
href="https://github.com/advthreat/iroh/pull/8751">#8751</a></li>
|
|
<li>Improve safe-filtering <a
|
|
href="https://github.com/advthreat/iroh/pull/8731">#8731</a></li>
|
|
<li>iroh-async: Flatten Datadog context <a
|
|
href="https://github.com/advthreat/iroh/pull/8706">#8706</a></li>
|
|
<li>iroh-async logging & tracing context <a
|
|
href="https://github.com/advthreat/iroh/pull/8705">#8705</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Socket timeout milliseconds (not seconds) <a
|
|
href="https://github.com/advthreat/iroh/pull/8690">#8690</a></li>
|
|
<li>Risk Score socket-timeout <a
|
|
href="https://github.com/advthreat/iroh/pull/8687">#8687</a></li>
|
|
<li>Threat Hunt Module Exclusion <a
|
|
href="https://github.com/advthreat/iroh/pull/8646">#8646</a></li>
|
|
<li>Remove dead code <a
|
|
href="https://github.com/advthreat/iroh/pull/8626">#8626</a></li>
|
|
<li>Incident Summary migration re-run <a
|
|
href="https://github.com/advthreat/iroh/pull/8597">#8597</a></li>
|
|
<li>Notification request uses paginated user search <a
|
|
href="https://github.com/advthreat/iroh/pull/8606">#8606</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-10">tenzin-config [10]</h4>
|
|
<ul>
|
|
<li>Fix auth parameters passed for calling ES <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1139">#1139</a></li>
|
|
<li>Address thread exhaustion in conn mgrs during threat hunting <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1130">#1130</a></li>
|
|
<li>Exclude CTIA modules from threat hunt execution <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1122">#1122</a></li>
|
|
<li>Add iroh-async client-id to rate unlimited list <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1053">#1053</a></li>
|
|
<li>Increase conn-manager thread count after PROD performance monitoring
|
|
<a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1042">#1042</a></li>
|
|
<li>Increase thread pool size for EU private intel conn mgr <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1039">#1039</a></li>
|
|
<li>Increase connection mgr thread pool for NAM/EU/TEST <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1030">#1030</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Increase thread pool size for engine connection manager <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1012">#1012</a></li>
|
|
<li>Config for skipping Private Intel during investigation threat hunt
|
|
<a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1009">#1009</a></li>
|
|
<li>Rerun incident summary migration and update ES index <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1001">#1001</a></li>
|
|
</ul>
|
|
<h3 id="guillaume-erétéo-52">Guillaume Erétéo [52]</h3>
|
|
<h4 id="ctia-11">ctia [11]</h4>
|
|
<ul>
|
|
<li>remove ES5 support <a
|
|
href="https://github.com/threatgrid/ctia/pull/1419">#1419</a></li>
|
|
<li>Optimize lucene searches <a
|
|
href="https://github.com/threatgrid/ctia/pull/1420">#1420</a></li>
|
|
<li>bump ctim / remove status disposition <a
|
|
href="https://github.com/threatgrid/ctia/pull/1417">#1417</a></li>
|
|
<li>ctim 1.3.15 <a
|
|
href="https://github.com/threatgrid/ctia/pull/1415">#1415</a></li>
|
|
<li>silent this too noisy log <a
|
|
href="https://github.com/threatgrid/ctia/pull/1414">#1414</a></li>
|
|
<li>ctim-1.3.14 <a
|
|
href="https://github.com/threatgrid/ctia/pull/1413">#1413</a></li>
|
|
<li>remove un-store <a
|
|
href="https://github.com/threatgrid/ctia/pull/1410">#1410</a></li>
|
|
<li>fix wait_for for delete search <a
|
|
href="https://github.com/threatgrid/ctia/pull/1399">#1399</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>incident meta <a
|
|
href="https://github.com/threatgrid/ctia/pull/1391">#1391</a></li>
|
|
<li>Incident status disposition <a
|
|
href="https://github.com/threatgrid/ctia/pull/1389">#1389</a></li>
|
|
<li>Update CODEOWNERS <a
|
|
href="https://github.com/threatgrid/ctia/pull/1387">#1387</a></li>
|
|
</ul>
|
|
<h4 id="iroh-38">iroh [38]</h4>
|
|
<ul>
|
|
<li>Enable auth on private intel es IOPS script <a
|
|
href="https://github.com/advthreat/iroh/pull/9275">#9275</a></li>
|
|
<li>Dump events with dump metrics script <a
|
|
href="https://github.com/advthreat/iroh/pull/9180">#9180</a></li>
|
|
<li>Sca clean phase 2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9176">#9176</a></li>
|
|
<li>add backup clusters for delete <a
|
|
href="https://github.com/advthreat/iroh/pull/9173">#9173</a></li>
|
|
<li>Scripts for SCA issue cleaning <a
|
|
href="https://github.com/advthreat/iroh/pull/9161">#9161</a></li>
|
|
<li>simplify sorting in telemetry reports <a
|
|
href="https://github.com/advthreat/iroh/pull/9144">#9144</a></li>
|
|
<li>Add logs to better monitor reports <a
|
|
href="https://github.com/advthreat/iroh/pull/9142">#9142</a></li>
|
|
<li>Report service: consider missing user/org ids <a
|
|
href="https://github.com/advthreat/iroh/pull/9134">#9134</a></li>
|
|
<li>filter ids on search <a
|
|
href="https://github.com/advthreat/iroh/pull/9130">#9130</a></li>
|
|
<li>Generate statistics about modules <a
|
|
href="https://github.com/advthreat/iroh/pull/9108">#9108</a></li>
|
|
<li>Refactor iops report generation <a
|
|
href="https://github.com/advthreat/iroh/pull/9099">#9099</a></li>
|
|
<li>bump ctim / remove status disposition <a
|
|
href="https://github.com/advthreat/iroh/pull/9114">#9114</a></li>
|
|
<li>fix flaky ES test: wait some more <a
|
|
href="https://github.com/advthreat/iroh/pull/9089">#9089</a></li>
|
|
<li>telemetry report: fix search iteration for batch size 10000 <a
|
|
href="https://github.com/advthreat/iroh/pull/9082">#9082</a></li>
|
|
<li>reduce logs by adding user-scopes <a
|
|
href="https://github.com/advthreat/iroh/pull/9078">#9078</a></li>
|
|
<li>tk store: update ES index state <a
|
|
href="https://github.com/advthreat/iroh/pull/8664">#8664</a></li>
|
|
<li>Add admin maintenance route to load MITRE stix <a
|
|
href="https://github.com/advthreat/iroh/pull/8967">#8967</a></li>
|
|
<li>ctim 1.3.15 <a
|
|
href="https://github.com/advthreat/iroh/pull/9068">#9068</a></li>
|
|
<li>limit walk entities to the necessary exports <a
|
|
href="https://github.com/advthreat/iroh/pull/9039">#9039</a></li>
|
|
<li>ctim 1.3.14 <a
|
|
href="https://github.com/advthreat/iroh/pull/9016">#9016</a></li>
|
|
<li>Dump ES metrics telemetry events <a
|
|
href="https://github.com/advthreat/iroh/pull/8999">#8999</a></li>
|
|
<li>script to clean SE false positive incidents and sightings <a
|
|
href="https://github.com/advthreat/iroh/pull/8846">#8846</a></li>
|
|
<li>MITRE Matrix: dynamic components design <a
|
|
href="https://github.com/advthreat/iroh/pull/8973">#8973</a></li>
|
|
<li>fix Talos threat hunt <a
|
|
href="https://github.com/advthreat/iroh/pull/8969">#8969</a></li>
|
|
<li>update the design of static MITRE matrix rendering <a
|
|
href="https://github.com/advthreat/iroh/pull/8949">#8949</a></li>
|
|
<li>replace lazyseq by iteration in reports <a
|
|
href="https://github.com/advthreat/iroh/pull/8957">#8957</a></li>
|
|
<li>For Jeetu by G2 <a
|
|
href="https://github.com/advthreat/iroh/pull/8920">#8920</a></li>
|
|
<li>Some more incident stats <a
|
|
href="https://github.com/advthreat/iroh/pull/8861">#8861</a></li>
|
|
<li>import mitre matrix backbone <a
|
|
href="https://github.com/advthreat/iroh/pull/8899">#8899</a></li>
|
|
<li>Mitre coverage static matrix <a
|
|
href="https://github.com/advthreat/iroh/pull/8882">#8882</a></li>
|
|
<li>add created and modified to IROH CTIM entities <a
|
|
href="https://github.com/advthreat/iroh/pull/8810">#8810</a></li>
|
|
<li>bundle import activity diagrams <a
|
|
href="https://github.com/advthreat/iroh/pull/8708">#8708</a></li>
|
|
<li>scoring at bundle import <a
|
|
href="https://github.com/advthreat/iroh/pull/8694">#8694</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Meta incident field <a
|
|
href="https://github.com/advthreat/iroh/pull/8617">#8617</a></li>
|
|
<li>entitlement-enforcement-jobs-service in default <a
|
|
href="https://github.com/advthreat/iroh/pull/8612">#8612</a></li>
|
|
<li>incident status_disposition <a
|
|
href="https://github.com/advthreat/iroh/pull/8587">#8587</a></li>
|
|
<li>introduce admin common web service for cisco services <a
|
|
href="https://github.com/advthreat/iroh/pull/8573">#8573</a></li>
|
|
<li>speed up listing of entilements <a
|
|
href="https://github.com/advthreat/iroh/pull/8516">#8516</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-3">tenzin-config [3]</h4>
|
|
<ul>
|
|
<li>configure / tune private intel proxy cm <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1074">#1074</a></li>
|
|
<li>increase bundle-batch-size <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1071">#1071</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>fix config path in README.md <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1000">#1000</a></li>
|
|
</ul>
|
|
<h3 id="ambrose-bonnaire-sergeant-41">Ambrose Bonnaire-Sergeant
|
|
[41]</h3>
|
|
<h4 id="ctia-13">ctia [13]</h4>
|
|
<ul>
|
|
<li>Bump ring-swagger with proof of memory leak fix <a
|
|
href="https://github.com/threatgrid/ctia/pull/1423">#1423</a></li>
|
|
<li>Clojure 1.11.1 -> 1.11.2 <a
|
|
href="https://github.com/threatgrid/ctia/pull/1416">#1416</a></li>
|
|
<li>Revert patch bundle commits <a
|
|
href="https://github.com/threatgrid/ctia/pull/1411">#1411</a></li>
|
|
<li>Fix 2XX response swagger/coercion, ban <code>:return</code> <a
|
|
href="https://github.com/threatgrid/ctia/pull/1407">#1407</a></li>
|
|
<li>Remove asset properties/mapping merging during bundle patch <a
|
|
href="https://github.com/threatgrid/ctia/pull/1408">#1408</a></li>
|
|
<li>Fix :body descriptions <a
|
|
href="https://github.com/threatgrid/ctia/pull/1409">#1409</a></li>
|
|
<li>Fix POST /bulk schema checking <a
|
|
href="https://github.com/threatgrid/ctia/pull/1406">#1406</a></li>
|
|
<li>Use prn instead of pprint for logs <a
|
|
href="https://github.com/threatgrid/ctia/pull/1401">#1401</a></li>
|
|
<li>Eval routes and options given to <code>context</code> at
|
|
initialization time <a
|
|
href="https://github.com/threatgrid/ctia/pull/1394">#1394</a></li>
|
|
<li>Use <code>st/merge</code> to merge schemas instead of
|
|
<code>into</code> <a
|
|
href="https://github.com/threatgrid/ctia/pull/1398">#1398</a></li>
|
|
<li>Never match existing asset-* entities when patch-existing=false <a
|
|
href="https://github.com/threatgrid/ctia/pull/1395">#1395</a></li>
|
|
<li>Re-enable incident tests <a
|
|
href="https://github.com/threatgrid/ctia/pull/1393">#1393</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Add external_ids to investigation select fields <a
|
|
href="https://github.com/threatgrid/ctia/pull/1392">#1392</a></li>
|
|
</ul>
|
|
<h4 id="iroh-24">iroh [24]</h4>
|
|
<ul>
|
|
<li>Add support for JDK 21 <a
|
|
href="https://github.com/advthreat/iroh/pull/9251">#9251</a></li>
|
|
<li>Bump ring-swagger and prove it fixes the memory leak <a
|
|
href="https://github.com/advthreat/iroh/pull/9244">#9244</a></li>
|
|
<li>Fix typo in debug log <a
|
|
href="https://github.com/advthreat/iroh/pull/9228">#9228</a></li>
|
|
<li>Debug logs to investigate person assets not being imported <a
|
|
href="https://github.com/advthreat/iroh/pull/9227">#9227</a></li>
|
|
<li>Update status endpoint to keep conure updated <a
|
|
href="https://github.com/advthreat/iroh/pull/9209">#9209</a></li>
|
|
<li>Update test for new carmine non-FIFO queues:
|
|
<code>queue-status-report-test</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/9103">#9103</a></li>
|
|
<li>Make generated tk meta easier to review using pprint <a
|
|
href="https://github.com/advthreat/iroh/pull/8805">#8805</a></li>
|
|
<li>Restrict possible values for updated asset properties <a
|
|
href="https://github.com/advthreat/iroh/pull/9022">#9022</a></li>
|
|
<li>Don't forward response headers from CTIA to IROH <a
|
|
href="https://github.com/advthreat/iroh/pull/9014">#9014</a></li>
|
|
<li>Only subscribe incidents with supported observables <a
|
|
href="https://github.com/advthreat/iroh/pull/9000">#9000</a></li>
|
|
<li>Fix flaky test <a
|
|
href="https://github.com/advthreat/iroh/pull/9001">#9001</a></li>
|
|
<li>Redis: Set NX / XX <a
|
|
href="https://github.com/advthreat/iroh/pull/8970">#8970</a></li>
|
|
<li>Bulk asset update + rescoring route <a
|
|
href="https://github.com/advthreat/iroh/pull/8963">#8963</a></li>
|
|
<li>Fix logf call <a
|
|
href="https://github.com/advthreat/iroh/pull/8925">#8925</a></li>
|
|
<li>Fix incident subscription args, and only subscribe incident if
|
|
observables/identities are non-empty <a
|
|
href="https://github.com/advthreat/iroh/pull/8921">#8921</a></li>
|
|
<li>Fix DI subscription URL <a
|
|
href="https://github.com/advthreat/iroh/pull/8914">#8914</a></li>
|
|
<li>Revert patch bundle commits <a
|
|
href="https://github.com/advthreat/iroh/pull/8903">#8903</a></li>
|
|
<li>Fix swagger description <a
|
|
href="https://github.com/advthreat/iroh/pull/8905">#8905</a></li>
|
|
<li>Asset properties update and incident rescoring route <a
|
|
href="https://github.com/advthreat/iroh/pull/8843">#8843</a></li>
|
|
<li>Rescoring task <a
|
|
href="https://github.com/advthreat/iroh/pull/8869">#8869</a></li>
|
|
<li>Generate valid DI auth tokens for incident subscriptions <a
|
|
href="https://github.com/advthreat/iroh/pull/8804">#8804</a></li>
|
|
<li>Fix <code>(reset)</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8799">#8799</a></li>
|
|
<li>Subscribe to incident asset rescoring via DI <a
|
|
href="https://github.com/advthreat/iroh/pull/8699">#8699</a></li>
|
|
<li>Only pass default patch-existing query params in bundle/import proxy
|
|
if patch-existing=true <a
|
|
href="https://github.com/advthreat/iroh/pull/8725">#8725</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-4">tenzin-config [4]</h4>
|
|
<ul>
|
|
<li>Bulk asset update limits <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1059">#1059</a></li>
|
|
<li>Add Conure url to Private intel config <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1052">#1052</a></li>
|
|
<li>Add config for DI client in iroh-engine <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1036">#1036</a></li>
|
|
<li>Add device insights url to iroh-engine config <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1014">#1014</a></li>
|
|
</ul>
|
|
<h2 id="integrations">integrations</h2>
|
|
<h3 id="matthieu-sprunck-20">Matthieu Sprunck [20]</h3>
|
|
<h4 id="iroh-16">iroh [16]</h4>
|
|
<ul>
|
|
<li>Adding and editing Automate notification types <a
|
|
href="https://github.com/advthreat/iroh/pull/9277">#9277</a></li>
|
|
<li>Rename automation_workflow_disabled to
|
|
automation_workflow_definition <a
|
|
href="https://github.com/advthreat/iroh/pull/9196">#9196</a></li>
|
|
<li>Revert "Update the json appender to rename the output level key
|
|
(#9187)" <a
|
|
href="https://github.com/advthreat/iroh/pull/9191">#9191</a></li>
|
|
<li>Change Incident Assignment Notification wording <a
|
|
href="https://github.com/advthreat/iroh/pull/9189">#9189</a></li>
|
|
<li>Add title and link to the incident in the incident assignment
|
|
notification <a
|
|
href="https://github.com/advthreat/iroh/pull/9188">#9188</a></li>
|
|
<li>Add a log when an unexpected status is returned from KafkaConnect <a
|
|
href="https://github.com/advthreat/iroh/pull/9153">#9153</a></li>
|
|
<li>IROH Proxy: Correct handling for path with spaces (%20) <a
|
|
href="https://github.com/advthreat/iroh/pull/9149">#9149</a></li>
|
|
<li>Build notification type name from notification type <a
|
|
href="https://github.com/advthreat/iroh/pull/9140">#9140</a></li>
|
|
<li>JMX metrics for clj-http connection manager <a
|
|
href="https://github.com/advthreat/iroh/pull/8765">#8765</a></li>
|
|
<li>Always decompress the body when status is not 2xx <a
|
|
href="https://github.com/advthreat/iroh/pull/8527">#8527</a></li>
|
|
<li>Restore default expiration (24h) for the local session token <a
|
|
href="https://github.com/advthreat/iroh/pull/8747">#8747</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Workflow event schema changes <a
|
|
href="https://github.com/advthreat/iroh/pull/8656">#8656</a></li>
|
|
<li>IROH Proxy: remove headers set by the reverse proxy <a
|
|
href="https://github.com/advthreat/iroh/pull/8655">#8655</a></li>
|
|
<li>More log context to investigate #8638 <a
|
|
href="https://github.com/advthreat/iroh/pull/8654">#8654</a></li>
|
|
<li>Add logging info to investigate #8638 <a
|
|
href="https://github.com/advthreat/iroh/pull/8653">#8653</a></li>
|
|
<li>StackOverflowError temporary fix <a
|
|
href="https://github.com/advthreat/iroh/pull/8607">#8607</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-4-1">tenzin-config [4]</h4>
|
|
<ul>
|
|
<li>Configure XDR URL in the PrivateIntel service for the Assignment
|
|
notification <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1116">#1116</a></li>
|
|
<li>Create a module record for Microsoft Graph API <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1050">#1050</a></li>
|
|
<li>Fix settings names for JAMF auth upgrade <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1048">#1048</a></li>
|
|
<li>Use Token Auth with the JAMF Classic API <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1038">#1038</a></li>
|
|
</ul>
|
|
<h3 id="kirill-chernyshov-42">Kirill Chernyshov [42]</h3>
|
|
<h4 id="iroh-35">iroh [35]</h4>
|
|
<ul>
|
|
<li>Draft design <a
|
|
href="https://github.com/advthreat/iroh/pull/9201">#9201</a></li>
|
|
<li>Format redirect url for email notification <a
|
|
href="https://github.com/advthreat/iroh/pull/9211">#9211</a></li>
|
|
<li>Use static string 'Cisco' as a subtitle <a
|
|
href="https://github.com/advthreat/iroh/pull/9210">#9210</a></li>
|
|
<li>Coerce incoming notification before email format <a
|
|
href="https://github.com/advthreat/iroh/pull/9204">#9204</a></li>
|
|
<li>[REFACTORING] Standardize trapperkeeper usage <a
|
|
href="https://github.com/advthreat/iroh/pull/9177">#9177</a></li>
|
|
<li>Use <code>notify!</code> to create notification via API call <a
|
|
href="https://github.com/advthreat/iroh/pull/9162">#9162</a></li>
|
|
<li>Fix copyright notice in email template <a
|
|
href="https://github.com/advthreat/iroh/pull/9159">#9159</a></li>
|
|
<li>Add simple template for notification email <a
|
|
href="https://github.com/advthreat/iroh/pull/9150">#9150</a></li>
|
|
<li>Allow nil as a correlation id <a
|
|
href="https://github.com/advthreat/iroh/pull/9143">#9143</a></li>
|
|
<li>Fix for EventService initialization <a
|
|
href="https://github.com/advthreat/iroh/pull/9141">#9141</a></li>
|
|
<li>Respect user notification preferences <a
|
|
href="https://github.com/advthreat/iroh/pull/9133">#9133</a></li>
|
|
<li>Add default config for NotificationInDelivery <a
|
|
href="https://github.com/advthreat/iroh/pull/9128">#9128</a></li>
|
|
<li>8938 e8811 process email notification delivery <a
|
|
href="https://github.com/advthreat/iroh/pull/9127">#9127</a></li>
|
|
<li>Fix config key <a
|
|
href="https://github.com/advthreat/iroh/pull/9115">#9115</a></li>
|
|
<li>Fix dev config for NotificationInDeliveryService <a
|
|
href="https://github.com/advthreat/iroh/pull/9113">#9113</a></li>
|
|
<li>On recieving NotificationRequest notify users according to their
|
|
preference <a
|
|
href="https://github.com/advthreat/iroh/pull/9087">#9087</a></li>
|
|
<li>Upgrade clojure 1.11.1 -> 1.11.2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9072">#9072</a></li>
|
|
<li>Remove maintenance notification type <a
|
|
href="https://github.com/advthreat/iroh/pull/9069">#9069</a></li>
|
|
<li>8933 e8811 create notificationindeliveryservice persistence only <a
|
|
href="https://github.com/advthreat/iroh/pull/9025">#9025</a></li>
|
|
<li>"In App" -> "In-App" <a
|
|
href="https://github.com/advthreat/iroh/pull/9020">#9020</a></li>
|
|
<li>Add correct :name and :description to notification type meta <a
|
|
href="https://github.com/advthreat/iroh/pull/9012">#9012</a></li>
|
|
<li>NotificationPreference API real endpoint <a
|
|
href="https://github.com/advthreat/iroh/pull/8995">#8995</a></li>
|
|
<li>NotificationPreference Service <a
|
|
href="https://github.com/advthreat/iroh/pull/8982">#8982</a></li>
|
|
<li>Fixes for notification endpoint <a
|
|
href="https://github.com/advthreat/iroh/pull/8964">#8964</a></li>
|
|
<li>Add notification preference api endpoints <a
|
|
href="https://github.com/advthreat/iroh/pull/8947">#8947</a></li>
|
|
<li>Initial draft design of notifications delivery <a
|
|
href="https://github.com/advthreat/iroh/pull/8844">#8844</a></li>
|
|
<li>Refactor data streams service <a
|
|
href="https://github.com/advthreat/iroh/pull/8793">#8793</a></li>
|
|
<li>DRY'ed out client-creds-token namespace <a
|
|
href="https://github.com/advthreat/iroh/pull/8783">#8783</a></li>
|
|
<li>Kafka connect monitoring <a
|
|
href="https://github.com/advthreat/iroh/pull/8278">#8278</a></li>
|
|
<li>Handle undelivered records <a
|
|
href="https://github.com/advthreat/iroh/pull/8634">#8634</a></li>
|
|
<li>Events data retention enforcement job <a
|
|
href="https://github.com/advthreat/iroh/pull/8722">#8722</a></li>
|
|
<li>Iroh events data retention implementation <a
|
|
href="https://github.com/advthreat/iroh/pull/8666">#8666</a></li>
|
|
<li>Iroh events postgres data retention <a
|
|
href="https://github.com/advthreat/iroh/pull/8693">#8693</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Use timbre for logging <a
|
|
href="https://github.com/advthreat/iroh/pull/8651">#8651</a></li>
|
|
<li>Add draft design for IROH Events data retention <a
|
|
href="https://github.com/advthreat/iroh/pull/8585">#8585</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-7">tenzin-config [7]</h4>
|
|
<ul>
|
|
<li>Add KafkaProducerService to all envs <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1107">#1107</a></li>
|
|
<li>Add email kafka consumer to all envs <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1106">#1106</a></li>
|
|
<li>Enable kafka consumer for email notifications <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1099">#1099</a></li>
|
|
<li>Add new kafka topics for IROH notifications <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1070">#1070</a></li>
|
|
<li>Add ES sink connector v2 to test full migration <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1035">#1035</a></li>
|
|
<li>Fix broken data stream on TEST <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1034">#1034</a></li>
|
|
<li>Config for DataStreams service <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1033">#1033</a></li>
|
|
</ul>
|
|
<h3 id="shafiq-33">Shafiq [33]</h3>
|
|
<h4 id="iroh-30-1">iroh [30]</h4>
|
|
<ul>
|
|
<li>Return relevant proxy health check errors req auth fails <a
|
|
href="https://github.com/advthreat/iroh/pull/9290">#9290</a></li>
|
|
<li>Fix access-token url for rubrik and commvault auth <a
|
|
href="https://github.com/advthreat/iroh/pull/9287">#9287</a></li>
|
|
<li>Support Async remote requests in AutomateRemoteProxy <a
|
|
href="https://github.com/advthreat/iroh/pull/9264">#9264</a></li>
|
|
<li>Design Automation-Remote target for iroh-proxy <a
|
|
href="https://github.com/advthreat/iroh/pull/9190">#9190</a></li>
|
|
<li>Trim whitespace when interpolating pipe transforms <a
|
|
href="https://github.com/advthreat/iroh/pull/9121">#9121</a></li>
|
|
<li>Support for GoogleAPI Authorization <a
|
|
href="https://github.com/advthreat/iroh/pull/9106">#9106</a></li>
|
|
<li>Refactor proxy health check <a
|
|
href="https://github.com/advthreat/iroh/pull/9066">#9066</a></li>
|
|
<li>Data retention cleanup of notification services <a
|
|
href="https://github.com/advthreat/iroh/pull/9064">#9064</a></li>
|
|
<li>Apply data retention policy on iroh-notifications <a
|
|
href="https://github.com/advthreat/iroh/pull/9054">#9054</a></li>
|
|
<li>Add <code>:remote</code> type in configuration spec fields <a
|
|
href="https://github.com/advthreat/iroh/pull/9046">#9046</a></li>
|
|
<li>Refactor proxy-health-check <a
|
|
href="https://github.com/advthreat/iroh/pull/9033">#9033</a></li>
|
|
<li>Update proxy-health-check logging <a
|
|
href="https://github.com/advthreat/iroh/pull/9028">#9028</a></li>
|
|
<li>Update proxy health check logging <a
|
|
href="https://github.com/advthreat/iroh/pull/9024">#9024</a></li>
|
|
<li>Perform relay-api request based on observable-types <a
|
|
href="https://github.com/advthreat/iroh/pull/9017">#9017</a></li>
|
|
<li>Add selection of settings for configuration-token auth <a
|
|
href="https://github.com/advthreat/iroh/pull/9007">#9007</a></li>
|
|
<li>Support for dedicated url setting for iroh-proxy requests <a
|
|
href="https://github.com/advthreat/iroh/pull/8998">#8998</a></li>
|
|
<li>Route for patching module-type documentation <a
|
|
href="https://github.com/advthreat/iroh/pull/8981">#8981</a></li>
|
|
<li>Add filtering of notifications using multiple statuses <a
|
|
href="https://github.com/advthreat/iroh/pull/8974">#8974</a></li>
|
|
<li>Support for transforming interpolated strings. <a
|
|
href="https://github.com/advthreat/iroh/pull/8945">#8945</a></li>
|
|
<li>Construct token url from base-url setting <a
|
|
href="https://github.com/advthreat/iroh/pull/8923">#8923</a></li>
|
|
<li>[IROH Proxy] Support for Rubrik and Commvault API services <a
|
|
href="https://github.com/advthreat/iroh/pull/8902">#8902</a></li>
|
|
<li>[iroh-proxy] Include POST method for proxy health check <a
|
|
href="https://github.com/advthreat/iroh/pull/8878">#8878</a></li>
|
|
<li>Update relay-module schemas for Checkpoint auth <a
|
|
href="https://github.com/advthreat/iroh/pull/8875">#8875</a></li>
|
|
<li>[iroh-proxy] Implement Checkpoint Smart-1 authentication <a
|
|
href="https://github.com/advthreat/iroh/pull/8873">#8873</a></li>
|
|
<li>Fix schema of proxy health check <a
|
|
href="https://github.com/advthreat/iroh/pull/8827">#8827</a></li>
|
|
<li>Add string matching for health check <a
|
|
href="https://github.com/advthreat/iroh/pull/8815">#8815</a></li>
|
|
<li>Fallback to iroh-events store when kafka send fails <a
|
|
href="https://github.com/advthreat/iroh/pull/8786">#8786</a></li>
|
|
<li>Fix mapping for incident events <a
|
|
href="https://github.com/advthreat/iroh/pull/8703">#8703</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Update iroh-event developer doc <a
|
|
href="https://github.com/advthreat/iroh/pull/8596">#8596</a></li>
|
|
<li>Add x-sort header to support search_after pagination <a
|
|
href="https://github.com/advthreat/iroh/pull/8586">#8586</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-3-1">tenzin-config [3]</h4>
|
|
<ul>
|
|
<li>Swtich to new sink-connector in INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1024">#1024</a></li>
|
|
<li>Add updated sink connector for all envs <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1021">#1021</a></li>
|
|
<li>Add sink connector for new iroh-event datastream <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1019">#1019</a></li>
|
|
</ul>
|
|
<h2 id="auth">auth</h2>
|
|
<h3 id="bartuka-54">bartuka [54]</h3>
|
|
<h4 id="iroh-46">iroh [46]</h4>
|
|
<ul>
|
|
<li>add <code>:content-type :json</code> explicitly to clj-http <a
|
|
href="https://github.com/advthreat/iroh/pull/9090">#9090</a></li>
|
|
<li>Brownfield Provisioning - make the <code>region</code> field
|
|
available for TEST purposes only <a
|
|
href="https://github.com/advthreat/iroh/pull/9079">#9079</a></li>
|
|
<li>Improve logs for Brownfield provisioning <a
|
|
href="https://github.com/advthreat/iroh/pull/9076">#9076</a></li>
|
|
<li>[IROH Auth] update QA routes for Universal Provisioning flow <a
|
|
href="https://github.com/advthreat/iroh/pull/9053">#9053</a></li>
|
|
<li>[IROH Auth] Fix access token brownfield provisioning <a
|
|
href="https://github.com/advthreat/iroh/pull/9049">#9049</a></li>
|
|
<li>[IROH Auth] bugfix - accept empty string as entitlement value for
|
|
universal provisioning <a
|
|
href="https://github.com/advthreat/iroh/pull/9021">#9021</a></li>
|
|
<li>[IROH Auth] FMC add re-token proxy request <a
|
|
href="https://github.com/advthreat/iroh/pull/9011">#9011</a></li>
|
|
<li>[IROH Auth] fix FMC redirect call to <code>/device</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8987">#8987</a></li>
|
|
<li>[IROH Auth] fix device verification redirection <a
|
|
href="https://github.com/advthreat/iroh/pull/8979">#8979</a></li>
|
|
<li>fix proxy requests to FMC <a
|
|
href="https://github.com/advthreat/iroh/pull/8972">#8972</a></li>
|
|
<li>[IROH Auth] FMC OAuth2 and SSE proxies <a
|
|
href="https://github.com/advthreat/iroh/pull/8840">#8840</a></li>
|
|
<li>[IROH Auth] Improvements to universal provisioning callback <a
|
|
href="https://github.com/advthreat/iroh/pull/8913">#8913</a></li>
|
|
<li>[IROH Auth] bugfix #4: add <code>:content-type :json</code> to
|
|
callback request <a
|
|
href="https://github.com/advthreat/iroh/pull/8909">#8909</a></li>
|
|
<li>[IROH Auth] fix payload sent to PIAM callback_url after provisioning
|
|
was complete <a
|
|
href="https://github.com/advthreat/iroh/pull/8900">#8900</a></li>
|
|
<li>[IROH Auth] bugfix Universal Provisioning created schema error <a
|
|
href="https://github.com/advthreat/iroh/pull/8892">#8892</a></li>
|
|
<li>[IROH Auth] bugfix parsing OKTA JWT scopes <a
|
|
href="https://github.com/advthreat/iroh/pull/8880">#8880</a></li>
|
|
<li>[IROH Auth] Brownfield provisioning - endpoint to attach existing
|
|
tenant to a SBG product <a
|
|
href="https://github.com/advthreat/iroh/pull/8806">#8806</a></li>
|
|
<li>[IROH Auth] Support FMC in the <code>jwks</code> service <a
|
|
href="https://github.com/advthreat/iroh/pull/8830">#8830</a></li>
|
|
<li>[IROH Auth] Fix DI onboarding in Universal Provisioning Flow <a
|
|
href="https://github.com/advthreat/iroh/pull/8813">#8813</a></li>
|
|
<li>Revert "[IROH Auth] support for FMC token in JWKS Service" <a
|
|
href="https://github.com/advthreat/iroh/pull/8816">#8816</a></li>
|
|
<li>[IROH Auth] support for FMC token in JWKS Service <a
|
|
href="https://github.com/advthreat/iroh/pull/8808">#8808</a></li>
|
|
<li>[IROH Auth] Check QA <code>callback_url</code> to complete
|
|
provisioning tests <a
|
|
href="https://github.com/advthreat/iroh/pull/8763">#8763</a></li>
|
|
<li>[IROH Auth] better swagger descriptions for Universal Provisioning
|
|
<a href="https://github.com/advthreat/iroh/pull/8752">#8752</a></li>
|
|
<li>[IROH Auth] remove empty strings from <code>client-id</code> got
|
|
from Vault <a
|
|
href="https://github.com/advthreat/iroh/pull/8760">#8760</a></li>
|
|
<li>[IROH Auth] add missing scope to get OKTA JWT <a
|
|
href="https://github.com/advthreat/iroh/pull/8759">#8759</a></li>
|
|
<li>[IROH Auth] add logs to investigate get okta jwt <a
|
|
href="https://github.com/advthreat/iroh/pull/8758">#8758</a></li>
|
|
<li>[IROH Auth] bugfix - <code>client/post</code> should use
|
|
<code>:form-params</code> instead of <code>:body</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8753">#8753</a></li>
|
|
<li>[IROH Auth] bugfixes - arity exception, change
|
|
<code>product-response</code> datatype, change <code>pmap</code> to
|
|
<code>map</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8738">#8738</a></li>
|
|
<li>[IROH Auth] bugfix - fix urls in <code>POST /tenants</code> returned
|
|
value and payload field names <a
|
|
href="https://github.com/advthreat/iroh/pull/8733">#8733</a></li>
|
|
<li>[IROH Auth] Cache OKTA JWT used for provisioning callback <a
|
|
href="https://github.com/advthreat/iroh/pull/8727">#8727</a></li>
|
|
<li>[IROH Auth] Improvements on logs and error handling to
|
|
UniversalProvisioning and JWKSService <a
|
|
href="https://github.com/advthreat/iroh/pull/8707">#8707</a></li>
|
|
<li>[IROH Auth] Duplicate <code>universal-provisioning</code> web routes
|
|
to accept IROH JWTs <a
|
|
href="https://github.com/advthreat/iroh/pull/8675">#8675</a></li>
|
|
<li>[IROH Auth] Expose <code>callbacks packages</code> store to check
|
|
Universal Provisioning status <a
|
|
href="https://github.com/advthreat/iroh/pull/8702">#8702</a></li>
|
|
<li>[IROH Auth] Improve 202 Accepted response for
|
|
<code>/universal-provisioning/create-tenants</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8701">#8701</a></li>
|
|
<li>[IROH Auth] Fix name convention to callbacks route in Universal
|
|
Provisioning flow <a
|
|
href="https://github.com/advthreat/iroh/pull/8691">#8691</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>[IROH Auth] Gen OKTA JWT to callback request in Universal
|
|
Provisioning flow <a
|
|
href="https://github.com/advthreat/iroh/pull/8673">#8673</a></li>
|
|
<li>bugfix - missing <code>UniversalProvisioningCallbackService</code>
|
|
to deploy IROH nodes <a
|
|
href="https://github.com/advthreat/iroh/pull/8680">#8680</a></li>
|
|
<li>[IROH Auth] Check pending provisions from time-to-time. Endpoint
|
|
that will be called by OPS tick <a
|
|
href="https://github.com/advthreat/iroh/pull/8674">#8674</a></li>
|
|
<li>[IROH Auth] Add callback handler to receive provisioning status from
|
|
downstream apps <a
|
|
href="https://github.com/advthreat/iroh/pull/8633">#8633</a></li>
|
|
<li>[IROH Auth] Add support to UserIdentity JWTs in
|
|
<code>JWKSService</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8647">#8647</a></li>
|
|
<li>[IROH Auth] Bugfix in JWKSService logic <a
|
|
href="https://github.com/advthreat/iroh/pull/8659">#8659</a></li>
|
|
<li>[IROH Auth] update docs for Universal Provisioning work <a
|
|
href="https://github.com/advthreat/iroh/pull/8640">#8640</a></li>
|
|
<li>[IROH Auth] Simplify IROH Web Core by leveraging
|
|
<code>JWKSService</code> for all webservices <a
|
|
href="https://github.com/advthreat/iroh/pull/8632">#8632</a></li>
|
|
<li>[IROH Auth] Add structure to keep track of onboardings to support
|
|
async flow in Universal Provisioning <a
|
|
href="https://github.com/advthreat/iroh/pull/8599">#8599</a></li>
|
|
<li>[IROH Auth] Add support to accept IROH Auth JWTs and External JWTs
|
|
in a WebService <a
|
|
href="https://github.com/advthreat/iroh/pull/8528">#8528</a></li>
|
|
<li>[IROH Auth] bump <code>ring-jwt-middleware</code> to
|
|
<code>1.1.5</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8568">#8568</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-8">tenzin-config [8]</h4>
|
|
<ul>
|
|
<li>add fmc client id for each env <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1065">#1065</a></li>
|
|
<li>fix url for device verification <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1058">#1058</a></li>
|
|
<li>Add FMC Proxy configuration <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1056">#1056</a></li>
|
|
<li>fix okta links <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1043">#1043</a></li>
|
|
<li>FMC base-urls to configure JWKS <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1040">#1040</a></li>
|
|
<li>[IROH Auth] bugfix - add config to okta jwks <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1017">#1017</a></li>
|
|
<li>[IROH Auth] add OKTA config for Universal Provisioning flow #1010 <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1013">#1013</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>add universal_provisioning_callbacks store <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1011">#1011</a></li>
|
|
</ul>
|
|
<h3 id="yann-esposito-118">Yann Esposito [118]</h3>
|
|
<h4 id="iroh-51">iroh [51]</h4>
|
|
<ul>
|
|
<li>Scopes by app <a
|
|
href="https://github.com/advthreat/iroh/pull/9247">#9247</a></li>
|
|
<li>Disable SSE Proxy for XDR orgs <a
|
|
href="https://github.com/advthreat/iroh/pull/9280">#9280</a></li>
|
|
<li>improve Client credentials error message to help debug <a
|
|
href="https://github.com/advthreat/iroh/pull/9213">#9213</a></li>
|
|
<li>Attempt to provide a body to the onboarding with mustache <a
|
|
href="https://github.com/advthreat/iroh/pull/9151">#9151</a></li>
|
|
<li>provisioning API for Org apps <a
|
|
href="https://github.com/advthreat/iroh/pull/9195">#9195</a></li>
|
|
<li>Revert "add admin-ui to the gh-pages (#9222)" <a
|
|
href="https://github.com/advthreat/iroh/pull/9223">#9223</a></li>
|
|
<li>add admin-ui to the gh-pages <a
|
|
href="https://github.com/advthreat/iroh/pull/9222">#9222</a></li>
|
|
<li>Add sc-enabled? flag to profile API views <a
|
|
href="https://github.com/advthreat/iroh/pull/9192">#9192</a></li>
|
|
<li>[PIAM Brownfield Provisioning]: Provide a way to update link tenants
|
|
<a href="https://github.com/advthreat/iroh/pull/9186">#9186</a></li>
|
|
<li>Add apps field to Orgs <a
|
|
href="https://github.com/advthreat/iroh/pull/9175">#9175</a></li>
|
|
<li>improve response when PIAM returns an error <a
|
|
href="https://github.com/advthreat/iroh/pull/9183">#9183</a></li>
|
|
<li>fix flaky test invite-test paging <a
|
|
href="https://github.com/advthreat/iroh/pull/9182">#9182</a></li>
|
|
<li>Support aero configurations <a
|
|
href="https://github.com/advthreat/iroh/pull/9170">#9170</a></li>
|
|
<li>Fix invites pagination <a
|
|
href="https://github.com/advthreat/iroh/pull/9138">#9138</a></li>
|
|
<li>Support FMC returning Bearer instead of bearer <a
|
|
href="https://github.com/advthreat/iroh/pull/9126">#9126</a></li>
|
|
<li>composable jwks test helper <a
|
|
href="https://github.com/advthreat/iroh/pull/9120">#9120</a></li>
|
|
<li>Sync user-name during SCSO login <a
|
|
href="https://github.com/advthreat/iroh/pull/9117">#9117</a></li>
|
|
<li>Another IPv6 in URL fix <a
|
|
href="https://github.com/advthreat/iroh/pull/9084">#9084</a></li>
|
|
<li>Support IPv6 in URL for inspect service <a
|
|
href="https://github.com/advthreat/iroh/pull/9083">#9083</a></li>
|
|
<li>Update of the login doc <a
|
|
href="https://github.com/advthreat/iroh/pull/9067">#9067</a></li>
|
|
<li>optimize search user given a list of ids <a
|
|
href="https://github.com/advthreat/iroh/pull/9018">#9018</a></li>
|
|
<li>Fix link tenant bug <a
|
|
href="https://github.com/advthreat/iroh/pull/8975">#8975</a></li>
|
|
<li>Upgrade Org to XDR on first entitlement update. <a
|
|
href="https://github.com/advthreat/iroh/pull/8881">#8881</a></li>
|
|
<li>[IROH-Auth]: Auth Code Grant Client that do not generate any refresh
|
|
token <a
|
|
href="https://github.com/advthreat/iroh/pull/8927">#8927</a></li>
|
|
<li>Specialize TAC routes access <a
|
|
href="https://github.com/advthreat/iroh/pull/8884">#8884</a></li>
|
|
<li>Remove legacy restriction of AO scopes <a
|
|
href="https://github.com/advthreat/iroh/pull/8890">#8890</a></li>
|
|
<li>Update deps to accept JWT without nbf claim <a
|
|
href="https://github.com/advthreat/iroh/pull/8872">#8872</a></li>
|
|
<li>New endpoint to ease impersonation usage <a
|
|
href="https://github.com/advthreat/iroh/pull/8855">#8855</a></li>
|
|
<li>Fix PIAM Universal Provisioning routes <a
|
|
href="https://github.com/advthreat/iroh/pull/8828">#8828</a></li>
|
|
<li>Should fix open impersonate flaky test <a
|
|
href="https://github.com/advthreat/iroh/pull/8809">#8809</a></li>
|
|
<li>Keep track of impersonators <a
|
|
href="https://github.com/advthreat/iroh/pull/8736">#8736</a></li>
|
|
<li>Restrict TAC routes to admins <a
|
|
href="https://github.com/advthreat/iroh/pull/8794">#8794</a></li>
|
|
<li>Remove with-tk <a
|
|
href="https://github.com/advthreat/iroh/pull/8779">#8779</a></li>
|
|
<li>Code/Test Improvements <a
|
|
href="https://github.com/advthreat/iroh/pull/8767">#8767</a></li>
|
|
<li>add a test for matching schema <a
|
|
href="https://github.com/advthreat/iroh/pull/8770">#8770</a></li>
|
|
<li>Custom Role Design doc <a
|
|
href="https://github.com/advthreat/iroh/pull/8497">#8497</a></li>
|
|
<li>Attempt to improve error message of match? <a
|
|
href="https://github.com/advthreat/iroh/pull/8769">#8769</a></li>
|
|
<li>Use <code>cid</code> for <code>trace_id</code> when present <a
|
|
href="https://github.com/advthreat/iroh/pull/8754">#8754</a></li>
|
|
<li>Support public client for custom routes <a
|
|
href="https://github.com/advthreat/iroh/pull/8749">#8749</a></li>
|
|
<li>Add playbook scope <a
|
|
href="https://github.com/advthreat/iroh/pull/8739">#8739</a></li>
|
|
<li>Fix webhook race condition risk <a
|
|
href="https://github.com/advthreat/iroh/pull/8728">#8728</a></li>
|
|
<li>Call get-org only once for org-virtual user <a
|
|
href="https://github.com/advthreat/iroh/pull/8724">#8724</a></li>
|
|
<li>Use a cache for entitlement summaries <a
|
|
href="https://github.com/advthreat/iroh/pull/8667">#8667</a></li>
|
|
<li>upgrade jetty version <a
|
|
href="https://github.com/advthreat/iroh/pull/8714">#8714</a></li>
|
|
<li>Remove a forgotten pretty printer <a
|
|
href="https://github.com/advthreat/iroh/pull/8713">#8713</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Fast Event Notifier dispatch using event-type <a
|
|
href="https://github.com/advthreat/iroh/pull/8650">#8650</a></li>
|
|
<li>Fix DI onboarding <a
|
|
href="https://github.com/advthreat/iroh/pull/8657">#8657</a></li>
|
|
<li>Generalize default indexes for data retention <a
|
|
href="https://github.com/advthreat/iroh/pull/8598">#8598</a></li>
|
|
<li>[Data Retention Policy]: Delete incident summaries along incident <a
|
|
href="https://github.com/advthreat/iroh/pull/8576">#8576</a></li>
|
|
<li>[Provisioning] Introduce <code>product-instance-id</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8577">#8577</a></li>
|
|
<li>Simply wait a lot more for ES to sync <a
|
|
href="https://github.com/advthreat/iroh/pull/8553">#8553</a></li>
|
|
</ul>
|
|
<h4 id="iroh-scripts-36">iroh-scripts [36]</h4>
|
|
<ul>
|
|
<li>ai onboarding</li>
|
|
<li>fix a bug with trust client</li>
|
|
<li>fix resend-invite</li>
|
|
<li>script to remove flags</li>
|
|
<li>fix a bug in create-super-org</li>
|
|
<li>relink scc script</li>
|
|
<li>prevent id collision</li>
|
|
<li>cleaned-up get-org response</li>
|
|
<li>Added add-flag script here</li>
|
|
<li>CSE client and better patch</li>
|
|
<li>resend-invite</li>
|
|
<li>add SXP riles prod clients</li>
|
|
<li>improve client manipulations</li>
|
|
<li>Updated scripts</li>
|
|
<li>use include</li>
|
|
<li>use local clojure</li>
|
|
<li>Added a better alias for sxo clients</li>
|
|
<li>SXO rules</li>
|
|
<li>added ai client with script</li>
|
|
<li>Fix</li>
|
|
<li>A few new scripts</li>
|
|
<li>Super client should be part of XDR orgs</li>
|
|
<li>Super org should have the XDR flag</li>
|
|
<li>Add admin user</li>
|
|
<li>updated and added scripts</li>
|
|
<li>save and improve client aliases</li>
|
|
<li>save improvements</li>
|
|
<li>create dashboard clients</li>
|
|
<li>Support client aliases in get-client</li>
|
|
<li>Update client with client-aliases</li>
|
|
<li>many new scripts</li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>added a 1-time script</li>
|
|
<li>Add trusted to get-client</li>
|
|
<li>Improve search and error messages</li>
|
|
<li>Prepare TG to SCSO org migration</li>
|
|
<li>add scope to a client</li>
|
|
</ul>
|
|
<h4 id="oauth2-client-demo-3">oauth2-client-demo [3]</h4>
|
|
<ul>
|
|
<li>pin packages</li>
|
|
<li>reuse authorized url</li>
|
|
<li>added Meraki client to the list</li>
|
|
</ul>
|
|
<h4 id="ring-jwt-middleware-3">ring-jwt-middleware [3]</h4>
|
|
<ul>
|
|
<li>Version 1.1.7-SNAPSHOT</li>
|
|
<li>Version 1.1.6</li>
|
|
<li>Support missing nbf JWT <a
|
|
href="https://github.com/advthreat/ring-jwt-middleware/pull/30">#30</a></li>
|
|
</ul>
|
|
<h4 id="scopula-6">scopula [6]</h4>
|
|
<ul>
|
|
<li>Version 0.3.3-SNAPSHOT</li>
|
|
<li>Version 0.3.2</li>
|
|
<li>real cljs support</li>
|
|
<li>Version 0.3.2-SNAPSHOT</li>
|
|
<li>Version 0.3.1</li>
|
|
<li>support cljs</li>
|
|
</ul>
|
|
<h4 id="tenzin-config-14">tenzin-config [14]</h4>
|
|
<ul>
|
|
<li>Add applications URL in iroh conf <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1146">#1146</a></li>
|
|
<li>Add AI Assistant automatic onboarding during Provisioning <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1142">#1142</a></li>
|
|
<li>add iroh gh-pages to allowed login origin <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1123">#1123</a></li>
|
|
<li>New SCA env for TEST/STAGING <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1114">#1114</a></li>
|
|
<li>configure automatio rules clients to not be rate limited <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1111">#1111</a></li>
|
|
<li>interpolation improvements <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1112">#1112</a></li>
|
|
<li>Add support for interpolation and self ref <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1110">#1110</a></li>
|
|
<li>Remove rate-limit for another SXO client on INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1087">#1087</a></li>
|
|
<li>Disable rate-limit SXO client for rules <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1084">#1084</a></li>
|
|
<li>Double threads dedicated for VirusTotal http calls <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1051">#1051</a></li>
|
|
<li>fix vault tpl transformations and checks <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1041">#1041</a></li>
|
|
<li>Remove rate-limit for automation <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1044">#1044</a></li>
|
|
<li>Check vault templating error <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1023">#1023</a></li>
|
|
<li>Add Universal Provisioning Services <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1015">#1015</a></li>
|
|
</ul>
|
|
<h4 id="xdr-provisioning-5">xdr-provisioning [5]</h4>
|
|
<ul>
|
|
<li>added a few useful script + ai onboarding support</li>
|
|
<li>improved re-onboarding script</li>
|
|
<li>use local clojure</li>
|
|
<li>Manage entitlements add-ons</li>
|
|
<li>add a re-provisioning script that rerun onboardings</li>
|
|
</ul>
|
|
<h3 id="olivier-barbeau-47">Olivier Barbeau [47]</h3>
|
|
<h4 id="iroh-31">iroh [31]</h4>
|
|
<ul>
|
|
<li>Add number of incidents to each technique in the Mitre matrix <a
|
|
href="https://github.com/advthreat/iroh/pull/9157">#9157</a></li>
|
|
<li>Fix events and incidents ES stores for DEV <a
|
|
href="https://github.com/advthreat/iroh/pull/9154">#9154</a></li>
|
|
<li>E8851: XDR Native & detections <a
|
|
href="https://github.com/advthreat/iroh/pull/9122">#9122</a></li>
|
|
<li>E8851: Design of changes for XDR native detections <a
|
|
href="https://github.com/advthreat/iroh/pull/9110">#9110</a></li>
|
|
<li>E8851: Product ordering in the coverage of techniques <a
|
|
href="https://github.com/advthreat/iroh/pull/9100">#9100</a></li>
|
|
<li>E8851: Product ordering and SCA renaming <a
|
|
href="https://github.com/advthreat/iroh/pull/9086">#9086</a></li>
|
|
<li>E8851: Add Org's integrations to the Mitre matrix <a
|
|
href="https://github.com/advthreat/iroh/pull/8993">#8993</a></li>
|
|
<li>E8851: Sorting of Mitre elements <a
|
|
href="https://github.com/advthreat/iroh/pull/8992">#8992</a></li>
|
|
<li>E8851: Static matrix common to all Orgs <a
|
|
href="https://github.com/advthreat/iroh/pull/8939">#8939</a></li>
|
|
<li>E8851: Talos MITRE coverage files import <a
|
|
href="https://github.com/advthreat/iroh/pull/8876">#8876</a></li>
|
|
<li>Design of the Talos MITRE coverage files import <a
|
|
href="https://github.com/advthreat/iroh/pull/8856">#8856</a></li>
|
|
<li>'iroh' node type and default services for all node types <a
|
|
href="https://github.com/advthreat/iroh/pull/8817">#8817</a></li>
|
|
<li>Check the list of services for a node type <a
|
|
href="https://github.com/advthreat/iroh/pull/8800">#8800</a></li>
|
|
<li>Fix merge error on PR 8784 <a
|
|
href="https://github.com/advthreat/iroh/pull/8797">#8797</a></li>
|
|
<li>[IROH configuration]: Move role-web-service config to default tk
|
|
files <a
|
|
href="https://github.com/advthreat/iroh/pull/8782">#8782</a></li>
|
|
<li>[IROH configuration]: Universal Provisioning Services config
|
|
refactor <a
|
|
href="https://github.com/advthreat/iroh/pull/8784">#8784</a></li>
|
|
<li>[IROH configuration]: explicit name for generated conf and meta <a
|
|
href="https://github.com/advthreat/iroh/pull/8785">#8785</a></li>
|
|
<li>Clean bootstrap.cfg; remove tmp file <a
|
|
href="https://github.com/advthreat/iroh/pull/8781">#8781</a></li>
|
|
<li>Add few additional tests to iroh services <a
|
|
href="https://github.com/advthreat/iroh/pull/8762">#8762</a></li>
|
|
<li>rewrite tests <a
|
|
href="https://github.com/advthreat/iroh/pull/8773">#8773</a></li>
|
|
<li>more info for debugging <a
|
|
href="https://github.com/advthreat/iroh/pull/8717">#8717</a></li>
|
|
<li>[IROH configuration]: general documentation <a
|
|
href="https://github.com/advthreat/iroh/pull/8764">#8764</a></li>
|
|
<li>update developer doc for api-gateway <a
|
|
href="https://github.com/advthreat/iroh/pull/8723">#8723</a></li>
|
|
<li>Some test clean-up <a
|
|
href="https://github.com/advthreat/iroh/pull/8716">#8716</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>High volume of SQL queries for a single observe/deliberate call <a
|
|
href="https://github.com/advthreat/iroh/pull/8682">#8682</a></li>
|
|
<li>Remove the state of module instances in
|
|
<code>obfuscate-module-instance</code> <a
|
|
href="https://github.com/advthreat/iroh/pull/8670">#8670</a></li>
|
|
<li>E8388: update proxy-endpoints-metadata endpoint and metadata <a
|
|
href="https://github.com/advthreat/iroh/pull/8663">#8663</a></li>
|
|
<li>E8388: update x-proxy endpoint and IntService ACL filters <a
|
|
href="https://github.com/advthreat/iroh/pull/8608">#8608</a></li>
|
|
<li>E8388 : Simplifies upgrade/downgrade tests <a
|
|
href="https://github.com/advthreat/iroh/pull/8635">#8635</a></li>
|
|
<li>Implement <code>Module Instance service</code> event handler <a
|
|
href="https://github.com/advthreat/iroh/pull/8592">#8592</a></li>
|
|
<li>Updates to the design 'entitlement changes for integration modules'
|
|
<a href="https://github.com/advthreat/iroh/pull/8541">#8541</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-16">tenzin-config [16]</h4>
|
|
<ul>
|
|
<li>add XDR native module types for PROD <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1115">#1115</a></li>
|
|
<li>add SCA module-type-id for XDR Native on TEST [temp UI fix] <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1109">#1109</a></li>
|
|
<li>add SCA module-type-id for XDR Native [temp UI fix] <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1108">#1108</a></li>
|
|
<li>Mitre: Add detections for XDR Native <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1098">#1098</a></li>
|
|
<li>product ordering and SCA renaming <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1079">#1079</a></li>
|
|
<li>Config for Mitre covering products <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1072">#1072</a></li>
|
|
<li>Deep merge for vectors and sets with duplicates check <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1032">#1032</a></li>
|
|
<li>Reduce configuration duplicates - config.edn part <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1031">#1031</a></li>
|
|
<li>Reduce configuration duplicates - bootstrap.cfg part <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1028">#1028</a></li>
|
|
<li>Move role-web-service config to IROH <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1026">#1026</a></li>
|
|
<li>Move Universal Provisioning Services config to IROH <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1027">#1027</a></li>
|
|
<li>Clean bootstrap cfg <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1025">#1025</a></li>
|
|
<li>Remove the <code>:registration</code> flag in all environments <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/963">#963</a></li>
|
|
<li>Remove the <code>:merge-users-by-email</code> flag in all
|
|
environments <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/962">#962</a></li>
|
|
<li>Remove the <code>:account-activation-optim</code> flag in all
|
|
environments as it is now activated everywhere. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/961">#961</a></li>
|
|
<li>Remove the <code>xdr-roles</code> flag in all environments <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/964">#964</a></li>
|
|
</ul>
|
|
<h3 id="yogsototh-52">(Yogsototh) [52]</h3>
|
|
<h4 id="iroh-scripts-36-1">iroh-scripts [36]</h4>
|
|
<ul>
|
|
<li>ai onboarding</li>
|
|
<li>fix a bug with trust client</li>
|
|
<li>fix resend-invite</li>
|
|
<li>script to remove flags</li>
|
|
<li>fix a bug in create-super-org</li>
|
|
<li>relink scc script</li>
|
|
<li>prevent id collision</li>
|
|
<li>cleaned-up get-org response</li>
|
|
<li>Added add-flag script here</li>
|
|
<li>CSE client and better patch</li>
|
|
<li>resend-invite</li>
|
|
<li>add SXP riles prod clients</li>
|
|
<li>improve client manipulations</li>
|
|
<li>Updated scripts</li>
|
|
<li>use include</li>
|
|
<li>use local clojure</li>
|
|
<li>Added a better alias for sxo clients</li>
|
|
<li>SXO rules</li>
|
|
<li>added ai client with script</li>
|
|
<li>Fix</li>
|
|
<li>A few new scripts</li>
|
|
<li>Super client should be part of XDR orgs</li>
|
|
<li>Super org should have the XDR flag</li>
|
|
<li>Add admin user</li>
|
|
<li>updated and added scripts</li>
|
|
<li>save and improve client aliases</li>
|
|
<li>save improvements</li>
|
|
<li>create dashboard clients</li>
|
|
<li>Support client aliases in get-client</li>
|
|
<li>Update client with client-aliases</li>
|
|
<li>many new scripts</li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>added a 1-time script</li>
|
|
<li>Add trusted to get-client</li>
|
|
<li>Improve search and error messages</li>
|
|
<li>Prepare TG to SCSO org migration</li>
|
|
<li>add scope to a client</li>
|
|
</ul>
|
|
<h4 id="oauth2-client-demo-3-1">oauth2-client-demo [3]</h4>
|
|
<ul>
|
|
<li>pin packages</li>
|
|
<li>reuse authorized url</li>
|
|
<li>added Meraki client to the list</li>
|
|
</ul>
|
|
<h4 id="ring-jwt-middleware-2">ring-jwt-middleware [2]</h4>
|
|
<ul>
|
|
<li>Version 1.1.7-SNAPSHOT</li>
|
|
<li>Version 1.1.6</li>
|
|
</ul>
|
|
<h4 id="scopula-6-1">scopula [6]</h4>
|
|
<ul>
|
|
<li>Version 0.3.3-SNAPSHOT</li>
|
|
<li>Version 0.3.2</li>
|
|
<li>real cljs support</li>
|
|
<li>Version 0.3.2-SNAPSHOT</li>
|
|
<li>Version 0.3.1</li>
|
|
<li>support cljs</li>
|
|
</ul>
|
|
<h4 id="xdr-provisioning-5-1">xdr-provisioning [5]</h4>
|
|
<ul>
|
|
<li>added a few useful script + ai onboarding support</li>
|
|
<li>improved re-onboarding script</li>
|
|
<li>use local clojure</li>
|
|
<li>Manage entitlements add-ons</li>
|
|
<li>add a re-provisioning script that rerun onboardings</li>
|
|
</ul>
|
|
<h2 id="iroh-ops">iroh-ops</h2>
|
|
<h3 id="jerome-schneider-1">Jerome Schneider [1]</h3>
|
|
<h4 id="tenzin-config-1">tenzin-config [1]</h4>
|
|
<ul>
|
|
<li>IROH migrate to new MSK SASL/SCRAM cluster!</li>
|
|
</ul>
|
|
<h3 id="patrick-patat-1">Patrick Patat [1]</h3>
|
|
<h4 id="tenzin-config-1-1">tenzin-config [1]</h4>
|
|
<ul>
|
|
<li>refactor ops config with new ref system <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1113">#1113</a></li>
|
|
</ul>
|
|
<h1 id="other">Other</h1>
|
|
<h2 id="other-1">Other</h2>
|
|
<h3 id="robert-levy-7">Robert Levy [7]</h3>
|
|
<h4 id="iroh-6">iroh [6]</h4>
|
|
<ul>
|
|
<li>Inherit properties from type in hierarchical modules <a
|
|
href="https://github.com/advthreat/iroh/pull/9042">#9042</a></li>
|
|
<li>Format hierarchical modules invalid-parent-id error with context and
|
|
error type <a
|
|
href="https://github.com/advthreat/iroh/pull/8901">#8901</a></li>
|
|
<li>Update hardcoded source in Secure Endpoint module <a
|
|
href="https://github.com/advthreat/iroh/pull/8874">#8874</a></li>
|
|
<li>Expose pagination & search functionality in notifications api <a
|
|
href="https://github.com/advthreat/iroh/pull/8803">#8803</a></li>
|
|
<li>Fix bug in hierarchical module logic producing empty
|
|
settings/settings_effective map <a
|
|
href="https://github.com/advthreat/iroh/pull/8745">#8745</a></li>
|
|
<li>Issue 8158 hierarchical module <a
|
|
href="https://github.com/advthreat/iroh/pull/8469">#8469</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-1-2">tenzin-config [1]</h4>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Revert "Adds cache configuration for CrowdStrike (#1002)" <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1005">#1005</a></li>
|
|
</ul>
|
|
<h3 id="eric-gierach-4">Eric Gierach [4]</h3>
|
|
<h4 id="iroh-1">iroh [1]</h4>
|
|
<ul>
|
|
<li>update iroh-engine to 0.16.5 <a
|
|
href="https://github.com/advthreat/iroh/pull/9291">#9291</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-3-2">tenzin-config [3]</h4>
|
|
<ul>
|
|
<li>removing duplicate entry <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1078">#1078</a></li>
|
|
<li>Swap stg and test configs for reporting. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1077">#1077</a></li>
|
|
<li>Disabling reporting until Ops gets the infra set up. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1075">#1075</a></li>
|
|
</ul>
|
|
<h3 id="ii-21">II [21]</h3>
|
|
<h4 id="iroh-17">iroh [17]</h4>
|
|
<ul>
|
|
<li>Xdr 1281 Adds user agent to Umbrella requests <a
|
|
href="https://github.com/advthreat/iroh/pull/9292">#9292</a></li>
|
|
<li>Keeps Kondo from being run on dev start <a
|
|
href="https://github.com/advthreat/iroh/pull/9220">#9220</a></li>
|
|
<li>Xdr 1282 Adds new Umbrella service to default services <a
|
|
href="https://github.com/advthreat/iroh/pull/9214">#9214</a></li>
|
|
<li>Xdr 1282 add v 2 token cache to umbrella integration <a
|
|
href="https://github.com/advthreat/iroh/pull/9208">#9208</a></li>
|
|
<li>XDR-1411 Fixes inconsistent v1 v2 refer <a
|
|
href="https://github.com/advthreat/iroh/pull/9197">#9197</a></li>
|
|
<li>9074 remove settings effective <a
|
|
href="https://github.com/advthreat/iroh/pull/9075">#9075</a></li>
|
|
<li>8990 umbrella investigate v2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9030">#9030</a></li>
|
|
<li>8958 Adds Missing Umbrella v2 Sightings <a
|
|
href="https://github.com/advthreat/iroh/pull/8960">#8960</a></li>
|
|
<li>8498 fix token cache <a
|
|
href="https://github.com/advthreat/iroh/pull/8911">#8911</a></li>
|
|
<li>8798 create migration to add parents to existing microsoft defender
|
|
modules <a
|
|
href="https://github.com/advthreat/iroh/pull/8870">#8870</a></li>
|
|
<li>Throws exception in parent validation on non-existent parent <a
|
|
href="https://github.com/advthreat/iroh/pull/8850">#8850</a></li>
|
|
<li>Merges module type props on create and update health check <a
|
|
href="https://github.com/advthreat/iroh/pull/8845">#8845</a></li>
|
|
<li>Implements v2 threat hunting <a
|
|
href="https://github.com/advthreat/iroh/pull/8833">#8833</a></li>
|
|
<li>This should fix issue with parent settings not used on create-patch
|
|
<a href="https://github.com/advthreat/iroh/pull/8822">#8822</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Adds insights scope to allowed Automation scopes in gen-ao-jwt <a
|
|
href="https://github.com/advthreat/iroh/pull/8678">#8678</a></li>
|
|
<li>8496 token cache fix <a
|
|
href="https://github.com/advthreat/iroh/pull/8637">#8637</a></li>
|
|
<li>8496 - relay module token cache <a
|
|
href="https://github.com/advthreat/iroh/pull/8580">#8580</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-4-2">tenzin-config [4]</h4>
|
|
<ul>
|
|
<li>Disables Umbrella module auto load so service does it <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1120">#1120</a></li>
|
|
<li>Enables Umbrella token caches <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1119">#1119</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Revert "Revert "Adds cache configuration for CrowdStrike (#1002)"
|
|
(#1005)" <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1008">#1008</a></li>
|
|
<li>Adds cache configuration for CrowdStrike <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1002">#1002</a></li>
|
|
</ul>
|
|
<h3 id="devin-walters-8">Devin Walters [8]</h3>
|
|
<h4 id="tenzin-config-8-1">tenzin-config [8]</h4>
|
|
<ul>
|
|
<li>Configure s3-http-client connection pool size for PROD environments
|
|
<a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1105">#1105</a></li>
|
|
<li>Turn on reporting pipeline in TEST <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1097">#1097</a></li>
|
|
<li>Up hikari pool size in INT for conure <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1095">#1095</a></li>
|
|
<li>Configure incident import bucket per PROD env for iroh and
|
|
iroh-async <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1092">#1092</a></li>
|
|
<li>Configure incident pipeline <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1091">#1091</a></li>
|
|
<li>Fix bucket name <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1083">#1083</a></li>
|
|
<li>Match s3 bucket key <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1082">#1082</a></li>
|
|
<li>Add INT and TEST enrichment bucket names to relevant configs <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1057">#1057</a></li>
|
|
</ul>
|
|
<h3 id="mia-7">Mia [7]</h3>
|
|
<h4 id="iroh-7">iroh [7]</h4>
|
|
<ul>
|
|
<li>new engine version <a
|
|
href="https://github.com/advthreat/iroh/pull/9273">#9273</a></li>
|
|
<li>Xdr 1918 no old assets <a
|
|
href="https://github.com/advthreat/iroh/pull/9267">#9267</a></li>
|
|
<li>create permanent logs to unobtrusively monitor bundle import results
|
|
<a href="https://github.com/advthreat/iroh/pull/9242">#9242</a></li>
|
|
<li>New iroh event docs <a
|
|
href="https://github.com/advthreat/iroh/pull/9181">#9181</a></li>
|
|
<li>iroh-engine 0.16.2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9125">#9125</a></li>
|
|
<li>Engine 0.16.1 <a
|
|
href="https://github.com/advthreat/iroh/pull/9116">#9116</a></li>
|
|
<li>Engine 0.16.0 <a
|
|
href="https://github.com/advthreat/iroh/pull/8997">#8997</a></li>
|
|
</ul>
|
|
<h3 id="martin-bruchanov-3">Martin Bruchanov [3]</h3>
|
|
<h4 id="tenzin-config-3-3">tenzin-config [3]</h4>
|
|
<ul>
|
|
<li>XDRSRE-1158: Enabling ElasticSearch authentication for CTIA/PCTIA <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1141">#1141</a></li>
|
|
<li>XDRSRE-1150: Retention enforcement authentication INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1132">#1132</a></li>
|
|
<li>XDRSRE-64: Authentication for public CTIA in INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1081">#1081</a></li>
|
|
</ul>
|
|
<h3 id="james-moser-1">James Moser [1]</h3>
|
|
<h4 id="tenzin-config-1-3">tenzin-config [1]</h4>
|
|
<ul>
|
|
<li>added QA domain to idps email domain whitelists <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1085">#1085</a></li>
|
|
</ul>
|
|
<h3 id="section">[21]</h3>
|
|
<h4 id="iroh-17-1">iroh [17]</h4>
|
|
<ul>
|
|
<li>Xdr 1281 Adds user agent to Umbrella requests <a
|
|
href="https://github.com/advthreat/iroh/pull/9292">#9292</a></li>
|
|
<li>Keeps Kondo from being run on dev start <a
|
|
href="https://github.com/advthreat/iroh/pull/9220">#9220</a></li>
|
|
<li>Xdr 1282 Adds new Umbrella service to default services <a
|
|
href="https://github.com/advthreat/iroh/pull/9214">#9214</a></li>
|
|
<li>Xdr 1282 add v 2 token cache to umbrella integration <a
|
|
href="https://github.com/advthreat/iroh/pull/9208">#9208</a></li>
|
|
<li>XDR-1411 Fixes inconsistent v1 v2 refer <a
|
|
href="https://github.com/advthreat/iroh/pull/9197">#9197</a></li>
|
|
<li>9074 remove settings effective <a
|
|
href="https://github.com/advthreat/iroh/pull/9075">#9075</a></li>
|
|
<li>8990 umbrella investigate v2 <a
|
|
href="https://github.com/advthreat/iroh/pull/9030">#9030</a></li>
|
|
<li>8958 Adds Missing Umbrella v2 Sightings <a
|
|
href="https://github.com/advthreat/iroh/pull/8960">#8960</a></li>
|
|
<li>8498 fix token cache <a
|
|
href="https://github.com/advthreat/iroh/pull/8911">#8911</a></li>
|
|
<li>8798 create migration to add parents to existing microsoft defender
|
|
modules <a
|
|
href="https://github.com/advthreat/iroh/pull/8870">#8870</a></li>
|
|
<li>Throws exception in parent validation on non-existent parent <a
|
|
href="https://github.com/advthreat/iroh/pull/8850">#8850</a></li>
|
|
<li>Merges module type props on create and update health check <a
|
|
href="https://github.com/advthreat/iroh/pull/8845">#8845</a></li>
|
|
<li>Implements v2 threat hunting <a
|
|
href="https://github.com/advthreat/iroh/pull/8833">#8833</a></li>
|
|
<li>This should fix issue with parent settings not used on create-patch
|
|
<a href="https://github.com/advthreat/iroh/pull/8822">#8822</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Adds insights scope to allowed Automation scopes in gen-ao-jwt <a
|
|
href="https://github.com/advthreat/iroh/pull/8678">#8678</a></li>
|
|
<li>8496 token cache fix <a
|
|
href="https://github.com/advthreat/iroh/pull/8637">#8637</a></li>
|
|
<li>8496 - relay module token cache <a
|
|
href="https://github.com/advthreat/iroh/pull/8580">#8580</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-4-3">tenzin-config [4]</h4>
|
|
<ul>
|
|
<li>Disables Umbrella module auto load so service does it <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1120">#1120</a></li>
|
|
<li>Enables Umbrella token caches <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1119">#1119</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Revert "Revert "Adds cache configuration for CrowdStrike (#1002)"
|
|
(#1005)" <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1008">#1008</a></li>
|
|
<li>Adds cache configuration for CrowdStrike <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1002">#1002</a></li>
|
|
</ul>
|
|
<h3 id="martin-bruchanov-1">Martin Bruchanov [1]</h3>
|
|
<h4 id="iroh-1-1">iroh [1]</h4>
|
|
<ul>
|
|
<li>XDR-1344: Final version of deletion script used for PROD change <a
|
|
href="https://github.com/advthreat/iroh/pull/9174">#9174</a></li>
|
|
</ul>
|
|
<h3 id="ruslan-yemelianov-2">Ruslan Yemelianov [2]</h3>
|
|
<h4 id="tenzin-config-2-1">tenzin-config [2]</h4>
|
|
<ul>
|
|
<li>Revert "enable ES auth private-ctia INT"</li>
|
|
<li>enable ES auth private-ctia INT</li>
|
|
</ul>
|
|
<h3 id="andrew-parisi-2">Andrew Parisi [2]</h3>
|
|
<h4 id="tenzin-config-2-2">tenzin-config [2]</h4>
|
|
<ul>
|
|
<li>[data-retention/update-iroh-internal-for-prod] <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1018">#1018</a></li>
|
|
</ul>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>[data-retention/update-entitlement-route-information] <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1004">#1004</a></li>
|
|
</ul>
|
|
<h3 id="scott-mcleod-7">Scott McLeod [7]</h3>
|
|
<h4 id="iroh-6-1">iroh [6]</h4>
|
|
<ul>
|
|
<li>Notification service timestamp filter <a
|
|
href="https://github.com/advthreat/iroh/pull/9252">#9252</a></li>
|
|
<li>Tk store half bounded intervals <a
|
|
href="https://github.com/advthreat/iroh/pull/9158">#9158</a></li>
|
|
<li>Extend tk search with range queries <a
|
|
href="https://github.com/advthreat/iroh/pull/8912">#8912</a></li>
|
|
<li>Resolves postgres driver sql-injection vulnerability #9091 <a
|
|
href="https://github.com/advthreat/iroh/pull/9092">#9092</a></li>
|
|
<li>Implement searching risk scores by score <a
|
|
href="https://github.com/advthreat/iroh/pull/8907">#8907</a></li>
|
|
<li>tk store: Add delete-search method #8213 <a
|
|
href="https://github.com/advthreat/iroh/pull/8692">#8692</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-1-4">tenzin-config [1]</h4>
|
|
<ul>
|
|
<li>Increase ReportService batch size to ES maximum <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1055">#1055</a></li>
|
|
</ul>
|
|
<h3 id="sam-waggoner-3">Sam Waggoner [3]</h3>
|
|
<h4 id="tenzin-config-3-4">tenzin-config [3]</h4>
|
|
<ul>
|
|
<li>Increase ctia.http.bulk.max-size in INT</li>
|
|
<li>Configure hydrant to use internal ES metrics api.</li>
|
|
<li>hydrant/912 add clean hashes importer.</li>
|
|
</ul>
|
|
<h3 id="t2sw-2">t2sw [2]</h3>
|
|
<h4 id="ctia-1">ctia [1]</h4>
|
|
<p><u>between 6 month and 7 month old</u></p>
|
|
<ul>
|
|
<li>Update CODEOWNERS <a
|
|
href="https://github.com/threatgrid/ctia/pull/1390">#1390</a></li>
|
|
</ul>
|
|
<h4 id="iroh-1-2">iroh [1]</h4>
|
|
<ul>
|
|
<li>add health endpoint to tac portal and update tests <a
|
|
href="https://github.com/advthreat/iroh/pull/9002">#9002</a></li>
|
|
</ul>
|
|
<h3 id="brooke-swanson-24">Brooke Swanson [24]</h3>
|
|
<h4 id="ctia-2-1">ctia [2]</h4>
|
|
<ul>
|
|
<li>XDR-1769: bump CTIM to 1.3.17. <a
|
|
href="https://github.com/threatgrid/ctia/pull/1422">#1422</a></li>
|
|
<li>Add brookeswanson to codeowners. <a
|
|
href="https://github.com/threatgrid/ctia/pull/1396">#1396</a></li>
|
|
</ul>
|
|
<h4 id="iroh-8">iroh [8]</h4>
|
|
<ul>
|
|
<li>Maintain behavior for existing events, but also notify s3 if an
|
|
incid… <a
|
|
href="https://github.com/advthreat/iroh/pull/9172">#9172</a></li>
|
|
<li>XDR-1769: bump CTIM to 1.3.17. <a
|
|
href="https://github.com/advthreat/iroh/pull/9226">#9226</a></li>
|
|
<li>Reformat bucket path <a
|
|
href="https://github.com/advthreat/iroh/pull/9102">#9102</a></li>
|
|
<li>Save to s3 on bundle import. <a
|
|
href="https://github.com/advthreat/iroh/pull/8977">#8977</a></li>
|
|
<li>Replace CTIA Crud with Conure Calls <a
|
|
href="https://github.com/advthreat/iroh/pull/8924">#8924</a></li>
|
|
<li>Limit risk score <a
|
|
href="https://github.com/advthreat/iroh/pull/8906">#8906</a></li>
|
|
<li>Set Limits around observe targets call <a
|
|
href="https://github.com/advthreat/iroh/pull/8910">#8910</a></li>
|
|
<li>Add no-doc true and prevent explosion due to mismatched types. <a
|
|
href="https://github.com/advthreat/iroh/pull/8548">#8548</a></li>
|
|
</ul>
|
|
<h4 id="tenzin-config-14-1">tenzin-config [14]</h4>
|
|
<ul>
|
|
<li>Failure to configure correct url. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1100">#1100</a></li>
|
|
<li>These were flipped in TEST and we would like to test reports. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1094">#1094</a></li>
|
|
<li>One more time see if the report tab will work. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1088">#1088</a></li>
|
|
<li>Toggle report feature until Infrastructure is stable. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1086">#1086</a></li>
|
|
<li>update config. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1080">#1080</a></li>
|
|
<li>Report in test. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1076">#1076</a></li>
|
|
<li>conure -> base-url. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1073">#1073</a></li>
|
|
<li>Temporary flip this to not spam logs. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1069">#1069</a></li>
|
|
<li>Output buckets. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1068">#1068</a></li>
|
|
<li>Distributor and Conure configs. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1067">#1067</a></li>
|
|
<li>Add base-url for incident export (and incident report). <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1064">#1064</a></li>
|
|
<li>Add playbook to conure configs. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1060">#1060</a></li>
|
|
<li>Add ouath2 config for all regions. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1020">#1020</a></li>
|
|
<li>Playbook automation config. <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1037">#1037</a></li>
|
|
</ul>
|
|
<h3 id="yurii-ivanisenko-1">Yurii Ivanisenko [1]</h3>
|
|
<h4 id="tenzin-config-1-5">tenzin-config [1]</h4>
|
|
<ul>
|
|
<li>tactical-portal moved to vercel <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1022">#1022</a></li>
|
|
</ul>
|
|
<h3 id="james-brock-1">James Brock [1]</h3>
|
|
<h4 id="easy-purescript-nix-1">easy-purescript-nix [1]</h4>
|
|
<ul>
|
|
<li>purs: 0.15.10 -> 0.15.15</li>
|
|
</ul>
|
|
<h3 id="ryemelia-9">ryemelia [9]</h3>
|
|
<h4 id="tenzin-config-9">tenzin-config [9]</h4>
|
|
<ul>
|
|
<li>XDRSRE-1370: Enable ES auth for staging-ctia service <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1147">#1147</a></li>
|
|
<li>XDRSRE-1370: Enable ES auth for ctia and private-ctia <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1145">#1145</a></li>
|
|
<li>XDRSRE-1155: Enable ES auth iroh/iroh-async all envs <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1137">#1137</a></li>
|
|
<li>XDRSRE-1150: [TEST] Enable ES auth iroh/iroh-async <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1128">#1128</a></li>
|
|
<li>Enable ES auth private-ctia TEST <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1126">#1126</a></li>
|
|
<li>Enable es auth CTIA test <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1127">#1127</a></li>
|
|
<li>fix kafka connector ES AUTH for INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1129">#1129</a></li>
|
|
<li>Enable ES auth private-ctia INT <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1125">#1125</a></li>
|
|
<li>XDRSRE-1273: [INT] Enable ES auth for iroh iroh-async <a
|
|
href="https://github.com/advthreat/tenzin-config/pull/1124">#1124</a></li>
|
|
</ul>
|
|
</body>
|
|
</html>
|