Announcing Graylog Illuminate 3.3
- Updated default user and device priority level assignments in static_accounts.csv (#1248)
- Severity and priority levels have been changed to be aligned
- Account and device prioity levels are: 1=low, 2=medium, 3=high, 4=critical
- All severity levels are now 1=informational, 2=low, 3=medium, 4=high, 5=critical
- This release requires Graylog 5.0.0 or later system with a valid Security or Operations license
- New Illuminate content included with Illuminate 3.3.0:
- Snort 3 IDS Processing and Spotlight Packs (#1204)
- Checkpoint Firewalls Processing Pack (#1053)
- pfSense/OPNsense Firewall Processing and Spotlight Packs (#1208)
- Spotlight files are now included in the Illuminate bundle
- The following Graylog Illuminate Spotlight packs have changed:
- Core: Added Network Traffic dashboard (#148)
GRAYLOG ILLUMINATE 3.3
Released: 2023-05-18
Fixes
- Core
- Added checks to verify proper values assigned to user and device priority levels (#1248)
- Entity enrichment lookup allows unsafe value entries (#1245)
- Microsoft Defender
- Extraction pattern breaking when encountering empty User field (#1278)
- Microsoft Windows Security
- Parsing breaking due to localization of keywords fields (#1212)
- Meraki
- Fixed parsing of flow logs when hostname present in log header (#1239)
- Cisco ASA
- “vendor_event_outcome” used where it should be “vendor_event_action” (#1187)
- Fixed logic issues destination_reference selection rule criteria (#1299)
- Apache HTTPD:
- Added support for CentOS/Redhat/FreeBSD default log filenames (#1271)
- vendor_event_severity_level should be vendor_event_severity (#1272)
Enhancements
- Added Winlogbeat version 8.x support for Windows Security, Sysmon, and Microsoft Defender content (#755)
- Core
- Added src_ip, src_port, dst_ip, dst_port mappings to Sigma mapping table (#1218)
- Added automatic mappings for event_severity to event_severity_level and visa versa (#1222)
Known Issues:
- Auditbeat cannot process events with multiple values assigned to vendor_event_action (#622)
Let us know what you’d like to have included in our GitHub issue tracker.
