ReleaseNotes_c2106.2.md

Security Content c2106.2 Release Notes

These Release Notes document security content updates from content package c2105.2 to c2106.2.

The security content updates listed below include changes to the following areas:

• Parsers

• Models

• Rules

In the lists below, each item represents a specific parser, model, or rule that has been added, updated, or deprecated. To facilitate finding every data source where the changed content items are referenced, a content library query has been created for each changed parser, model, or rule. To view the results of each query, click on the link for the relevant content item.

Parsers

• New

• Updated

• Deprecated

New Parsers

• apache-failed-app-login-2

• avi-lb-app-login

• azure-atp-security-alert-4

• cef-mcafee-mvision-skyhigh-dlp-alert-1

• cef-microsoft-graph-activity-6

• cef-okta-app-login-1

• cef-okta-logs-authentication

• counteract-network-alert-5

• defender-atp-security-alert-3

• defender-atp-security-alert-4

• f5-account-switch

• f5-dlp-email-out

• f5-process-created

• f5-ssh-login-successful-1

• goanywhere-failed-logon

• goanywhere-file-delete-1

• goanywhere-file-delete

• goanywhere-file-download-1

• goanywhere-file-download

• goanywhere-file-upload-1

• goanywhere-file-upload

• goanywhere-remote-logon-1

• goanywhere-remote-logon-2

• goanywhere-remote-logon-3

• goanywhere-remote-logon

• mcas-security-alert-1

• nokia-vitalqip-computer-logon-1

• nokia-vitalqip-computer-logon

• ping-authentication-failed

• ping-authentication-successful

• raw-4624-10

• raw-4648-5

• raw-4672-3

• raw-4673-2

• raw-4674-4

• raw-4768-5

• raw-4769-7

• raw-4771-2

• raw-4776-5

• raw-5140-2

• raw-5145-11

• s-mcafee-usb-activity-dvd-1

• s-mcafee-usb-activity-dvd-2

• s-mvision-dlp-alert-1

• s-mvision-dlp-alert-2

• s-mvision-dlp-alert-3

• s-mvision-dlp-alert-4

• s-mvision-dlp-alert-5

• symantec-dlp-alert-2

• syslog-4776-multiline

• trendmicro-network-conn-failed

• trendmicro-network-conn-successful

• windows-xml-4674

• windows-xml-4700

• windows-xml-4720

• windows-xml-4722

• windows-xml-4742

• windows-xml-member-added-2008

• windows-xml-powershell-800

• windows-xml-powershell-process-created-1

• windows-xml-powershell-process-created-2

• windows-xml-powershell-process-created

Updated Parsers

• ad-audit-4624

• apc-network-alert

• azure-process-created-1

• cef-4624

• cef-O365-dlp-email

• cef-f5-asm-alert

• cef-forcepoint-proxy

• cef-o365-dlp-alert

• cef-o365-dlp-email

• cef-o365-security-alert

• cef-okta-account-password-reset

• cef-okta-account-unlocked

• cef-palo-alto-networks-security-alert

• cef-sophos-dlp-alert-7

• cef-sophos-dlp-alert-8

• cef-sophos-security-alert-10

• cef-sophos-security-alert-11

• cef-sophos-security-alert-12

• cef-sophos-security-alert-13

• cef-sophos-security-alert-14

• cef-sophos-security-alert-15

• cef-sophos-security-alert-18

• cef-sophos-security-alert-26

• cef-sophos-security-alert-30

• cef-sophos-security-alert-7

• cef-sophos-security-alert-8

• cef-tippingPoint-network-alert-1

• cef-tippingPoint-network-alert

• cef-trendmicro-dlp-email-alert

• cef-trendmicro-security-alert-2

• cef-trendmicro-security-alert-5

• cef-trendmicro-security-alert-6

• cef-trendmicro-security-alert-7

• cef-trendmicro-security-alert-8

• cef-xps-print-activity

• cisco-2960-auth-failed-1

• cisco-asa-connection-built-302013

• cisco-dns-response

• cisco-netflow-connection-1

• cisco-ssh-login-1

• cisco-umbrella-proxy

• counteract-network-alert-4

• crowdstrike-app-activity-10

• crowdstrike-app-activity-11

• crowdstrike-app-activity-7

• crowdstrike-app-activity-8

• crowdstrike-app-activity-9

• crowdstrike-file-download-1

• crowdstrike-file-download

• crowdstrike-file-read-3

• crowdstrike-file-read

• crowdstrike-file-write-2

• crowdstrike-file-write-3

• crowdstrike-file-write-4

• crowdstrike-file-write-5

• crowdstrike-file-write-7

• crowdstrike-file-write

• crowdstrike-network-connection

• crowdstrike-process-created-1

• crowdstrike-process-created-2

• crowdstrike-process-created

• crowdstrike-process-network

• crowdstrike-service-created

• digitalguardian-process-created

• emc-syslog-4624

• f5-silverline-network-alert-1

• falcon-dns-request

• fortinet-network-connection

• json-4624-1

• json-4624

• json-4625-1

• json-4648-1

• json-4648

• json-4768-1

• json-4769-1

• json-4776-1

• json-5136

• json-sysmon-file-create-1

• json-sysmon-file-create

• json-sysmon-process-created-1

• json-sysmon-process-created

• json-windows-auth

• json-windows-vpn-login

• l-pan-file-alert

• mcafee-usb-activity-1

• mcafee-usb-activity

• mcafee-usb-insert-1

• mcafee-usb-insert

• meraki-network-connection-1

• n-forwarded-cef-4624

• o365-activity-3

• o365-activity

• o365-mal-url-click

• o365-phishing-alert

• paloalto-network-connection

• pan-alert-1

• pan-alert

• proofpoint-email-4

• proofpoint-email

• q-1102

• q-tippingpoint-sms-alert-1

• q-tippingpoint-sms-alert-2

• q-tippingpoint-sms-alert-3

• q-tippingpoint-sms-alert-4

• q-tippingpoint-sms-alert-5

• q-tippingpoint-sms-alert

• q-unix-as

• q-zscaler-web-activity

• raw-1102

• raw-4104

• raw-4624-2

• raw-4624-7

• raw-4624-8

• raw-4625

• raw-4662-1

• raw-4663-4

• raw-4719

• raw-4723

• raw-4724

• raw-4742

• raw-4778

• raw-4801

• raw-5145-1

• raw-5156

• raw-7045

• raw-juniper-nwc-vpn-authfailed

• raw-member-added-2008

• raw-member-removed-2008-2

• raw-windows-account-4720

• raw-windows-account-4722

• raw-windows-account-4726

• raw-windows-account-624

• raw-windows-account-630

• s-1102

• s-4698

• s-516

• s-560

• s-crowdstrike-app-login-10

• s-crowdstrike-app-login-1

• s-crowdstrike-app-login-2

• s-crowdstrike-app-login-3

• s-crowdstrike-app-login-4

• s-crowdstrike-app-login-5

• s-crowdstrike-app-login-6

• s-crowdstrike-app-login-7

• s-crowdstrike-app-login-8

• s-crowdstrike-app-login-9

• s-crowdstrike-app-login

• s-mcafee-print-activity-1

• s-mcafee-usb-activity-bluetooth

• s-mcafee-usb-activity-diskdrives

• s-mcafee-usb-activity-dvd

• s-mcafee-usb-activity-imaging

• s-mcafee-usb-activity-portable

• s-mcafee-usb-filewrite

• s-okta-app-login-1

• s-okta-app-login-2

• s-svn-app-activity-1

• s-svn-app-activity-2

• s-svn-app-activity-3

• s-svn-app-activity-4

• s-svn-app-activity-5

• s-svn-app-activity-6

• s-svn-app-activity-7

• s-svn-app-activity-8

• s-svn-app-activity

• s-windows-event-1102

• s-windows-event-4624

• s-windows-event-4625

• s-windows-event-4648

• s-windows-event-4672

• s-windows-event-4673

• s-windows-event-4674

• s-windows-event-4688

• s-windows-event-4697

• s-windows-event-4719

• s-windows-event-4720

• s-windows-event-4722

• s-windows-event-4723

• s-windows-event-4724

• s-windows-event-4725

• s-windows-event-4728

• s-windows-event-4729

• s-windows-event-4732

• s-windows-event-4733

• s-windows-event-4740

• s-windows-event-4776

• s-windows-event-4778

• s-windows-event-4779

• s-windows-event-4780

• s-windows-event-4800

• s-windows-event-4801

• s-windows-event-5140

• s-windows-event-528

• s-windows-event-534

• s-windows-event-540

• s-windows-event-552

• s-windows-event-576

• s-windows-event-578

• s-windows-event-601

• s-windows-event-602

• s-windows-event-626

• s-windows-event-627

• s-windows-event-629

• s-windows-event-633

• s-windows-event-636

• s-windows-event-637

• s-windows-event-644

• s-xml-4697

• s-xml-4770

• s-xml-7045

• s-xml-windows-member-10

• s-xml-windows-member-11

• s-xml-windows-member-13

• s-xml-windows-member-14

• s-xml-windows-member-15

• s-xml-windows-member-16

• s-xml-windows-member-1

• s-xml-windows-member-2

• s-xml-windows-member-3

• s-xml-windows-member-4

• s-xml-windows-member-5

• s-xml-windows-member-6

• s-xml-windows-member-7

• s-xml-windows-member-8

• s-xml-windows-member-9

• sentinelone-dns-query

• sentinelone-dns-response-1

• sentinelone-dns-response

• sentinelone-file-create-1

• sentinelone-file-create

• sentinelone-file-delete-1

• sentinelone-file-delete

• sentinelone-file-modify-1

• sentinelone-file-modify

• sentinelone-network-connection-1

• sentinelone-network-connection

• sentinelone-process-created-1

• sentinelone-process-created

• sentinelone-task-register

• sentinelone-task-update-1

• sentinelone-task-update-2

• sentinelone-task-update

• sentinelone-web-activity-1

• sentinelone-web-activity-2

• sentinelone-web-activity

• shibboleth-auth-successful

• snare-1102

• symantec-usb-block

• sysmon-file-create

• sysmon-process-created-1

• sysmon-process-created

• sysmon-process-network

• tippingpoint-sms-alert

• u-googledrive-file-permission-change

• vmware-esxi-login-1

• win-disable-device-request

• win-disable-device

• win-enable-device-request

• win-enable-device

• win-external-device-recog

• windows-dns-query-3

• windows-events-4624

• xml-1102

• xml-4622

• xml-4672

Deprecated Parsers

There are no deprecated parsers in this release.

Models

• New

• Updated

• Deprecated

New Models

There are no new models in this release.

Updated Models

• A-FW-ProcessName-FileName – File creations for process

• A-NETFLOW-OsH-Scanners – Assets that access multiple assets within seconds in the organization

• UA-UC – Countries for user activity

Deprecated Models

There are no deprecated models in this release.

Rules

• New

• Updated

• Deprecated

New Rules

There are no new rules in this release.

Updated Rules

There are no updated rules in this release.

Deprecated Rules

• A-Attrib-Hide-Files – com.exabeam.releasenotesgeneratortool.UseCase@7181ae3f

• A-NETFLOW-OsH-PortScan-Slow-A – com.exabeam.releasenotesgeneratortool.UseCase@77a57272

• A-NETFLOW-OsH-PortScan-Slow-F – com.exabeam.releasenotesgeneratortool.UseCase@33b37288

• A-NETFLOW-OsH-PortSweep-Slow – com.exabeam.releasenotesgeneratortool.UseCase@276438c9

• A-Sysprep-Appdata – com.exabeam.releasenotesgeneratortool.UseCase@70a9f84e

• A-Userinit-Child-Process – com.exabeam.releasenotesgeneratortool.UseCase@130f889

• A-WMI-Exec-Suspicious-Cmds – com.exabeam.releasenotesgeneratortool.UseCase@101df177

• A-XSL-Script-Processing – com.exabeam.releasenotesgeneratortool.UseCase@74294adb

• Attrib-Hide-Files – com.exabeam.releasenotesgeneratortool.UseCase@166fa74d

• Sysprep-Appdata – com.exabeam.releasenotesgeneratortool.UseCase@2f490758

• Userinit-Child-Process – com.exabeam.releasenotesgeneratortool.UseCase@40f08448

• WMI-Exec-Suspicious-Cmds – com.exabeam.releasenotesgeneratortool.UseCase@588df31b

• XSL-Script-Processing – com.exabeam.releasenotesgeneratortool.UseCase@1188e820