Skip to content

1.7.0

Choose a tag to compare

View all tags
@mikeradka mikeradka released this 14 Nov 21:43
1.7.0
dc6359b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[v1.7.0] - Nov 14th, 2025

Added

  • Event Classes

    1. Added Peripheral Activity event class to the System category. #1471

  • Objects

    1. Added reporter object. #1476
    2. Added Windows extension to the process object.
    3. Added the function_invocation and parameter objects. #1497

  • Observables

    1. Set network_endpoint.uid as an Observable type - type_id: 48. #1502

  • Dictionary Attributes

    1. Added vendor_id_list as a string_t array. #1471
    2. Added post_value, pre_value and return_value as string_t. #1497
    3. Added launch_type_id enum and launch_type sibling. #1517
    4. Added log_source log_source_uid log_format as string_t. #1483

Improved

  • Event Classes

    1. Added auth_factors as an attribute to the Account Change class and updated related activity names. #1455
    2. Added Invoke as an activity_id value for the Module Activity class. #1497
    3. Added launch_type_id and launch_type as attributes to the Process Activity event class. #1517
    4. Added descriptions to values of activity_id enum in Process Activity event class. #1517
    5. Added missing context classification to windows_service_activity.win_service. #1531
    6. Added missing requirement to process_activity.launch_type. #1531
    7. Added cumulative_traffic attribute to the base Network event. Updated traffic description. #1529

  • Objects

    1. Added type, type_uid, and vendor_id_list to the peripheral_device object. #1471
    2. Relaxed the class attribute requirement to optional in the peripheral_device object. #1471
    3. Set the vendor_name requirement to recommended in the peripheral_device object. #1471
    4. Added reporter to the metadata object. #1476
    5. Added event_uid and type_uid to the observable object. #1503
    6. Set load_type_id requirement to recommended in the module object. #1497
    7. Added at_least_one constraint on load_type_id and function_name in the module object. #1497
    8. Modified descriptions in the module object to accommodate Module Activity: Invoke event. #1497
    9. Added function_invocation to the module object. #1497
    10. Relaxed the file attribute requirement to optional in the job object. #1509
    11. Relaxed the name and uid requirement to recommended with at_least_one constraint in the extension object. #1511
    12. Added hosting_process, service_file and service_dll_file to the win_service object.
    13. Added hosted_services, array to the process object.
    14. Added source, type, log_source, original_event_uid,log_format, transmit_time to metadata. log_format to logger#1483
    15. Added start_time, end_time and timespan to the network_traffic object. Updated network_traffic description. #1529

  • Dictionary Attributes

    1. Added Local (4) enum to the direction_id attribute. #1475
    2. Added Atom (38) enum as an available type_id for win_resource object. #1477
    3. Updated reference descriptions/urls for win_resource types, including Directory (1), Event (2), Timer (3), Device (4), Mutant (5), File (7), Token (8), Thread (9), Section (10), WindowStation (11), Driver (15), IoCompletion (16), Controller (17), SymbolicLink (18), WmiGuid (19), Process (20), Profile (21), Desktop (22), KeyedEvent (23), Adapter (24), Callback (27), Semaphore (28), Job (29), ALPC Port (32), SAM_ALIAS (33), SAM_GROUP (34), SAM_USER (35), SAM_DOMAIN (36), SAM_SERVER (37), and Atom (38). #1477
    4. Added hosted_services to the Windows extension to the process object.
    5. Added multiple values to the state_id enum attribute for the digital_signature object. #1520
    6. Added WFP Filter (39), WFP Callout (40), WFP Layer (41), WFP Sub-layer (42), WFP Provider (43) and WFP Provider Context (44) WindowsFilteringPlatform-related enums as an available type_ids for win_resource object. #1530
    7. Added cumulative_traffic of network_traffic type. #1529

Misc

  1. Updated description for the peripheral_device object and the vendor_name attribute within it. #1471
  2. Corrected the deprecation note for the Web Resource Access Activity event class. #1492
Assets 2
Loading