Skip to content

1.9.0

Latest
Latest

Choose a tag to compare

View all tags
@floydtree floydtree released this 03 Aug 14:39
Immutable release. Only release title and notes can be modified.
1.9.0
856d462
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[v1.9.0] - Aug 3rd, 2026

Added

  • Categories

  • Event Classes

    1. Added user_management and role_management. #1603
    2. Added clipboard_activity. #1655
    3. Added device_power_state_activity class to capture power state changes of a device. #1624

  • Profiles

    1. Added record_integrity profile that adds a cryptographic attestation over the event (integrity, authenticity, and non-repudiation), applied at the base event so any class can carry it. #1661
    2. Added optional delegation attribute to the ai_operation profile, linking data-plane actions to the delegated authority under which they were performed. #1665

  • Objects

    1. Added delegation object describing a durable authorization context issued by a principal to a delegate. #1665
    2. Added job_action object to describe an action that job can perform. #1597
    3. Added job_trigger object to describe a condition when job performs its action. #1597
    4. Added cpu_info object for CPUs (array name cpu_info_list). #1630
    5. Added iam_role object for user, role and group management. #1603
    6. Added clipboard and clipboard_item object for clipboard activity. #1655
    7. Added dns_resource_record object to represent an RFC 1035 resource record, used across Answer, Authority, and Additional sections. #1634
    8. Added dns_section object to represent a DNS message section containing supplementary resource records and an optional TSIG record. #1634
    9. Added tsig object to represent a TSIG (Transaction Signature) record with structured fields for security analytics: algorithm, key_name, error_id, and error. #1634
    10. Added download_info object with information pertaining to a downloaded file. #1658
    11. Added note object to capture a comment along with the user who made the comment and when the note was modified. #1670
    12. Added ai_agent object representing an autonomous AI agent, distinct from the existing agent object (which models security sensors such as EDR, DLP, APM). #1641
    13. Added attestation object carrying a fingerprint of and digital signatures over an event, with optional tamper-evident chain attributes (prev_event, chain_uid) and an authority_uid identifying the attesting party. #1661
    14. Added prev_event object referencing the previous event in a tamper-evident chain by its fingerprint (content binding) together with uid and type_uid (retrieval). #1661
    15. Added sensor_info object including the sensor_layer_id and related attributes. #1703

  • Observables

    1. Set iam_role.name (49) & iam_role.uid (50) as Observable types. #1603

  • Platform Extensions

  • Dictionary Attributes

    1. Added attestation_list, prev_event, authority_uid, and chain_uid attributes for the record_integrity profile. #1661
    2. Added com_class_uuid attribute to reflect Class Identifier of a Component Object Model. #1597
    3. Added event_codes that is a set of event identifiers. #1597
    4. Added log_sources that is a set of log systems. #1597
    5. Added job_actions that describes a set of actions that job can perform. #1597
    6. Added job_triggers that describes a set of conditions when job performs its actions. #1597
    7. Added updated_job that reflects the attempted or the actual updated job. #1597
    8. Added properties that is a set of characteristics associated with an entity. #1597
    9. Added speed_mhz for compute unit clock speed in MHz. #1630
    10. Added cpu_info_list as an array of cpu_info objects. #1630
    11. Added iam_role, iam_roles, updated_role, updated_group, updated_user attributes. #1603
    12. Added updated_entity, updated_resources, and updated_web_resources attributes for reporting intended or actual post-update state. #1618
    13. Added initiator and initiator_id attributes for identifying which endpoint initiated a network communication, with generic Unknown (0) and Other (99) enums. #1598
    14. Added transaction_id, query_additional, response_additional, authority, and key_name dictionary attributes for DNS Activity restructuring. #1634
    15. Added peripheral_devices for a set of peripherals. #1645
    16. Added serialization and serialization_id attributes to record the canonical serialization or signing-envelope scheme used to produce the signed bytes. #1662
    17. Added binary_data, contents, clipboard_native_type, string_data. #1655
    18. Added uid_numeric attribute to enable a unique identifier that is numeric to be represented natively using the long_t data type. #1643
    19. Added download_info attribute to file object. #1658
    20. Added notes attribute as an array of Note objects. #1670
    21. Added prompt_text and response_text attributes for capturing the input prompt text and model response text of an AI message. #1674
    22. Added ai_agent attribute referencing the new ai_agent object. #1641
    23. Added hosted_ai_agent_list attribute for enumerating AI agents hosted by a process or other runtime. #1641
    24. Added charter attribute (file type) for documents defining the role, scope, and operating bounds of an entity. #1641
    25. Added criticality_id dictionary attribute with a four-level criticality enum Low (1), Medium (2), High (3), and Very High (4), plus generic Unknown (0) and Other (99) enums, paired with the existing criticality sibling. #1693
    26. Added sensor_layer_id and sensor_layer sibling. #1703
    27. Added sensor_info_list as an array of type sensor_info for the analytic object. #1703
    28. Added delegation and issuer_uid attributes supporting the delegation object and ai_operation profile. #1665

Improved

  • Categories

  • Event Classes

    1. Added updated_job in Scheduled Job Activity class to reflect the actual or attempted state of the job upon update activity. #1597
    2. Added iam_role and role management support to group_management, authorize_session. Filled out the group_management class with complete lifecycle as well as added resources, policies to the discrete activities. #1603
    3. Added updated_* attributes to Entity Management and Web Resources Activity for class-specific update result reporting. #1618
    4. Added initiator_id and initiator to Network Activity with network-specific enums Source Endpoint (1) and Destination Endpoint (2), and updated src_endpoint and dst_endpoint descriptions to reflect bi-flow and asymmetric flow scenarios. #1598
    5. Added transaction_id, opcode_id/opcode, flag_ids/flags, authority, query_additional, and response_additional to DNS Activity. #1634
    6. Extended activity_id attribute in HTTP Activity to cover all methods in IANA HTTP Method Registry. #1654
    7. Added users to group_management to replace deprecated user. #1666
    8. Added application attribute to Application Lifecycle to replace the deprecated app attribute, resolving the mismatch where app (captioned "Application") was typed as the product object. #1702
    9. Added notes to finding and incident_finding. #1670
    10. Added resources to finding for consistency and referencing within the class. #1670
    11. Added the ai_operation profile to the system, network, application, and iam base event classes so all System Activity, Network Activity, Application Activity, and Identity & Access Management events inherit agent attribution. Also added the profile to email_activity (which does not extend a base with the profile). #1641
    12. Added the record_integrity profile to the base_event class so every event class can optionally carry a cryptographic attestation over the event. #1661

  • Profiles

    1. Added ai_agent attribute to the ai_operation profile. #1641

  • Objects

    1. Added job_actions array of objects to the job object. #1597
    2. Added job_triggers array of objects to the job object. #1597
    3. Added type_id attribute to the job object to describe mechanism that executes the job. #1597
    4. Extended run_state_id attribute with Disabled (5) in the job object. #1597
    5. Added uid attribute to the job object. #1597
    6. Relaxed name attribute constraint to recommended in the job object. #1597
    7. Added at_least_one constraint for name and type_id attributes in the job object. #1597
    8. Updated cpu_count description in device_hw_info to cross-reference cpu_info_list. #1630
    9. Updated gpu_count and gpu_info_list descriptions in device_hw_info to cross-reference each other. #1630
    10. Added bcc attribute to the email object. #1632
    11. Added bcc_mailboxes attribute to the email object. #1632
    12. Added iam_role to actor. #1603
    13. dns_answer now extends dns_resource_record so it inherits the RFC 1035 resource record fields (class, hostname, rdata, ttl, type); flag_ids and flags remain locally on dns_answer and are deprecated in favor of the corresponding attributes on DNS Activity. #1634
    14. Removed the abstract _dns object; class, type, and the deprecated packet_uid attribute now live directly on dns_query. #1634
    15. Added peripheral_devices to device. #1645
    16. Added serialization and serialization_id to the digital_signature object to record the canonical signing input (JCS, JWS, COSE, DSSE, Authenticode). #1662
    17. Added encoding and encoding_id to the fingerprint object to record how the raw hash bytes are represented as the value string (Hex, Base64, Base64URL). #1684
    18. Added uid_numeric to _entity so that a numeric uid value can be represented natively. #1643
    19. Extended http_method attribute in the http_request object to cover all methods in IANA HTTP Method Registry. #1654
    20. Added prompt_text and response_text attributes to the message_context object, complementing the existing prompt_tokens and completion_tokens metrics with the verbatim prompt and response text. #1674
    21. Added Code Signing (5) enum value to algorithm_id and Code Signing (7) enum value to serialization_id in the digital_signature object. #1668
    22. Removed Microsoft from descriptions in algorithm_id and serialization_id in the digital_signature object. #1668
    23. Added ai_agent attribute to the evidences object so detections involving multiple AI agents, such as an agent spawning a sub-agent in violation of usage policy, can be captured as separate evidence entries. #1681
    24. Added ai_agent to process. Added hosted_ai_agent_list to process for cases where a process hosts multiple agents that cannot be individually attributed. #1641
    25. Added charter attribute to ai_agent for the agent's durable role definition document (system prompt or constitution). #1641
    26. Added product attribute to the application object so an application can carry the identity of the software product it is an instance of (vendor, CPE, canonical version). #1702
    27. Added application attribute to the actor object to replace the deprecated app_name/app_uid scalars with the richer application object for the client application or service that initiated the activity. #1702
    28. Added App Package (6) enum value to algorithm_id and App Package (8) enum value to serialization_id in the digital_signature object. #1692
    29. Added serialization and serialization_id to the fingerprint object, mirroring digital_signature, so a verifier knows the canonical serialization scheme used to produce the fingerprinted byte sequence. #1661
    30. Added Flat (1) enum value to serialization_id in the digital_signature and fingerprint objects for flat hashes or signatures over a raw byte sequence; the later serialization_id values shift up by one (JCS (2) through App Package (8)), keeping the two enums identical. #1661
    31. Added rule attribute to discovery_details. #1706
    32. Added sensor_info_list to the analytic object. #1703

  • Observables

  • Platform Extensions

    1. Added prev_win_service attribute to Windows Service Activity Class in order to store previous state of the Windows service. #1663
    2. Improved activity_id description and descriptions for its enum values in Windows Service Activity Class. #1663
    3. Added "See specific usage" to win_service description in Windows extension dictionary. #1663

  • Dictionary Attributes

    1. Improved job object description to describe cases beyond System Activity class.

Bugfixes

  1. Fixed the static anti-pattern checker so dictionary attributes are analyzed with the full compiled dictionary; the missing-sibling rule no longer false-positives when the sibling exists in dictionary.json. #1613
  2. Added tunnel_type_id enum values to dictionary.json to resolve the anti-pattern of missing enums in the dictionary attribute. #1602
  3. Fixed rcode_id enum value 16 caption from BADSIG_VERS to BADVERS in DNS Activity. Code 16 in the DNS header RCODE space is specifically Bad EDNS OPT Version; BADSIG belongs in the TSIG error field. #1634
  4. Fixed bad URLs to ASTM F3411-22a in drone_flights_activity event class and unmanned_aerial_system object. #1676

Deprecated

  1. Deprecated is_src_dst_assignment_known dictionary attribute and its usage in Network Activity in favour of initiator_id. #1598
  2. Deprecated message attribute in the http_response object. The code and status attributes already convey the HTTP status code and reason phrase. #1616
  3. Deprecated entity_result, resources_result, and web_resources_result in favor of the corresponding updated_* attributes. #1618
  4. Deprecated resource in Group Management in favor of resources. #1603
  5. Deprecated usage of cmd_line attribute in favor of job_actions.cmd_line in the job object. #1597
  6. Deprecated usage of last_run_time attribute in favor of job_triggers.last_run_time in the job object. #1597
  7. Deprecated usage of next_run_time attribute in favor of job_triggers.next_run_time in the job object. #1597
  8. Deprecated packet_uid attribute in dns_query object in favor of transaction_id on DNS Activity. #1634
  9. Deprecated the app dictionary attribute (captioned "Application" but typed as the product object) and its usage in Application Lifecycle, in favor of the application attribute. #1702
  10. Deprecated the app_name and app_uid usages in the actor object in favor of the application attribute. (The app_name usage in Network is unchanged - there it is a DPI/NBAR traffic classification label, not an application entity.) #1702
  11. Deprecated opcode and opcode_id attributes in dns_query object in favor of opcode/opcode_id on DNS Activity. #1634
  12. Deprecated flag_ids, flags, and packet_uid attributes in dns_answer object in favor of flag_ids/flags/transaction_id on DNS Activity. #1634
  13. Deprecated the account_change and user_access_management classes in favor of the user_management class. #1603
  14. Deprecated the user_result attribute in favor of the updated_user attribute. #1603
  15. Deprecated cpu_cores in the dictionary in favor of cores. #1630
  16. Deprecated cpu_speed in the dictionary in favor of speed_mhz. #1630
  17. Deprecated cpu_type in the dictionary in favor of model and vendor_name within cpu_info_list[*]. #1630
  18. Deprecated cpu_architecture, cpu_architecture_id, cpu_bits, cpu_cores, cpu_speed, and cpu_type on device_hw_info in favor of their equivalents within cpu_info_list[*]. #1630
  19. Deprecated the user attribute in the group_management class in favor of users. #1666
  20. Deprecated the comment attribute in the finding class and its extended classes, and the incident_finding class in favor of notes. #1670

Misc

  1. Added static anti-pattern detection, LLM-to-static learning pipeline, and deprecated attribute filtering to the automated PR review workflows. #1599
  2. Added references and @deprecated support to the profile metaschema, aligning it with event class and object metaschemas. #1625
  3. Updated all dictionary attributes, event classes, and objects where descriptions contained embedded authoritative URLs, and moved them to references sections, keeping the normative schema descriptions free from required URLs. #1676
  4. Added a required, machine-readable superseded_by field to the @deprecated annotation and backfilled all 126 existing deprecations (dictionary attributes, class/object/profile attributes, whole classes and objects, and enum values) with resolved replacement references; an empty array denotes removal with no replacement. Normalized deprecation messages to name replacements by their actual names in <code> tags. #1707
  5. New Extension registration for Trellix #1701.
Assets 3
Loading