Skip to content

v11.2.14

Choose a tag to compare

View all tags
@osmontero osmontero released this 25 Sep 22:32
· 186 commits to v11 since this release
v11.2.14
dda9d45
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

UTMStack v11.2.14 adds new detections for AWS and Microsoft 365, improves Windows administrator awareness monitoring, and includes many fixes that make log parsing, alert accuracy, and security controls more reliable.

What's New

  • Added 18 new detection rules for AWS and Microsoft 365 to help identify monitoring gaps.
  • Added new administrator awareness detections for Windows events.
  • Added grouped administrator awareness alerts for Microsoft 365.
  • Added broader syslog support, including CEF and LEEF formats.
  • Added a local user creation option for administrators in the interface.
  • The Windows agent now lets administrators choose event channels to collect, with changes applied without restarting.
  • Added a new alerts view for reviewing security alerts.

Improved

  • Improved alert grouping and deduplication for SonicWall, CrowdStrike, and Microsoft 365 password-spraying alerts.
  • Improved final status and outcome reporting for SentinelOne, CrowdStrike, Suricata, Windows, Linux, Google Cloud, and Azure.
  • Improved log parsing and field accuracy for many sources, including Cisco, Palo Alto, Fortinet, Sophos, Meraki, Mikrotik, pfSense, GitHub, Google, Kaspersky, Bitdefender, ESET, and IBM.
  • Improved Microsoft 365 collection by starting all subscriptions, following pagination, and resuming from the last collected point.
  • Improved platform stability and resource usage.

Fixed

  • Fixed security issues, including patches for disclosed CVEs, stronger two-factor authentication controls, safer SAML handling, and reduced exposure of credentials and secrets.
  • Fixed false positives and missing fields in detections for Suricata, Cisco, Palo Alto, Fortinet, Sophos, CrowdStrike, SentinelOne, Microsoft 365, AWS, Google, Azure, Linux, Windows, and other sources.
  • Fixed email settings so sensitive values are masked and email-related mismatches are resolved.
  • Fixed local user creation errors and password validation messages.
  • Fixed agent credential handling so credentials are no longer exposed in registration responses or logs.
  • Fixed alert and log parsing issues that could cause missing addresses, actions, outcomes, or incorrect severity.

Full Changelog: v11.2.13...v11.2.14

Assets 3
Loading