September 21, 2022

© 2022 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

To streamline the process of upgrading to an On Demand plan, we've integrated the SOC Prime Platform with Stripe. Now, you can make a self-service upgrade without leaving the Platform.

In addition, all order customization options, including the payment method, are now available directly in the Stripe modal. This makes ordering an On Demand plan even more simple and convenient. After the purchase, you'll have your plan activated automatically right away.

We've introduced an ability to link multiple Custom Field Mapping profiles to a platform environment set up for integration. The linked profiles will be automatically applied to Sigma rule translations with matching log sources in Quick Hunt and CCM for the corresponding environment.

This improvement will come in handy when you have multiple environments with different data schemas.

Now, there are two ways to link a Custom Field Mapping profile to an environment:

To leverage the linking of Custom Field Mapping profiles to Environments in Quick Hunt, select the Default option in the Custom Field Mapping dropdown.

Custom Field Mapping profiles will be applied as follows:

You can always select a Custom Field Mapping profile manually. The option you've chosen in the Custom Field Mapping dropdown is retained across sessions.

If you set the Use Default Custom Field Mapping based on Log Source checkbox when setting up a Job in Continuous Content Management, mapping profiles are applied as follows:

If you clear the checkbox, the mapping profile to be applied can be selected manually.

We've added the Default Custom Field Mappings dropdown to the ArcSight environment setup modal. Now, security professionals using this platform with a non-standard data schema can automatically tailor Sigma rule translations to their specific field and data location names in Quick Hunt and CCM.

We've updated the legal documents regulating the use of our products and other aspects of interacting with them:

We've streamlined the user experience by removing some redundant confirmation modals. These modals have been replaced with popups that provide the action confirmation, but disappear on their own and do not require any additional interaction.

In particular, we've removed modals that showed after editing a rule inside an Inventory Content List or deleting a content item on the Inventory tab.

We've updated the default order of the Global Content lists. Now, they are sorted by Last Updated.

If you select a different sorting, the changes are retained.

To ensure you have access to the most relevant attack simulations, we've updated Red Tests available on the SOC Prime Platform by synchronizing them with the Red Canary repo on GitHub.

We've replaced hyphens with periods in the MITRE ATT&CK® sub-technique IDs to make them match the conventional MITRE formatting.

We've updated the list of key features for the Community subscription plan. Now, it includes a point about the 3-day waiting time.

To make the unlocking confirmation modal less intrusive, we've changed its behavior to show only the first time a user unlocks a Sigma rule. The modal prompts if the user wants to unlock the rule and informs that all the following rules will be unlocked without extra confirmation.

This behavior has been implemented both on a rule's page and in Quick Hunt.

We've updated the popup at socprime.com offering the user to accept our Cookie Policy or check cookie settings.

We've updated our Platform Guides so they reflect the latest functionality.

With this release, we’ve made the following key bug fixes and improvements to enhance the user experience with the SOC Prime Platform: