Skip to main content

SOC Prime Platform Product Release Notes 5.5.1

S
Written by Sergey Bayrachny

January 25, 2023

© 2023 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

Authentication with Microsoft and GitHub

As part of our effort to streamline logging in and signing up flows, we've added authentication with Microsoft and GitHub accounts.

To log in to an existing SOC Prime Platform account, use your Microsoft or GitHub account associated with the same email.

To create a new SOC Prime Platform account, use your Microsoft or GitHub account associated with the email you want to use for your SOC Prime Platform account.

Note that you can only use a work email.

Content Quality Improvements

Microsoft Sentinel

  • We've enhanced the accuracy of Microsoft Sentinel Rule and Query translations by adding a new mapping for Sigma rules that have the aws product and cloudtrail service defined in the logsource section.

  • We've improved translation logic for exclusion conditions to ensure that the filters used in a Sigma rule are always rendered accurately in translation.

    For example, the filters in the following piece of a Sigma rule:

    filters:
          - Image|endswith: 'Example.exe'
          - CommandLine|contains: 'example'
    condition: selection1 and selection2 and not filters

    are now translated into:

    …and not ((NewProcessName endswith @'Example.exe') or (CommandLine contains @'example'))

    This improvement has also been implemented for Microsoft Defender for Endpoint.

Chronicle Security

We've ensured that backslashes in the translation are always escaped (for example, when used in file paths). Previously, escaping could be not applied in certain fields:

`.*\example\file\path\binary.exe.*` → `.*\\example\\file\\path\\binary.exe.*`

Splunk

  • We've improved the Splunk translations by adding escape characters before backslashes. For example:

    TargetFilename="*\Example\file\name.aaa" → TargetFilename="*\\Example\\file\\name.aaa"

  • We've removed extra space in front of the value of the actions field in Splunk Alerts.

Snowflake

We've improved the syntax of translations into Snowflake Query format by making sure that parentheses are applied correctly where Sigma rules have complex conditions, such as selection1 and (selection2 or (selection3 and (selection4 or selection5))).

Sigma Parsing Improvement

We've improved the parsing of field names with dots, such as actor.user.email, used in aggregations in the condition component of a Sigma rule. This ensures the translations of such conditions into all platform formats have correct field names.

Cyber Threat Search Engine

We've implemented minor style and text improvements on the Cyber Threat Search Engine page.

Platform Guides

We've updated our Platform Guides with information on the new functionality of the SOC Prime Platform.
​

Did this answer your question?