May 15, 2024

© 2024 SOC Prime Inc.

All rights reserved. This product and documentation related are protected by copyright and distributed under licenses restricting their use, copying, distribution, and decompilation. No part of this product or documentation related may be reproduced in any form or by any means without the prior written authorization of SOC Prime. While every precaution has been taken in the preparation of this book, SOC Prime assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.

We've released a full-fledged Role-Based Access Control (RBAC) to ensure organizations have granular control over the access privileges of each user in their team.

Access control is managed in the following way:

This page replaces the My Team page. Here the Manager of an Organization can:

On this page, the Manager of an organization can:

Role configuration lets you define the following access permissions:

The old permission levels were migrated in the following way:

We've updated the version of MITRE ATT&CK used in all our products to 15.0. You can learn what's changed in MITRE ATT&CK Release Notes.

We've moved the configuration of GitHub integration from Data Planes to Integrations. Now, to configure an integration with your GitHub repository:

Now, to navigate to your custom repositories, use the Repositories item in the header menu in Threat Detection Marketplace

Now, the parameter that prepends or appends text to the alert name is also applied to the values of the action.notable.param.rule_title and action.correlationsearch.label fields.

We've updated the format of the URL required for using the hunting functionality. Now, the user has to provide the URL of their web console (on the Discover page) ending with “/discover“.

We've re-enabled the TDM API endpoints related to content list management:

Some parameters of these endpoints were updated. You can find out more in the API user guide.

We've added the modal with cross-platform translation quality statistics. To view it, click the Accuracy hexagon button in the lower right corner of the screen.

In the modal, you can see the accuracy of translation for each pair of supported native formats using each available ruleset. Delta shows an increase or decrease in accuracy compared to the previous test.

We've added support for the following functions when translating from Splunk into Microsoft Sentinel:

Now, you can schedule regular or one-off scans. You can set up a scan to be repeated every x days, on the x day of every week, or on the x day of every month. To schedule a scan, click the down arrow next to the Start Scan button after you've chosen a hunting scenario. In the dropdown that appears, select Schedule Scan.

The Schedule Scan menu appears. Here you can set all the configurations.

To run a one-off postponed scan:

To run a regular scheduled scan:

You can find your scheduled scan on the Schedules tab of the Investigations page. Click the Logs icon to view the status of each scan in the schedule.

We've extended the supported log sources with Azure Active Directory and Office365.

We've added a notification shown to the user when Data Audit continues for more than 30 seconds. The notification says that the Data Audit is still in progress and will need some more time, but everything works fine.