• New support for AWS Config and AWS Health findings in OCSF format, normalizing the finding description, severity, affected resource, account, and region
• Expanded Citrix NetScaler visibility: the syslog parser now handles Application Firewall (AppFW), system event, routing, and IPsec messages that were previously dropped, with new log mappers for AppFW detections such as cross-site scripting and SQL injection, device and monitor state changes, and routing commands executed on the appliance. AppFW events with IPv6 source addresses are now also parsed correctly
• Enhanced AWS S3 Server Access Logs parsing and mapping to capture the requested object path, application user ID, and session ID

Changes are enumerated below.

Log Mappers​

• [New] AWS Config - OCSF Finding Events
• [New] AWS Health - OCSF Finding Events
• [New] Citrix NetScaler - AppFW
• [New] Citrix NetScaler - NetScaler Event
• [New] Citrix NetScaler - Routing Command Executed
• [Updated] AWS S3 Server Access Log - Custom Parser
• [Updated] Citrix NetScaler - MESSAGE

Parsers​

• [Updated] /Parsers/System/AWS/AWS S3 Server Access Logs
• [Updated] /Parsers/System/Citrix/Citrix NetScaler Syslog

• New Check Point Audit support with a parser and log mapper covering administrator activity on Check Point management, including which objects were changed, the operation performed, the administrator, source IP, and session.
• Fixed CrowdStrike Falcon Data Protection detections so severity and normalized severity now populate, including for Informational-level detections.
• Jamf Protect Gatekeeper and threat match execution events are now handled by the Jamf Protect Analytics mapper instead of falling through to a generic mapping, so they normalize with the correct fields.
• Updated how Palo Alto Networks firewall actions map to the success field across the traffic and threat custom parser log mappers.

Changes are enumerated below.

Log Mappers​

• [New] Check Point Audit
• [Updated] CrowdStrike Falcon - Catch DataProtectionDetectionSummaryEvent
• [Updated] Jamf Protect Analytics - Events
• [Updated] Palo Alto Threat DLP non File - Custom Parser
• [Updated] Palo Alto Threat Data - Custom Parser
• [Updated] Palo Alto Threat File - Custom Parser
• [Updated] Palo Alto Threat Flood - Custom Parser
• [Updated] Palo Alto Threat Packet - Custom Parser
• [Updated] Palo Alto Threat Scan - Custom Parser
• [Updated] Palo Alto Threat Spyware - Custom Parser
• [Updated] Palo Alto Threat URL Filtering - Custom Parser
• [Updated] Palo Alto Threat Virus - Custom Parser
• [Updated] Palo Alto Threat Vulnerability - Custom Parser
• [Updated] Palo Alto Threat Wildfire - Custom Parser
• [Updated] Palo Alto Threat Wildfire Virus - Custom Parser
• [Updated] Palo Alto Traffic - Custom Parser

Parsers​

• [New] /Parsers/System/Check Point/Check Point Audit JSON

When you investigate an insight in Mobot, the SOC Analyst Agent can now query data beyond the Cloud SIEM index, including raw cloud logs (for example, AWS CloudTrail), metrics, lookup tables, and collector health. Mobot indicates the source when it returns information from outside Cloud SIEM. Auto-investigation verdicts remain unchanged and continue to use only Cloud SIEM data.

Learn more.

Follow the steps below to use the Organizations filter:

1. Click the filter bar and select Organizations from the dropdown.
   
2. Select is any of as the condition, then select up to 100 organizations from the dropdown, or leave it unselected to keep seeing insights from all child organizations.
   

Learn more.

Log Mappers​

• [New] Google Cloud Platform Vertex AI
• [New] PingOne - Audit Event
• [Updated] AWSGuardDuty - Audit Events
• [Updated] AWSGuardDuty - Reconnaissance and malicious activity detection
• [Updated] AWSGuardDuty - Tor Client and Relay
• [Updated] AWSGuardDuty - UnauthorizedAccess_EC2_TorIPCaller
• [Updated] Cisco Meraki Traffic Events
  • Added destination hostname (dstDevice_hostname) mapping
• [Updated] Cisco Meraki WPA - Custom Parser
  • Added alternate source keys so source MAC address (srcDevice_mac), source IP (srcDevice_ip), and device hostname (device_hostname) populate for cloud-to-cloud collected events
• [Updated] UnauthorizedAccess_EC2_SSHBruteForce

Parsers​

• [New] /Parsers/System/Google/Google Cloud Platform Vertex AI
• [New] /Parsers/System/PingIdentity/PingOne
• [Updated] /Parsers/System/AWS/AWS Security Hub
• [Updated] /Parsers/System/Cisco/Cisco Meraki C2C
• [Updated] /Parsers/System/Okta/Okta

• Updated Threat Intel IP rules to exclude internal destination IP addresses from triggering alerts, reducing false positives for inbound and outbound threat feed matches
• Added source device IP mapping for Microsoft Office 365 Teams events
• Fixed Proofpoint on Demand email disposition mapping to correctly populate action, normalized action, and delivery success fields
• Removed redundant device IP mapping from Suricata to prevent duplicate IP enrichment
• Additional changes are enumerated below

Rules​

• [Updated] MATCH-S01024 Threat Intel - Destination IP Address (High Confidence)
• [Updated] MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence)
• [Updated] MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence)
• [Updated] MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence)
• [Updated] MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence)
• [Updated] MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence)

Log Mappers​

• [Updated] Microsoft Office 365 Teams Events
  • Added source device IP (srcDevice_ip) mapping
• [Updated] Proofpoint on Demand C2C - Catch All
  • Fixed action field to use filter.disposition
  • Added normalizedAction (allow/deny) and success (true/false) lookups
• [Updated] Suricata - JSON
  • Removed redundant device_ip mapping

Parsers​

• [New] /Parsers/System/Akamai/Akamai SIEM C2C

Rules​

• [Updated] MATCH-S00455 O365 - Successful Authentication with PowerShell User Agent
• [Updated] MATCH-S01024 Threat Intel - Destination IP Address (High Confidence)
• [Updated] MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence)
• [Updated] MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence)
• [Updated] MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence)
• [Updated] MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence)
• [Updated] MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence)

Log Mappers​

• [New] Check Point CloudGuard
• [Updated] Akamai CPC
• [Updated] Akamai Noname API Security Insight Log
• [Updated] Alert
• [Updated] AlphaSOC
• [Updated] AWS API Gateway
• [Updated] Bitdefender - fw
• [Updated] Bitdefender - network-monitor
• [Updated] Check Point Avanan
• [Updated] CrowdStrike Falcon - Catch DataProtectionDetectionSummaryEvent
• [Updated] CrowdStrike FDR - SuspiciousDnsRequest
• [Updated] Darktrace Parser - Catch All
• [Updated] Egnyte DLP Parser - Catch All
• [Updated] FireEye CMS DM
• [Updated] FireEye CMS IM
• [Updated] FireEye CMS Malware Callback
• [Updated] FireEye CMS RC
• [Updated] FireEye CMS RO
• [Updated] FireEye CMS WI
• [Updated] FireEye MPS Malware Object
• [Updated] Firepower Catch All
• [Updated] Firepower File Malware Events
• [Updated] Firepower Intrusion Events
• [Updated] Firepower Primary Detection Engine Intrusion Events
• [Updated] Firepower Snort Alerts
• [Updated] Fortinet Anomaly Logs
• [Updated] Fortinet DLP Logs
• [Updated] Fortinet Virus
• [Updated] Google Workspace Alert Center - Data Loss Prevention
• [Updated] Google Workspace Alert Center - Domain wide takeout
• [Updated] Google Workspace Alert Center - Gmail phishing
• [Updated] Google Workspace Alert Center - Gmail phishing (Misconfigured whitelist)
• [Updated] IBM Guardium Logs
• [Updated] Kemp WAF Message
• [Updated] Microsoft Graph Security API C2C - Dynamic Vendor/Product - Microsoft IPC
• [Updated] Microsoft Graph Security API C2C - Dynamic Vendor/Product - Microsoft Office 365 Security and Compliance
• [Updated] Microsoft Office 365 Active Directory Authentication Events
• [Updated] Microsoft Office 365 Threat Intelligence Atp Content Events
• [Updated] Microsoft Office 365 Threat Intelligence Events
• [Updated] Microsoft Office 365 Threat Intelligence Url Events
• [Updated] Mimecast Targeted Threat Protection Logs
• [Updated] Netskope - Alerts
• [Updated] Netskope - DLP Alerts
• [Updated] Office 365 - Compliance DLP Exchange Item Events
• [Updated] Office 365 - Compliance DLP SharePoint
• [Updated] Office 365 - Security Compliance Alerts
• [Updated] Palo Alto Threat Scan - Custom Parser
• [Updated] Palo Alto Threat Spyware - Custom Parser
• [Updated] Palo Alto Threat Virus - Custom Parser
• [Updated] Proofpoint TRAP Default Mapping
• [Updated] Thinkst Canary Parser - Catch All
• [Updated] Trend Micro Control Manager CEF CnC
• [Updated] Varonis Alerts Catch All
• [Updated] Varonis DatAdvantage - CEF
• [Updated] Varonis DatAlert - Parser
• [Updated] Vectra AI Catch All
• [Updated] Vectra AI User Login
• [Updated] Vectra Cognito Catch All

Parsers​

• [New] /Parsers/System/AWS/AWS API Gateway
• [New] /Parsers/System/Check Point/Check Point CloudGuard

Schema​

• [New] fromUser_accessId
• [New] targetUser_accessId
• [New] user_accessId

The Insights Automations tab displays all associated playbook runs, including the trigger, start time, and current status. Select a playbook to view detailed execution information. Learn more.

This release delivers the Runtime and Identity phase of the Normalized Detection rule migration announced in the 2026-07-14 content release. Log mappings for these sources no longer contribute to the Normalized Security Signal passthrough rule (MATCH-S00402) and instead route to MATCH-S01159 (Normalized Runtime Detection) and MATCH-S01161 (Normalized Identity Detection). Custom content built on MATCH-S00402 for these vendors — tuning expressions, custom insights, and rule tuning — needs to be migrated to the new rules.

Additionally, Legacy Threat Intelligence rules using the 'threat' match list have been renamed to reflect their pending deprecation in favor of the current threat intelligence rules using the hasThreatMatch operator which have been available for over a year. The legacy rules will continue to function, but they will be removed in a future content release and the feature will cease to work. Customers should migrate any custom content built on the legacy rules to the current threat intelligence rules.

Remaining target dates:

• August 13 — Network and Data Protection sources
• August 27 — Cloud and Endpoint sources

This content release includes:

• Runtime detections from Falco, Sysdig Secure, Twistlock (Prisma Cloud Compute), Aqua Security, and Contrast ADR now route to the Normalized Runtime Detection rule (MATCH-S01159) rather than the general passthrough rule, giving container and application runtime alerts their own tunable rule
• Identity detections from Azure AD Identity Protection, Microsoft Azure Advanced Threat Protection, Microsoft Defender for Cloud Apps, Google Workspace Alert Center, Okta, Slack, Box, DocuSign Monitor, Salesforce, and CrowdStrike Identity Protection now route to the Normalized Identity Detection rule (MATCH-S01161)
• MITRE ATLAS technique tags added to existing AI and LLM detection rules covering AWS Bedrock, Anthropic Claude, and GitHub Copilot, so signals from AI platform activity carry adversarial AI technique context alongside existing MITRE ATT&CK tagging
• Legacy Threat Intel rules renamed and their descriptions updated to identify them as legacy and note their pending deprecation in favor of the current threat intelligence rules using the hasThreatMatch operator
• Removed a redundant device IP mapping from the Cloudflare Logpush mapper so device and source device fields are no longer populated from the same input value
• Updated Check Point Firewall JSON parsing to fall back to the firewall subproduct field when the primary product field is absent, improving vendor and product identification
• Removed the Windows Defender SCCM grok parser and mapper as the parser was generating entirely false positive matches across Sumo Logic Cloud SIEM customers

Changes are enumerated below.

Rules​

• [Updated] THRESHOLD-S00125 AWS Bedrock - Knowledge Base Mass Deletion
• [Updated] MATCH-S01151 AWS Bedrock - Privileged Permissions Granted
• [Updated] CHAIN-S00026 AWS Bedrock - Privileged Policy Created and Attached
• [Updated] MATCH-S00922 AWS Bedrock Agent Created
• [Updated] MATCH-S00924 AWS Bedrock Guardrail Deleted
• [Updated] MATCH-S00923 AWS Bedrock Model Invocation Denied for User
• [Updated] MATCH-S00921 AWS Bedrock Model Invocation Logging Configuration Change Observed
• [Updated] MATCH-S01155 Claude Compliance API Logging Disabled
• [Updated] FIRST-S00084 First Seen AWS Bedrock API Call from User
• [Updated] FIRST-S00081 First Seen Model ID in AWS Bedrock Put Entitlement by User
• [Updated] FIRST-S00085 First Seen Role Creating AWS Bedrock Agent
• [Updated] FIRST-S00082 First Seen User Enumerating AWS Bedrock Models
• [Updated] FIRST-S00100 First Seen User Enumerating Custom AWS Bedrock Models
• [Updated] MATCH-S00954 GitHub - Copilot Seat Cancelled by GitHub
• [Updated] LEGACY-S00110 Legacy Threat Intel - Device IP Matched Threat Intel Domain Name
• [Updated] LEGACY-S00111 Legacy Threat Intel - Device IP Matched Threat Intel URL
• [Updated] MATCH-S00555 Legacy Threat Intel - Inbound Traffic Context
• [Updated] LEGACY-S00109 Legacy Threat Intel - Matched Domain Name
• [Updated] LEGACY-S00108 Legacy Threat Intel - Matched File Hash
• [Updated] MATCH-S00815 Legacy Threat Intel - Successful Authentication from Threat IP
• [Updated] LEGACY-S00107 Legacy Threat Intel Match - IP Address
• [Updated] MATCH-S01163 Normalized Data Protection Detection
• [Updated] MATCH-S01159 Normalized Runtime Detection
• [Updated] OUTLIER-S00019 Outlier in AWS Bedrock API Calls from User
• [Updated] OUTLIER-S00022 Outlier in AWS Bedrock Foundation Model Enumeration Calls from User

Log Mappers​

• [Updated] Aqua Access Control
• [Updated] Aqua Runtime Policy Match
• [Updated] Azure Risky Users
• [Updated] Azure User Risk Events
• [Updated] Box - SHIELD_ALERT
• [Updated] Cloudflare - Logpush
• [Updated] Contrast Security ADR Default Mapping
• [Updated] CrowdStrike Falcon Host API IdpDetectionSummaryEvent
• [Updated] CrowdStrike Falcon Host API IdpDetectionSummaryEvent (CNC)
• [Updated] CrowdStrike Falcon Identity Protection
• [Updated] CrowdStrike Falcon Identity Protection (CNC)
• [Updated] DocuSign Monitor - Alert
• [Updated] Falco Detection JSON
• [Updated] Google Workspace Alert Center - AppMaker Editor
• [Updated] Google Workspace Alert Center - Google Operations
• [Updated] Google Workspace Alert Center - Google identity
• [Updated] Google Workspace Alert Center - Security Center rules
• [Updated] Google Workspace Alert Center - State Sponsored Attack
• [Updated] Microsoft Cloud App Security - Direct
• [Updated] Microsoft Graph Identity Protection API C2C - riskDetections
• [Updated] Microsoft Graph Identity Protection API C2C - riskyUsers
• [Updated] Microsoft Graph Security API C2C - Dynamic Vendor/Product - Azure Advanced Threat Protection
• [Updated] Microsoft Graph Security API C2C - Dynamic Vendor/Product - Microsoft Defender for Cloud Apps
• [Updated] Okta Security Threat Events
• [Updated] Salesforce Normalized Security Signal Passthrough
• [Updated] Slack Anomaly Event
• [Updated] Sysdig Policy Detection JSON
• [Updated] Twistlock Container Runtime Audit

Parsers​

• [Updated] /Parsers/System/Check Point/Check Point Firewall JSON

Legacy Grok Parsers​

• [Removed] /Parsers/System/Windows/Windows Defender SCCM

We're excited to announce that Sumo Logic's SOC Analyst Agent, a powerful agentic AI tool designed to improve the speed and accuracy of your Security Operations Center (SOC) team's threat investigations, is now generally available. The agent investigates Cloud SIEM insights with evidence-backed verdicts, helping your team cut through false-positive noise and speed up threat resolution. Learn more.

The agent requires a Cloud SIEM subscription and is opt-in.

The SOC Analyst Agent provides the following new functionality:

• AI Investigation tab in Cloud SIEM
• Insight investigation in Mobot
• SOC Analyst Settings tab for auto-investigation controls

AI Investigation tab​

A new AI Investigation tab in Cloud SIEM provides an AI-generated analysis of insights that accelerates investigation and troubleshooting by your SOC team.

Insight investigation in Mobot​

When you select the Ask Mobot button on the new AI Investigation tab in Cloud SIEM, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use Mobot's focused query capabilities to drill down into the insight for greater detail.

SOC Analyst Settings​

The new SOC Analyst Settings tab on the Cloud SIEM Workflow Configuration page lets administrators control how the agent consumes your committed monthly investigation volume. Define an Auto-Investigation Filter to exclude low-priority insights from automatic investigation, and use Volume & Overage Settings to choose whether investigation continues past your committed volume. Learn more.

To better represent and improve reliability of third-party security alerts passed through to Sumo Logic Cloud SIEM, we are introducing six new detection rules. These new rules represent new, more granular categories, enabling easier tuning and improved context from the underlying alerts over the existing Normalized Security Signal passthrough rule (MATCH-S00402). Since this is a significant change and custom content such as tuning expressions and custom insights dependent on the existing passthrough rule will need to be migrated, we will be phasing the migration of vendor/product log mappings which contribute records to the passthroughs over the course of July and August.

Target Dates:

• July 30 — Runtime and Identity sources

  • Runtime (MATCH-S01159): Falco, Sysdig Secure, Twistlock (Prisma Cloud Compute), Aqua Security
  • Identity (MATCH-S01161): Azure AD Identity Protection, Microsoft ATA, Microsoft Graph Identity API, MCAS/Defender for Cloud Apps, Google Workspace Alert Center, Slack Enterprise, Okta, DocuSign Monitor, Exabeam, Salesforce, Box, CrowdStrike Identity Protection

• August 13 — Network and Data Protection sources

  • Network (MATCH-S01162): Kemp LoadMaster WAF, Palo Alto Firewall, FortiGate, FireEye NX/CMS, Vectra AI, Claroty xDome, Darktrace, AlphaSOC, CrowdStrike FDR, Bitdefender, Trend Micro
  • Data Protection (MATCH-S01163): Egnyte DLP, Varonis, Netskope, Akamai CPC, Noname API Security, Check Point Avanan, Proofpoint TRAP, Mimecast, Thinkst Canary, Contrast ADR, Qualys, IBM Guardium, Office 365 DLP, CrowdStrike DataProtection, Fortinet, Google Workspace

• August 27 — Cloud and Endpoint sources

  • Cloud (MATCH-S01160): AWS GuardDuty, AWS Security Hub, Google Cloud SCC, GCP IDS, Orca Security, Wiz, Palo Alto Prisma Cloud, Azure
  • Endpoint (MATCH-S01158): CrowdStrike Falcon, SentinelOne, Carbon Black, Cylance, Cisco AMP, Cybereason, Endgame, Jamf Protect, Malwarebytes, McAfee, Palo Alto Cortex XDR, Sophos, Tanium, Trend Micro, Windows Defender, FireEye HX, Azure Defender for Endpoint, Google Workspace, Bitdefender

• This content release includes:
  • Six new Normalized Detection rules that provide unified pass-through coverage across security domains — cloud, endpoint, identity, network, runtime, and data protection. These will eventually replace the existing Normalized Security Signal passthrough rule (MATCH-S00402).
  • New AWS GuardDuty AttackSequence log mapper to surface multi-stage attack sequence findings
  • Updated Palo Alto Threat and Traffic log mappers removing inappropriately normalized Palo Alto specific flag fields
  • Updated Office 365 parsing to better extract nested fields and combine separated key-value pairs that represent a single pair.
  • Updated Microsoft Teams external and guest access detection rules to reflect updated Office 365 parsing
  • Updated Okta MFA mapping to remove incorrect classification of logon for events only representing a portion of the logon process.
  • Added alternate value for device_hostname to WatchGuard Fireware mapper
  • Changes are enumerated below

Rules​

• [New] MATCH-S01158 Normalized Endpoint Detection
• [New] MATCH-S01159 Normalized Runtime Detection
• [New] MATCH-S01160 Normalized Cloud Detection
• [New] MATCH-S01161 Normalized Identity Detection
• [New] MATCH-S01162 Normalized Network Detection
• [New] MATCH-S01163 Normalized Data Protection Detection
• [Updated] MATCH-S00888 Microsoft Teams External Access Enabled
• [Updated] MATCH-S00889 Microsoft Teams Guest Access Enabled

Log Mappers​

• [New] AWSGuardDuty - AttackSequence
• [Updated] Okta Authentication - auth_via_mfa
• [Updated] Palo Alto Threat DLP non File - Custom Parser
• [Updated] Palo Alto Threat Data - Custom Parser
• [Updated] Palo Alto Threat File - Custom Parser
• [Updated] Palo Alto Threat Flood - Custom Parser
• [Updated] Palo Alto Threat Packet - Custom Parser
• [Updated] Palo Alto Threat Scan - Custom Parser
• [Updated] Palo Alto Threat Spyware - Custom Parser
• [Updated] Palo Alto Threat URL Filtering - Custom Parser
• [Updated] Palo Alto Threat Virus - Custom Parser
• [Updated] Palo Alto Threat Vulnerability - Custom Parser
• [Updated] Palo Alto Threat Wildfire - Custom Parser
• [Updated] Palo Alto Threat Wildfire Virus - Custom Parser
• [Updated] Palo Alto Traffic - Custom Parser
• [Updated] Watchguard Fireware - Firewall

Parsers​

• [Updated] /Parsers/System/Microsoft/Office 365

Schema​

• [Updated] threat_ruleType
  • endpoint
  • runtime
  • cloud
  • identity
  • network
  • data_protection

Learn more.

Log Mappers​

• [New] Microsoft Azure Defender for Cloud - Assessments
• [New] Microsoft Azure Defender for Cloud - Posture
• [New] Microsoft Azure Defender for Cloud - Security Alerts
• [New] Microsoft Azure Defender for Cloud - Sub-Assessments
• [Updated] Slack Anomaly Event
• [Updated] Slack Catch All
• [Updated] Slack Login

Parsers​

• [New] /Parsers/System/Microsoft/Azure Defender For Cloud
• [Updated] /Parsers/System/AWS/AWS WAF
• [Updated] /Parsers/System/Slack/Slack Enterprise Audit

Rules​

• [New] MATCH-S01153 AF_ALG Socket Opened by Unprivileged Process
  • A unprivileged process on a Linux host opened a socket using the kernel cryptographic API subsystem
• [New] CHAIN-S00027 OpenClaw - Outbound Connection from Child Process
  • This ordered chain rule triggers when a child process of an openclaw-gateway node process is created on a host followed within 5 minutes by an outbound network connection to an external IP from the same process on the same host, grouped by process ID and hostname. Command lines associated with ip neighbor discovery are excluded as these can be a normal part of OpenClaw operation.
• [New] MATCH-S01149 OpenClaw - Shell Launch by Gateway
  • This rule triggers when a Node.js process with 'openclaw' in its command line spawns shell interpreters such bash, zsh, sh, PowerShell or python. It monitors process creation events to identify when OpenClaw's shell integration features actively execute system commands. Command lines associated with ip neighbor discovery are excluded as these can be a normal part of OpenClaw operation.
• [New] MATCH-S01152 OpenClaw - Skill Installed Out-of-Band
  • This rule triggers when a file matching .openclawskills*.md is created by a process whose base image is not "node" (the standard OpenClaw runtime). It monitors Sysmon FileCreate events and flags skill file writes that occur outside the official openclaw or clawhub installer processes.
• [New] MATCH-S01150 OpenClaw - Activity on Default Port
  • This rule triggers when a websocket connection to TCP port 18789 returns HTTP status 'Switching Protocols', indicating websocket handshake. Port 18789 is OpenClaw's default local server port, providing detection of active OpenClaw usage.
• [New] FIRST-S00101 AWS Bedrock - KB Data Source from External S3 Bucket
  • Detection: This rule triggers when an S3 bucket from an external AWS account is added to a Bedrock Knowledge Base via UpdateDataSource or CreateDataSource API calls in which the external AWS account hasn't been observed in the last 90 days.
• [New] THRESHOLD-S00125 AWS Bedrock - Knowledge Base Mass Deletion
  • This rule triggers when a user deletes multiple AWS Bedrock Knowledge Bases within a short time period from the same source IP address. It monitors CloudTrail logs for successful DeleteKnowledgeBase API calls and excludes AWS service-linked roles.
• [New] MATCH-S01151 AWS Bedrock - Privileged Permissions Granted
  • This rule triggers when Bedrock IAM permissions are granted through: (1) attachment of managed policies (AmazonBedrockFullAccess, AmazonBedrockStudioFullAccess), (2) creation of policies containing Bedrock actions, or (3) inline policy assignments. It monitors high-risk actions including model invocation, AI agent creation, guardrail deletion, logging configuration changes, knowledge base creation, and provisioned throughput allocation.
• [New] CHAIN-S00026 AWS Bedrock - Privileged Policy Created and Attached
  • This rule triggers when Bedrock IAM permissions are granted through the creation and attachment of an IAM policy with privileged Bedrock permissions including model invocation, AI agent creation, guardrail deletion, logging configuration changes, knowledge base creation, and provisioned throughput allocation.
• [New] THRESHOLD-S00124 AWS Bedrock - Rapid Guardrail Interventions
  • This rule triggers when 10 or more Bedrock Guardrail interventions occur within 60 seconds for a user. It monitors CloudWatch logs where stopReason equals 'guardrail_intervened', indicating the guardrail blocked model responses that violated content policies.
• [New] MATCH-S01154 Unexpected Root Process from Unprivileged Login Session
  • A user executed a program as root on a Linux host while the originating login session belongs to an unprivileged user, which is inconsistent with legitimate privilege escalation workflows.
• [Updated] MATCH-S00307 AWS - Excessive OAuth Application Permissions Scope
• [Updated] MATCH-S00306 AWS - New UserPoolClient Created
• [Updated] MATCH-S00921 AWS Bedrock Model Invocation Logging Configuration Change Observed
• [Updated] MATCH-S00715 AWS Cloud Storage Deletion
• [Updated] AGGREGATION-S00002 AWS CloudTrail - Aggressive Reconnaissance
• [Updated] LEGACY-S00207 AWS CloudTrail - Customer Master Key Disabled or Scheduled for Deletion
• [Updated] MATCH-S00261 AWS CloudTrail - Database Snapshot Created
• [Updated] MATCH-S00208 AWS CloudTrail - EC2 Access Key Action Detected
• [Updated] MATCH-S00246 AWS CloudTrail - GetSecretValue from non Amazon IP
• [Updated] MATCH-S00111 AWS CloudTrail - IAM CreateUser Action Observed
• [Updated] LEGACY-S00206 AWS CloudTrail - IAM Policy Applied
• [Updated] MATCH-S00101 AWS CloudTrail - IAM Privileged Policy Applied to Group
• [Updated] MATCH-S00104 AWS CloudTrail - IAM Privileged Policy Applied to Role
• [Updated] MATCH-S00099 AWS CloudTrail - IAM Privileged Policy Applied to User
• [Updated] THRESHOLD-S00051 AWS CloudTrail - IAM User Generating AccessDenied Errors Across Multiple Actions
• [Updated] MATCH-S00113 AWS CloudTrail - Logging Configuration Change Observed
• [Updated] MATCH-S00308 AWS CloudTrail - OpsWorks Describe Permissions Event
• [Updated] MATCH-S00109 AWS CloudTrail - Permissions Boundary Lifted
• [Updated] MATCH-S00105 AWS CloudTrail - Public S3 Bucket Exposed
• [Updated] MATCH-S00213 AWS CloudTrail - Reconnaissance related event
• [Updated] MATCH-S00096 AWS CloudTrail - Root Console Successful Login Observed
• [Updated] MATCH-S00764 AWS CloudTrail - S3 Bucket Public Access Block Disabled
• [Updated] MATCH-S00210 AWS CloudTrail - SQS List Queues Event
• [Updated] MATCH-S00240 AWS CloudTrail - ScheduleKeyDeletion in KMS
• [Updated] MATCH-S00247 AWS CloudTrail - Secrets Manager sensitive admin action observed
• [Updated] MATCH-S00238 AWS CloudTrail - sensitive activity in KMS
• [Updated] MATCH-S00540 AWS CloudTrail Network Access Control List Deleted
• [Updated] MATCH-S00664 AWS CloudWatch Alarm Actions Disabled
• [Updated] MATCH-S00663 AWS CloudWatch Alarm Deletion
• [Updated] MATCH-S00662 AWS CloudWatch Anomaly Detector Deletion
• [Updated] MATCH-S00665 AWS CloudWatch Log Group Deletion
• [Updated] MATCH-S00661 AWS CloudWatch Log Stream Deletion
• [Updated] MATCH-S00671 AWS Config Recorder Deletion
• [Updated] MATCH-S00672 AWS Config Recorder Stopped
• [Updated] MATCH-S00670 AWS Config Service Tampering
• [Updated] MATCH-S00654 AWS ECS Cluster Deleted
• [Updated] MATCH-S00716 AWS Image Creation
• [Updated] MATCH-S00717 AWS Image Deletion
• [Updated] THRESHOLD-S00106 AWS Image Discovery
• [Updated] MATCH-S00718 AWS Image Modification
• [Updated] MATCH-S00719 AWS Instance Creation
• [Updated] MATCH-S00720 AWS Instance Deletion
• [Updated] THRESHOLD-S00107 AWS Instance Discovery
• [Updated] MATCH-S00721 AWS Instance Modification
• [Updated] MATCH-S00679 AWS Route 53 Domain Registered
• [Updated] THRESHOLD-S00093 AWS Route 53 Reconnaissance
• [Updated] MATCH-S00677 AWS Route 53 Service Tampering
• [Updated] MATCH-S00680 AWS Route 53 TestDNSAnswer
• [Updated] MATCH-S00678 AWS Route 53 Traffic Policy Creation
• [Updated] MATCH-S00674 AWS WAF Access Control List Updated
• [Updated] THRESHOLD-S00092 AWS WAF Reconnaissance
• [Updated] MATCH-S00676 AWS WAF Rule Group Updated
• [Updated] MATCH-S00675 AWS WAF Rule Updated
• [Updated] MATCH-S00673 AWS WAF Service Tampering
• [Updated] MATCH-S00660 Anomalous AWS User Executed a Command on ECS Container
• [Updated] MATCH-S00686 Base64 Decode in Command Line
• [Updated] FIRST-S00085 First Seen Role Creating AWS Bedrock Agent
• [Updated] MATCH-S00655 New Container Uploaded to AWS ECR
• [Updated] MATCH-S00826 SSH Keys Added to EC2 Instance
• [Updated] MATCH-S00281 Windows - PowerShell Process Discovery

Log Mappers​

• [New] Fortinet Authentication Logs
• [Updated] CloudTrail - application-insights.amazonaws.com - ListApplications
• [Updated] CloudTrail - cloudtrail.amazonaws.com - Trail Change|Logging
• [Updated] CloudTrail - cognito-idp.amazonaws.com - CreateUserPoolClient
• [Updated] CloudTrail - controltower.amazonaws.com - CreateManagedAccount
• [Updated] CloudTrail - ec2.amazonaws.com - All Network Events
• [Updated] CloudTrail - ec2.amazonaws.com - BidEvictedEvent
• [Updated] CloudTrail - ecr.amazonaws.com - PolicyExecutionEvent
• [Updated] CloudTrail - ecs.amazonaws.com - AwsApiCall-ExecuteCommand
• [Updated] CloudTrail - elasticfilesystem.amazonaws.com - NewClientConnection
• [Updated] CloudTrail - iam.amazonaws.com - Policy Change
• [Updated] CloudTrail - kms.amazonaws.com - DisableKey|ScheduleKeyDeletion
• [Updated] CloudTrail - kms.amazonaws.com - RotateKey
• [Updated] CloudTrail - lambda.amazonaws.com - Audit Change
• [Updated] CloudTrail - lambda.amazonaws.com - DeleteEventSourceMapping|DeleteFunction
• [Updated] CloudTrail - lambda.amazonaws.com - DeleteFunctionUrlConfig
• [Updated] CloudTrail - lambda.amazonaws.com - GetFunction
• [Updated] CloudTrail - lambda.amazonaws.com - GetLayerVersionPolicy
• [Updated] CloudTrail - lambda.amazonaws.com - GetPolicy|GetLayerVersionPolicy
• [Updated] CloudTrail - lambda.amazonaws.com - ListEventSourceMappings
• [Updated] CloudTrail - lambda.amazonaws.com - ListFunctions
• [Updated] CloudTrail - lambda.amazonaws.com - Resource Access
• [Updated] CloudTrail - logs.amazonaws.com - DeleteDestination|DeleteLogGroup|DeleteLogStream
• [Updated] CloudTrail - organizations.amazonaws.com - CreateAccountResult
• [Updated] CloudTrail - s3.amazonaws.com - Bucket Change
• [Updated] CloudTrail - s3.amazonaws.com - GetBucketAcl
• [Updated] CloudTrail - secretsmanager.amazonaws.com - RotationSucceeded|RotationStarted
• [Updated] CloudTrail - secretsmanager.amazonaws.com - SecretVersionDeletion
• [Updated] CloudTrail - signin.amazonaws.com - All AwsConsoleSignIn events
• [Updated] CloudTrail - sso.amazonaws.com - Federate|ListProfilesForApplication
• [Updated] CloudTrail Batch get Partition
• [Updated] CloudTrail Default Mapping
• [Updated] Microsoft Office 365 Active Directory Authentication Events

Parsers​

• [Updated] /Parsers/System/Fortinet/Fortigate/Fortigate-Syslog
• [Updated] /Parsers/System/Microsoft/Office 365

• Updated MITRE ATT&CK tactic and technique tags across 89 rules to align with the MITRE ATT&CK v19 framework update, which reorganized the former Defense Evasion tactic into Stealth and the new Defense Impairment tactic
• Affected rules now reference the correct successor techniques and tactic identifiers, ensuring accurate threat classification in detection workflows
• Additional changes are enumerated below

Rules​

• [Updated] MATCH-S00307 AWS - Excessive OAuth Application Permissions Scope
• [Updated] MATCH-S00306 AWS - New UserPoolClient Created
• [Updated] MATCH-S00261 AWS CloudTrail - Database Snapshot Created
• [Updated] MATCH-S00113 AWS CloudTrail - Logging Configuration Change Observed
• [Updated] MATCH-S00654 AWS ECS Cluster Deleted
• [Updated] MATCH-S00719 AWS Instance Creation
• [Updated] MATCH-S00720 AWS Instance Deletion
• [Updated] MATCH-S00721 AWS Instance Modification
• [Updated] MATCH-S00598 Alibaba ActionTrail Logging Configuration Change Observed
• [Updated] MATCH-S00516 Antivirus Ransomware Detection
• [Updated] MATCH-S00510 Attempt to Add Certificate to Store
• [Updated] MATCH-S00390 Attempted Credential Dump From Registry Via Reg.Exe
• [Updated] MATCH-S00805 Azure - Bastion Host Created/Modified
• [Updated] MATCH-S00806 Azure - Bastion Host Deleted
• [Updated] MATCH-S00808 Azure - Container Instance Creation/Modification
• [Updated] MATCH-S00809 Azure - Container Start
• [Updated] MATCH-S00786 Azure - SQL Database Export
• [Updated] MATCH-S00303 Azure - Unauthorized OAuth Application
• [Updated] MATCH-S00803 Azure - Virtual Machine Creation/Modification
• [Updated] MATCH-S00804 Azure - Virtual Machine Deleted
• [Updated] MATCH-S00801 Azure - Virtual Machine Started
• [Updated] MATCH-S00802 Azure - Virtual Machine Stopped
• [Updated] MATCH-S00896 Azure Authentication Policy Change
• [Updated] CHAIN-S00022 Azure DevOps - Agent Pool Created and Deleted within a Short Period
• [Updated] FIRST-S00099 Azure DevOps - First Seen User Creating Agent Pool
• [Updated] FIRST-S00092 Azure DevOps - First Seen User Creating Release Pipeline
• [Updated] FIRST-S00097 Azure DevOps - First Seen User Modifying Build Variables
• [Updated] FIRST-S00096 Azure DevOps - First Seen User Modifying Release Pipeline
• [Updated] OUTLIER-S00030 Azure DevOps - Outlier in Pools Deleted Rapidly
• [Updated] MATCH-S00891 Azure OAUTH Application Consent from User
• [Updated] MATCH-S00373 BlueMashroom DLL Load
• [Updated] MATCH-S01155 Claude Compliance API Logging Disabled
• [Updated] MATCH-S01157 Claude Organization IP Restriction Deleted
• [Updated] MATCH-S00758 CrashControl Registry Modification
• [Updated] MATCH-S00544 Disabling Remote User Account Control
• [Updated] MATCH-S00319 Dridex Process Pattern
• [Updated] MATCH-S00392 File or Folder Permissions Modifications
• [Updated] FIRST-S00037 First Seen AWS EKS Admission Controller Created by IP Address
• [Updated] FIRST-S00020 First Seen Azure OAUTH Application Consent from User
• [Updated] FIRST-S00030 First Seen Outbound Connection to External IP Address on Port 445 from IP Address
• [Updated] FIRST-S00034 First Seen Session Token Granted to User from New IP
• [Updated] FIRST-S00087 First Seen User Creating or Modifying EC2 Launch Template
• [Updated] MATCH-S00712 GCP Instance Creation
• [Updated] MATCH-S00713 GCP Instance Deletion
• [Updated] MATCH-S00714 GCP Instance Modification
• [Updated] MATCH-S00958 GitHub - PR Review Requirement Removed
• [Updated] MATCH-S00962 GitHub - Repository Visibility Permissions Changed
• [Updated] MATCH-S00964 GitHub - SSO Recovery Codes Access Activity
• [Updated] MATCH-S00966 GitHub - Two-Factor Authentication Disabled for Organization
• [Updated] MATCH-S00301 Google Workspace - Excessive OAuth Application Permissions Scope
• [Updated] MATCH-S00227 Google Workspace - Unauthorized OAuth Application
• [Updated] MATCH-S00894 HAR file creation observed on host
• [Updated] MATCH-S00850 LastPass - Policy Added
• [Updated] MATCH-S00851 LastPass - Policy Deleted
• [Updated] MATCH-S00852 LastPass - Shared Folder Created
• [Updated] MATCH-S00578 Lsass Registry Key Modified
• [Updated] MATCH-S00534 MacOS - Re-Opened Applications
• [Updated] MATCH-S00729 MacOS Gatekeeper Bypass
• [Updated] MATCH-S00731 MacOS System Integrity Protection Disabled
• [Updated] MATCH-S00397 Mimikatz Loaded Images Detected
• [Updated] MATCH-S00404 Mimikatz via Powershell and EventID 4703
• [Updated] MATCH-S00655 New Container Uploaded to AWS ECR
• [Updated] MATCH-S00906 Okta - Application Created
• [Updated] FIRST-S00067 Okta - First Seen Client ID/ASN combo in successful OIDC token grant
• [Updated] MATCH-S00683 Overly Permissive Chmod Command
• [Updated] MATCH-S00698 PATH Set to Current Directory
• [Updated] MATCH-S00704 Persistence Registry Key Modification
• [Updated] MATCH-S00200 Potential Pass the Hash Activity
• [Updated] MATCH-S00545 Registry Keys For Creating Shim Databases
• [Updated] MATCH-S00705 Registry Modification - Authentication Package
• [Updated] MATCH-S00730 Registry Modification - Code Signing
• [Updated] MATCH-S00735 Registry Modification - SIP or Trust Provider
• [Updated] MATCH-S00569 Registry Persistence Mechanisms
• [Updated] MATCH-S00328 Rubeus Hack Tool
• [Updated] MATCH-S00498 Rubeus Hack Tool Logon Process Name
• [Updated] LEGACY-S00094 Self-signed Certificates
• [Updated] MATCH-S00834 Sensitive Registry Key (WDigest) Edit
• [Updated] MATCH-S00196 Successful Overpass the Hash Attempt
• [Updated] LEGACY-S00182 Suspicious HTTP User-Agent
• [Updated] MATCH-S00135 Suspicious Registry Key Modification
• [Updated] MATCH-S00886 Suspicious chmod Execution
• [Updated] MATCH-S00567 Ursnif Malware Registry Key
• [Updated] MATCH-S00316 WannaCry Ransomware
• [Updated] MATCH-S00272 Windows - Rogue Domain Controller - dcshadow
• [Updated] MATCH-S00107 Windows - User Adds Self to Security Group
• [Updated] LEGACY-S00169 Windows Account Added To Privileged Security Group
• [Updated] MATCH-S00274 Windows Credential Editor (WCE) Tool Use Detected
• [Updated] MATCH-S00880 macOS - Entitlement Enumeration via Xattr

Rules​

• [New] MATCH-S01156 Claude Admin or Platform API Key Created
  • This rule triggers when a new Admin or Platform API key is created within a Claude organization.
• [New] MATCH-S01155 Claude Compliance API Logging Disabled
  • This rule triggers when an administrator disables Compliance API activity logging for the organization.
• [New] MATCH-S01157 Claude Organization IP Restriction Deleted
  • This rule triggers when an IP restriction is deleted from a Claude organization, removing a network access control.
• [New] FIRST-S00102 First Seen User Initiating Claude Data Export
  • This rule triggers the first time a user initiates a Claude organization data export within a 90-day baseline window.
• [New] OUTLIER-S00034 Outlier in Claude Compliance API Calls from User
  • This rule triggers when the number of Compliance API calls from a single user in a one-hour window exceeds the established baseline by 2 standard deviations with a minimum floor of 15 calls.
• [New] OUTLIER-S00035 Outlier in Claude Resource Deletions from User
  • This rule triggers when the number of Claude resource deletions (chats, projects, and files) from a single user in a one-hour window exceeds the established baseline by 2 standard deviations with a minimum floor of 5 deletions.
• [Updated] OUTLIER-S00007 Spike in Windows Administrative Privileges Granted for User
  • This rule has been updated to force case insensitivity in the match expression for user accounts, ensuring more consistent detection of spikes in administrative privileges granted regardless of username casing.

Log Mappers​

• [New] Claude - Admin API Key Events
• [New] Claude - Authentication Events
• [New] Claude - account_deleted
• [New] Claude - api_key_created
• [New] Claude - claude_artifact_sharing_updated
• [New] Claude - claude_artifact_viewed
• [New] Claude - claude_chat_created
• [New] Claude - claude_chat_deleted
• [New] Claude - claude_chat_viewed
• [New] Claude - claude_code_review_config_updated
• [New] Claude - claude_code_review_repository_added
• [New] Claude - claude_code_review_repository_removed
• [New] Claude - claude_code_security_center_config_updated
• [New] Claude - claude_file_deleted
• [New] Claude - claude_file_uploaded
• [New] Claude - claude_file_viewed
• [New] Claude - claude_organization_settings_updated
• [New] Claude - claude_project_created
• [New] Claude - claude_project_deleted
• [New] Claude - claude_project_sharing_updated
• [New] Claude - claude_project_viewed
• [New] Claude - claude_skill_created
• [New] Claude - claude_user_settings_updated
• [New] Claude - cli_plugin_exec_policy_updated
• [New] Claude - compliance_api_accessed
• [New] Claude - desktop_extension_allowlisted
• [New] Claude - desktop_extension_blocklisted
• [New] Claude - desktop_extension_deleted
• [New] Claude - desktop_extension_removed_from_allowlist
• [New] Claude - desktop_extension_unblocked
• [New] Claude - domain_claim_initiated
• [New] Claude - mcp_server_created
• [New] Claude - mcp_server_deleted
• [New] Claude - mcp_server_updated
• [New] Claude - mcp_tool_policy_updated
• [New] Claude - org_compliance_api_settings_updated
• [New] Claude - org_cowork_disabled
• [New] Claude - org_data_export_completed
• [New] Claude - org_data_export_started
• [New] Claude - org_invite_link_disabled
• [New] Claude - org_invite_link_generated
• [New] Claude - org_ip_restriction_created
• [New] Claude - org_ip_restriction_deleted
• [New] Claude - org_ip_restriction_updated
• [New] Claude - org_member_invites_disabled
• [New] Claude - org_member_invites_enabled
• [New] Claude - org_sso_connection_activated
• [New] Claude - org_sso_connection_deactivated
• [New] Claude - org_sso_connection_deleted
• [New] Claude - org_user_invite_accepted
• [New] Claude - org_user_invite_sent
• [New] Claude - platform_api_key_created
• [New] Claude - platform_federation_issuer_archived
• [New] Claude - platform_federation_issuer_updated
• [New] Claude - platform_federation_rule_archived
• [New] Claude - platform_federation_rule_updated
• [New] Claude - platform_federation_rule_workspace_added
• [New] Claude - platform_federation_rule_workspace_removed
• [New] Claude - platform_file_deleted
• [New] Claude - platform_file_uploaded
• [New] Claude - platform_service_account_archived
• [New] Claude - platform_service_account_updated
• [New] Claude - platform_workspace_created
• [New] Claude - platform_workspace_rate_limit_deleted
• [New] Claude - platform_workspace_rate_limit_updated
• [New] Claude - role_assignment_granted
• [New] Claude - tunnel_token_minted
• [New] Claude - tunnel_token_revoked
• [New] Claude - user_consent_revoked
• [New] Claude - user_logged_out
• [New] Claude Activity Logs - Catch All
• [Updated] Imperva Incapsula Logs

Parsers​

• [New] /Parsers/System/Anthropic/Claude Activity Logs

Rules​

• [Updated] THRESHOLD-S00016 HTTP Response Error Spike - Internal
• [Updated] THRESHOLD-S00099 Long URL Containing SQL Commands
• [Updated] OUTLIER-S00016 Okta - Outlier in OIDC token request failures
• [Updated] MATCH-S00835 Possible Dynamic URL Domain
• [Updated] LEGACY-S00182 Suspicious HTTP User-Agent

Log Mappers​

• [New] Laurel Linux Audit - Process Start
• [Updated] Fortinet UTM IDS1
• [Updated] Laurel Linux Audit - System Call
• [Updated] Okta Authentication - auth_via_AD_agent
• [Updated] Okta Authentication - auth_via_mfa
• [Updated] Okta Authentication - auth_via_radius
• [Updated] Okta Authentication - sso
• [Updated] Okta Authentication Events
• [Updated] Okta Catch All
• [Updated] Okta Security Threat Events

Parsers​

• [Updated] /Parsers/System/AWS/AWS WAF
• [Updated] /Parsers/System/Fortinet/Fortigate/Fortigate-CEF

Rules​

• [Updated] MATCH-S00924 AWS Bedrock Guardrail Deleted
• [Updated] MATCH-S00921 AWS Bedrock Model Invocation Logging Configuration Change Observed
• [Updated] MATCH-S00113 AWS CloudTrail - Logging Configuration Change Observed
• [Updated] MATCH-S00540 AWS CloudTrail Network Access Control List Deleted
• [Updated] MATCH-S00664 AWS CloudWatch Alarm Actions Disabled
• [Updated] MATCH-S00663 AWS CloudWatch Alarm Deletion
• [Updated] MATCH-S00662 AWS CloudWatch Anomaly Detector Deletion
• [Updated] MATCH-S00665 AWS CloudWatch Log Group Deletion
• [Updated] MATCH-S00661 AWS CloudWatch Log Stream Deletion
• [Updated] MATCH-S00671 AWS Config Recorder Deletion
• [Updated] MATCH-S00672 AWS Config Recorder Stopped
• [Updated] MATCH-S00670 AWS Config Service Tampering
• [Updated] MATCH-S00677 AWS Route 53 Service Tampering
• [Updated] MATCH-S00674 AWS WAF Access Control List Updated
• [Updated] MATCH-S00676 AWS WAF Rule Group Updated
• [Updated] MATCH-S00675 AWS WAF Rule Updated
• [Updated] MATCH-S00673 AWS WAF Service Tampering
• [Updated] MATCH-S00598 Alibaba ActionTrail Logging Configuration Change Observed
• [Updated] MATCH-S00589 Alibaba ActionTrail Network Access Control List Deleted
• [Updated] MATCH-S00516 Antivirus Ransomware Detection
• [Updated] MATCH-S00415 Attempt to Clear Windows Event Logs Using Wevtutil
• [Updated] MATCH-S00795 Azure - Diagnostic Setting Deleted
• [Updated] MATCH-S00796 Azure - Diagnostic Setting Modified
• [Updated] MATCH-S00797 Azure - Event Hub Deleted
• [Updated] MATCH-S00864 Azure Firewall Rule Modified
• [Updated] MATCH-S00373 BlueMashroom DLL Load
• [Updated] MATCH-S00388 COMPlus_ETWEnabled Command Line Arguments
• [Updated] LEGACY-S00037 Fortinet Critical App-Risk
• [Updated] LEGACY-S00038 Fortinet High App-Risk
• [Updated] MATCH-S00620 GCP Audit Cloud SQL Database Modified
• [Updated] MATCH-S00621 GCP Audit GCE Firewall Rule Modified
• [Updated] MATCH-S00622 GCP Audit GCE Network Route Created or Modified
• [Updated] MATCH-S00623 GCP Audit GCE VPC Network Modified
• [Updated] MATCH-S00626 GCP Audit Logging Sink Modified
• [Updated] MATCH-S00627 GCP Audit Pub/Sub Subscriber Modified
• [Updated] MATCH-S00628 GCP Audit Pub/Sub Topic Deleted
• [Updated] MATCH-S00953 GitHub - Audit Logging Modification
• [Updated] MATCH-S00962 GitHub - Repository Visibility Permissions Changed
• [Updated] MATCH-S00288 NotPetya Ransomware Activity
• [Updated] MATCH-S00831 Office 365 Unified Audit Logging Disabled
• [Updated] THRESHOLD-S00048 Outbound Traffic to Countries Outside the United States
• [Updated] MATCH-S00546 Potential Reconnaissance Obfuscation
• [Updated] LEGACY-S00080 SSH Interesting Hostname Login
• [Updated] LEGACY-S00170 The Audit Log was Cleared - 1102
• [Updated] MATCH-S01024 Threat Intel - Destination IP Address (High Confidence)
• [Updated] MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence)
• [Updated] MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence)
• [Updated] MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence)
• [Updated] MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence)
• [Updated] MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence)
• [Updated] MATCH-S00531 Unload Sysmon Filter Driver
• [Updated] MATCH-S00892 Value Added to Azure NSG Group
• [Updated] MATCH-S00521 Windows - Critical Service Disabled via Command Line
• [Updated] MATCH-S00549 Windows Disable Antispyware Registry
• [Updated] MATCH-S00538 Windows Firewall Rule Added
• [Updated] MATCH-S00537 Windows Firewall Rule Deleted
• [Updated] MATCH-S00536 Windows Firewall Rule Modified
• [Updated] MATCH-S00533 Windows Security Account Manager Stopped

Log Mappers​

• [Deleted] Fortinet DNS Query
• [Deleted] Fortinet Traffic2
• [Deleted] Fortinet dns Logs
• [New] Citrix Cloud Session Logs
• [Updated] Fortinet Anomaly Logs
• [Updated] Fortinet Appctrl1
• [Updated] Fortinet Appctrl2
• [Updated] Fortinet Authentication
• [Updated] Fortinet DLP Logs
• [Updated] Fortinet DNS
• [Updated] Fortinet Endpoint
• [Updated] Fortinet Event Logs
• [Updated] Fortinet FortiGate-200D Auth CEF
• [Updated] Fortinet FortiGate-200D Endpoint CEF
• [Updated] Fortinet FortiGate-200D Flow CEF
• [Updated] Fortinet Traffic
• [Updated] Fortinet UTM IDS1
• [Updated] Fortinet VPN
• [Updated] Fortinet Virus
• [Updated] Fortinet ha Logs
• [Updated] Fortinet perf-stats pba-close Systems Logs
• [Updated] Fortinet security-rating Logs
• [Updated] Fortinet ssl Logs
• [Updated] Fortinet voip Logs
• [Updated] Fortinet wad Logs
• [Updated] Fortinet waf Logs
• [Updated] Fortinet wireless Logs
• [Updated] Linux-Sysmon/Operational - 1
• [Updated] Linux-Sysmon/Operational - 10
• [Updated] Linux-Sysmon/Operational - 15
• [Updated] Linux-Sysmon/Operational - 16
• [Updated] Linux-Sysmon/Operational - 17
• [Updated] Linux-Sysmon/Operational - 18
• [Updated] Linux-Sysmon/Operational - 2
• [Updated] Linux-Sysmon/Operational - 23
• [Updated] Linux-Sysmon/Operational - 3
• [Updated] Linux-Sysmon/Operational - 4
• [Updated] Linux-Sysmon/Operational - 5
• [Updated] Linux-Sysmon/Operational - 6
• [Updated] Linux-Sysmon/Operational - 7
• [Updated] Linux-Sysmon/Operational - 8
• [Updated] Linux-Sysmon/Operational - 9
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 1
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 10
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 12, 13, and 14
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 15
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 16
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 17
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 18
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 19|20
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 2
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 21
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 22
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 23
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 24
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 25
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 26
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 27
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 28
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 3
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 4
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 5
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 6
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 7
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 8
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 9
• [Updated] Windows - Microsoft-Windows-Sysmon/Operational-29

Parsers​

• [Updated] /Parsers/System/Citrix/Citrix Cloud C2C

Schema​

Updated MITRE ATT&CK Tactics & Techniques to v19

This content release includes:

• New AWS Bedrock audit logging to track knowledge base deletion events.
• Enhanced field mappings and parsing for Netskope security events, improving username extraction, threat categorization, and anomaly detection across 14 log mappers.
• Updated Microsoft Exchange Message Trace mapper and parser to support Graph API log format with improved email tracking and user identification.
• Expanded AWS CloudWatch and IAM logging with improved identity field mapping, timestamp parsing, and resource tracking.
• Parser enhancements for Imperva Incapsula (cslabel field support) and Infoblox (new log format support).
• New schema fields for grandparent process tracking to improve visibility into process execution chains.

Additional changes are enumerated below.

Log Mappers​

• [New] CloudTrail - bedrock.amazonaws.com - DeleteKnowledgeBase
• [Updated] AWS CloudWatch Custom
• [Updated] CloudTrail - iam.amazonaws.com - Policy Change
• [Updated] Microsoft O365 Exchange Message Trace C2C
• [Updated] Netskope - Alerts
• [Updated] Netskope - Anomaly - Bulk Download
• [Updated] Netskope - Anomaly - User Shared Credentials
• [Updated] Netskope - Application Events
• [Updated] Netskope - Audit Authentication Events - Logoff
• [Updated] Netskope - Audit Authentication Events - Logon
• [Updated] Netskope - Audit Events
• [Updated] Netskope - Catch All
• [Updated] Netskope - DLP Alerts
• [Updated] Netskope - Incidents
• [Updated] Netskope - Network Events
• [Updated] Netskope - Page Events
• [Updated] Netskope - nspolicy

Parsers​

• [Updated] /Parsers/System/AWS/AWS CloudWatch
• [Updated] /Parsers/System/Imperva/Imperva Incapsula
• [Updated] /Parsers/System/Infoblox/Infoblox
• [Updated] /Parsers/System/Netskope/Netskope Security Cloud JSON
• [Updated] /Parsers/System/Microsoft/O365 Exchange Message Trace C2C

Schema​

• [New] grandparentBaseImage
• [New] grandparentCommandLine
• [New] grandparentPid