Initially released on 2nd February 2022
¶ Major Features
This release brings a completely revamped and improved visualisation (especially useful for investigating large clusters), as well as added functionality for our MSSP customers to manage multiple organisations.
¶ New Visualisation
Following feedback on the difficulty of reading large fans of entities in busy clusters, we have re-thought the visualisation with a simple solution of flipping it through 90 degrees.
Internal entities are now displayed in a column on the left of the visualisation, timeline in the middle, and external entities on the right. This allows us to present the alert volumes related to each entity, and better identify where correlation is focused for the cluster. We also now specify the Hour/Day/Week/Month in the timeline rather than only by number.
See new visualisation for an overview of the major changes, as well as video above.
¶ MSSP Organisation Switching
For our Managed Security Service Providers, managing multiple organisations has previously meant separate logins for each. It is now possible to associate your account with multiple organisations to allow you to more quickly switch between your customers whilst keeping data in a separate instance. This is quick and easy using a drop down menu on the side bar, each being identified by a uniquely generated jdenticon.
Read more about switching organisations
¶ Minor Improvements
- Further improvements to rate limiting and batching, better handling of spikes of alerts in a short period
- Further preparations for triggering SOC.OS Alerting (coming soon)
- Security and performance updates
¶ Bug Fixes
- Fixed Cluster searches no longer appear/default load for alert based searches
- Fixed Issue where long lists would stretch beyond the scroll limit of Overview/Context panel
- Fixed Changes in numbered hour/day/week/month fixed by introduction of specific time stamp on timeline
- Fixed Cluster list workbench no longer requires refresh when attempting to load missing or empty search
- Fixed Tags with special characters (eg slashes) are correctly parsed in search chips
- Fixed "View all in Data Table" consistently added to sections of Overview panel
- Fixed Cluster Data Table view more reliably loads multiple (10+) attributesMore UI bugs and inconsistencies fixed
¶ Source System Integrations
¶ New integrations of source systems
- Microsoft Defender for Endpoint (additional to Graph API, please contact us to enable this on top of your existing Graph integrations)
- Orca Security
- NinjaRMM (including BitDefender and Webroot)
- Webroot
- Sophos Enterprise Console
¶ Improved existing integrations
- More detailed mapping of Sophos alerts
- Additional alert formats handled for ManageEngineAD
- Improved entity resolution and correlation criteria for SentinelOne
- Improved entity resolution for MS Graph
- Improved entity resolution for AWS
¶ SOC.OS Wiki and help pages
- New cluster visualisation guide, and visualisation changes overview
- Updates to pages to reflect visualisation changes
- MSSP organisation switching tutorial
- Activity timeline tutorial
- Team management and MFA tutorial
- New and updated integration instruction pages for a number of tools
- Guidance on configuring TLS for SOC.OS Agent
- Clarification on Supressing Correlation with Custom Enrichments (Tagging)
- Updates to SOC.OS glossary
- Updated dashboard overview