Package tausight/ephi-risk-posture Release Notes

Package tausight/ephi-risk-posture Release Notes Version 1.1.0
Parser renaming and Deprecation notice

The old parser tausight-json is deprecated, and replaced by the new parser tausight-ephi. While the old parser will remain available during a tranisition period, all future changes will only go into the new tausight-ephi parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old tausight-json parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

Duplicated vendor fields dropped in new parser

The old tausight-json parser would duplicate certain fields, which the new tausight-ephi parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:

  • Vendor.clipboardActivity.destProcessInfo.userName

  • Vendor.clipboardActivity.srcProcessInfo.processId

  • Vendor.clipboardActivity.srcProcessInfo.processName

  • Vendor.clipboardActivity.srcProcessInfo.userName

  • Vendor.deviceAttached.usbDevice.deviceId

  • Vendor.deviceAttached.usbDevice.manufacturer

  • Vendor.fileCopied.destinationFileInfo.fileExtension

  • Vendor.fileCopied.destinationFileInfo.groupName

  • Vendor.fileCopied.destinationFileInfo.ownerName

  • Vendor.fileCopied.destinationFilename

  • Vendor.fileCopied.sourceFileInfo.fileExtension

  • Vendor.fileCopied.sourceFileInfo.groupName

  • Vendor.fileCopied.sourceFileInfo.ownerName

  • Vendor.fileCopied.sourceFilename

  • Vendor.fileDeleted.fileInfo.fileExtension

  • Vendor.fileDeleted.fileInfo.groupName

  • Vendor.fileDeleted.fileInfo.ownerName

  • Vendor.fileDeleted.filename

  • Vendor.fileInspected.fileInfo.fileExtension

  • Vendor.fileInspected.fileInfo.fileSize

  • Vendor.fileInspected.fileInfo.groupName

  • Vendor.fileInspected.fileInfo.ownerName

  • Vendor.fileInspected.filename

  • Vendor.fileIoActivity.fileOpened.fileExtension

  • Vendor.fileIoActivity.fileOpened.filename

  • Vendor.fileIoActivity.fileOpened.processInfo.processId

  • Vendor.fileIoActivity.fileOpened.processInfo.processName

Miscellaneous

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

  • Removes the file.old.path, file.old.path, file.old.extension and file.old.owner fields, as they did not conform to CPS standard.

  • Bug fix: Renames process.id to process.pid to ensure compliance with CPS standard.

Package tausight/ephi-risk-posture Release Notes Version 1.0.0

  • Adds new event.module and Cps.version fields

  • Removes the Product, related.user and related.hash fields

  • Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type