Falcon LogScale 1.82.0 LTS (2023-04-12)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.82.0LTS2023-04-12

Cloud

On-Prem

2024-04-30No1.44.01.26.0No

Download: https://repo.humio.com/repository/maven-releases/com/humio/server/1.82.0/server-1.82.0.tar.gz

Hide file hashes

Show file hashes

Bug fixes and updates.

New features and improvements

  • User Interface

    • Improvements have been made on the Fields Panel, that would flicker when switching between the Results and Events tabs and the query was live. It now displays the fields of the aggregated query when on the Results tab, and the fields of the events query when on the Events tab.

  • Queries

    • Added backend support for organization level query blocking. Actors with the BlockQueries permission are able to block and stop queries running within their organization.

  • Functions

    • The match()query function has been improved in terms of speed when using glob as the mode.

  • Other

    • Added optional global argument to stopAllQueries, stopStreamingQueries, stopHistoricalQueries, blockedQueries, addToBlocklistById, addToBlocklist permissions. Default is false i.e. within own organization only.

    • Worker-level query scheduling has been adjusted to avoid long-term starvation of expensive queries.

Fixed in this release

  • API

    • Fixed an issue with API Explorer that could fail to load in some configurations when using cookie authentication.

  • Dashboards and Widgets

    • The dropdown menu for dashboard parameter suggestions is now faster and can handle several thousand entries without blocking the UI.

      For more information, see Work with Dashboard Parameters.

  • Functions

  • Other

    • Fixed a permission issue for LogScale Self-Hosted having a dependency on the ManageOrganizations system permission, which should not apply to that environment — the ManageCluster system permission in itself is now sufficient for Self-Hosted.

    • Fixed an issue that occurred when creating users: when multiple user creation requests were sent at the same time, multiple users were in some cases created with the same name.

    • Fixed an issue that could cause recently merged mini-segments to be excluded from searches after a reboot.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • microsoft/microsoft365 has been updated to v1.1.0.

      • Introduces a new "Email IOC detections" dashboard, which allows scanning your emails for matches against any indicators of compromise (IOC) as reported by CrowdStrike.

      • Includes drilldown capabilities, to easily investigate any IOC matches you might find.

      • Bumps the minimum supported version of LogScale from 1.50 to 1.77.

      • Adds a "Sender IP" parameter to the "Email investigation" dashboard, allowing easy filtering on sender IP addresses.

      • Makes a changes to presentation of data in the "Email investigation" dashboard. Most notably, the "Email details" widget is split in two, to better present the data.

      • The "Email overview" dashboard now provides a clearer view of what emails have been blocked, and also includes an overview of IOC detections on delivered emails.

      • The "Email overview" now uses the "FROM" SMTP email address to determine the sender, instead of the "MAIL FROM" address. This brings it in line with the rest of the package.

      • Some widgets have been moved from the "Email overview" dashboard to "Email threat summary".

      For more information, see Package microsoft/microsoft365 Release Notes.