Falcon LogScale 1.82.2 LTS (2023-06-22)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.82.2LTS2023-06-22

Cloud

On-Prem

2024-04-30No1.44.01.26.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.82.0, 1.82.1, 1.82.0, 1.82.1, 1.82.0, 1.82.1

Security fixes.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • The GraphQL mutation deleteAllRolesAndGroups() has been removed.

      Imported from 1.82.0

    • The GraphQL mutation updateFederationOfView() has been removed.

      Imported from 1.82.0

New features and improvements

  • User Interface

    • Improvements have been made on the Fields Panel, that would flicker when switching between the Results and Events tabs and the query was live. It now displays the fields of the aggregated query when on the Results tab, and the fields of the events query when on the Events tab.

      Imported from 1.82.1

  • GraphQL API

    • The GraphQL mutation updateMaxIngestRequestSize() has been added; Override the globally configured maximum size of ingest requests.

      Imported from 1.82.0

    • The GraphQL mutation removeLoginBridge() has been added.

      Imported from 1.82.0

    • The GraphQL mutation updateRemoteFederatedConnection() has been added; [PREVIEW: Experimental feature, not ready for production.] Update a federated connection to a remote view.

      Imported from 1.82.0

    • The GraphQL mutation updateLocalFederatedConnection() has been added; [PREVIEW: Experimental feature, not ready for production.] Update a federated connection to a local view.

      Imported from 1.82.0

    • The GraphQL mutation setLoginBridge() has been added.

      Imported from 1.82.0

    • The GraphQL mutation updateLogCollectorConfigurationDescription() has been added.

      Imported from 1.82.0

    • The GraphQL mutation removeLoginBridgeAllowedUsers() has been added.

      Imported from 1.82.0

    • The GraphQL mutation addLoginBridgeAllowedUsers() has been added.

      Imported from 1.82.0

    • The GraphQL mutation createRemoteFederatedConnection() has been added; [PREVIEW: Experimental feature, not ready for production.] Create a federated connection to a remote view.

      Imported from 1.82.0

    • The GraphQL mutation updateSearchLinkInteraction() has been added; Update a search link interaction.

      Imported from 1.82.0

    • The GraphQL mutation setMinHostAlivePercentageToEnableClusterRebalancing() has been added; Sets the percentage of all hosts relevant to a particular cluster rebalance operation that need to be alive before we allow the system to automatically execute the operation to the supplied value. Cluster rebalance operations currently include reassigning digest work, and moving existing segments to balance disk usage.

      Imported from 1.82.0

    • The GraphQL mutation assignLogCollectorsToConfiguration() has been added.

      Imported from 1.82.0

    • The GraphQL mutation createSearchLinkInteraction() has been added; Create a search link interaction.

      Imported from 1.82.0

    • The GraphQL query validateAccessTokenV2() has been added; Validate the Access Token.

      Imported from 1.82.0

    • The GraphQL mutation unenrollLogCollectors() has been added.

      Imported from 1.82.0

    • The GraphQL mutation updateLogCollectorConfigurationName() has been added.

      Imported from 1.82.0

    • The GraphQL mutation updateActionSecurityPolicies() has been added; Update the action security policies for the organization.

      Imported from 1.82.0

    • The GraphQL mutation createLocalFederatedConnection() has been added; [PREVIEW: Experimental feature, not ready for production.] Create a federated connection to a local view.

      Imported from 1.82.0

    • The GraphQL mutation deleteFederatedConnection() has been added; [PREVIEW: Experimental feature, not ready for production.] Delete a federated connection from a view.

      Imported from 1.82.0

    • The GraphQL mutation setCid() has been added; Set CID of provisioned organization.

      Imported from 1.82.0

    • The GraphQL query loginBridgeRequest() has been added.

      Imported from 1.82.0

  • Queries

    • Added backend support for organization level query blocking. Actors with the BlockQueries permission are able to block and stop queries running within their organization.

      Imported from 1.82.1

  • Functions

    • The match()query function has been improved in terms of speed when using glob as the mode.

      Imported from 1.82.1

  • Other

    • Added optional global argument to stopAllQueries, stopStreamingQueries, stopHistoricalQueries, blockedQueries, addToBlocklistById, addToBlocklist permissions. Default is false i.e. within own organization only.

      Imported from 1.82.1

    • Worker-level query scheduling has been adjusted to avoid long-term starvation of expensive queries.

      Imported from 1.82.1

Fixed in this release

  • Security

    • Verified that LogScale does not use the affected Akka dependency component in CVE-2023-31442 by default, and have taken additional precautions to notify customers.

      For:

      • LogScale Cloud/Falcon Long Term Repository:

        • This CVE does not impact LogScale Cloud or LTR customers.

      • LogScale Self-Hosted:

        • Exposure to risk:

          • Potential risk is only present if a self hosted customer has modified the Akka parameters to a non default value of akka.io.dns.resolver = async-dns during initial setup.

          • By default LogScale does not use this configuration parameter.

          • CrowdStrike has never recommended custom Akka parameters. We recommend using default values for all parameters.

        • Steps to mitigate:

          • Setting akka.io.dns.resolver to default value (inet-address) will mitigate the potential risk.

        • On versions older than 1.92.0:

          • Unset the custom Akka configuration. Refer to Akka documentation for more information on how to unset or pass a different value to the parameter here.

          • CrowdStrike recommends upgrading LogScale to 1.92.x or higher versions.

  • User Interface

  • API

    • Fixed an issue with API Explorer that could fail to load in some configurations when using cookie authentication.

      Imported from 1.82.1

  • Dashboards and Widgets

    • The dropdown menu for dashboard parameter suggestions is now faster and can handle several thousand entries without blocking the UI.

      Imported from 1.82.1

      For more information, see Work with Dashboard Parameters.

  • Functions

  • Other

    • Fixed a permission issue for LogScale Self-Hosted having a dependency on the ManageOrganizations system permission, which should not apply to that environment — the ManageCluster system permission in itself is now sufficient for Self-Hosted.

      Imported from 1.82.1

    • Fixed an issue that occurred when creating users: when multiple user creation requests were sent at the same time, multiple users were in some cases created with the same name.

      Imported from 1.82.1

    • Fixed an issue that could cause recently merged mini-segments to be excluded from searches after a reboot.

      Imported from 1.82.1

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • crowdstrike/spotlight has been updated to v0.1.1.

      • Fixed error with some dashboard widgets being cut off

      For more information, see Package crowdstrike/spotlight Release Notes.

    • microsoft/microsoft365 has been updated to v1.1.0.

      • Introduces a new "Email IOC detections" dashboard, which allows scanning your emails for matches against any indicators of compromise (IOC) as reported by CrowdStrike.

      • Includes drilldown capabilities, to easily investigate any IOC matches you might find.

      • Bumps the minimum supported version of LogScale from 1.50 to 1.77.

      • Adds a "Sender IP" parameter to the "Email investigation" dashboard, allowing easy filtering on sender IP addresses.

      • Makes a changes to presentation of data in the "Email investigation" dashboard. Most notably, the "Email details" widget is split in two, to better present the data.

      • The "Email overview" dashboard now provides a clearer view of what emails have been blocked, and also includes an overview of IOC detections on delivered emails.

      • The "Email overview" now uses the "FROM" SMTP email address to determine the sender, instead of the "MAIL FROM" address. This brings it in line with the rest of the package.

      • Some widgets have been moved from the "Email overview" dashboard to "Email threat summary".

      Imported from 1.82.1

      For more information, see Package microsoft/microsoft365 Release Notes.

    • netskope/casb has been updated to v0.2.0.

      • Fixed parser to process all events

      • Added test cases to the parser

      • Updated dashboards to consume fields extracted by fixed parser

      For more information, see Package netskope/casb Release Notes.