v3.66.0

What's Changed

🕵️ New Detections

• new rule: GCP.User.Added.To.Privileged.Group by @ben-githubs in #1378

🐛 Bug Fixes and Tunes

• Remove deprecated rules by @ben-githubs in #1369
• Configure lint-mitre to ignore schema test files by @ben-githubs in #1381
• Delete 'Snowflake.PublicRoleGrant' & query by @ben-githubs in #1386

🏡 Miscellaneous

• Format Sublime YAML files by @le4ker in #1373
• build(deps): bump docker/setup-buildx-action from 3.6.1 to 3.7.0 by @dependabot in #1375
• build(deps): bump docker/setup-buildx-action from 3.7.0 to 3.7.1 by @dependabot in #1377
• THREAT-397 Reformat deep_get(event to event.deep_get( by @akozlovets098 in #1374
• build(deps): bump actions/checkout from 4.1.7 to 4.2.1 by @dependabot in #1379
• Fix linter error in gsuite_workspace_calendar_external_sharing.py by @le4ker in #1383
• build(deps): bump thollander/actions-comment-pull-request from 2.5.0 to 3.0.0 by @dependabot in #1385
• Add AlertTitle to rule_jsonschema.json by @geoffg-sentry in #1384

Full Changelog: v3.65.0...v3.66.0

v3.65.0

What's Changed

🕵️ New Detections

• THREAT-387 Sublime Security Rules by @akozlovets098 in #1356
• Slack.AuditLogs.ApplicationDoS -> threshold rule by @akozlovets098 in #1349

🔍️️ New Queries

• Issue 1367: Reformat YAML to Always Use Literal Block for Query Text by @ben-githubs in #1370

🌯 New Packs and Pack Expansion

• Add Unpacked Items to Packs by @ben-githubs in #1361

🐛 Bug Fixes and Tunes

• Fix issue 466: Add mock to rule test by @arielkr256 in #1364
• Fix issue 439: AccountId case by @arielkr256 in #1365
• Fix issue 468: Zendesk severity override by @arielkr256 in #1363
• fix - IAM User takeover Correlation Rule correlating on IP instead of user by @akozlovets098 in #1362
• Filter out Intelsat satellite network plane wifi from Impossible Travel by @geoffg-sentry in #1358

🏡 Miscellaneous

• Add Format Checker for MITRE ATT&CK Matrix Report Mappings by @ben-githubs in #1360
• test with api by @arielkr256 in #1355
• build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in #1368
• Merge changes from main to release by @le4ker in #1372

Full Changelog: v3.64.0...v3.65.0

v3.64.0

What's Changed

🕵️ New Detections

• Wiz audit rules by @akozlovets098 in #1323

🔍️️ New Queries

• Remove Multi-Table Queries from Packs by @ben-githubs in #1353

🗓️️ Scheduled Rules

• THREAT-354 Converting caching rules to correlation by @akozlovets098 in #1348
• more correlation rules from AWS re:inforce by @arielkr256 in #1289

🏡 Miscellaneous

• Prepare for v3.62.0 by @arielkr256 in #1338
• Prepare for 3.63.0 by @akozlovets098 in #1350
• build(deps): bump step-security/harden-runner from 2.9.1 to 2.10.1 by @dependabot in #1352
• Refreshing Contributing Guidelines by @arielkr256 in #1344
• validate and upload on PRs by @arielkr256 in #1351
• Validate on PR approval by @arielkr256 in #1354

Full Changelog: v3.63.0...v3.64.0

v3.63.0

What's Changed

🐛 Bug Fixes and Tunes

• AWS SAML Activity Tuning by @arielkr256 in #1341
• Tuning Snyk Rules by @arielkr256 in #1340
• Update Pack Manifests with Data Models and Globals by @ben-githubs in #1342
• added get_actor_user method to data model by @biancafu-panther in #1343
• Add Missing Pack Items by @ben-githubs in #1345

🏡 Miscellaneous

• build(deps): bump actions/setup-python from 5.1.1 to 5.2.0 by @dependabot in #1339

New Contributors

• @biancafu-panther made their first contribution in #1343

Full Changelog: v3.62.0...v3.63.0

v3.62.0

What's Changed

🏡 Miscellaneous

• Prepare for v3.61.0 by @arielkr256 in #1321
• Remove deprecated IOC helpers by @arielkr256 in #1325
• Info Alerts are Signals, Nonrouted by @arielkr256 in #1328
• New Rules: CS EventStream Audit Events by @ben-githubs in #1307
• Okta rate limit tuning by @arielkr256 in #1329
• traffic mirroring tuning by @arielkr256 in #1330
• GCP K8S tuning by @arielkr256 in #1331
• Missing MITRE ATT&CK tactics by @arielkr256 in #1322
• tuning Wiz Alert Passthrough rule by @arielkr256 in #1326
• Improve GitHub Webhook Modified rule by @geoffg-sentry in #1324
• Add Dynamic Severity to AWS.CloudTrail.SnapshotMadePublic by @ben-githubs in #1333
• Fix Unit Tests Failing in Pypanther by @ben-githubs in #1335
• Convert to Signals by @arielkr256 in #1336
• THREAT 371: Slack Anomaly Detection Tuning by @ben-githubs in #1334
• PAT update v0.52.1 by @arielkr256 in #1337

Full Changelog: v3.61.0...v3.62.0

v3.61.0

What's Changed

🏡 Miscellaneous

• Releasing performance improvements by @nhakmiller in #1305
• Update rule_jsonschema.json by @chrisarav in #1306
• build(deps): bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @dependabot in #1309
• UDM safe lookups by @nhakmiller in #1311
• Minor typo fix in displayname, potentiall -> potentially by @kjihso in #1312
• Add Github Dependabot Alert Dismissed Rule by @elimgh in #1310
• added default values to get/deep_get by @arielkr256 in #1313
• AWS Compromised Service Role - CR -> Scheduled Rule by @arielkr256 in #1315
• GitHub Advanced Security Change WITHOUT Repo Archived - Sequence to Group CR by @arielkr256 in #1314
• build(deps): bump step-security/harden-runner from 2.9.0 to 2.9.1 by @dependabot in #1317
• Update again gcp_k8s_cron_job_created_or_modified.yml by @chrisarav in #1318
• Prepare for 3.60.0 by @akozlovets098 in #1319
• CR upload fixes by @arielkr256 in #1320

New Contributors

• @chrisarav made their first contribution in #1306
• @elimgh made their first contribution in #1310

Full Changelog: v3.59.0...v3.60.0
Full Changelog: v3.60.0...v3.61.0

v3.59.0

What's Changed

🏡 Miscellaneous

• Prepare for 3.58 by @ben-githubs in #1299
• Add entity JSON object to Slack Privilege Escalation tests by @bmbeverst in #1300
• Update rates by @nhakmiller in #1301
• Bump rate minutes more by @nhakmiller in #1302

Full Changelog: v3.58.0...v3.59.0

v3.58.0

What's Changed

🏡 Miscellaneous

• 3.57.0 Release by @le4ker in #1291
• Update safe lookup by @nhakmiller in #1292
• Update default timeouts by @nhakmiller in #1294
• build(deps): bump step-security/harden-runner from 2.8.1 to 2.9.0 by @dependabot in #1293
• build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @dependabot in #1297
• build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 by @dependabot in #1298
• Fix methodName lookups for Cloud Run rules, add tests by @geoffg-sentry in #1296
• Correct the target and actor in Slack Audit log UserPrivilegeEscalation plus clean up by @bmbeverst in #1288
• bugfix for base64 encoded arguments by @arielkr256 in #1295

New Contributors

• @bmbeverst made their first contribution in #1288

Full Changelog: v3.57.0...v3.58.0

v3.57.0

What's Changed

🏡 Miscellaneous

• Remove explorer/powershell relationship by @geoffg-sentry in #1278
• build(deps): bump docker/setup-qemu-action from 3.0.0 to 3.1.0 by @dependabot in #1281
• build(deps): bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in #1282
• Aws gd ref links by @JPhenglavong in #1283
• Add initial Correlation Rules by @egibs in #1260
• Snowflake Data Exfiltration CR by @arielkr256 in #1257
• lower severity for sensor update requests by @arielkr256 in #1285
• correlation rules from AWS re:inforce by @arielkr256 in #1279
• build(deps): bump actions/setup-python from 5.1.0 to 5.1.1 by @dependabot in #1284
• Formatting: Converting Tabs to Spaces in YAML Files by @ben-githubs in #1290
• CrowdStrike event stream api rules by @JPhenglavong in #1286
• Push Security correlation rules by @arielkr256 in #1280

New Contributors

• @geoffg-sentry made their first contribution in #1278

Full Changelog: v3.56.0...v3.57.0

v3.56.0

What's Changed

🏡 Miscellaneous

• Update PAT to 0.51.0 by @egibs in #1272
• latest traildiscover updates by @arielkr256 in #1273
• Threat-315 Wiz Alert Passthrough by @akozlovets098 in #1251

Full Changelog: v3.55.0...v3.56.0