Fixes

• #90 v1.8.0 beta5 bug
• #91 Correlate and enrich Microsoft-Windows-Kernel-File ETW logs

Fixed #85: Add API endpoint to manage IOCs spread on endpoints for de…

• #78: request feature - list closed report on a defined time period
• #77: Missing query criticality parameter on get /endpoint call
• #65: Archive reports
• #66: Implement /endpoint/{UUID}/report/archive
• #63: Make manager's data persistent

- new way to store events
- new way to search for events

Fixed issues:
- #68 showkey parameter in /endpoints
- #64 Change /alerts to /detections
- #60 Add score /endpoints
- #58 Date last alert in /endpoints
- #57 Add group member to manager API endpoint structure
- #56 Skip parameter in /logs /alerts
- #55 Limit parameter in /logs /alerts
- #54 Filter parameter in /rules API endpoint

• New Administrative HTTP API with following features:
  • Manage endpoints (list, create, delete)
  • Get basic statistics about the manager
  • Execute commands on endpoints and get results
    • Can drop files prior to execution, to execute binaries/scripts not present on endpoint. Dropped files are deleted after command was ran.
    • Can retrieve files (post command execution), to retrieve results of the command
  • Collect files from endpoints for forensic purposes
  • Contain / Uncontain endpoints by restricting any network traffic except communication to the manager.
  • Query endpoints logs
  • Query endpoints alerts
  • Pivot on a timestamp and retrieve logs/alerts around that time pivot
  • Access endpoint report
    • Scoring (relative to each environment) allowing to sort endpoints and spot the ones behaving differently from the others.
    • Alerts / TTPs observed on a given time frame
  • Manage rules (list, create, update, save, delete)
• Integration with Sysmon v12 and v13
  • Integrate ClipboardData events
    • Put the content of the clipboard data inside the event to allow creating rule on the content of the clipboard
  • Integrate ProcessTampering events
    • Enrich event with a diffing score between .text section on disk and in memory
• Implemented certificate pinning on client to enhance security of the communiaction channel between endpoints and management server
• Log filtering capabilities, allowing one to collect contextual events. Log filtering is achieved by creating Gene filtering rules (c.f. Gene Documentation).
• Configuration files in TOML format for better readability
• Better protection of the installation directory

WHIDS version 1.6.2

Compare

Choose a tag to compare

WHIDS version 1.6.1

Compare

Choose a tag to compare

WHIDS version 1.6.0

Compare

Choose a tag to compare