Skip to content Skip to main navigation Skip to footer

Tag: visualizer

v9.6.6.a Release Notes for Cyfin

Enhancements

  • Reports
    • Templates
      • Updated libraries used by Report Template to eliminate potential vulnerabilities. 
    • Dashboard
      • Visualizer
        • Updated libraries used by visualizer to eliminate potential vulnerabilities.

Corrections

  • Reports
    • Templates
      • Corrected issue with running reports on nested groups where users from a subgroup would not be included in report.
    • Dashboard
      • Visualizer
        • Corrected issue with editing a panel where the bar chart previews would not render.

Understanding Behavior Analytics: Hits, Visits, and Sessions

In Behavior analytics, “Hits,” “Visits,” and “Sessions” are fundamental metrics that build on each other. Here’s an explanation that reflects their interrelated nature:

Hits

  • Definition: A ‘Hit’ refers to any record stored for a unique user interaction with a website.
  • Details: This includes every element (like images, JavaScript files, Cascading Style Sheets (CSS), embedded objects) loaded or interacted with on a webpage. Each element counts as a separate ‘Hit’. Notably, these elements might not always be loaded from the website’s primary domain; often, they are served from another domain, such as a Content Delivery Network (CDN), which is common for media files and scripts.
  • Example: Loading a single web page that includes five images and two JavaScript files from a CDN, along with one CSS file from the primary domain, would result in eight hits.

Visits

  • Definition: A ‘Visit’ represents each individual interaction a user has while on a website or online application.
  • Details: This is measured by user actions that lead to new page loads or significant interactions within the same page. Each distinct action, like a click leading to a new page or a notable change on the current page, is counted as a separate visit.
  • Example: A user clicks on a link to open a new page, and then another link to visit a different section, with each action counted as an individual visit.

Sessions

  • Definition: A ‘Session’ encompasses a series of visits by a user within a specific timeframe.
  • Details: It begins when a user first accesses a website or application and ends after a period of inactivity or user logout. A session includes all visits (and therefore, all hits) made during that period.
  • Example: A user visits a website, browsing through different pages (each page view is a visit), and then logs into an online application. All the activities, including website browsing and interactions within the online application until the user logs out or becomes inactive, constitute a single session.

v9.6.4.b Release Notes for Cyfin

Enhancements

  • Visualizer
    • Added support for Microsoft defender reporting.

Corrections

    • Data Management
      • Syslog
        • Corrected issue that could cause direct syslog imports to stop working upon a service restart. The file writer continued to work, just the metric server stop receiving the data directly. This was caused by the syslog server attempting to start before the importer had been initialized.
    • Visualizer
      • Corrected aggregation on nested fields

Defender Data Source Field Definitions

An incident in Microsoft 365 Defender is a collection of correlated alerts and associated data that make up the story of an attack.

Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant.

Because piecing the individual alerts together to gain insight into an attack can be challenging and time-consuming, Microsoft 365 Defender automatically aggregates the alerts and their associated information into an incident.

Field NameDefinition
incidentIdUnique identifier to represent the incident
redirectIncidentIdOnly populated in case an incident is being grouped together with another incident, as part of the incident processing logic.
incidentNameString value available for every incident.
createdTimeTime when incident was first created.
lastUpdateTimeTime when the incident was last updated on the backend.This field can be used when you’re setting the request parameter for the range of time that incidents are retrieved.
assignedToOwner of the incident, or null if no owner is assigned.
classificationThe specification for the incident. The property values are: Unknown, FalsePositive, TruePositive
determinationSpecifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other
detectionSourceSpecifies source of detection.
statusCategorize incidents (as Active, or Resolved). It can help you organize and manage your response to incidents.
severityIndicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention.One of the following values: Informational, Low, *Medium, and High.
tagsArray of custom tags associated with an incident, for example to flag a group of incidents with a common characteristic.
commentsArray of comments created by secops when managing the incident, for example additional information about the classification selection.
alertsArray containing all of the alerts related to the incident, plus other information, such as severity, entities that were involved in the alert, and the source of the alerts.
alertIdUnique identifier to represent the alert
incidentIdUnique identifier to represent the incident this alert is associated with
serviceSourceService that the alert originates from, such as Microsoft Defender for Endpoint, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, or Microsoft Defender for Office 365.
creationTimeTime when alert was first created.
lastUpdatedTimeTime when alert was last updated at the backend.
resolvedTimeTime when alert was resolved.
firstActivityTime when alert first reported that activity was updated at the backend.
titleBrief identifying string value available for each alert.
descriptionString value describing each alert.
categoryVisual and numeric view of how far the attack has progressed along the kill chain. Aligned to the MITRE ATT&CK™ framework.
statusCategorize alerts (as New, Active, or Resolved). It can help you organize and manage your response to alerts.
severityIndicates the possible impact on assets. The higher the severity the bigger the impact. Typically higher severity items require the most immediate attention.
One of the following values: Informational, Low, Medium, and High.
investigationIdThe automated investigation ID triggered by this alert.
investigationStateInformation on the investigation’s current status. One of the following values: Unknown, Terminated, SuccessfullyRemediated, Benign, Failed, PartiallyRemediated, Running, PendingApproval, PendingResource, PartiallyInvestigated, TerminatedByUser, TerminatedBySystem, Queued, InnerFailure, PreexistingAlert, UnsupportedOs, UnsupportedAlertType, SuppressedAlert.
classificationThe specification for the incident. The property values are: Unknown, FalsePositive, TruePositive, or null
determinationSpecifies the determination of the incident. The property values are: NotAvailable, Apt, Malware, SecurityPersonnel, SecurityTesting, UnwantedSoftware, Other or null
assignedToOwner of the incident, or null if no owner is assigned.
actorNameThe activity group, if any, the associated with this alert.
threatFamilyNameThreat family associated with this alert.
mitreTechniquesThe attack techniques, as aligned with the MITRE ATT&CK™ framework.
devicesAll devices where alerts related to the incident were sent.
DeviceIdThe device ID as designated in Microsoft Defender for Endpoint.
aadDeviceIdThe device ID as designated in Azure Active Directory. Only available for domain-joined devices.
deviceDnsNameThe fully qualified domain name for the device.
osPlatformThe OS platform the device is running.
osBuildThe build version for the OS the device is running.
rbacGroupNameThe role-based access control (RBAC) group associated with the device.
firstSeenTime when device was first seen.
healthStatusThe health state of the device.
riskScoreThe risk score for the device.
entitiesAll entities that have been identified to be part of, or related to, a given alert.
entityTypeEntities that have been identified to be part of, or related to, a given alert.
The properties values are: User, Ip, Url, File, Process, MailBox, MailMessage, MailCluster, Registry
sha1Available if entityType is File.
The file hash for alerts associated with a file or process.
sha256Available if entityType is File.
The file hash for alerts associated with a file or process.
fileNameAvailable if entityType is File.
The file name for alerts associated with a file or process
filePathAvailable if entityType is File.
The file path for alerts associated with a file or process
processIdAvailable if entityType is Process.
processCommandLineAvailable if entityType is Process.
processCreationTimeAvailable if entityType is Process.
parentProcessIdAvailable if entityType is Process.
parentProcessCreationTimeAvailable if entityType is Process.
ipAddressAvailable if entityType is Ip.
IP address for alerts associated with network events, such as Communication to a malicious network destination.
urlAvailable if entityType is Url.
Url for alerts associated to network events, such as, Communication to a malicious network destination.
accountNameAvailable if entityType is User.
domainNameAvailable if entityType is User.
userSidAvailable if entityType is User.
aadUserIdAvailable if entityType is User.
userPrincipalNameAvailable if entityType is User/MailBox/MailMessage.
mailboxDisplayNameAvailable if entityType is MailBox.
mailboxAddressAvailable if entityType is User/MailBox/MailMessage.
clusterByAvailable if entityType is MailCluster.
senderAvailable if entityType is User/MailBox/MailMessage.
recipientAvailable if entityType is MailMessage.
subjectAvailable if entityType is MailMessage.
deliveryActionAvailable if entityType is MailMessage.
securityGroupIdAvailable if entityType is SecurityGroup.
securityGroupNameAvailable if entityType is SecurityGroup.
registryHiveAvailable if entityType is Registry.
registryKeyAvailable if entityType is Registry.
registryValueTypeAvailable if entityType is Registry.
registryValueAvailable if entityType is Registry.
deviceIdThe ID, if any, of the device related to the entity.

v9.6.4 Release Notes for Cyfin

Enhancements

  • Reporting
    • Firewall Reporting
      • Palo Alto Firewall reporting now available in addition to Web data. Both types of data can be seamlessly imported and reported on in the Visualizer which has been updated to include pre-configured Firewall dashboards. * Firewall Reporting requires an upgraded license, but evaluation periods are available.
  • Data Management
    • Log Data Setup
      • Updated the location of the wizard buttons for clarity and optimized flow.
    • Log Date Types
      • Updated Sonicwall VPN to include ability to parse NetExtender VPN data.

Palo Alto Data Source Field Definitions

Field NameDefinition
actionAction taken for the session; values are alert, allow, deny, drop, drop-all-packets, reset-client, reset-server, reset-both, block-url.
action_sourceSpecifies whether the action taken to allow or block an application was defined in the application or in policy. The actions can be allow, deny, drop, reset- server, reset-client or reset-both for the session.
applicationApplication associated with the session.
application_categoryThe application category specified in the application configuration properties.
application_riskRisk level associated with the application (1=lowest to 5=highest).
application_saasDisplays yes if a SaaS application or no if not a SaaS application.
application_subcategoryThe application subcategory specified in the application configuration properties.
application_technologyThe application technology specified in the application configuration properties.
bytesNumber of total bytes (transmit and receive) for the session.
categoryDescribes the content of a Web page that was visited.
contenttypeRefers to an HTTP header field that specifies the type of data contained in the body of an HTTP request or response. Values could be any of the following: jpeg, mpeg, pdf, html, css, etc.
datetimeDate time stamp associated with each recrod hit
dest_countryDestination country or Internal region for private addresses.
dest_ipOriginal session destination IP address.
dest_zoneZone the session was destined to.
deviceLogType
directionIndicates the direction of the attack, client-to-server or server-to-client
groupOrganizational groups are structured in a hierarchical manner, forming a tree-like structure.
hitNumber of records (represents a record count)
http2_connectionIdentifies if traffic used an HTTP/2 Connection or not
identity
ipOriginal session source IP address.
ip_protocolIP protocol associated with the session.
portDestination port utilized by the session.
recordName
referrer
results
ruleName of the rule that the session matched.
severity
source
source_zoneZone the session was sourced from.
threat_categoryDescribes threat categories used to classify different types of threat signatures.
Threat_contenttypeSubtype of the threat and traffic log
threat_idPalo Alto Networks identifier for known and custom threats.
typeSpecifies the type of log;
url
userField refers to the information recorded about the user associated with a specific network connection or traffic event.
useragentHTTP header field sent by a web browser or other client software when making a request to a web server. It identifies the client’s software, version, and other relevant information to help the server understand the capabilities and requirements of the client.

v9.6.3 Release Notes for Cyfin

Enhancements

  • Data Managements
    • Log Data Setup
      • Added Microsoft Defender as a configuration option. This feature only available for Cyfin in VM environment.
  • Reporting
    • Dashboard
      • Visualizer
        • Added Dashboard level filters. This allows a filter to be applied to all panels with matching data source on the configured dashboard.
  • Usage statistics
    • Added periodic anonymous usage statistics gathering to improve customer experience.

Corrections

  • Data Management
    • Import
      • Disabled auto importing of syslog enabled log configurations because stream is already automatically imported.

v9.6.2 Release Notes for CyBlock Appliance

Enhancements

  • Enhancements
    • System
      •  Added ability to import Groups and IDs through Directory Agent.
    • System Status
      • Messages
        • Visualizer
          • Added screen to view Visualizer profiling information.
    • Reporting
      • Dashboard
        • Visualizer
          • Added preconfigured dashboard templates for users to select when creating new dashboards.
          • Updated timeframe selection to always be relative when creating/editing dashboards. Modifying the timeframe in the dashboard view page is only temporary and a button is added to reset back to default timeframe selection. Navigating away also resets the timeframe back to dashboard default.

Corrections

  • Reporting
    • Dashboard
      • Visualizer
        • Corrected visualizer link in product menu when user account does not have a valid email address by redirecting to logon accounts modification screen.

v9.6.2 Release Notes for CyBlock Software & Virtual Appliance Release Notes

Enhancements

  • Enhancements
    • System
      •  Added ability to import Groups and IDs through Directory Agent.
    • System Status
      • Messages
        • Visualizer
          • Added screen to view Visualizer profiling information.
    • Reporting
      • Dashboard
        • Visualizer
          • Added preconfigured dashboard templates for users to select when creating new dashboards.
          • Updated timeframe selection to always be relative when creating/editing dashboards. Modifying the timeframe in the dashboard view page is only temporary and a button is added to reset back to default timeframe selection. Navigating away also resets the timeframe back to dashboard default.

Corrections

  • Reporting
    • Dashboard
      • Visualizer
        • Corrected visualizer link in product menu when user account does not have a valid email address by redirecting to logon accounts modification screen.

v9.6.2 Release Notes for Cyfin

Enhancements

  • System
    •  Added ability to import Groups and IDs through Directory Agent.
  • System Status
    • Messages
      • Visualizer
        • Added screen to view Visualizer profiling information.
  • Reporting
    • Dashboard
      • Visualizer
        • Added preconfigured dashboard templates for users to select when creating new dashboards.
        • Updated timeframe selection to always be relative when creating/editing dashboards. Modifying the timeframe in the dashboard view page is only temporary and a button is added to reset back to default timeframe selection. Navigating away also resets the timeframe back to dashboard default.

Corrections

  • Reporting
    • Dashboard
      • Visualizer
        • Corrected visualizer link in product menu when user account does not have a valid email address by redirecting to logon accounts modification screen.