v2.5.0

What's Changed

Definition Files

• Added support for network connection port field in definition files by @pmichaudrc in #116
• Added support for registry field in definition files by @xC0uNt3r7hr34t in #117

EDR

• Updated Cortex XDR query building logic by @rc-csmith in #113

General

• New feature to limit returned results by @TreWilkinsRC in #118

New Contributors

• @TreWilkinsRC made their first contribution in #118

Full Changelog: v2.4.1...v2.5.0

v2.4.1

What's Changed

Definition Files

• No changes

EDR

• No changes

General

• Add Support for Sigma Rules by @rc-csmith in #106

Full Changelog: v2.4.0...v2.4.1

v2.4.0

What's Changed

Definition Files

• Updated remote-admin.json by @rc-benbernstein in #102
• Added cve-2023-34362-iocs.json for MOVEit vulnerability public IOCs by @RCWCates in #108

EDR

• Updated Microsoft Defender for Endpoint Query Building Logic by @rc-csmith in #104

General

• Bug Fix for IOC File Processing Errors by @rc-csmith in #98
• Added Unit Tests by @rc-csmith in #107

New Contributors

• @rc-benbernstein made their first contribution in #102
• @RCWCates made their first contribution in #108

Full Changelog: v2.3.0...v2.4.0

v2.3.0

What's Changed

Definition Files

• No changes

EDR

• Implemented Support for Cortex XDR by @rc-csmith in #89

General

• No changes

Full Changelog: v2.2.0...v2.3.0

v2.2.0

What's Changed

Definition Files

• Existing definition files updated to use new query field by @rc-csmith in #100

EDR

• Added support for regex and full query options within definition files. Expanded parameter mappings and output fields for SentinelOne by @xC0uNt3r7hr34t in #87
• Added Support for "Query" Field in Definition Files for VMware Carbon Black Response, VMware Carbon Black Cloud and Microsoft Defender for Endpoint by @rc-csmith in #93
• Implemented PowerQuery support for SentinelOne by @jholtmann in #94

General

• No changes

Full Changelog: v2.1.0...v2.2.0

v2.1.0

What's Changed

Definition Files

• Updated active-directory.json by @rcZachDiehl in #64
• Updated remote-admin.json by @rc-zfink in #63
• Updated system-utils.json by @alafrenz42 in #66
• Created wdac-app-block.json by @rc-csmith in #70

EDR

• Made siteID optional for SentinelOne by @rc-csmith in #72
• Fixed query options and added support for process name for SentinelOne by @xC0uNt3r7hr34t in #74
• Added base_query filters to merged queries for all command line argument scenarios for SentinelOne by @xC0uNt3r7hr34t in #78
• Allowed siteID and/or accountID in commandLine for SentinelOne by @rc-csmith in #79
• Implemented VMware Carbon Black Cloud SDK by @rc-csmith in #69
• Added enhancements to VMware Carbon Black Response & VMware Carbon Black Cloud by @rc-csmith in #84

General

• Patched cbapi import issue in Python 3.10+ by @jholtmann in #68
• Upgraded cbapi to support Python 3.10+ by @jholtmann in #91

New Contributors

• @rcZachDiehl made their first contribution in #64
• @rc-zfink made their first contribution in #63
• @rc-csmith made their first contribution in #72
• @xC0uNt3r7hr34t made their first contribution in #74
• @alafrenz42 made their first contribution in #66

Full Changelog: v2.0...v2.1.0

v2.0 - SentinelOne Support

Merge pull request #54 from redcanaryco/dev-v2

Update documentation and click version string for v2.0

v1.0

Merge pull request #51 from amashinchi-rc/update-readme-per-wiki

Update readme per wiki