Changelog

New

• Learned inactivity thresholds: Rilevera now learns how often each log source usually sends logs, and marks a source inactive only when it stays silent longer than that. When you open an inactive source from Logs, its banner tells you how often it usually reports.
• Learning period: A new log source is in a learning period for its first 14 days, or until Rilevera learns its reporting pattern. During that time it shows a Learning status and isn’t flagged for issues. On Logs, hover the brain icon to see which sources are still learning.

Improved

• Inactive log sources in Slack: The weekly Rilevera Rollup Summary Slack message now counts log sources that have stopped sending logs based on each source’s learned pattern, instead of a fixed number of days.

Fixed

• Horizontal scrollbar on MITRE technique list: Horizontal scrollbar on Mitre Alignment page now appears without scrolling to the bottom of the page.
• Rule ID column styling: Fixed overlap styling issues on the rule ID column in the rules grid.
• Rules table field ordering: Corrected the column field order in the rules table based on the view, so important fields show up first.
• Broken Log Entity Names: Rilevera now rejects more broken log entity names, created by incomplete and broken logs from providers.

New

• Splunk rule management: Changes you make to a Splunk rule in Rilevera now sync to Splunk. When you Accept a review of the rule, or click Enable Rule or Disable Rule, Rilevera updates the rule in Splunk.

Fixed

• Accepting a review of a Sumo Logic rule with a schedule no longer fails because of the schedule’s time range.
• Text filters on table columns now match regardless of letter case. Before this fix, a filter with capital letters could miss matching rows.
• Rule repository page now loads ~5x faster.

Improved

• MITRE classification reviews: Rilevera no longer opens a review when it reclassifies a rule and the proposed MITRE tactics and techniques match the rule’s current ones.

Fixed

• In an automated MITRE classification review, turning on Diff on the rule’s Docs tab now compares the proposed tactics and techniques with the rule’s current ones in the Mitre Attack Coverage section. Before this fix, every proposed tactic and technique showed as added.

New

• New vendors: Rilevera now recognizes log sources from Akamai, Cohesity, Docker, Forescout, Fortinet, IBM, Imperva, Infoblox, Informatica, Kong, NetApp, Netskope, Omnissa, SAP, Thales, Torq, and VMware, and shows the vendor and product for each.

Improved

• Resolved fields in notifications: In a Source Field Missing or Field Never Seen on a Mapped Source notification, rules whose fields are no longer failing now show a Resolved pill. When every affected rule is resolved, the notification tells you so.
• Sumo Logic Data Sources: Rules no longer show false “missing data source” alerts. Data source matching now ignores behavioral fields in log searches, monitors, and SIEM queries, so more of them are correctly linked.

Fixed

• Splunk rules that set only an index-time search window, such as key indicators, now sync with their time range. Before this fix, these rules synced without one.

Fixed

• Log sources discovered in Sumo Logic Cloud SIEM are now recognized as SIEM sources, so Cloud SIEM rules map to them on the Data Sources tab. Before this fix, those sources weren’t treated as SIEM sources, so Cloud SIEM rules didn’t map to them.

New

• Splunk macro expansion: In a Splunk rule’s query view, click a macro to expand its definition inline. Click the expanded lines to collapse them again. Nested macros expand the same way.

Improved

• Highlighted diffs: Turn on Diff on the Versions or Overlapping Rules tab of a rule to compare queries with syntax highlighting. Switch between Split and Unified views.
• Detections state: Filters, sort order, page, and page size on the Detections page are now saved in the URL, so they’re kept when you go back from a rule.

Fixed

• Sumo Logic rules with multiple notifications now load their rule details and schedule settings without errors.
• Sumo Logic alerts now ingest correctly when their Detected At time is slightly earlier than their First Observed At time. Before this fix, those alerts failed to ingest.
• Data Sync now captures every Sumo Logic source category. Before this fix, some categories could be missed.

New

• New vendors: Rilevera now recognizes log sources from Cato Networks, Finxact, GitLab, Orca Security, and Teleport, and shows the vendor and product for each.

Improved

• Log source classification: Rilevera now recognizes more log types, including Google Cloud Load Balancing, Chrome Enterprise Browser, Temporal Cloud, and AWS Elastic Load Balancer (ELB), Security Lake, Site-to-Site VPN, and RDS logs. Coverage also expands for many existing vendors, including Google Cloud, Atlassian, Cloudflare, and Kubernetes.
• Google Cloud Pub/Sub: Google Cloud logs delivered through a Pub/Sub push subscription are now classified the same way as logs delivered directly.

Fixed

• Sumo Logic monitors with notifications set up in Sumo Logic now sync and save changes without errors.
• Fields that are present in a log with a null value now count as existing when Rilevera classifies the log.

New

• Test connection for Slack: In the Add Slack Integration or Edit Slack Integration dialog on Integrations, click Test connection to send a test message to your webhook without saving.
• Field names in notifications: Source Field Missing and Field Never Seen on a Mapped Source notifications on the Notifications page now list the fields that caused each rule to fail.

New

• Show deactivated: Deactivated users are now hidden from the Organization members table by default. Turn on Show deactivated to see them.

Improved

• Query editing: When you edit a detection rule’s query on the Query tab, the editor now highlights query syntax as you type. This works for Sumo Logic, Datadog, Splunk, and Panther rules.
• Splunk severity: Splunk rules whose finding severity is set to unknown now sync with Critical severity.

Fixed

• Sumo Logic monitors now show their status from Sumo Logic, such as Normal, instead of Unknown.

Improved

• Tab links: The tab you open on a detection rule’s details page or a log source’s page is now saved in the URL. You can bookmark or share a link that opens a specific tab.
• No Mapped Sources notifications: Clicking Review Rule in a notification about rules with no mapped sources now opens the rule’s Data Sources tab.

Fixed

• The same error message no longer stacks as multiple toasts when it occurs more than once.
• Log sources whose logs can’t be parsed are no longer mapped to detection rules.

New

• Alert metrics: The Overview tab on a detection rule’s details page now has a Metrics section with Mean Daily Alerts, Precision, Mean Time to Detect, Mean Time to Acknowledge, Mean Time to Respond, and Acknowledgement Rate. Use Compare with to see how each metric changed against another date range or version.
• Weekly Log Volume: A log source’s page now shows a Weekly Log Volume card with the total logs from the last 7 days. Click the card to open a daily chart.
• Splunk queries: The Query tab on a Splunk rule’s details page now highlights Splunk query syntax.
• Required Field Missing From Dependency: A new validation status flags a detection rule when a rule it depends on doesn’t output a field it needs. You can subscribe a Slack channel to this event.

Fixed

• If you don’t have permission to view reviews, a detection rule’s details page no longer shows errors.

Fixed

• Removing an integration now asks you to confirm first. Click Remove Integration on the integration’s card, then click Remove in the Remove integration? dialog, or click Cancel to keep it.

New

• Connected Rules: When a detection rule uses other rules or is used by them, a Connected Rules tab appears on the rule’s details page. Click a connected rule to open it in a new tab.
• Splunk integration: You can now connect Splunk as a source platform from Integrations with an Auth Token and Site URL. Turn on Trust self-signed certificate only for on-premises Splunk Enterprise deployments that use a self-signed certificate.
• Datadog OAuth: You can now connect Datadog with OAuth. Select your site, choose the OAuth (Recommended) tab, and click Connect with Datadog (OAuth). API key and app key authentication is still available.
• Bulk notification actions: On the Notifications page, select notifications with their checkboxes or Select all, then use Mark as to mark them Read or Unread or to Archive them.

Improved

• Panther queries: The Query tab on a Panther rule’s details page now highlights Python and SQL syntax.
• Notifications: The notification list loads in pages. Click Load more to see older notifications.
• Resizable columns: You can drag column edges to resize columns in the detection rules table and the Alerts table.
• Tags column: The Tags column in the detection rules table shows tags as pills. When a rule has more than one tag, click the +N items pill to see all of them.

Fixed

• Opening the Tags column filter in the detection rules table no longer causes an error.