Skip to content

fix[frontend](socai): added default template for empty previous socai…#2095

Merged
osmontero merged 4 commits into
release/v11.2.9from
backlog/fix/socai
May 22, 2026
Merged

fix[frontend](socai): added default template for empty previous socai…#2095
osmontero merged 4 commits into
release/v11.2.9from
backlog/fix/socai

Conversation

@AlexSanchez-bit

Copy link
Copy Markdown
Contributor

Main chages

previously an already defined configuratio was needed for getting config kays, data types, now a default template for newly created data is setted up so updates can work even if there's no module group on database

@AlexSanchez-bit AlexSanchez-bit requested a review from a team May 21, 2026 21:50
@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown

❌ Go dependencies check failed

There are outdated Go dependencies, or modules that could not be inspected.
Run bash .github/scripts/go-deps.sh --update --discover locally and
commit the updated go.mod / go.sum files.

Script output
🔍 Discovered 25 Go projects

📦 Dependencies with updates available:

  📁 ./agent:
     - golang.org/x/sys: v0.44.0 → v0.45.0

�[0;31m❌ Please update dependencies before merging.�[0m

@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

⚠️ architecture (gemini-3-flash-lite) — Tier 2 — changes requested

Summary: UI/Backend logic for handling masked configuration values; minor structural improvement needed for data type consistency.

  • medium backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java:52 — Manual collection of stream results into an ArrayList followed by manual iteration for filtering logic is verbose. Consider using a custom collector or a cleaner stream pipeline to maintain consistency with existing codebase patterns.
  • low frontend/src/app/app-module/guides/guide-soc-ai/guide-soc-ai.component.ts:495 — The pushChange method now accepts a confDataType parameter, but the default value 'text' might lead to silent misconfigurations if new keys are added without explicit types. Ensure this is documented or enforced via a stricter interface.

⚠️ bugs (gemini-3-flash-lite) — Tier 2 — changes requested

Summary: Fixed logic for handling masked API keys and headers; added missing configuration creation logic in pushChange.

  • medium frontend/src/app/app-module/guides/guide-soc-ai/guide-soc-ai.component.ts:58 — The variable 'maskedDisplay' is set to '', but the regex in 'isMaskedValue' (line 595) and the logic in 'loadConfig' (line 392) expect '**' (5 asterisks). This mismatch will cause the UI to fail to recognize masked values correctly.

🛑 security (gemini-3-flash-lite) — Tier 3 — engineer review required

Summary: Modifications to configuration handling and API key persistence logic in SOC AI module.

  • medium backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java:55 — The validator now allows arbitrary configuration keys to be added to the database if they are not present in the existing configuration. This could lead to configuration injection or unauthorized state modification if input is not strictly sanitized.
  • medium frontend/src/app/app-module/guides/guide-soc-ai/guide-soc-ai.component.ts:505 — The pushChange method now allows creating new configuration entries with arbitrary keys and values if they don't exist, potentially bypassing intended configuration schemas.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — see approver comments above.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — see approver comments above.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — see approver comments above.

@osmontero osmontero merged commit 6e169dd into release/v11.2.9 May 22, 2026
5 of 7 checks passed
@osmontero osmontero deleted the backlog/fix/socai branch May 22, 2026 16:37
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

* fix[ci]: fix changelog script failing when tag doesn't exist yet and unblock installer on changelog failure

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

* fix[ci]: fix changelog script failing when tag doesn't exist yet and unblock installer on changelog failure

* ci: simplify v11 pipeline to trigger on release events instead of push to v11

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants