Skip to content

fix[backend](alert_responses): fixed powershell commands syntax errors#2228

Merged
Kbayero merged 2 commits into
release/v11.2.9from
backlog/fix/ir_audit_default_commands
Jun 16, 2026
Merged

fix[backend](alert_responses): fixed powershell commands syntax errors#2228
Kbayero merged 2 commits into
release/v11.2.9from
backlog/fix/ir_audit_default_commands

Conversation

@AlexSanchez-bit

Copy link
Copy Markdown
Contributor

No description provided.

@AlexSanchez-bit AlexSanchez-bit requested a review from a team June 15, 2026 20:47
@AlexSanchez-bit AlexSanchez-bit linked an issue Jun 15, 2026 that may be closed by this pull request
3 tasks
@AlexSanchez-bit AlexSanchez-bit removed a link to an issue Jun 15, 2026
3 tasks
@AlexSanchez-bit AlexSanchez-bit linked an issue Jun 15, 2026 that may be closed by this pull request
3 tasks
@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — Tier 3 — engineer review required

Summary: Dependency updates across multiple services and critical DB migration changes.

  • high backend/src/main/resources/config/liquibase/changelog/20260615001_fix_response_action_template_syntax.xml:1 — Database migration detected. Modifying production data (deleting/updating templates) requires verification of impact on existing agent-manager logic and potential state inconsistency.
  • medium agent/go.mod:1 — Dependency updates in agent/go.mod (e.g., threatwinds/go-sdk, golang.org/x/sys) may affect agent-manager compatibility. Ensure these updates do not introduce breaking changes to the wire protocol or agent-manager communication.
  • medium installer/go.mod:1 — Installer dependencies updated. Changes to installer logic must be validated against existing deployment environments to ensure no regression in upgrade paths.

⚠️ bugs (gemini-3-flash-lite) — Tier 2 — changes requested

Summary: Typo in SQL migration script: 'applicactionname' should be 'applicationname'.

  • medium backend/src/main/resources/config/liquibase/changelog/20260615001_fix_response_action_template_syntax.xml:18 — Typo in SQL comment: 'applicactionname' → 'applicationname'. This is a user-facing/documentation string in the migration log.

⚠️ security (gemini-3-flash-lite) — Tier 2 — changes requested

Summary: Information disclosure of an internal developer name ('Alex') in a database migration script.

  • medium backend/src/main/resources/config/liquibase/changelog/20260615001_fix_response_action_template_syntax.xml:8 — Information disclosure: The 'author' attribute contains a personal name ('Alex'). Replace with a generic identifier or team alias to maintain privacy.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — see approver comments above.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — see approver comments above.

@Kbayero Kbayero merged commit 80c844c into release/v11.2.9 Jun 16, 2026
5 of 7 checks passed
@Kbayero Kbayero deleted the backlog/fix/ir_audit_default_commands branch June 16, 2026 13:21
@github-project-automation github-project-automation Bot moved this to ✅ Done in UTMStack OSS Jun 16, 2026
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

* fix[ci]: fix changelog script failing when tag doesn't exist yet and unblock installer on changelog failure

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Kbayero added a commit that referenced this pull request Jun 17, 2026
* update actions workflow

* fix(workflows): unblock PR checks on large diffs + private go modules

* fix(approver): use english in sticky PR comments

* Feature/cleanup rules and filters (#2091)

* refactor(filters): update macOS filter configuration

* chore(rules): remove Office365 brute force detection rule

* chore(rules): remove PowerShell Empire detection rule

* chore(rules): remove RDP brute force attacks rule

* fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087)

* fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error

* chore[](): updated go packages

* fix[frontend](environment):environments on gitignore and removed the actual local dev environment

* chore[](): updated go packages

* feat[backed](elasticSearchService): added batch processing of request… (#2090)

* feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors

* chore[backend](): updated go dependencies

* fix[backend](elastic-service): sanitized csv before exportation and changed error messages

* fix[frontend](socai): added default template for empty previous socai… (#2095)

* fix[frontend](build): added environment.ts (#2099)

* fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098)

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* Hotfix/socai custom header (#2101)

* fix[frontend](socai): added default template for empty previous socai config (#2092)

* fix[frontend](socai): added default template for empty previous socai configuration

* fix[frontend](socai): setted customHeaders as password key type

* fix[frontend](socai): dont let empty description on modules

* fix[backend](socai): generate the modulegroup with new keys if no other exists on db

* fix[backend](changeset): added customHeader entries as password type

* fix(frontend): update nginx from 1.19.5 to 1.30.1

Remediate 22 known CVEs including CVE-2026-42945 (actively
exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was
affected by buffer overflows, memory disclosure, HTTP/2 injection,
SSL session reuse, and multiple other vulnerabilities patched in
the 1.30.1 stable release.

* Backlog/fix/socai module disabled (#2102)

* fix[backend](socai): changed socai default module keys

* fix[backend](modules): added default keys on module creation response

* fix[frontend](socai): handled empty (disabled) module configuration

* Backlog/fix/tag rules (#2106)

* fix[frontend](rules): improved post event count validation

* fix[frontend](tag_rules): added events related fields on tag rule creation

---------

Co-authored-by: Osmany Montero <osmontero@icloud.com>

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107)

* fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement

* chore[](): updated go packages

* fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103)

- google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical)
- github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low)
- go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high)
- com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3)
- org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high)

Signed-off-by: Osmany Montero <osmontero@icloud.com>

* fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0

* fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127)

* refactor(rules): drop "now-" prefix from within field (#2176)

* fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178)

* fix[installer](setup): added lock on installer final phase (#2180)

* fix[frontend](alerts): properly handle update alerts errors (#2193)

* feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221)

* feat(rules/o365): add Audit Log Purge detection rule (#2220)

* feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219)

* feat(rules/o365): add Admin Role Assignment detection rule (#2218)

* refactor(rules/google): update GCP correlation rules (#2194)

* feature(rules/google): add rule GCS Sensitive Data Access (#2187)

* feature(rules/google): add rule GCS Bucket Deleted (#2186)

* Tune bruteforce correlation and drop unreliable PTH rule (#2192)

* fix(rules/windows): tighten bruteforce_attack correlation scope

* fix(rules/windows): scope multi-failure-then-success rule by source

* chore(rules/windows): remove pass_the_hash_detection rule

* fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array.

* feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190)

* feature(rules/google): add rule Cloud Logging Sink Modified (#2189)

* feature(rules/google): add rule Firewall Open Ingress (#2182)

* Update filters: GCP, Sophos XG, Windows (#2175)

* feat(filters/gcp): add Cloud Audit Logs (protoPayload) support

* fix(filters/sophos-xg): guard renames and actionResult against missing fields

* chore(filters/windows): rename log.data.SubStatus field

* fix(filters/sophos-xg): correct operator precedence in actionResult guard

* feature(rules/google): add rule Audit Logging Configuration Changed (#2181)

* Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188)

* feature(rules/google): add rule IAM Policy Changed - Privilege Escalation

* fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic

* feature(rules/google): add rule Firewall Rule Deleted (#2183)

* feature(rules/google): add rule GCS Bucket Created (#2185)

* fix(rules/google): rebalance CIA impact scores for GCP rules (#2227)

* feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review

* fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3

* fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230)

* fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds

* fix[backend](go_deps): updated go dependencies

* fix[backend](alert_responses): fixed powershell commands syntax errors (#2228)

* fix[backend](alert_responses): fixed powershell commands syntax errors

* fix[backend](go_deps): updated go dependencies

* fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226)

* fix[backend](incident_response_audit): enabled filters on agents-with-command query

* fix[backend](go_deps): updated go dependencies

---------

Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>

* fix[backend](compilance_reports): migrated compilance reports from ol… (#2232)

* fix[backend](compilance_reports): migrated compilance reports from old table to new one

* fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion

* chore: update golang dependencies

* fix[ci]: fix changelog script failing when tag doesn't exist yet and unblock installer on changelog failure

* ci: simplify v11 pipeline to trigger on release events instead of push to v11

---------

Signed-off-by: Osmany Montero <osmontero@icloud.com>
Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com>
Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
Co-authored-by: Osmany Montero <osmontero@icloud.com>
Co-authored-by: developutm <development@utmstack.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

default flow commands with syntax errors

2 participants