> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Intelligence Release Notes

## Threat Intelligence Release 351

Release Notes | October 2026

**Important Communications**

Updates to correlation rules, field extraction, and event parsing across multiple vendors.

* Changes may affect filters or correlations that reference vendor specific fields
* Improvements to detection accuracy and false positive reduction may affect correlation behavior for Microsoft Windows, Office 365, and Cloudflare environments

**New Detections**

* Detection for admin operations performed in Microsoft Azure Active Directory adding members to roles scoped over restrictive management assignment
* Detection for Microsoft Office 365 Azure Active Directory admin operations with multiple permission changes
* Detection for password spray activity using Windows NxLog events
* Detection for suspicious Windows MSHTA spawning curl or PowerShell to retrieve a Windows Installer (MSI) file
* Detection for suspicious execution in Microsoft Defender Advanced Threat Protection
* Detection for suspicious ScreenConnect top-level domains
* Detection for TeamCity exploitation based on SentinelOne events
* Detection for impossible travel activity in Google Workspace
* Detection for anomalous sign-in properties in Microsoft Outlook

**Detection and Correlation Improvements**

* Improved field extraction to parse account names and file paths for Cmd or PowerShell Execution with Comments detections
* Improved rule logic to parse reporting device hostnames to OTX alarms
* Reduced false positives for Windows Scheduled Job Created detections by excluding Custom Field 29 and BingWallpaper
* Reduced false positives for Microsoft Edge remote file download detections by tuning legitimate headless rendering activity
* Improved field extraction to parse source process parent, source process parent command line, and source process grandparent command line for CrowdStrike detections
* Improved detection logic for CrowdStrike alarms by adding in-progress event status
* Improved detection logic for possible Impacket SecretDump remote activity
* Improved detection logic for Kerberos logon to multiple accounts
* Improved accuracy for PowerShell Execution of Hoaxshell detections by adding a check for command line positioning
* Improved field extraction to parse source process parent and source process parent command line for PowerShell Execution of Encoded Command detections
* Improved field extraction and reduced false positives for Cloudflare Enterprise detections by parsing firewall actions and removing blocked traffic
* Reduced false positives for Avanan Email Security potential phishing email detections by excluding graymail

**Plugin Improvements**

* Improved parsing for Sophos XG Firewall syslog events
* Improved field extraction to parse sensitive information type names for Microsoft Office 365 Exchange logs
* Added parsing support for additional fields in VMware API syslog events
* Improved parsing for Microsoft Azure Network Security Group logs
* Added parsing support for SAP HANA syslog events
* Improved parsing for Amazon Web Services RDS PostgreSQL logs
* Improved decoding for Docker logs
* Added a new regular expression to improve parsing for VeloCloud logs
* Added parsing support for Dell SonicWall NSa 2650 Common Event Format logs
* Improved parsing for UILA uObserve syslog events
* Improved parsing for Google G Suite Audit events
* Improved parsing for Okta API logs
* Improved field extraction to parse command line data for Microsoft Defender events
* Added parsing support for Cyberint
* Improved parsing for Netskope Common Event Format logs
* Added parsing support for Radware Cloud Web Application Firewall syslog events

**Fixes**

* Fixed parsing issues for VMware ESXi generic syslog events
* Fixed parsing issues for Juniper EX Series generic syslog events
* Fixed parsing issues for Amazon Web Services RDS MySQL syslog events
* Fixed parsing issues for Kaspersky Security Center logs
* Resolved an issue causing blank event names in Trellix Endpoint Security logs

## Threat Intelligence Release 350

Release Notes | September 2026

**Important Communications**

Updates to correlation rules, field extraction, and event parsing across multiple vendors.

* Improvements to detection accuracy and false positive reduction may affect correlation behavior for Microsoft Windows, Office 365, and Fortinet environments.
* Changes may affect filters or correlations that reference vendor specific fields.

**New Detections**

* Detection for AI agent or LLM runtime launched by a suspicious parent process on Windows
* Detection for first-seen AI runtime or agent binary on Windows hosts
* Detection for AI API calls from non-browser scripting or tooling processes on Windows
* Detection for MCP server processes listening on non-loopback sockets on Windows
* Detection for AI agent processes reading credential material or secret files on Windows
* Detection for local LLM runtimes listening on non-loopback sockets on Windows
* Detection for AI coding agents spawning sensitive child processes on Windows
* Detection for Microsoft 365 Copilot interactions triggering a JailbreakDetected audit verdict
* Detection for weakening or removing AWS Bedrock guardrails via AWS CloudTrail
* Detection for disabling or altering AWS Bedrock model invocation logging configurations via AWS CloudTrail
* Detection for active exploitation attempts against AI infrastructure based on Suricata NIDS signatures
* Detection for rapid access to multiple distinct generative AI services from a single host using Palo Alto PAN-OS events
* Detection for anomalous data uploads to generative AI destinations based on Darktrace alerts
* Detection for first-seen usage of generative AI applications on Fortinet FortiGate
* Detection for cross-prompt injection attacks against Microsoft 365 Copilot interactions
* Detection for repeated file uploads to generative AI applications on Fortinet FortiGate
* Detection for ransomware executables staged in the Windows PerfLogs directory
* Detection for Windows LockScreenContentServer sideloading from non-standard paths
* Detection for suspicious usage of XZ utils

**Detection and Correlation Improvements**

* Improved accuracy for Microsoft Office 365 Suspicious MS Teams Chat with External User detections by adding checks for Support and HelpDesk variations
* Reduced false positives in Windows User Privilege Escalation detections by excluding legitimate Mozilla Firefox background processes
* Increased severity to Medium and reduced false positives for Windows ShimCache Persistence detections by excluding default Microsoft update registry paths
* Improved accuracy for Microsoft Office 365 ATP phishing detections by adding recognized email security vendors to the global correlation list
* Fixed criteria for Fortinet FortiGate VPN Successful Authentication After Brute Force detections to properly trigger on successful IPsec VPN authentications
* Reduced false positives in Microsoft Exchange Suspicious inbox rule detections by implementing stricter string matching

**Plugin Improvements**

* Improved field extraction for Palo Alto Cortex XDR alert and management logs
* Improved parsing and normalization of country and sender fields in CheckPoint Harmony logs
* Improved parsing of attacker IP addresses from the ipEvidence object in Microsoft Defender for Endpoint logs
* Improved field extraction for Zimperium Mobile Device Security zIPS logs
* Improved parsing and normalization for Ubiquiti NetFlow IPFIX events
* Improved parsing for Fortinet FortiGate and FortiAuthenticator CEF logs
* Added parsing support for Azure Microsoft Guest Configuration events
* Added parsing support for Netwin SGRWIN Syslog Gateway events
* Added parsing support for Dell EMC S4048 switch logs
* Added parsing support for Axur One Ticket Feeds events

**Fixes**

* Fixed parsing issues that caused missing event names and fields in Barracuda Web Application Firewall logs
* Resolved an issue where Trustwave Secure Web Gateway events were not automatically detected and parsed with correct event names
* Resolved an issue where F5 BIG-IP events were incorrectly parsed as generic data sources

## Threat Intelligence Release 349

Release Notes | August 2026

**Important Communications**

The following parser and event normalization updates may affect orchestration rules, filters, reports, or correlation behavior that reference vendor-specific fields, event names, or normalized values.

* Mimecast Threat Reporting events were updated to improve field extraction for message, recipient, reporter, and threat analysis values.
* Bitdefender GravityZone incident events were updated to use detection names, incident types, and attack types for more specific event names.
* Veeam Backup events were updated to use consistent event names for backup and restore activity.
* Cisco Identity Services Engine events were updated to extract additional accounting, profiling, identity, network device, and DHCP fields.
* MOVEit Transfer NXLog event names were updated to consistently group automation user activity.
* Click Studios Passwordstate RDP and SSH event names were updated to consistently group related remote access activity.

**New Detections**

* Detection for repeated failed Active Directory authentications reported by F5 BIG-IP Access Policy Manager.
* Detection for abnormal Microsoft 365 Exchange email sending rates.
* Detection for Microsoft Entra ID users successfully logging in from multiple countries without requiring source workstation data.
* Detection for multiple Microsoft Teams chats created by external [onmicrosoft.com](http://onmicrosoft.com) accounts.
* Detection for suspicious remote content retrieval through headless Windows Console Host processes.
* Detection for PowerShell commands that disable Microsoft Defender script scanning, network protection, web content evaluation, or SmartScreen.
* Detection for suspicious child processes launched by Microsoft AutoGen Studio host processes.
* Detection for Microsoft 365 inbox rules that move messages from [postmaster@outlook.com](mailto:postmaster@outlook.com).
* Detection for high-volume Microsoft 365 MailItemsAccessed activity.

**Detection and Correlation Improvements**

* Improved possible replay attack detection by requiring multiple related events within a short period, reducing alerts caused by isolated time synchronization issues.
* Improved outbound SSH connection detection by excluding expected Bitvise SSH Server and Bitvise SSH Client processes.
* Improved Microsoft Teams suspicious external chat detection by checking sender usernames for suspicious top-level domains.
* Improved Microsoft Exchange suspicious inbox rule detection by checking email subject values parsed into additional fields.
* Improved CrowdStrike intelligence detections to include events with new and in-progress statuses.
* Improved Microsoft Teams suspicious external chat detection by checking external account display names, email-like display names, and IT-related [onmicrosoft.com](http://onmicrosoft.com) usernames.
* Improved Microsoft Teams suspicious external chat detection by identifying external display names containing engineering, administrative, management, maintenance, or system-related terms.
* Improved Duo multiple user account deletion detection by excluding expected deletions performed by the System account.

**Plugin Improvements**

* Added syslog parsing support for Safran SecureSync 2400.
* Added syslog parsing support for Cisco Secure Workload.
* Added DataDome and Datadog JSON log parsing support for bot detection, HTTP activity, environment, and service fields.
* Added parsing support for Microsoft Azure Storage Account Availability metrics.
* Added syslog parsing support for Dell PowerVault ME5012.
* Improved Microsoft Office 365 Audit parsing by extracting Microsoft Teams ChatThreadId values.
* Improved Microsoft Office 365 Azure AD parsing by extracting ResultStatusDetail from UserLoggedIn events.
* Improved Microsoft Azure Monitor Agent parsing by normalizing Windows Security EventData values, including usernames, domains, IP addresses, ports, logon types, authentication packages, security identifiers, and logon identifiers.
* Improved Palo Alto Cortex XDR Alert parsing by extracting case ID values.
* Improved Microsoft Office 365 Entra Sign-ins parsing by replacing Generic event names with event-specific names.
* Improved Microsoft Office 365 Entra Directory Audits parsing by extracting result reasons, target resource display names, modified property values, and user principal names.
* Improved Microsoft Office 365 Entra Directory Audits parsing by replacing Generic event names with event-specific names.
* Improved Microsoft Azure Blob Storage authentication parsing by extracting identity type, token hash, user agent, and URI values.
* Improved Mimecast Threat Reporting parsing by extracting subject, sent date, report date, sender header, recipient count, reporter count, and threat analysis values.
* Improved Bitdefender GravityZone incident parsing by assigning event names based on detection names, incident types, and attack types.
* Improved Google Workspace Audit parsing by correcting login failure event names and extracting organization, initiation, failure type, application, customer, qualifier, and IP autonomous system values.
* Improved Juniper EX Series parsing by assigning event-specific names instead of Generic event names.
* Improved WatchGuard XTM parsing by extracting source and destination IP addresses instead of using the firewall address for both values.
* Improved Palo Alto Panorama audit log parsing by extracting event names, operation types, administrator usernames, commands, target objects, configuration paths, operation results, device identifiers, hostnames, and timestamps.
* Improved Veeam Backup parsing by assigning consistent event names to backup and restore activity.
* Improved Cisco Identity Services Engine parsing by extracting additional accounting, profiling, identity, network device, DHCP, endpoint, and storage fields.
* Improved MOVEit Transfer NXLog parsing by normalizing event names for automation user activity.
* Improved Click Studios Passwordstate parsing by normalizing related RDP and SSH event names.
* Improved Fortinet FortiGate parsing by extracting the appact field from traffic events.
* Improved Somansa WebKeeper parsing by normalizing dated and unnamed events and correcting source, destination, port, category, action, and policy mappings.
* Improved Windows NXLog parsing for Windows Security Event ID 5449 by extracting provider context key, provider context name, and provider context type.
* Improved Windows NXLog parsing for Windows Security Event ID 5447 by extracting filter key, filter name, and layer name.
* Improved Cisco Meraki Air Marshal parsing by extracting wireless network, access point, VLAN, signal strength, frame type, authentication, identity, and client activity fields.

**Fixes**

* Resolved an issue where Bitdefender GravityZone incident events used the same generic event name for different incident types.
* Resolved an issue where Veeam Backup events used raw payload values instead of consistent event names.
* Resolved an issue where MOVEit Transfer NXLog automation events were split into multiple unique event names instead of being grouped consistently.
* Resolved an issue where Click Studios Passwordstate RDP and SSH events were split across inconsistent event names.
* Resolved an issue where Juniper EX Series events were reported as Generic events.
* Resolved an issue where WatchGuard XTM events used the firewall address instead of the source and destination IP addresses present in the logs.
* Resolved an issue where Palo Alto Panorama audit events were reported without event names or searchable administrative activity fields.
* Resolved an issue where Microsoft Office 365 Entra Sign-ins events were reported as Generic events.
* Resolved an issue where Microsoft Office 365 Entra Directory Audits events were reported as Generic events.
* Resolved an issue where Google Workspace Audit login failure events had incomplete event names and missing fields.
* Resolved an issue where Somansa WebKeeper events used timestamps or empty values as event names and mapped network fields incorrectly.

## Threat Intelligence Release 348

Release Notes | July 2026

**Important Communications**

The following parser and event normalization updates may affect orchestration rules, filters, reports, or correlation behavior that reference vendor specific fields, event names, or normalized values.

* ExaGrid Audit Logs Parser events were updated to populate event names for events that were previously parsed without an event name
* Ruckus WAP events were updated to extract usable fields and improve normalization for wireless controller syslog events
* Cisco ESA Email Security Cloud parsing was updated to reduce Generic event output and improve field extraction from syslog events
* SentinelOne Singularity Operations Center BlueApp events were updated to use SentinelOne specific event names instead of Generic event names
* Juniper EX Series event naming was updated to support logs that include the %INTERACT-6- prefix

**New Detections**

* Detection for postinstall execution associated with the Mastra npm supply chain compromise using setup.cjs or easy-day-js execution through node or node.exe
* Detection for PowerShell execution using NoProfile, ExecutionPolicy Bypass, WindowStyle Hidden, and script file execution
* Detection for Windows registry symbolic link creation under CloudFiles BlockedApps associated with MiniPlasma style activity
* Detection for Nimbus RAT payload execution using bundled OpenJDK from InboxCorePro staging paths
* Detection for Copy Fail activity associated with CVE-2026-31431
* Detection for Remcos DonutLoader staging through SyncAppvPublishingServer, cscript.exe, PowerShell, and Invoke-Expression

**Detection and Correlation Improvements**

* Improved Microsoft Exchange suspicious inbox rule detection by adding checks for suspicious inbox rule names and business email compromise related email subject values
* Improved Microsoft Defender for Office 365 phishing detection by excluding OutboundSpam events with External delivery locations when the related email was already quarantined
* Improved Fortinet FortiGate infected file detection by excluding blocked web redirector detections that did not provide meaningful file detection signal
* Improved SentinelOne Malware Detected correlation behavior by using both mitigation status and agent mitigation mode to reduce alarms for threats already mitigated or protected
* Improved Windows recovery environment disabled via reagentc detection by excluding expected activity from system and machine accounts
* Improved Fortinet FortiGate automated login logout detection to reduce low-signal alerts from short administrative sessions
* Improved PowerShell encoded command detection by excluding known PowerShell AST parser script activity
* Improved Windows WerFault detection for wermgr.exe execution from non-standard Windows directories

**Plugin Improvements**

* Added Mimecast Events Collection support for JSON formatted Mimecast security events
* Added Lenovo ThinkSystem DM3010H syslog parsing support
* Added Wiz Vulnerability Management API collection support
* Added Progress Kemp LoadMaster Web Application Firewall syslog parsing support
* Added OpenText NetIQ eDirectory LDAP CEF parsing support
* Added Netscout Arbor Sightline DDoS syslog parsing support with autodiscovery handling
* Added Check Point Infinity Portal CEF parsing support for Check Point Harmony SASE, Harmony Endpoint, and SD-WAN logs
* Added ManageEngine Endpoint Central syslog parsing support for audit and endpoint management events
* Improved Proofpoint On Demand BlueApp collection to include audit stream support and preserve additional JSON payload fields
* Improved Fortinet FortiGate Rogue AP detected events by parsing the onwire field
* Improved Fortinet FortiGate CEF autodetection for FortiGate-601F devices
* Improved Fortinet FortiGate CEF parsing by mapping the FTNTFGTcfgattr field for configuration attribute changes
* Improved Ruckus WAP parsing by extracting wireless controller fields and normalizing client and endpoint values
* Improved Cisco ESA Email Security Cloud parsing to reduce Generic event handling and improve syslog field extraction
* Improved Senha Segura parsing for Senha Expirada events by extracting the affected destination username
* Improved Shorewall Firewall parsing so Firewall TCP Drop events are categorized as Shorewall Firewall instead of Linux Kernel
* Improved Citrix NetScaler parsing by extracting HTTP request URLs from HTTPREQUEST events
* Improved Microsoft Office 365 Azure AD parsing by extracting User ID for Update StsRefreshTokenValidFrom Timestamp events
* Improved Sophos Central JSON parsing by extracting the unmet\_prerequisites field
* Improved Cisco Meraki AUTER parsing by normalizing firewall and VPN firewall actions from pattern values
* Improved Cisco Firepower Management Center parsing by extracting usernames from audit login events
* Improved NGINX and DataDome log parsing by normalizing OCSF HTTP activity fields, HTTP response values, DataDome bot details, and event names
* Improved ManageEngine PAM360 parsing by extracting ResourceAudit and UserAudit fields
* Improved Cisco Meraki AUTER parsing by normalizing user agent values
* Improved Cisco Duo Activity parsing by extracting response\_info values under target detail for fraud related activity
* Improved Linux audit PATH event parsing by extracting audit event ID, item number, file path, inode, and device values

**Fixes**

* Resolved an issue where ExaGrid Audit Logs Parser events were parsed without event names
* Resolved an issue where SentinelOne Singularity Operations Center BlueApp events were ingested as Generic event instead of SentinelOne specific event names
* Resolved an issue where Juniper EX Series events were missing updated event names after the %INTERACT-6- log prefix was added
* Resolved an issue where Windows NXLog IIS HTTP OK events parsed incorrect source IP and hostname values
* Resolved an issue where Linux audit PATH events did not correctly parse file path and related audit fields

## Threat Intelligence Release 347

Release Notes | June 2026

**Important Communications**

This release includes updates to event parsing, field extraction, event naming, and new log source support. These changes may affect orchestration rules, saved searches, dashboards, and correlations that reference vendor-specific fields, event names, or normalized values.

* Resolved missing data sources for Microsoft Defender for Endpoint schedulers
* Added field extraction for Microsoft Office 365 Audit TeamsAdminAction events
* Updated Microsoft Office 365 Azure AD UserLoggedIn event field mapping
* Added field extraction for Netskope CEF compromised credential events
* Added field extraction for Okta identity events
* Added field extraction for Senha Segura privileged access events
* Added field extraction for Salesforce Activity InsufficientAccess events
* Added field extraction for Cato Networks Cloud-based NGFW DNS Protection events
* Updated Citrix NetScaler event naming to differentiate HTTP request methods
* Expanded parsing coverage for AlienVault Agent Windows Event Log events
* Added new log source support for Peplink Balance 3xx switches
* Added new log source support for HPE FlexFabric 5710 Switch Series
* Added new log source support for UILA uObserve
* Changes may affect filters or correlations that reference vendor-specific event names, extracted fields, or normalized values

**New Detections**

* Detection for searches of Group Policy Preference password files that may indicate attempts to recover stored credentials in Active Directory environments
* Detection for [ASP.NET](http://ASP.NET) ViewState deserialization vulnerability activity associated with CVE-2026-5426
* Detection for attempts to disable Windows Credential Guard through registry modifications
* Detection for abuse of nslookup and findstr to retrieve and execute commands through DNS-based techniques
* Detection for suspicious child process activity originating from Microsoft Semantic Kernel agent environments
* Detection for sensitive Windows file collection using print.exe
* Detection for successful legacy SMTP authentication activity using BAV2ROPC
* Detection for PowerShell-based remote archive download, extraction, and execution chains
* Detection for macOS AMOS stealer style archive creation, file splitting, and upload activity
* Detection for Windows Axios supply chain attack activity involving script execution and outbound command activity
* Detection for Quarian backdoor activity

**Detection and Correlation Improvements**

* Reduced false positives in PowerShell Execution of Encoded Command detections by improving handling of Windows Admin Center uninstall activity
* Updated OfficeLaunchExe detection coverage for Windows child processes launched by Microsoft Word

**Plugin Improvements**

* Improved Microsoft Office 365 Audit parsing for TeamsAdminAction events, including ModifiedProperties.OldValue and ModifiedProperties.NewValue fields
* Improved Microsoft Office 365 Azure AD parsing for UserLoggedIn events, including SessionID and Device ID field mapping
* Added extraction of the ccMatchedUsername field for Netskope CEF compromised credential events
* Improved Falco event parsing for Kubernetes namespace and pod name values
* Added field extraction for Senha Segura privileged access logs, including cs label fields, tenant, user, access policy, and access profile values
* Improved Okta event parsing for risk, user behavior, displayName, and target fields
* Improved parsing coverage for HPE OfficeConnect 1910 to 1950 switch logs
* Improved Apache Tomcat log identification so Apache Tomcat events are parsed by the Apache Tomcat parser
* Expanded field extraction for Aruba 9000 Gateway logs, including MAC address, ICMP, action, policy, process, hostname, and process ID fields
* Added parsing support for Peplink Balance 3xx switch logs
* Added parsing support for HPE FlexFabric 5710 Switch Series logs
* Added parsing support for UILA uObserve logs
* Improved Citrix NetScaler event naming for HTTP GET, POST, PUT, DELETE, and related HTTP request methods
* Expanded field extraction for AlienVault Agent Windows Event Log events, including TargetSid, AllowedToDelegateTo, AccountExpires, and UserWorkstations fields
* Improved event naming for Ubiquiti UniFi syslog events
* Added parsing support for the dns\_protection\_category field in Cato Networks Cloud-based NGFW DNS Protection events
* Added field extraction for Salesforce Activity InsufficientAccess events, including Access Error and Entity Type fields

**Fixes**

* Resolved an issue where Microsoft Defender for Endpoint data sources were missing from available schedulers
* Resolved an issue where McAfee Web Gateway Cloud events were generated with blank event names
* Resolved an issue where Apache Tomcat logs were categorized as generic events instead of being parsed by the Apache Tomcat parser
* Resolved an issue where Citrix NetScaler HTTP request events used a single HTTPREQUEST event name instead of differentiating HTTP request methods
* Resolved parsing issues affecting Veeam Backup syslog events
* Resolved missing event names for Ubiquiti UniFi syslog events
* Resolved missing field extraction for Cato Networks Cloud-based NGFW DNS Protection events
* Resolved missing field extraction for Salesforce Activity InsufficientAccess events

## Threat Intelligence Release 346

Release Notes | May 2026

**Important Communications**

This release included parser, normalization, event naming, and field extraction updates that may affect orchestration rules, filters, reports, and correlations that reference vendor specific fields or event names.

* Updates to event naming and normalization for OpenGear Out-of-Band Management, Avanan Email Security SmartDLP, MOVEit Transfer NXLog, SonicWall UTM, and Netskope events
* Field extraction improvements for Microsoft Office 365 SharePoint, Microsoft Office 365 Audit, Cisco Umbrella Proxy, Google G Suite Drive, CrowdStrike Identity Alert Logs, Cisco Meraki AUTER, and Linux Kernel events
* Linux Services parser updates for Amavis and Zimbra Mail Server logs improved handling of complex message flow details, repeated entries, and large recipient lists
* Changes may affect filters or correlations that reference vendor specific event names, authentication fields, VPN fields, host name fields, firewall fields, or extracted file name values

**New Detections**

* Detection for CVE-2026-33829 Snipping Tool NTLM leak activity involving Snipping Tool URI execution and public network connections
* Detection for Windows LSA boot key registry access by a non-LSASS process
* Detection for direct RPC calls to the Windows Defender update endpoint by a non-Windows Update process
* Detection for Microsoft Defender for Endpoint Sapphire Sleet actor activity
* Detection for command-line discovery of installed security products, including Windows Defender, Malwarebytes Endpoint Agent, Trend Micro Security, Kaspersky Endpoint Security, Webroot, ESET, and Avast

**Detection and Correlation Improvements**

* Updated macOS AVAgent detection coverage to include activity involving the */tmp/helper* staging cache directory
* Updated indicator of interest detections to align with revised high confidence indicator names for general, command and control, stealer, and fast-flux activity
* Reduced false positives in Windows PowerShell encoded command detections related to Microsoft Windows Admin Center configuration activity
* Improved Windows Kerberos account enumeration correlation coverage by relaxing overly restrictive matching logic
* Removed a verified non-malicious indicator from OTX Pulse based alarm generation to reduce false positive alarms

**Plugin Improvements**

* Added parsing support for Barracuda Sentinel email security, Coraza WAF, Pulp 3 pulpcore-api, Cohesity DataPlatform API audit, and Sophos Central case events
* Improved Microsoft Office 365 SharePoint and Microsoft Office 365 Audit parsing to extract authentication related fields, including AuthenticationType, OldValue, and NewValue details
* Improved Cisco Meraki AUTER parsing for AnyConnect VPN events, including event names, authenticating users, VPN IP addresses, and source IP addresses
* Improved Cisco Umbrella Proxy, Google G Suite Drive, and CrowdStrike Identity Alert Logs parsing to extract additional file name, application, and host name fields
* Improved Linux Kernel iptables parsing to extract source, destination, action, and port number details
* Improved zScaler NSS Web Logs parsing to extract device owner and device hostname fields
* Improved Trend Micro Deep Security parsing to support TrendAI vendor naming changes

**Fixes**

* Resolved issues where OpenGear Out-of-Band Management, Netskope, and Passwordstate Syslog events displayed without proper normalization or event names
* Resolved issues where Linux Services logs from Amavis and Zimbra Mail Server were incorrectly routed to the Generic Plugin instead of the Linux Services parser
* Resolved issues where Avanan Email Security SmartDLP, MOVEit Transfer NXLog, and SonicWall UTM events generated inconsistent or overly unique event names that impacted reporting and rule creation
* Resolved issues where Linux Kernel iptables events did not display complete source, destination, action, and port number details

See Older Release Notes in [Success Center](https://success.levelblue.com/s/)