What's new in EventLog Analyzer?

 Fixes

• Minor issues in archiving have been fixed.

 Fixes

• Issues due to security hardening during agent upgrade are fixed.

 Enhancements

• The version of JSON jar bundled with the product has been upgraded to 20190722.0.0.
• The version of PostGreSQL bundled with the product has been upgraded to 10.15.
• The EventLog Analyzer build image has been upgraded.
• Predefined VPN reports have now been added for CheckPoint and Barracuda Firewall.
• The threat detection in Correlation tab has been enhanced for improved performance.
• Logon reports for Firepower have now been added.
• The Windows and Linux agent versions have been upgraded to 4.5 and 1.3 respectively.
• You can now use either the Auto detect option or use the server time to revert the timezone.
• The performance of STIX/TAXII threat feeds operations and Advanced Threat Analytics has been enhanced.
• EventLog Analyzer now supports in-memory threat look-ups. This can be availed by getting in touch with support@eventloganalyzer.com.

 Fixes

• Application sources from which the agent collects logs, have been added to local log collection poll where it can be used for syslog collection.
• SysEvtCol wasn't starting after the version upgrade. This issue has been fixed.
• It was noticed that the Syslog devices when pinged, continued to ping until the device is restarted. This issue has been fixed.
• Issues in the IPSec VPN reports have been fixed.
• Issue in parsing of Source IP field for Cisco Failed VPN Logon events has been fixed.
• Issues in Archive Integrity Cycle have been fixed.
• Issue in parsing PaloAlto VPN logs has been fixed.
• Log collector down alert was wrongly generated when a syslog device was added as a LinuxFIM. This issue has been fixed.
• The timezone issue while fetching data for Dashboard has been fixed.
• Issues in Apache web server attack reports have been fixed.

 Enhancements

• The Log receiver option is now enabled only for administrators.
• Read access is now provided for the current archive file, so that other applications can access it.
• OpenSSL has been upgraded from openssl_1_1_0c to openssl_1_1_0l.
• Option to disable the population of trend tables (tables containing hourly log count) has been added.
• Parser rules for Windows Event ID 800 has been added.

 Fixes

• Issue with switching the managed server in the Compliance page has been fixed.
• Issues with parsing of severity information from old Windows archive files have been fixed.
• The dashboard now renders perfectly for all date formats.
• Sophos, pfSense, and Juniper devices' logs can now be parsed without errors.
• The Syslog Viewer no longer stops displaying incoming logs when the language is changed from English.
• Issue which caused log collection to be stopped when an existing ELA installation was migrated to a different device has been fixed.
• Issue in deletion of custom fields created from preview of import log has been fixed.
• Issue which caused the alert dumps to accumulate when a correlation rule is built with "is variable" condition has been fixed.
• Updates and improvements to ensure ELA works in the "High Availability" mode when started as a service.
• Fixes to ensure archive logs don't get corrupted when Java virtual machine hangs or shuts down abruptly.
• Problems concerning crashes in native logger have been fixed.
• Problem of disconnection of SSH during agent sync has been fixed.
• Problem with Linux File Integrity Monitoring filters has been fixed.
• Problems with permissions being escalated for non-privileged users while importing logs have been fixed.

 Fixes

• The issue with processing of cached records created before 12120 build has been fixed.

 New features

Compliance reports for NRC and Cyber Essentials

• EventLog Analyzer offers out-of-the-box reports for complying with the mandates prescribed in the Nuclear Regulatory Commission RG 5.71 and Cyber Essentials.

 Enhancements

• You can now import logs stored in Amazon Simple Storage Service (Amazon S3) buckets.
• EventLog Analyzer now supports server message block (SMB) 2.0 for importing logs, discovering IIS Servers, and file integrity monitoring.

 Fixes

• Issue in log collector caused by packet size being bigger than the buffer size has been fixed.
• Issue in sending test emails from the product has been fixed.

 New features

Secure archival of log files

• Checksums are now used to maintain the integrity of archived log files, thus helping meet compliance requirements.

Supports Huawei firewall

• Predefined reports and alert profiles help easily audit security events of Huawei firewalls.

Supports Malwarebytes

• Predefined reports and alert profiles help in auditing logs from Malwarebytes, thereby improving the threat detection mechanism.

 Enhancements

• Kerberos has been added as an authentication method for log collection.
• Removable Disk Auditing now supports more device types.
• The object access policies enabled by default in an agent have been optimized to reduce log dropping.
• The IP address of the remote device has been added as a field in file integrity monitoring logs.
• Permission changes for files are now audited.
• All logs generated during agent downtime will be collected from the Event Viewer, once the agent recovers.

 Fixes

• Issue with restarting of the log collector has been fixed.
• Issue in specifying multiple entries in the fields of database filters has been fixed.
• Issue in log collection filter for Windows logs forwarded as syslog has been fixed.
• Consistency issue in deletion events of folders with child objects has been fixed.

 New features

• The correlation module now supports logs from ManageEngine OpManager and Password Manager Pro.
• Forensic analysis can be performed on the actions of the user(s) and device(s) involved in a successfully correlated event.

 Enhancements

• Reports of network devices can now also be viewed in the Compliance tab.
• An option to enable or disable the out of memory alert notification.
• The mail subject of low disk space and out of memory alerts can be customized.
• Automatic assignment of alerts to technicians based on alert profiles.
• An option to delete generated alerts, when deleting the alert profile that they are associated to.
• Exporting compliance reports has been made faster.
• The compliance report scheduler has been enhanced.

 Fixes

• Issue in parsing of File Integrity Message in the alert mail has been fixed.
• Issue in automatically adding agent has been fixed.
• Issue which generated alerts with wrong criteria for AS400 has been fixed.
• Issue in Compliance report scheduler has been fixed.

 New features

SQL Server auto discovery

• which makes it easier to configure SQL servers for monitoring.

Column Integrity Monitoring in SQL Server

• Track changes in a monitored column including who changed the value, at what time the value was changed, and the database table in which the value was changed.

SQL Server Advanced Audit reports

• SQL Server Advanced Audit reports provide information on the history of schema and object changes, most used tables, and more.

 Enhancements

• Auditing can now be enabled only for the selected SQL Server instances.
• Audit policies can now be created or deleted from EventLog Analyzer.
• The user interface of the Manage Applications tab has been enhanced for better user experience.

 Fixes

• Issue in password with special characters entered during the configuration of mail server has been fixed.
• Issue which added duplicate entries to reports exported in CSV format has been fixed.
• Issues in parsing and indexing of SolarWinds and Snare logs have been fixed.
• Cross Site Scripting (XSS) in the search and reports page (CVE-2018-7405) raised by Suresh Khutale has been fixed.
• Vulnerability issue of remote code execution when uploaded by an agent has been fixed.