Table of Contents

1. 5.2 (GA)
   • Build 5296

     Released on 17 Jan, 2023

     Hot Fixes

     • Config file corruption due to insufficient storage has been fixed.
     • Issues with accessing Log360 UI post upgrade (in build versions 5269 and above) have been fixed.
   • Build 5293

     Released on 30 Dec, 2022

     New feature

     A customizable dashboard where the user will be able to add tabs, customize tabs, add widgets, customize widgets with other customizations such as Full Screen and Dark theme.

     Enhancement

     The GUI of the dashboard page in Log360 has been revamped.

   • Build 5289

     Released on 24 Nov, 2022

     New feature

     • Log360 now offers audit-ready compliance reports for:
       • GLBA
       • ISO 27001:2013
       • Cyber Essentials
       • ISLP
       • NRC
       • COCO
       • NERC
       • FERPA
       • PDPA
   • Build 5288

     Released on 16 Nov, 2022

     Features

     • In-app push notifications: Get notified about security releases and vulnerabilities within the app.
   • Build 5286

     Released on 04 Nov, 2022

     Enhancement

     • Log360 now allows you to configure your mail server using SMTP (Basic or OAuth authentication) or using your mail service provider’s API.
   • Build 5282

     Released on 26 Oct, 2022

     Important Update

     • Third-party requirement for NTLMv2 SSO: To enable NTLMv2 SSO for ManageEngine Log360 and the integrated components in builds 5282 and above, you will have to manually download the Jespa JAR file and add it to the product's lib folder. For more information, click here.
     • Note for customers who are on build 5281 or lower: If you have already enabled NTLMv2 SSO, you can continue using the feature and no further actions are needed.

     Notes: Please ensure that you integrate EventLog Analyzer version 12250 or above in the latest and upcoming builds of Log360 (Build 5282 and above).
   • Build 5281

     Released on 20 Oct, 2022

     Enhancements

     • The Centralized Technician Management feature now supports limited editions of M365 Manager Plus and Exchange Reporter Plus.

     Fixes

     • Issues while editing multiple delegations using Log360's Centralized Technician Management console have been fixed.
   • Build 5279

     Released on 28 Sep, 2022

     Features

     • You can now reorder the integrated components in the apps pane.
     • Microsoft Authenticator and custom TOTP authenticator can be added.
     • Log360 now provides out-of-the-box compliance reports for California Privacy Rights Act (CPRA).

     Enhancements

     • The GUI of the integration page in Log360 has been revamped.

     Fixes

     • Issues faced by admin technicians in downloading scheduled compliance reports have been fixed.
     • An issue where emails had corrupted zip files for scheduled compliance reports in CSV format has been resolved.
     • Issues in translating the overview PDF to Japanese and Chinese in scheduled compliance reports have been fixed.
   • Build 5276

     Released on 02 Sep, 2022

     Fix

     • When you add a new technician using Log360's Centralized Technician Management console and delegating that technician with access to EventLog Analyzer component, there was an issue in delegating device groups, when the count was more than ten. This issue has been fixed.
   • Build 5275

     Released on 19 Aug, 2022

     Enhancements

     • When EventLog Analyzer is integrated with Log360, the disconnected or stopped child product's Elasticsearch node will auto restart when Log360 is started.

     Note: EventLog Analyzer needs to be upgraded to build 12239 for this feature to be available.
   • Build 5274

     Released on 09 Aug, 2022

     Enhancement

     • The size of the installation file (.exe) has been reduced.
   • Build 5272

     Released on 02 Aug, 2022

     Fixes

     • Internal code refactoring has been done.
     • With the centralized technician management feature (from Build 5250), there was an issue with managing the existing AD technician accounts before the upgrade. This issue has been fixed.
   • Build 5269

     Released on 19 Jul, 2022

     Enhancements

     • Java Runtime Environment (JRE) package has been upgraded to Zulu JRE 1.8.0_282.
   • Build 5268

     Released on 01 Jul, 2022

     New feature

     • The default installation location has been changed to Program Files/Program Files(x86), based on the architecture.

       Note: Kindly ensure that you integrate EventLog Analyzer version 12225 or above in the latest and upcoming builds of Log360 (Build 5268 and above).

   • Build 5267

     Released on 29 Jun, 2022

     Fixes

     • Device synchronization issues have been fixed.
     • Installation and uninstallation issues have been fixed.
     • Out of memory issues have been fixed.
     • Domain synchronization issues have been fixed.
   • Build 5265

     Released on 13 Jun, 2022

     Fix

     • While integrating a product in Log360 using an alias name, SAN names revert to the common name or hostname. This is now fixed.
   • Build 5263

     Released on 1 Jun, 2022

     Feature

     • Browser notifications: Get push notifications in your web browser for product downtime, updates, new events (workshops, webinars, seminars), and more.

     Fixes

     • Issues while accessing Eventlog Analyzer reports tab from Log360's apps pane using the reverse proxy URL are fixed.
     • Reflected XSS is fixed.
     • CSRF token generation will be session-based now.
   • Build 5262

     Released on 26 May, 2022

     Issue fixes

     • A rare upgrade failure issue has been fixed.
     • Issues with auto update for builds starting from 5256 have been fixed.

     Note: Auto update will not work for builds starting from 5256 to 5261. Users will have to manually update these builds.
   • Build 5261

     Released on 19 May, 2022

     Enhancements

     • The version of Spring Framework jar bundled with the product has been upgraded to 5.3.18.
   • Build 5256

     Released on 16 Mar, 2022

     Enhancements

     • Internal code refactoring for enhanced security.
   • Build 5254

     Released on 14 Feb, 2022

     New feature

     • Log360 now has out-of-the-box compliance reports for the Protection of Personal Information Act (POPIA).

     Fix

     • Issue in Startup notification mail has now been fixed.
   • Build 5253

     Released on 9 Feb, 2022

     New feature

     • Log360 now has out-of-the-box compliance reports for the Cybersecurity Maturity Model Certification (CMMC).
   • Build 5250

     Released on 19 Jan, 2022

     New feature

     • Centralized Technician Management: Technicians accounts can be managed centrally from the Log360 UI for all the components.

     Note: Limited versions of ADManager Plus, M365 Manager Plus and Exchange Reporter Plus do not support Centralized Technician Management Feature.
   • Build 5246

     Released on 7 Jan, 2022

     Fix

     • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-44832).
     • Removed log4j-1.2.15.jar in Log360\lib folder
   • Build 5245

     Released on 24 Dec, 2021

     Issue fix

     • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-45105).
   • Build 5244

     Released on 17 Dec, 2021

     Issue fix

     • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-45046).
     • JAR-hell issue post 5243 service pack is fixed.
   • Build 5243

     Released on 14 Dec, 2021

     Fix

     • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-44228).
   • Build 5242

     Released on 6 Dec, 2021

     Enhancement:

     • Internal code refactoring for enhanced security.

     Fix

     • Clickjacking vulnerability which could allow an attacker to disclose information or redirect users, has been patched.
   • Build 5240

     Released on 25 Nov, 2021

     Enhancement:

     • The version of PostGreSQL bundled with the product has been upgraded to 10.18.
   • Build 5238

     Released on 17 Nov, 2021

     Enhancements:

     • Security Hardening tab to manage and configure all security settings of Log360 from one place.
     • Mandatory default password change for built-in admin account.

     Fixes:

     • Internal Bug Bounty fixes
     • Internal code refactoring
   • Build 5236

     Released on 22 Oct, 2021

     Fix:

     • Apache Struts dependency has been removed from Log360 to fix the vulnerabilities caused by it.
   • Build 5235

     Released on 15 Oct, 2021

     Fix:

     • This release includes a fix for a critical security vulnerability with ID CVE-2021-20136, to prevent remote code execution (RCE).
   • Build 5234

     Released on 14 Oct, 2021

     Fix:

     • This release includes a fix for the remote code execution (RCE) issue when migrating the DB server, reported by moon.
   • Build 5233

     Released on 12 Oct, 2021

     Fix:

     • Internal code refactoring has been done.
   • Build 5232

     Released on 4 Oct, 2021

     Fix:

     • Internal code refactoring has been done.
   • Build 5229

     Released on 9 Sep, 2021

     Security Issue fix:

     • An authentication bypass vulnerability affecting REST API URLs, which was rated critical, has now been fixed.
   • Build 5226

     Released on 11 Aug, 2021

     Fix:

     • EventLog Analyzer was not loading properly when accessed from Log360's apps pane. This issue was observed in builds released post 12160 and 5220 of EventLog Analyzer and Log360 respectively. It has now been fixed.
   • Build 5225

     Released on 30 Jul, 2021

     Fixes:

     The following security issues have been fixed.

     • ZVE-2021-2132: Remote code execution issue using BCP file overwrite reported by Sahil Dhar.
     • ZVE-2021-2020: Multiple stored cross-site scripting vulnerabilities reported by Sahil Dhar.
     • ZVE-2021-2407: OS Command injection vulnerability reported by Thai.
   • Build 5224

     Released on 7 Jul, 2021

     Fixes:

     • The CSRF vulnerability has been fixed to prevent possible attacks.
     • The following security issues have been fixed:
       • ZVE-2021-2034: The CSRF vulnerability in disabling logon security settings. (The issue was identified by reporter, Sahil Dhar).
       • ZVE-2021-2018: Remote code execution using the arbitrary file overwrite vulnerability. (The issue was identified by reporter, Sahil Dhar).
       • ZVE-2021-2033: The issue in validating LOGO_PATH key value in the stored XSS logon settings. (The issue was identified by reporter, Sahil Dhar).
   • Build 5219

     Released on 19 May, 2021

     Security issue fixes:

     • This release includes the fix for ZVE-2021-1509 unrestricted file upload issue that led to remote execution of code, thereby allowing unauthorized access to the server, reported by Sahil Dhar.
     • It also includes the fix for CSRF ZVE-2021-1508 vulnerability attack on proxy settings that has been restricted, reported by Sahil Dhar.
   • Build 5218

     Released on 16 Mar, 2021

     Bug bounty fix:

     • Zip-Slip vulnerability that arises when uploading a zip in SSL certification tool has been fixed.
   • Build 5214

     Released on 4 Jan, 2021

     New feature:

     Centralized device allocation:

     • Windows devices can be centrally managed across the log management and active directory auditing components of Log360.

     Enhancements:

     • The log management component of Log360 can now be deployed in distributed environments and monitored centrally.

     Note:

     • By default, Log360 auto updating capability will be disabled. Manually enable it to automatically update to the latest version.
     • Kindly ensure that you integrate EventLog Analyzer version 12150 or above and ADAudit Plus version 6065 or above in the latest and upcoming builds of Log360 (Build 5214 and above).
   • Build 5213

     Released on 27 Nov, 2020

     New feature:

     • Reverse proxy support: Log360 can now be configured as a reverse proxy server. Enhance security for your servers, as their identity is protected and all communication between them and their clients is routed through Log360.

     Enhancements:

     • User interface enhancements
       • The apps pane in the product has been enhanced to make it easier to access.
       • The option button to jump to related products has been enhanced for better visual appeal.
       • The components integrated with the product will now load automatically to reduce the UI loading time.
       • The Log360 logo will now be displayed across all the components inside the product.
     • Automated updates: This option allows you to automatically detect, download, and apply the product updates as soon as they are released.
     • The version of jQuery bundled with the product has been upgraded to 3.5.1.

     Fix:

     • Domain users were able to view data that should be accessible only to product admins using a specific URL. This issue has been fixed.
   • Build 5220_Beta

     Released on 5 Nov, 2020

     Enhancements:

     • Get real-time alert notifications when malicious techniques defined in the MITRE ATT&CK framework are detected in your network.
     • Analyze incidents comprehensively with detailed security analytics reports.
     • Group different 'techniques and tactics' alerts into a single logical incident for organized investigation.
     • Group different alert events as an incident and assign it to an analyst.
     • Investigate incidents better by viewing all the related events and actors involved.
     • Manage and bring down the incident resolution time using different metrics such as incident age, and more.

     Click here to access Log360 Build 5220_Beta (Beta version).

   • Build 5211

     Released on 20 Oct, 2020

     Enhancements:

     • The version of Tomcat bundled with the product has been upgraded to 8.5.57
     • The version of PostgreSQL bundled with the product has been upgraded to 10.12
     • The NTLM single sign-on authentication protocol has been upgraded to SMB2.
   • Build 5210

     Released on 31 Aug, 2020

     Enhancements:

     InstallShield 18 has been adopted for installing the solution. The user can now choose from three modes of installation:

     • Standard Installation- All Log360 components will be installed.
     • Custom Installation- The user can choose the required components to be installed.
     • Minimal Installation- Only the Log360 build will be installed.
   • Build 5209

     Released on 28 Aug, 2020

     Fix:

     • The issue which caused the GUI to not load properly and displayed a Refused to connect page while accessing certain components of Log360 has been fixed.
   • Build 5206

     Released on 27 Jul, 2020

     Feature:

     • File Integrity Monitoring console: Log360 now has a dedicated console for file integrity monitoring. This integrated console enables you to configure file integrity monitoring centrally for file servers supported by ADAudit Plus and EventLog Analyzer.
   • Build 5201

     Released on 24 Jun, 2020

     Fix:

     • The failure of Elasticsearch server restart due to timeout has been fixed.
   • Build 5200

     Released on 10 Jun, 2020

     Fixes:

     • The issues experienced while upgrading Log360 to later builds have now been fixed.
     • Issue in Manage Compliance tab for service pack upgrades has been fixed.
2. 5.1 (GA)
   • Build 5167

     Released on 9 Jun, 2020

     Fix:

     • Index archival in Elasticsearch has been fixed.
   • Build 5166

     Released on 17 May, 2020

     Fix:

     • This release includes fix for the CVE-2020-24786 vulnerability, which allowed unauthenticated changes to integration system configuration, reported by Florian Hauser.
   • Build 5164

     Released on 28 Apr, 2020

     New features:

     • Integrated Cloud Security Plus reports: You can now integrate Cloud Security Plus reports in Log360 and view all the reports under the Log360 reports tab.
     • Centralized SSL configuration: You can configure SSL centrally from Log360 for the components.

     Enhancement:

     • Workgroup Servers: Workgroup servers will be synchronized in ELA and ADAP automatically.
   • Build 5160

     Released on 28 Feb, 2020

     Fix

     • Issue in mail synchronization has been fixed.
   • Build 5155

     Released on 16 Jan, 2020

     Fix

     • Issue in EventLog Analyzer's integration with Log360 due to the presence of multiple unpingable devices has been fixed. 
   • Build 5154

     Released on 14 Dec, 2019

     New feature

     • FISMA, GPG, GDPR, CCPA, and SOX compliance reports: Log360 now has out-of-the-box reports for complying with FISMA, GPG, GDPR, CCPA, and SOX.
   • Build 5150

     Released on 23 Sep, 2019

     New feature

     • Compliance management: Log360 now has a dedicated tab for managing compliance requirements. It contains ready-made reports to prove compliance with IT mandates such as PCI DSS and HIPAA.
   • Build 5120

     Released on 4 July, 2019

     New features

     • New login settings
       • Captcha has been included in the login page for increased security.
       • Block users: You can now set a threshold for login attempts. On reaching that threshold, the user will be blocked from trying to login for a specific period.
       • Smart card authentication: The use of smart cards/PKI/certificates has been enabled as additional options for Log360 login. If you have such an authentication system configured in your organization, Log360 can be configured to authenticate users through it, bypassing other first factor methods.
       • Two-factor authentication: Log360 now provides an extra layer of security for its users by supporting two-factor authentication during login. Supported authentication methods include:
         1. Duo Security
         2. RSA SecurID
         3. RADIUS Authentication
         4. Google Authenticator
         5. Email verification
         6. SMS verification
     • SSL Certification tool to help you easily generate CSR and apply SSL certificates in Log360 to make the product safer for data transfer.
     • Database migration: Now you can easily change Log360's bundled PostgreSQL database to Microsoft SQL Server or another instance of PostgreSQL from the web console.

     Enhancements

     • Backup Log360's data on Microsoft SQL Servers, in addition to PostgreSQL databases.
     • Navigate to all the individual components of Log360 from the single tray icon.
     • View upcoming events such as webinars, workshops, and seminars from the Support tab.

     Fix

     • Issue in synchronizing devices has been fixed.
   • Build 5111

     Released on 20 June, 2019

     New Feature

     • Search Engine Management: Users can add multiple machines for the shared storage of data. This optimizes disk space and improves indexing performance.
   • Build 5110

     Released on 31 May, 2019

     Fix

     • Issue in integrating EventLog Analyzer's Linux instance with Log360 has been fixed.
   • Build 5108

     Released on 8 May, 2019

     New feature

     • New language options: Log360 now supports Chinese and Japanese in addition to English.

     Enhancement

     • The graphs in the EventLog Analyzer dashboard of Log360 have been enhanced for easy inference.
   • Build 5107

     Released on 15 Apr, 2019

     New features

     Active Directory Reporting Add-on: Get insights into critical Active Directory security incidents that could help seal the insider attacks. With this add-on, get over 45 predefined report templates that provide details on AD objects such as:

     • Inactive, locked out, account expired, password expired users and more.
     • Security groups, group members, groups without members, and more.
     • Inactive, disabled, recently deleted computers and more.
     • Disabled, unused, recently created GPOs, and more.
     • All OUs, empty and recently created OUs.
     • Shares in servers, permissions on folders, and more.
     • Objects/servers/subnets accessible by accounts, server permissions, and more.
   • Build 5102

     Released on 21 Mar, 2019

     Fix

     • Vulnerability issue in the logo file upload feature has been fixed.
   • Build 5100

     Released on 22 Feb, 2019

     New feature

     User and Entity Behavior Analytics (UEBA)

     Detect user and entity behavior anomalies, account compromises, data exfiltrations, and insider threats with the User and Entity Behavior Analytics (UEBA) add-on, that is powered by machine learning. This add-on offers,

     • Score-based risk assessment
     • Threat corroboration
3. 5.0 (GA)
   • Build 5070

     Released on 8 Feb, 2019

     Enhancement

     • Log360's dashboard keeps getting better with the addition of all the latest reports and graphs from ADAudit Plus.

     Fixes

     • Issue in applying self-signed certificates has been fixed.
     • Issue in auto-backup of EventLog Analyzer has been fixed.
   • Build 5065

     Released on 12 Dec, 2018

     Enhancement

     • Technicians created in EventLog Analyzer and ADAudit Plus components of Log360 can now login to the M365 Manager Plus module.
   • Build 5063

     Released on 23 Nov, 2018

     New Feature

     ManageEngine DataSecurity Plus, a data visibility and security solution, capable of data discovery, file storage analysis, and Windows file server auditing has been integrated with Log360. You can now,

     • Locate, analyze, and secure personally identifiable information (PII) in your files, folders, and shares from insider and external threats.
     • Gain visibility into data usage trends, file access patterns, volume of personal data in files, and file permission changes.
     • Meet multiple compliance regulations, and generate clear, concise audit records as legal evidence.
   • Build 5047

     Released on 4 Apr, 2018

     New Feature

     ManageEngine Exchange Reporter Plus, an auditing, alerting, and reporting solution for Microsoft Exchange Servers has now integrated with Log360. With this integration, track incoming and outgoing email messages, monitor mailbox sizes, and perform Exchange traffic analysis.

     • Exchange Server reporting: Get complete information about all components of your Exchange environment, including mailboxes, distribution lists, public folders, and more.
     • Exchange Server auditing: Track and report on non-owner mailbox accesses, mailbox logon activity, changes to mailbox permissions, server configurations, and more.
   • Build 5044

     Released on 7 Mar, 2018

     Fixes

     • Cross Site Scripting (XSS) vulnerability issue in the search and reports page (CVE-2018-7405) raised by Suresh Khutale has been fixed.
     • Vulnerability issue of remote code execution when uploaded by an agent (DDI-VRT-2018-10) has been fixed.
   • Build 5043

     Released on 19 Feb, 2018

     New Feature

     ManageEngine M365 Manager Plus, an Microsoft 365 reporting, management, auditing, and alerting tool is now integrated with Log360. With this integration, get access to general and audit reports, and create alerts for critical events in Exchange Online and Azure Active Directory.

     • Microsoft 365 Reporting: Access an exhaustive list of reports to get deep insights on Exchange Online and Azure Active Directory and comply with industry mandates like SOX, PCI DSS, FISMA, HIPAA, and GLBA.
     • Microsoft 365 Auditing: Audit non-owner mailbox accesses, admin activities, password resets, license modifications, group membership changes, and more.
     • Microsoft 365 Alerting: Create your own custom alerts for critical events in Exchange Online and Azure Active Directory to get notified via email in real-time.
   • Build 5040

     Released on 12 Jan, 2018

     New Features

     • Three new predefined correlation rules that detect suspicious SQL backup, installation of services and software.
     • Logs from syslog and other devices can be forwarded to any server including file servers and Windows servers.
   • Build 5039

     Released on 8 Dec, 2017

     New Feature

     • GDPR compliance reports: Offers predefined report templates to help you easily comply with the GDPR's requirements.
   • Build 5038

     Released on 29 Nov, 2017

     New Features

     • Reports of both ADAuditPlus and EventLog Analyzer have been consolidated and can be viewed in the same window.

     Enhancements

     • The mechanism of recording the log flow rate has been changed.
     • An extra field "Display name" has been added to the pre-defined reports and search section.

     Fixes

     • The issue with parsing of fields for NPS events occurring on Windows Server 2016 has been fixed.
     • Addition of VMware reports for created and deleted VMs (Event IDs: 13002 and 13003).
     • The issue with the Solaris user account management report and SUDO command execution report has been fixed.
     • Issue with populating of web traffic reports for WatchGuard has been fixed.
     • The issue with the policy changes report for Symantec devices has been fixed.
     • The issue with exporting reports from the "My Reports" category in EventLog Analyzer has been fixed.
   • Build 5036

     Released on 17 Oct, 2017

     New Features

     The Correlation Engine has been completely upgraded to bring you complex attack detection across all devices on your network, enhanced field-level correlation, improved incident reports with timeline view, and much more:

     • Multiple log format support: Correlation is now carried out across multiple log formats, enabling you to correlate logs from Windows and Unix systems, network devices, and more.
     • Enhanced field-level correlation: Correlation can be done based on multiple log field values to provide fine-grained attack detection.
     • Predefined rules: The module is packaged with 25 predefined complex attack patterns.
     • Custom rule builder: The custom correlation rule builder has been upgraded to include over 250 predefined network actions and advanced filters.
       • Check for unique, constant, or shared field values among the actions that make up a rule.
       • Use multiple comparison conditions for fields, namely 'equals', 'not equal to', 'starts with', or 'ends with'.
       • Create rules for individual log types using specific network actions, or rules common to all log types with generic network actions.
     • Incident management integration: All correlation alerts can be viewed and managed with the in-built incident management console.

     Enhancements

     • The correlation user interface has been upgraded with an all new look and feel, incorporating all the above new features.
     • The time between each individual pair of actions can now be specified when creating a rule.
   • Build 5031

     Released on August 15th, 2017

     • Enhanced threat intelligence platform: The solution now supports STIX/TAXII threat feeds. The global threat feed database will be updated automatically.
     • Malicious IP and URL alerts: Upon analyzing the threat feeds and log data from the network, the solution sends out real-time alerts if suspicious traffic or out going traffic to malicious domain is detected.
   • Build 5030

     Released on August 4th, 2017

     • Log360 now supports NTLMv2 authentication.
     • You can now automatically back up PostgreSQL database of EventLog Analyzer and Log 360.
   • Build 5024

     Released on July 19th, 2017

     • Host synchronisation mechanism has been enhanced.
       • Inherited hosts that are disabled due to license expiry or limit exceeding license count, cannot be enabled.
       • If a host has been added in one of the components, then it will be inherited automatically in the other component.