v3.61.0

What's Changed

🏡 Miscellaneous

• Releasing performance improvements by @nhakmiller in #1305
• Update rule_jsonschema.json by @chrisarav in #1306
• build(deps): bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @dependabot in #1309
• UDM safe lookups by @nhakmiller in #1311
• Minor typo fix in displayname, potentiall -> potentially by @kjihso in #1312
• Add Github Dependabot Alert Dismissed Rule by @elimgh in #1310
• added default values to get/deep_get by @arielkr256 in #1313
• AWS Compromised Service Role - CR -> Scheduled Rule by @arielkr256 in #1315
• GitHub Advanced Security Change WITHOUT Repo Archived - Sequence to Group CR by @arielkr256 in #1314
• build(deps): bump step-security/harden-runner from 2.9.0 to 2.9.1 by @dependabot in #1317
• Update again gcp_k8s_cron_job_created_or_modified.yml by @chrisarav in #1318
• Prepare for 3.60.0 by @akozlovets098 in #1319
• CR upload fixes by @arielkr256 in #1320

New Contributors

• @chrisarav made their first contribution in #1306
• @elimgh made their first contribution in #1310

Full Changelog: v3.59.0...v3.60.0
Full Changelog: v3.60.0...v3.61.0

v3.59.0

What's Changed

🏡 Miscellaneous

• Prepare for 3.58 by @ben-githubs in #1299
• Add entity JSON object to Slack Privilege Escalation tests by @bmbeverst in #1300
• Update rates by @nhakmiller in #1301
• Bump rate minutes more by @nhakmiller in #1302

Full Changelog: v3.58.0...v3.59.0

v3.58.0

What's Changed

🏡 Miscellaneous

• 3.57.0 Release by @le4ker in #1291
• Update safe lookup by @nhakmiller in #1292
• Update default timeouts by @nhakmiller in #1294
• build(deps): bump step-security/harden-runner from 2.8.1 to 2.9.0 by @dependabot in #1293
• build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @dependabot in #1297
• build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 by @dependabot in #1298
• Fix methodName lookups for Cloud Run rules, add tests by @geoffg-sentry in #1296
• Correct the target and actor in Slack Audit log UserPrivilegeEscalation plus clean up by @bmbeverst in #1288
• bugfix for base64 encoded arguments by @arielkr256 in #1295

New Contributors

• @bmbeverst made their first contribution in #1288

Full Changelog: v3.57.0...v3.58.0

v3.57.0

What's Changed

🏡 Miscellaneous

• Remove explorer/powershell relationship by @geoffg-sentry in #1278
• build(deps): bump docker/setup-qemu-action from 3.0.0 to 3.1.0 by @dependabot in #1281
• build(deps): bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in #1282
• Aws gd ref links by @JPhenglavong in #1283
• Add initial Correlation Rules by @egibs in #1260
• Snowflake Data Exfiltration CR by @arielkr256 in #1257
• lower severity for sensor update requests by @arielkr256 in #1285
• correlation rules from AWS re:inforce by @arielkr256 in #1279
• build(deps): bump actions/setup-python from 5.1.0 to 5.1.1 by @dependabot in #1284
• Formatting: Converting Tabs to Spaces in YAML Files by @ben-githubs in #1290
• CrowdStrike event stream api rules by @JPhenglavong in #1286
• Push Security correlation rules by @arielkr256 in #1280

New Contributors

• @geoffg-sentry made their first contribution in #1278

Full Changelog: v3.56.0...v3.57.0

v3.56.0

What's Changed

🏡 Miscellaneous

• Update PAT to 0.51.0 by @egibs in #1272
• latest traildiscover updates by @arielkr256 in #1273
• Threat-315 Wiz Alert Passthrough by @akozlovets098 in #1251

Full Changelog: v3.55.0...v3.56.0

v3.55.0

What's Changed

🏡 Miscellaneous

• Replace panther_analysis_tool import with updated import by @egibs in #1230
• Update Action versions; use SHAs by @egibs in #1231
• migrates the gcp_storage_hmac_keys_create rule to by @arielkr256 in #1233
• move scheduled rules to the queries directory by @arielkr256 in #1234
• consistency nit fixes by @kjihso in #1235
• AppOmni Alert passthrough by @jzandona in #1211
• Push Security rules by @jstanulis-push in #1207
• Push Security pack by @arielkr256 in #1239
• Push logtype update by @arielkr256 in #1240
• Remove Node/NPM/Prettier by @egibs in #1241
• Small Workflow tweaks by @egibs in #1243
• Use harden-runner Action for all Workflows by @egibs in #1244
• Threat 319 Replace geoinfo_from_ip with new version by @akozlovets098 in #1242
• Use full Action SHAs rather than versioned releases by @egibs in #1245
• THREAT-321 Auth0 CIC Credential Stuffing by @arielkr256 in #1246
• Update panther-core to 0.10.1 via PAT by @egibs in #1249
• Tweak Snowflake queries by @egibs in #1250
• Fixed typo in README.md by @JPhenglavong in #1253
• build(deps): bump step-security/harden-runner from 2.8.0 to 2.8.1 by @dependabot in #1254
• Using GITHUB_OUTPUT env var instead of old ::set-output shorthand by @c0nfleis in #1255
• OCSF data model, VPC/DNS by @akozlovets098 in #1214
• fix: consider deny rules for ssh network acl policy by @skeggse in #1236
• AWS Honeypot Detections threat-306 by @JPhenglavong in #1252
• Update aws_console_login_without_mfa.py by @JPhenglavong in #1237
• Update PAT to 0.50.0 by @egibs in #1259
• Push Security schema rename by @arielkr256 in #1258
• build(deps): bump actions/checkout from 4.1.6 to 4.1.7 by @dependabot in #1263
• Update PAT to 0.50.1 by @egibs in #1261
• improve error handling for dynamic functions by @arielkr256 in #1262
• update vscode schema to honor correlation rules by @nskobov in #1264
• Remove .husky directory by @le4ker in #1266
• update snowflake queries with p_occurs_since by @arielkr256 in #1265
• remove greynoise luts by @arielkr256 in #1267
• Edit: Downgrade Okta.Anonymizing.VPN.Login to INFO severity if Apple Relay used by @ben-githubs in #1268
• Remove unnecessary pipenv step by @egibs in #1270

New Contributors

• @jstanulis-push made their first contribution in #1207
• @skeggse made their first contribution in #1236

Full Changelog: v3.54.0...v3.55.0

v3.54.0

What's Changed

🏡 Miscellaneous

• Prepare for 3.53.0 by @egibs in #1232
• Add saved queries for ongoing Snowflake threats by @egibs in #1248

Full Changelog: v3.53.0...v3.54.0

v3.53.0

What's Changed

🏡 Miscellaneous

• Update PAT to 0.48.0; PDH to 0.4.0 (#1227) by @egibs in #1228
• Add threat-research as codeowners (#1213) by @egibs in #1229
• Replace panther_analysis_tool import with updated import by @egibs in #1230
• Update Action versions; use SHAs by @egibs in #1231

Full Changelog: v3.52.0...v3.53.0

v3.52.0

What's Changed

🏡 Miscellaneous

• Prepare for 3.51.0 by @egibs in #1225
• Use Python3.11 for panther-analysis (#1223) by @egibs in #1226
• Update PAT to 0.48.0; PDH to 0.4.0 by @egibs in #1227

Full Changelog: v3.51.0...v3.52.0

v3.51.0

What's Changed

🏡 Miscellaneous

• Prepare for 3.50.0 by @egibs in #1217
• Fix timestamps by @nhakmiller in #1219

Full Changelog: v3.50.0...v3.51.0