https://cybertoolchain.io/tools/hunters-pathfinder-ai New releases and features in Hunters Pathfinder AI, tracked by The Cyber Toolchain. en Mon, 07 Sep 2026 07:33:06 GMT https://docs.hunters.ai/v1/docs/updates https://docs.hunters.ai/v1/docs/updates Mon, 07 Sep 2026 07:33:06 GMT Hunters Pathfinder AI adds unified anomalous login detection, Windows password-change enrichment and scoring, and four new AXON threat hunting reports. • Adds the `Context Unified Anomalous Login` detector, which evaluates successful anomalous logins across identity providers, SaaS applications, cloud platforms, VPNs, and other integrated login sources using per-user behavioral baselines covering geolocation, IP address, and user agent category. • Introduces the `Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity` detector, identifying authentication activity from offensive-related distributions and tools including Kali Linux, Parrot Linux, BackBox Linux, BlackArch Linux, Scout Suite, TrailBlazer, and TruffleHog. • Adds a `Windows Recent Password Change` enrichment that queries Windows Security Event Logs for Event ID 4723 (self-initiated password change) and Event ID 4724 (privileged password reset), surfacing last change time, initiating user, and source computer as lead context. • Adds a `Windows Recent Password Change Model` scoring layer that applies a configurable confidence modifier to reduce noise from password-reset-triggered alerts and increase confidence when a password change may indicate account takeover. • Adds an AXON Threat Hunting Report for multi-layer Base64-encoded command execution covering defense evasion and obfuscation across Windows, Linux, and macOS process creation events. • Adds an AXON Threat Hunting Report for Azure Service Principal sign-ins via anomalous user agents, using a 45-day behavioral baseline and automatic suppression when a corresponding app registration update occurred within 24 hours of the anomalous sign-in. • Adds an AXON Threat Hunting Report for publicly accessible cloud storage resources across AWS S3, Azure Blob Storage, and Google Cloud Storage, identifying externally reachable buckets and containers with anonymous enumeration or access. Breaking changes: • The following detectors are deprecated and will be removed on July 6, 2026, replaced by `Context Unified Anomalous Login`: `CloudTrail anomalous console login`, `Anomalous login by an Azure account`, `Office365 anomalous login`, `Okta anomalous login`, `Okta successful login from host without an EDR agent`, `Okta successful administrative access from host without an EDR agent`, `Successful Duo authentication from host without an EDR agent`, `Successful Azure portal sign-in from machine without EDR agent`, `Successful Azure CLI sign-in from machine without EDR agent`, `Successful AWS console login from host without an EDR agent`, `Successful G Suite login from computer without EDR agent`, `G Suite successful authorization of token to GCP related interface without EDR agent`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/v1/docs/updates https://docs.hunters.ai/v1/docs/updates Mon, 13 Jul 2026 10:06:56 GMT Hunters adds unified anomalous login detector, Windows password-change enrichment/scoring, and four new AXON threat hunt reports. • New detector: 'Context Unified Anomalous Login' detects successful anomalous logins across identity providers, SaaS apps, cloud platforms, VPNs, and other integrated login sources using per-user behavioral baselines spanning geolocation, IP, and user-agent signals. • New detector: 'Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity' flags authentication activity from offensive tooling (Kali Linux, Parrot Linux, Scout Suite, TruffleHog, and others) in SPN and non-interactive sign-in flows. • New enrichment: 'Windows Recent Password Change' queries Windows Security Event Logs (Event ID 4723 and 4724) to surface last password change time, initiating user, and source computer as lead context. • New scoring layer: 'Windows Recent Password Change Model' applies a configurable confidence modifier to leads based on recency of password reset, reducing noise from post-reset behavior and boosting confidence in potential account-takeover scenarios. • New AXON Threat Hunt Report: Multi-Layer Encoded Command Execution — hunts for nested Base64 encoding/decoding chains in process creation events across Windows, Linux, and macOS as indicators of payload obfuscation. • New AXON Threat Hunt Report: Azure Service Principal Sign-In via Anomalous User Agent — baselines each SPN's User Agent over 45 days and suppresses false positives by correlating against Azure Audit logs for app registration changes within 24 hours. • New AXON Threat Hunt Report: Suspicious User-Agent in Azure Non-Interactive/SPN Sign-In Activity — extends prior interactive-login coverage to SPN and non-interactive sign-ins targeting high-privilege, MFA-exempt identities. • New AXON Threat Hunt Report: Publicly Accessible Storage Resources — external exposure assessment discovers and validates publicly reachable AWS S3, Azure Blob Storage, and Google Cloud Storage resources using customer domains and org identifiers. • Breaking change: Twelve legacy anomalous-login detectors (including CloudTrail, Azure, Office 365, Okta, Duo, AWS, and G Suite variants) will be deprecated on July 6, 2026, replaced by the new 'Context Unified Anomalous Login' detector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/june-2026-1 https://docs.hunters.ai/docs/june-2026-1 Mon, 01 Jun 2026 00:00:00 GMT Hunters Pathfinder AI June 2026 adds S3 data onboarding, Org Context UI, 5 new detectors and 10 integrations. • Adds `pathfinder` data onboarding capability to ingest custom S3 buckets with automatic OCSF mapping • Adds organizational context creation via public preview UI for manual input • Adds 'Suspicious File Created in Windows Startup Folder' detector • Adds 'Suspicious User-Agent Observed in Sign-In Activity' detector • Adds 'Microsoft 365 Defender Copilot Prompt Injection 3rd Party Alert' detector • Adds 'Azure Service Principal Sign-In via Unusual User Agent Category' detector • Adds 'Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity' detector • Adds Windows User Lock Status enrichment and scoring model • Adds Upguard Alerts SaaS integration • Adds Upguard Cyberrisk Breaches logs integration • Adds Barracuda Sentinel logs integration • Adds Cloudflare Network Analytics integration • Adds E-Series integration • Adds IBM DB2 integration • Adds Cisco FMC integration • Adds Cohesity integration • Adds CyberArk Cloud Audit Logs integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/v1/docs/updates https://docs.hunters.ai/v1/docs/updates Mon, 01 Jun 2026 00:00:00 GMT Hunters Pathfinder AI adds Context Unified Anomalous Login detector, new threat hunts, and Windows Password Change enrichment • Adds `Context Unified Anomalous Login` detector for successful anomalous logins across unified authentication sources (identity providers, SaaS, cloud, VPN) • Introduces multi-layer encoded command execution detection for process creation events with nested Base64 encoding/decoding on Windows, Linux, and macOS • Adds Azure Service Principal sign-in anomaly detection based on User Agent divergence from 45-day baseline with audit log correlation • Adds `Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity` detector for offensive tool signatures in SPN/non-interactive sign-ins • Adds publicly accessible storage resource discovery for AWS S3, Azure Blob Storage, and Google Cloud Storage via automated external exposure assessment • Adds `Windows Recent Password Change` enrichment querying Event ID 4723/4724 for password reset context • Adds `Windows Recent Password Change Model` scoring layer with configurable confidence modifier based on recent password resets Breaking changes: • The following legacy detectors are deprecated and will stop functioning after July 6, 2026: CloudTrail anomalous console login, Anomalous login by an Azure account, Office365 anomalous login, Okta anomalous login, Okta successful login from host without an EDR agent, Okta successful administrative access from host without an EDR agent, Successful Duo authentication from host without an EDR agent, Successful Azure portal sign-in from machine without EDR agent, Successful Azure CLI sign-in from machine without EDR agent, Successful AWS console login from host without an EDR agent, Successful G Suite login from computer without EDR agent, G Suite successful authorization of token to GCP related interface without EDR agent. They are replaced by `Context Unified Anomalous Login`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/december-2025-2 https://docs.hunters.ai/docs/december-2025-2 Mon, 01 Dec 2025 00:00:00 GMT Hunters Pathfinder AI Open Beta, new IOC IPv6 support, and multiple integrations • Pathfinder AI moves to Open Beta on Jan 7, 2026, enabling automatic AI-driven investigations on all relevant alerts within the Hunters platform. • IOCs Search now supports IPv6 addresses for indicator lookups. • Adds CrowdStrike Falcon 3rd party XDR detections via a new Alerts API endpoint integration. • Enrichments now display service operations made on an agent ID in the 24 hours prior to lead start time. • New integrations: Checkpoint EDR (S3), KnowBe4 PhishER (Webhook/S3), Netskope Network Events (API), Cerberus (S3), Windows DNS channel/debug logs (S3), GCP-V2 SCC Assets/Findings (API), Pan firewall Users (API), BeyondTrust PW safe On-Prem (S3 migration). Breaking changes: • CrowdStrike 'Incident logs' are being retired; users must migrate to the CrowdStrike Alerts (crowdstrike_alerts) integration before March 9, 2026. • Microsoft Message Trace legacy tools and APIs will be turned off on March 18, 2026; users must migrate to Microsoft's Graph API endpoint for continued email log ingestion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-december-2025-1 https://docs.hunters.ai/docs/release-notes-december-2025-1 Mon, 01 Dec 2025 00:00:00 GMT Hunters Pathfinder AI Dec 2025 adds Data Source pivot to Search and 8 new integrations. • Adds a 'Pivot to Search' action on the Data Source page to run a 100-record query from the datalake • Adds `Azure Sign-In Info from Correlation ID` enrichment to create an Azure Sign-In Mega Entity based on `azure_correlation_id` • Adds `M365 File Download App Usage Statistics` enrichment displaying global and user-specific download stats • Adds 8 new integrations: Delinea-audit-logs (S3), FortiDLP-logs (API), Genesys-audit-logs (API), FastTrack (3 API endpoints), Vectra RUX Detection events (API), Sekoia Advanced Feed (API), PAN firewall URL-filtering (S3) • Improves Detector page UX to display the effective alert threshold by calculating Hunter default vs customer setting vs global alert threshold Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/november-2025-1 https://docs.hunters.ai/docs/november-2025-1 Sat, 01 Nov 2025 00:00:00 GMT New detectors for SMB lateral movement and Impacket execution; new EDR and AWS drilldowns; new integrations for Wiz, Zero Networks, Jamf Protect, and others. • Adds `SMB Connection From an Abnormal Process` detector that flags non-system processes initiating SMB connections via Windows event log 5156. • Adds `Possible Execution of Impacket` detector to identify potential lateral movement and credential theft via Impacket scripts. • Adds `New-Browser User Agents Authenticating to OfficeHome` detector for monitoring non-browser authentication to Microsoft 365. • Adds `Microsoft 365 Abnormal Mail Access by Unusual ClientAppId` detector for detecting mailbox access via atypical client applications. • Adds Suspicious Teams communication from foreign user detector filtering chats from commonly used domains. • Adds `EDR Process ID to Registry Operations` drilldown querying registry activity half an hour before and after lead inception. • Adds `Process Connections from IP over Kerberos` drilldown for identifying outbound Kerberos connections (port 88) by process. • Adds `Destination IP to Process Connections` drilldown mapping destination IPs to endpoint processes. • Adds `AWS User Role Attachment Activities` drilldown monitoring AttachRolePolicy, AttachGroupPolicy, and AttachUserPolicy events. • Adds Associated Microsoft Teams Activities and Complementary M365 audit logs drilldown for investigating Teams phishing success. • Adds SentinelOne Threat Raw Correlation drilldown providing context on alerts, processes, files, and network activity. • Adds new integration for Wiz Threats via Webhook/S3. • Adds new integration for Zero Networks Audit Activity Logs via API/S3. • Adds new integration for Jamf Protect Events via API/S3. • Adds new integration for Tanium audit logs (33 endpoints) via API/S3. • Adds new integration for Fastly WAF via S3. • Adds new integration for Check Point Email Events via S3. Breaking changes: • The `SOCKS proxy usage` detector is deprecated and will stop triggering leads. • The `Process execution from remote network share` detector is replaced by a scoring model in EDR-based detectors. • The `Suspicious execution from %ProgramData%` detector is replaced by a scoring model in EDR-based detectors. • The Possible use of a stolen or forged user ticket (TGT) detector is deprecated and will stop triggering leads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/november-2025-2 https://docs.hunters.ai/docs/november-2025-2 Sat, 01 Nov 2025 00:00:00 GMT Hunters Pathfinder AI adds AWS SES Enumeration detector, MOTW drilldown, and new webhook/API integrations for DataDog, Delinea, Beyondtrust, FortiDLP, and Genesys. • Adds `Possible AWS SES Enumeration` detector to identify attackers checking compromised account status via ListServiceQuotas, GetSendQuota, GetAccount, ListIdentities, GetIdentityVerificationAttributes, GetAccountSendingEnabled, and UpdateAccountSendingEnabled • Adds `Potential download origin URL found` drilldown enrichment for Crowdstrike MotwWritten events showing Referrer and Host URLs • Adds `Microsoft 365 users who accessed mailbox owned by this user` drilldown to identify shared mailboxes via non-owner access • Adds DataDog webhook integration for alerting • Adds Delinea-audit-logs S3 integration for Suite Cloud logs • Adds Beyondtrust-remote-support-session API integration • Adds FortiDLP-logs API integration • Adds Genesys-audit-logs API integration Breaking changes: • The `Execution of WHOAMI as local system` detector is deprecated and planned for removal on Nov 27, 2025 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/january-2025-2 https://docs.hunters.ai/docs/january-2025-2 Wed, 01 Jan 2025 00:00:00 GMT Hunters Pathfinder AI January 2025 (2): New Netskope V2 integration with two detectors and EC2 detection logic. • Adds `Netskope Audit Events` and `Netskope Application Events` detections via the updated Netskope V2 integration • Adds `aws_unusual_amount_of_ec2_access` detector to identify suspicious EC2 access patterns including password enumeration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/january-2025-1 https://docs.hunters.ai/docs/january-2025-1 Wed, 01 Jan 2025 00:00:00 GMT Hunters Pathfinder AI adds multi-tenant SOC queue, new Fortinet/Zscaler integrations, custom scoring API, and AWS/gSuite detectors • Adds `like` wildcard operator for asset tagging rules and renames `exact value` to `equals` • Exposes the Leads Scoring API endpoint for programmatic creation of custom scoring rules • Integrates Fortinet FortiMail logs into the data lake with IOC Search mapping • Integrates Fortinet FortiAnalyzer logs into the data lake with IOC Search mapping • Integrates Zscaler Nanolog Streaming Service (NSS) logs into the data lake with Web Requests schema mapping • Adds `edr_anomalous_ssm_startsession_command_execution` detector for anomalous AWS SSM commands • Adds `aws_console_login_by_federated_user` detector for federated console logins • Adds `edr_manual_credentials_gathering_using_aws_imds` detector for manual IMDS credential harvesting • Adds `gsuite_phishing_by_container_bound_script` detector for Google Workspace phishing via container-bound scripts • Adds `aws_access_key_compromised_policy_attatched` detector for AWSCompromisedKeyQuarantine policy activation • Adds `generic_password_spray_successful_model_v2` scoring layer for high-probability spray attacks • Adds "Large number of failed logins" custom rule with a 150-attempt threshold for brute force leads Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/november-2024-2 https://docs.hunters.ai/docs/november-2024-2 Fri, 01 Nov 2024 00:00:00 GMT Hunters Pathfinder AI adds Juniper, OpenStack, Databricks, CloudSEK, Keycloak, Wiz EKS Runtime integrations and Nozomi detector. • Adds integration with Juniper Networks for Switch Logs and Firewall Logs, including ingestion to the data lake and mapping to IOC Search and Hunters Login Schema. • Adds integration with Microsoft Defender Advanced Hunting logs, replacing Defender for Endpoint and Defender XDR Identity Query logs, with ingestion to the data lake and mapping to IOC Search. • Adds integration with OpenStack IaaS platform for log ingestion to the data lake and mapping to IOC Search. • Adds integration with Databricks cloud analytics platform for log ingestion to the data lake and mapping to IOC Search. • Adds integration with CloudSEK predictive threat intelligence for log ingestion to the data lake and mapping to IOC Search. • Adds integration with Keycloak IAM solution, including ingestion to the data lake, mapping to IOC Search, and mapping to Hunters Login Schema. • Adds integration with Wiz EKS Runtime logs for Amazon Elastic Kubernetes Service (EKS) workloads, including ingestion to the data lake and mapping to IOC Search. • Adds new `nozomi_alerts` detector for Nozomi alerts that filters out posture-like alerts and known vulnerability scanner noise. Breaking changes: • Microsoft Defender Advanced Hunting logs replace the following: Some data types under Defender for Endpoint (see here) and Defender XDR Identity Query logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-028 https://docs.hunters.ai/docs/release-notes-028 Sun, 01 Sep 2024 00:00:00 GMT Hunters Pathfinder AI adds Azure Event Hub ingestion, Meraki/SAP integrations, new API timestamps, and detection logic • Adds support for ingesting Microsoft logs via Azure Event Hub • Adds new `Meraki Auth Users` integration for splash guest and RADIUS user data • Adds new `SAP Security Audit Logs` integration mapped to the Hunters Login Schema • Adds new `SAP S/4HANA Security Audit Logs` integration mapped to the Hunters Login Schema • Adds `Azure Kubernetes Service` integration mapped to the Hunters K8s Schema • Adds `Azure Application Gateway WAF` integration mapped to the Hunters Network Schema • Adds `Microsoft Purview` integration for data governance logs • Adds `Microsoft Defender Identity Query` integration for identity threat insights • Adds new detector `aws_malicious_user_agents` to identify API calls by known attacking tools via User-Agent field • Adds new detector `edr_cmd_suspicious_silent_execution_patterns` to find suspicious silent cmd.exe execution with the `/Q` flag • Adds two timestamp fields to the Get Leads API endpoint: `event_end_time` and `ingestion_time` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/security-research-update https://docs.hunters.ai/docs/security-research-update Sun, 01 Sep 2024 00:00:00 GMT Hunters Pathfinder AI updates Azure AD, Defender for Office 365, and Proofpoint detector logic to reduce SOC noise • Adds `risk_state` filtering for Azure AD Identity Protection Risk Detections to limit SOC queue entries to specific risk states Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-025 https://docs.hunters.ai/docs/release-notes-025 Mon, 01 Jul 2024 00:00:00 GMT Hunters Pathfinder AI adds SOC Queue custom views, F5 Big IP WAF integration, and new Google/GCP threat detectors. • `gsuite_drive_ownership_transferred` detector • `gsuite_domain_added_to_trusted_domains` detector • `gsuite_mfa_enforcement_disabled` detector • `gcp_audit_dm_privesc_using_sa_key_template` detector • `gsuite_external_user_added_to_group` detector • `gsuite_custom_admin_role_created` detector • `gsuite_admin_role_assignment` detector • `gsuite_email_route_created_or_modified` detector • `windows_event_machine_account_certificate_authentication` confidence adjustments Breaking changes: • The default confidence score for `windows_event_machine_account_certificate_authentication` is lowered to medium (from high) and no leads are entered into the SOC queue. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-026 https://docs.hunters.ai/docs/release-notes-026 Mon, 01 Jul 2024 00:00:00 GMT New Netscaler AppFW and GitLab Audit Logs integrations, Snowflake situational awareness detector, and enhanced plain text password discovery. • Adds `Netscaler Application Firewall` integration with ingestion to the data lake, IOC Search mapping, and Hunters Web Requests Schema mapping. • Adds `GitLab Audit Logs` integration with ingestion to the data lake and IOC Search mapping. • Adds new detector `snowflake_query_awareness_behavior` for identifying multiple situational awareness database commands executed within a 30-minute window on Snowflake accounts. • Improves `edr_plain_text_password_discovery` detector by replacing Windows Sid field with username extracted from `target_file_path`, adding `user_folder_name` field to EDR file events, and filtering out PDFs and Ivanti processes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-024 https://docs.hunters.ai/docs/release-notes-024 Mon, 01 Jul 2024 00:00:00 GMT Hunters Pathfinder AI July 2024 adds SOC Queue tabs, Detectors UI revamp, custom scoring API, SQL detectors, and new integrations. • Adds `SOC Queue` tabs to create customized, shareable views of the SOC Queue • Revamps the `Detectors` page UI with enhanced functionality to answer environment-specific detector questions • Introduces the Leads Scoring API endpoint for programmatic management of custom scoring rules • Enables SQL Custom Detectors (Raw SQL Auto and Scheduled) via the Detectors API • Improves lead view with collapse/expand all, default enrichment visibility, integrated Lead activity on Summary page, CSV export of activity, and quick-copy functionality • Adds new workflow triggers: `Lead Was Managed`, `Story Was Managed`, and `New/Updated Comment` for bi-directional ITSM sync • Adds `Armis` integration for IOC Search mapping and native alerts • Adds `AWS Transit Gateway Flow Logs` integration with network schema and IOC Search mapping • Adds Linux IP Tables (Shorewell) integration with network schema and IOC Search mapping Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-019 https://docs.hunters.ai/docs/release-notes-019 Thu, 01 Feb 2024 00:00:00 GMT Hunters Pathfinder AI adds Skyhigh SWG, MikroTik, pfSense, Kubernetes, and Imperva SecureSphere integrations plus SOC Queue UI enhancements. • Adds `Skyhigh` integration for secure web gateway log ingestion, proxy event mapping, and IOC search. • Adds `MikroTik` integration for network router and switch log ingestion to the data lake. • Adds `pfSense` integration including filter log ingestion, network schema mapping, and IOC search support. • Adds `Kubernetes` integration enabling audit log ingestion, Kubernetes schema mapping, and IOC search support. • Adds `Imperva SecureSphere WAF` integration for alert ingestion and IOC search mapping. • Introduces new SOC Queue filters to isolate unassigned Alerts, Leads, and Stories. • Relocates the threshold setting to a new `Queue Configuration` option at the top of the SOC Queue page. • Adds an expandable view mode in the SOC Queue by clicking `Hide dashboard`. • Adds detection for creation or modification of external facing Kubernetes NodePort Services (`k8s_creation_or_modification_of_nodeport_service`). • Adds `O365_file_history` enrichment to query SharePoint and OneDrive file access history. • Adds `O365_threat_intel_file_info` enrichment to fetch metadata and detection signatures for suspicious files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-018 https://docs.hunters.ai/docs/release-notes-018 Thu, 01 Feb 2024 00:00:00 GMT Hunters Pathfinder AI adds data source tagging with lead/alert filtering, VMWare/Axis/Netography/Cisco/SilverPeak/SentinelOne/Island integrations, and new EDR/K8s detectors. • Adds `data source tagging` to allow adding business context tags to connected data flows for filtering leads, alerts, and stories. • Adds `VMWare NSX Avi Logs` integration including ingestion to the data lake, mapping to Web Requests schema, and IOC Search. • Adds `Axis Security` integration with ingestion to the data lake, mapping to DNS and Web Requests schemas, and IOC Search. • Adds `Netography` integration with ingestion to the data source, third-party alert generation, and mapping to IOC Search. • Adds `Cisco ISE` integration with ingestion to the data lake, mapping to login schema, and IOC Search. • Adds `SilverPeak` integration with S3 data ingestion to the data lake, mapping to Network Schema, and IOC Search. • Expands `SentinelOne Custom Rules` support to include all alerts raised from custom rules with third-party alert generation. • Adds `Island Browser` integration with 3 data type ingestion into the data lake and timeline log mapping to IOC Search. • Enhances detector export CSV to include a `MITRE Technique ID` column in addition to Technique name. • Adds new detector `edr_directory_masquerading_using_colorcpl.exe` for detecting masquerading via colorcpl.exe file parameters. • Adds new detector `k8s_anonymous_authorized_request` for Kubernetes API requests authorized by unauthenticated users. • Adds Kubernetes enrichments `k8s_allowed_request_to_rolebinding_creation` and `ip_k8s_activity` alongside the anonymous request detector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-014 https://docs.hunters.ai/docs/release-notes-014 Wed, 01 Nov 2023 00:00:00 GMT New Qualys Hosts and Box integrations; Web SQLi and GCP function mod detectors; Linux AuditD self-service parsing • Adds `Qualys Hosts` data type integration with ASR and DNS enrichments • Adds new `Box` integration (Users, Groups, Events) mapped to login schema and IOC Search • Adds `Linux Mail Logs` ingestion from `/var/log/maillog` mapped to Email schema and IOC Search • Adds `Linux AuditD` integration upgrade with open self-service ingestion and full raw key-value parsing • Adds `web_server_sql_injection` detector for SQLi in web requests • Adds `gcp_cloud_function_modified_from_storage` detector for Cloud Function source modification via GCP Storage • Enhances `edr_powershell_suspicious_flags` detector to cover PS downgrade flags like `-v 2` and `-version 2` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-015 https://docs.hunters.ai/docs/release-notes-015 Wed, 01 Nov 2023 00:00:00 GMT New user/role API, 5-min custom detection intervals, Cisco/AWS/MuleSoft integrations, and new EDR detectors • Adds a new API endpoint for managing users and roles, supporting operations such as listing users, organizations, and roles; creating users; assigning/unassigning roles; and removing users. • Reduces the custom detector execution interval from 10 minutes to 5 minutes. • Adds Cisco Switch log support with mapping to the Network Unified Schema and IOC Search. • Adds Cisco WLC syslog support for Wireless LAN Controllers. • Adds AWS Cloudwatch logs integration for monitoring Amazon EC2, CloudTrail, and Route 53 sources. • Adds MuleSoft Application log support via transformation to the data lake. • Adds Claroty SRA log support with mapping to the Network Unified Schema and IOC Search. • Enables self-service configuration for Claroty CTD Events connections on the platform. • Maps Zerofox logs to native alerts to surface them as leads in Hunters. • Adds new detector `web_requests_excessive_unauthorized` (ID: web_requests_excessive_unauthorized) for high numbers of unauthorized HTTP requests. • Adds new detector `edr_export_creds_via_wcm_wizard` (ID: edr_export_creds_via_wcm_wizard) for credential export via Windows Credential Manager. • Adds new detector `web_requests_excessive_internal_server_error` (ID: web_requests_excessive_internal_server_error) for high numbers of internal server error HTTP requests. • Updates detector `cs_execution_under_mounted_iso` to detect scenarios where the ISO mount is initiated by `dllhost.exe` and execution by `explorer.exe`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/release-notes-011 https://docs.hunters.ai/docs/release-notes-011 Tue, 01 Aug 2023 00:00:00 GMT Hunters Pathfinder AI August 2023 introduces Threat Clustering, Seraphic/AWS RDS/Azure AD Identity Protection/Harness/VGS/SolarWinds integrations, Office 365 detection pack, • Official release of Threat Clustering to reduce triage time by grouping leads based on malicious intent and context • Adds IOC Search support for 1Password, Microsoft 365 Defender, Agari, Azure AD Users, Atlassian Confluence/Jira, Mimecast, AWS Config/Inspector/WAF/GuardDuty/Route53/S3, Office365 Audit Logs, Cisco ASA/FTD, Okta, CrowdStrike, Orca, GCP Audit/Security Command Center, Wiz, Google Workspace, Zscaler, Meraki, and Gsuite directory users • Adds native integration with Seraphic Security browser security solution including puller for Events/Alerts endpoints and transformation to Snowflake • Adds native integration with AWS RDS Aurora data via transformer for RDS logs • Adds native integration with Azure AD Identity Protection risk detection reports via Graph API collection • Adds ingestion of Palo Alto Networks XDR Raw Logs mapped to 8 unified schemas for AWS bucket exports • Adds native integration with Harness IO Audit Logs mapped to Login Unified Schema • Adds native integration with Very Good Security Events via transformer • Adds native integration with SolarWinds Orion logs mapped to Login Unified Schema • Adds Office 365 Detection Pack containing four new detectors: Suspicious Transport Rule Created, Hiding of Incoming Emails using Inbox Rule, Disablement of Exchange Audit Log, and Forwarding Rules Outside Organization • Adds GCP IAM Roles Enumeration Using GetIAMPolicy time series detector to detect aggressive IAM policy enumeration via Get-IAM-Policy API calls Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-010 https://docs.hunters.ai/docs/rn-010 Sat, 01 Jul 2023 00:00:00 GMT Hunters Pathfinder AI adds 9 new integrations (AWS S3/VPN/EKS, Infoblox, VMWare, Bricata, Crowdstrike Mobile, Ironscales, Malwarebytes) and a Kerberoasting detector. • Supports onboarding of AWS S3 Server Access Logs mapped to the web requests unified schema • Supports onboarding of AWS S3 Client VPN Connection Logs mapped to web requests and login unified schemas • Supports onboarding of AWS EKS Control Plane logs with 6 distinct transformations ingested to Snowflake • Supports onboarding of Infoblox Audit & DHCP logs including transformation for NIOS DHCP and Audit • Supports onboarding of VMWare AirWatch Workspace One UEM logs mapped to the Unified Login Schema • Integrates Bricata NDR with handling suffix pattern, log transformation, and third-party detection • Supports Crowdstrike Mobile Alerts via puller collection, transformation, and third-party detection • Integrates Ironscales Incidents via a new incidents endpoint puller, Snowflake transformation, and detection • Supports Malwarebytes Nebula Events and Detections via endpoints puller, Snowflake transformation, and investigation group • Adds 'Suspected Kerberoasting - Excessive Weakly Encrypted TGS Requests' detector using Time Series Anomaly logic • Deprecates 'Office Application Loads WMI Module', 'Failed MFA Challenge without Successful Followup', and 'Login Attempt to a Locked Okta Account' detectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-008-improvements-to-hunters-threat-clustering-abilities-published-july-2023 https://docs.hunters.ai/docs/rn-008-improvements-to-hunters-threat-clustering-abilities-published-july-2023 Sat, 01 Jul 2023 00:00:00 GMT Hunters Pathfinder AI July 2023 release improves Threat Clustering UX with new Cluster Details panel and triage efficiency indicators. • Adds a revamped 'Cluster Details' panel featuring status and classification statistics, reorganized cluster information, and an integrated lead grid for quick triage. • Adds a quick-link interface to inspect a sample lead from within the SOC Queue or Leads page for rapid specimen examination. • Introduces global and per-cluster 'triage booster' indicators that quantify time and effort savings derived from using threat clustering. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-007-published-july-2023 https://docs.hunters.ai/docs/rn-007-published-july-2023 Sat, 01 Jul 2023 00:00:00 GMT New Databricks Partner Connect, STIX-TAXII connector, Salesforce Event Logs schema, and MFA fatigue detector in July 2023 (1) • Adds 'Partner Connect' option in the Databricks Partner Connect Store for quicker setup • Adds 'STIX-TAXII Connector' integration for CTI ingestion • Adds support for 'Salesforce Event Logs' schema with 60 event types via Salesforce API integration • Adds 'Detector source indication' column on the Leads page to show detector origin (3rd party, Hunters, Custom) • Adds quick lead actions in the lead panel for assigning leads and clearing assignees Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-009-threat-clustering-release https://docs.hunters.ai/docs/rn-009-threat-clustering-release Sat, 01 Jul 2023 00:00:00 GMT Threat Clustering GA adds Clustered view to SOC Queue and new Cluster Details panel with Triage Booster metrics • `Clustered` toggle in the SOC Queue switches the default lead view from unclustered to threat-based aggregation. • New `Cluster Details` panel provides status, classification statistics, lead grid, and quick actions for grouped leads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-002-published-march-2023 https://docs.hunters.ai/docs/rn-002-published-march-2023 Wed, 01 Mar 2023 00:00:00 GMT Hunters Pathfinder AI introduces IOC search GA, AWS Inspector/Vectra/Symantec/Zscaler integrations, Azure AD detection pack, and verbose audit logs. • Makes IOC search generally available, allowing direct search of raw data logs for known Indicators of Compromise without SQL queries • Adds support for AWS Inspector Findings as a new log source type • Adds Vectra NDR (formerly Cognito) network detection and response logs to integrations • Supports Symantec Cloud Secure Web Gateway Audit Logs • Supports Zscaler ZIA DNS logs • Expands Hunters audit log records to include verbose details for Asset tag, Asset annotation, Custom rule, Custom analytic, and Data source edits Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai https://docs.hunters.ai/docs/rn-003-published-march-2023 https://docs.hunters.ai/docs/rn-003-published-march-2023 Wed, 01 Mar 2023 00:00:00 GMT New custom detector operators, Watchguard Firebox/Slack/Cyera integrations, and an Azure service principal credential detector in March 2023 (2) • Adds additional logic operators to the Custom Detectors framework for advanced threat coverage. • Supports onboarding Watchguard Firebox Logs via AWS S3 intermediary. • Supports onboarding Cloudflare Area 1 email alerts via API. • Supports onboarding Zscaler ZIA Firewall logs via syslog/S3. • Supports onboarding Cisco ESA Consolidated Event Logs (CEF) via AWS S3. • Supports onboarding Teleport Audit Events Logs via Fluentd/Logstash/S3. • Supports onboarding three Slack log types: Audit Logs, Users, and Files. • Supports onboarding Cyera Issues and Datastores logs for triaging. • Adds a new detection for "Addition of new credentials to a service principal on Azure Active Directory" in the Azure content pack. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hunters-pathfinder-ai