Unix

Improved log validation in UnixSysmonCompiledNormalizer so that logs it does not support, particularly large logs, are rejected much faster. This reduces processing time and prevents queues building up in the normalization layer.

UnixCompiledNormalizer  now normalizes additional Forcepoint logs, including Forcepoint DLP logs and postfix/smtpd logs (signatures 407, 408 and 409).

UnixCompiledNormalizer now normalizes additional Unix-format NetApp logs (signature 410). NetApp StorageGRID audit logs continue to be normalized by the LP_Netapp StorageGRID normalization package.

UnixAuditLogNormalizer now normalizes enriched auditd logs forwarded through rsyslog, including logs that carry only a syslog timestamp and no epoch time. These logs were previously left unnormalized or normalized with norm_id=UnixSyscall. After upgrading, review any searches, dashboards or alert rules that relied on norm_id=UnixSyscall for these auditd events.

UnixCompiledNormalizer now normalizes logs from newer versions of BIND 9 DNS, such as 9.11.4, including query and security logs from named.

Added signatures to normalize more logs from common Unix services, including sudo , pam_unix , systemd , kernel iptablesand traps  messages, crontab , anacron , avahi-daemon , dbus-daemon , xrdp , xrdp-sesman  and xrdp-chansrv. The signatures are in the LP_Unix Sudo, LP_Unix Syscall, LP_Unix Systemd, LP_Unix xrdp, LP_Unix Cron, LP_Unix Anacron and LP_Unix Generic normalization packages and in UnixCompiledNormalizer .

Updated UnixCompiledNormalizer , UnixAuditLogNormalizer  and UnixSysmonCompiledNormalizer to TypeHandler v4, and updated the bundled LP_Common Unix System normalization package to v166

The LP_Kernel normalization package normalized audit logs and incident logs generated by the SIEM itself as kernel logging events. When incident logs were forwarded back to the SIEM through syslog, this repeatedly triggered false Unix Kernel Logging Stopped alerts. This is fixed in LP_Kernel v109, which is included in this release

At the turn of the year, logs with timestamps that contained only the month and day were assigned the previous year when the log source was in a timezone ahead of the SIEM server. These logs were then dropped as being outside the repository retention period.

After upgrading the Unix application, UnixCompiledNormalizer repeatedly logged a ValueError in the normalizer service log when its dynamic cache contained deprecated signature IDs.

Logs matching signature 144004 in the LP_Unix Inetd normalization package were indexed without the norm_id field, so searches, dashboards and alert rules that filter on norm_id missed them.

UnixCompiledNormalizer failed to load with a DuplicateSectionError when its DynamicCache.conf file contained duplicate [Setting] sections. Unix logs were left unnormalized and a queue built up in the processing pipeline.

The LP_Unix Ftpd normalization package parsed HTTP status codes incorrectly when the data size in the log was -. For example, in a log containing 302 -  , the status_codewas set to 30instead of 302 and datasizeto 2 instead of -.