Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.72 Release - AskJ1 Community
<main> <article class="userContent"> <p>2021-06-02</p> <h2 data-id="new-features-and-improvements">New Features and Improvements</h2> <ul><li><p>Improved tooltip placement on the gear menu so that the tooltips no longer cover up other menu items</p></li> <li><p>Newly imported CIS Benchmarks will now have Policies & Procedures disabled by default</p></li> <li><p>In-app purchase & products page has been redesigned so it is easier to use now</p></li> <li><p>When filtering findings & vulnerabilities:</p> <ul><li>filtering by <code class="code codeInline" spellcheck="false" tabindex="0">informational</code> will also include <code class="code codeInline" spellcheck="false" tabindex="0">informative</code> and <code class="code codeInline" spellcheck="false" tabindex="0">info</code></li> <li>filtering by <code class="code codeInline" spellcheck="false" tabindex="0">no value</code> will also include <code class="code codeInline" spellcheck="false" tabindex="0">undefined</code> and <code class="code codeInline" spellcheck="false" tabindex="0">null</code></li> </ul></li> <li><p>Added support for AWS VPC endpoints and enpoint policy permissions, WAF V2, API Gateway V2,<br> IAM permissions boundary policy and a lot more Integrations capabilities (see details below).</p></li> </ul><h2 data-id="integrations">Integrations</h2> <h3 data-id="aws">AWS</h3> <ul><li><p>Improved permissions analysis for IAM resource policies</p></li> <li><p>Improved consistency of the <code class="code codeInline" spellcheck="false" tabindex="0">actions</code>, <code class="code codeInline" spellcheck="false" tabindex="0">conditions</code>, <code class="code codeInline" spellcheck="false" tabindex="0">resources</code>, and<br><code class="code codeInline" spellcheck="false" tabindex="0">principal</code> properties on IAM permission relationships</p></li> <li><p>Added <code class="code codeInline" spellcheck="false" tabindex="0">normalizedActions</code> property on IAM permission relationships to store<br> action values in all lowercase</p></li> <li><p>Renamed <code class="code codeInline" spellcheck="false" tabindex="0">WAF</code> to <code class="code codeInline" spellcheck="false" tabindex="0">WAF Classic</code></p></li> <li><p>Added support for ingesting the following <strong>new</strong> resources:</p></li> </ul><table><thead><tr><th>Service</th> <th>Resource / Entity</th> </tr></thead><tbody><tr><td>WAF</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2_web_acl</code></td> </tr><tr><td>API Gateway V2 API</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_api</code></td> </tr><tr><td>API Gateway V2 Route</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code></td> </tr><tr><td>API Gateway V2 Integration</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code></td> </tr><tr><td>API Gateway V2 Authorizer</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code></td> </tr><tr><td>VPC Endpoint</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc_endpoint</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following <strong>new</strong> relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_api</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_route</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_integration</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">CONNECTS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_api_gateway_v2_authorizer</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">CONNECTS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_waf_v2_web_acl</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">PROTECTS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">resource</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_elb</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">CONNECTS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc_endpoint</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">aws_vpc_endpoint</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">aws_policy</code></td> </tr></tbody></table><ul><li><p>Add IAM permissions boundary policy <code class="code codeInline" spellcheck="false" tabindex="0">RESTRICTS</code> IAM users or roles<br> relationships</p></li> <li><p>Parse <code class="code codeInline" spellcheck="false" tabindex="0">DENY</code> statements in IAM policies and create <code class="code codeInline" spellcheck="false" tabindex="0">DENIES</code> relationships</p></li> <li><p>Add <code class="code codeInline" spellcheck="false" tabindex="0">restorableByUserIds</code> property to <code class="code codeInline" spellcheck="false" tabindex="0">aws_ebs_snapshot</code> entities. This was<br> already captured as <code class="code codeInline" spellcheck="false" tabindex="0">sharedWithAccounts</code> property on the entity. Additionally,<br> when the snapshot is shared with another account, the <code class="code codeInline" spellcheck="false" tabindex="0">shared</code> property is set<br> to <code class="code codeInline" spellcheck="false" tabindex="0">true</code>. When the snapshot is shared with <code class="code codeInline" spellcheck="false" tabindex="0">all</code>, the <code class="code codeInline" spellcheck="false" tabindex="0">public</code> property is<br> set to <code class="code codeInline" spellcheck="false" tabindex="0">true</code>.</p></li> </ul><h3 data-id="azure">Azure</h3> <ul><li><p>Changed the policy definition entity <code class="code codeInline" spellcheck="false" tabindex="0">_key</code> suffix to <code class="code codeInline" spellcheck="false" tabindex="0">:latest</code> instead of<br><code class="code codeInline" spellcheck="false" tabindex="0">:${timestamp}</code> to reduce policy state churn during integration invocations.</p></li> <li><p>Added ingestion of Azure Management Groups when the<br><code class="code codeInline" spellcheck="false" tabindex="0">configureSubscriptionInstances</code> configuration field is <code class="code codeInline" spellcheck="false" tabindex="0">true</code>. This ingestion<br> requires users to assign the <code class="code codeInline" spellcheck="false" tabindex="0">Management Group Reader</code><br><a rel="nofollow" href="https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#management-group-reader">role</a><br> to the service principal used in the given integration configuration to the <strong>Tenant Root Group</strong> <a rel="nofollow" href="https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#root-management-group-for-each-directory">management group</a>.</p></li> <li><p>Added support for ingesting the following <strong>new</strong> resources:</p></li> </ul><table><thead><tr><th>Service</th> <th>Resource / Entity</th> </tr></thead><tbody><tr><td>Gallery</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_gallery</code></td> </tr><tr><td>Gallery Image</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_shared_image</code></td> </tr><tr><td>Management Groups</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_management_group</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following <strong>new</strong> relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_resource_group</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_gallery</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_gallery</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">CONTAINS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_shared_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_vm</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_shared_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_vm</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_management_group</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">CONTAINS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_management_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_management_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_vm</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">azure_service_principal</code></td> </tr></tbody></table><ul><li>New properties added to resources:</li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_vm_extension</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">settings</code>, <code class="code codeInline" spellcheck="false" tabindex="0">extType</code>, <code class="code codeInline" spellcheck="false" tabindex="0">publisher</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">azure_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">isMfaRegistered</code></td> </tr></tbody></table><h3 data-id="google-cloud">Google Cloud</h3> <ul><li>Added support for ingesting the following <strong>new</strong> resources:</li> </ul><table><thead><tr><th>Service</th> <th>Resource / Entity</th> </tr></thead><tbody><tr><td>BigQuery</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_table</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following <strong>new</strong> relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HAS</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_table</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_disk</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_mysql_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_postgres_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">USES</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr></tbody></table><ul><li>New properties added to resources:</li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_disk</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyServiceAccount</code>, <code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">integrityMonitoringEnabled</code>, <code class="code codeInline" spellcheck="false" tabindex="0">secureBootEnabled</code>, <code class="code codeInline" spellcheck="false" tabindex="0">vtpmEnabled</code>, <code class="code codeInline" spellcheck="false" tabindex="0">connectedNetworksCount</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_mysql_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_postgres_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_storage_bucket</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kmsKeyName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">_class: Database</code> <a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/issues/175">#175</a></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">All Entities</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code></td> </tr></tbody></table><ul><li><p>Support for <code class="code codeInline" spellcheck="false" tabindex="0">--integration-polling-interval</code> in the<br><code class="code codeInline" spellcheck="false" tabindex="0">jupiterone-organization-setup</code> CLI</p></li> <li><p><a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/issues/186">#186</a> - Accept<br><code class="code codeInline" spellcheck="false" tabindex="0">storage-api.googleapis.com</code> and <code class="code codeInline" spellcheck="false" tabindex="0">storage-component.googleapis.com</code> services<br> to enable buckets step</p></li> <li><p><a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/issues/171">#171</a> - Do not<br> fail when App Engine applications and versions cannot be fetched</p></li> <li><p>Improved logic that determines whether a <code class="code codeInline" spellcheck="false" tabindex="0">google_compute_instance</code> is a<br> shielded VM or not by considering whether vTPM is enabled</p></li> <li><p><a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/issues/151">#151</a> - Fix<br> duplicate <code class="code codeInline" spellcheck="false" tabindex="0">_key</code> on Cloud Run resources</p></li> <li><p><a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/issues/158">#158</a> - Do not<br> fail when App Engine services cannot be fetched</p></li> </ul><h3 data-id="knowbe4">KnowBe4</h3> <ul><li>Ingest retired campaigns</li> </ul><h3 data-id="qualys">Qualys</h3> <ul><li><p>Use host asset <code class="code codeInline" spellcheck="false" tabindex="0">dnsHostName</code> in <code class="code codeInline" spellcheck="false" tabindex="0">Finding.targets</code> and <code class="code codeInline" spellcheck="false" tabindex="0">Finding.fqdn</code> when<br> available and fall back to host asset <code class="code codeInline" spellcheck="false" tabindex="0">fqdn</code>. The latter is often an empty<br> string and not useful for intended purpose.</p></li> <li><p>Use host asset <code class="code codeInline" spellcheck="false" tabindex="0">hostname</code> as <code class="code codeInline" spellcheck="false" tabindex="0">Host.hostname</code> when available.</p></li> </ul><h3 data-id="slack">Slack</h3> <ul><li>New properties added to resources:</li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">slack_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">appUser</code>, <code class="code codeInline" spellcheck="false" tabindex="0">userType</code>, fixed <code class="code codeInline" spellcheck="false" tabindex="0">bot</code></td> </tr></tbody></table><h3 data-id="tenable-cloud">Tenable Cloud</h3> <ul><li>Improved handling of processing for asset and vulnerability exports</li> </ul><h2 data-id="bug-fixes">Bug Fixes</h2> <ul><li><p>Resolved an issue where the Finding Details viewer would not have a max height<br> and would cause large amounts of scrolling to be required</p></li> <li><p>Resolved some issues regarding importing rule packs after configuring your<br> first integration</p></li> </ul> </article> </main>
.png)