Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.77 Release - AskJ1 Community
<main> <article class="userContent"> <p>August 11, 2021</p> <h2 data-id="new-features-and-improvements">New Features and Improvements</h2> <ul><li><p>New <strong>Query Anywhere</strong> feature that allows users to quickly access the query <br> interface from any page in the product and get answers to their questions without <br> switching contexts.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/93L5BR6L71V2/query-anywhere.png" alt="query-anywhere" class="embedImage-img importedEmbed-img"></img></p></li> <li><p>Added new <strong>string concatenation</strong> function to J1QL. The new J1QL <br> return function <code class="code codeInline" spellcheck="false" tabindex="0">CONCAT()</code> allows users to combine two or more queried <br> columns, strings, or numbers into one new string value.</p> <p>For example:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Find Person Return CONCAT(Person.lastName, ', ', Person.firstName) </pre></li> <li><p>Added <strong>CIS AWS Benchmark v1.4</strong> to the Compliance app. Customers who configure <br> an AWS integration for the first time will have v1.4 auto imported (was previously v1.2).</p></li> <li><p>Added a new <strong>Request a feature</strong> option in the JupiterOne help center dropdown menu,<br> located above the <strong>Report a bug</strong> option.</p></li> <li><p>Improved styling to the Policies app.</p></li> </ul><h2 data-id="integrations">Integrations</h2> <h3 data-id="artifactory">Artifactory</h3> <ul><li><p>Provided <code class="code codeInline" spellcheck="false" tabindex="0">404</code> error handling to validate configuration and display a useful error message<br> to the user.</p></li> <li><p>Changed <code class="code codeInline" spellcheck="false" tabindex="0">CodeRepo.{id, createdBy, updatedBy}</code> from <code class="code codeInline" spellcheck="false" tabindex="0">number</code> to <code class="code codeInline" spellcheck="false" tabindex="0">string</code> to<br> meet data-model schema requirements.</p></li> </ul><h3 data-id="azure">Azure</h3> <ul><li><p>Improved configuration validation when a <code class="code codeInline" spellcheck="false" tabindex="0">subscriptionId</code> parameter is provided<br> to present better errors to users, such as:</p> <ul><li><p><code class="code codeInline" spellcheck="false" tabindex="0">The provided subscription identifier '{{SUBSCRIPTION_ID}}' is malformed or invalid.</code></p></li> <li><p><code class="code codeInline" spellcheck="false" tabindex="0">The subscription '{{SUBSCRIPTION_ID}}' could not be found.</code></p></li> <li><p><code class="code codeInline" spellcheck="false" tabindex="0">The client '{{CLIENT_ID}}' with object id '{{CLIENT_ID}}' does not have authorization to perform action 'Microsoft.Resources/subscriptions/read' over scope '/subscriptions/{{SUBSCRIPTION_ID}}' or the scope is invalid.</code></p></li> </ul></li> </ul><h3 data-id="aws">AWS</h3> <ul><li>Added support to capture EC2 user data as a property and detect secrets in the<br> user data. Secrets (such as API token, access key, hash) detected are redacted<br> and the EC2 instance entity is set with the <code class="code codeInline" spellcheck="false" tabindex="0">hasSecrets: true</code> property.</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Note: this requires <code class="code codeInline" spellcheck="false" tabindex="0">ec2:describeInstanceAttribute</code> permission.</p> </div></blockquote> <ul><li>Added <code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster_parameter_group</code> entities and relationships to<br><code class="code codeInline" spellcheck="false" tabindex="0">aws_redshift_cluster</code> entities.</li> </ul><h3 data-id="crowdstrike">Crowdstrike</h3> <ul><li><p>API requests that respond with a <code class="code codeInline" spellcheck="false" tabindex="0">500</code> status code are now retried.</p></li> <li><p>Normalized <code class="code codeInline" spellcheck="false" tabindex="0">macAddress</code> to support mapping to <code class="code codeInline" spellcheck="false" tabindex="0">Host</code> entities.</p></li> <li><p>New properties added to resources:</p></li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">crowdstrike_sensor</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ec2InstanceArn</code></td> </tr></tbody></table><h3 data-id="google-cloud">Google Cloud</h3> <ul><li><p>API calls are now retried on "Quota exceeded" errors</p></li> <li><p>Encoded the path part of the <code class="code codeInline" spellcheck="false" tabindex="0">webLink</code> entity property</p></li> <li><p>Added support for ingesting the following <strong>new</strong> relationships:</p></li> </ul><table><thead><tr><th>Source</th> <th>class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ANY_RESOURCE</code> (*)</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_projects</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_mysql_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_postgres_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_domain</code></td> </tr></tbody></table><p>* other than specific ingested types</p> <h3 data-id="google-workspaces">Google Workspaces</h3> <ul><li>Provided <code class="code codeInline" spellcheck="false" tabindex="0">404</code> error handling for invalid email responses for the group settings endpoint.</li> </ul><h3 data-id="onelogin">OneLogin</h3> <ul><li><p>Added the ability to pass a different API hostname (such as<br><code class="code codeInline" spellcheck="false" tabindex="0">https://api.eu.onelogin.com</code>) to fetch data from different OneLogin<br> environments.</p></li> <li><p>Fixed <code class="code codeInline" spellcheck="false" tabindex="0">undefined undefined</code> in user jobs to show proper <code class="code codeInline" spellcheck="false" tabindex="0">status</code> and<br><code class="code codeInline" spellcheck="false" tabindex="0">statusText</code>, such as <code class="code codeInline" spellcheck="false" tabindex="0">401 Unauthorized</code>.</p></li> <li><p>Fixed <code class="code codeInline" spellcheck="false" tabindex="0">UPLOAD_ERROR</code>, <code class="code codeInline" spellcheck="false" tabindex="0">NOT_ALLOWED</code> caused by <code class="code codeInline" spellcheck="false" tabindex="0">_icon</code> property on app and<br> personal app entities. Removed the <code class="code codeInline" spellcheck="false" tabindex="0">_icon</code> property as it is not allowed to be<br> an underscore property.</p></li> <li><p>Migrated to the latest SDK, leading to normalized property names due to schema<br> validations:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">login_id</code> -> <code class="code codeInline" spellcheck="false" tabindex="0">loginId</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">connector_id</code> -> <code class="code codeInline" spellcheck="false" tabindex="0">connectorId</code></li> <li><code class="code codeInline" spellcheck="false" tabindex="0">custom_attribute</code> prefix -> <code class="code codeInline" spellcheck="false" tabindex="0">customAttribute</code></li> </ul></li> </ul><h3 data-id="okta">Okta</h3> <ul><li>Provided <code class="code codeInline" spellcheck="false" tabindex="0">404</code> error handling for non-existent groups or apps when fetching details.</li> </ul><h2 data-id="bug-fixes">Bug Fixes</h2> <ul><li><p>Resolved an issue where fields including the word <code class="code codeInline" spellcheck="false" tabindex="0">tag</code> showed the tag icon in the column header.</p></li> <li><p>Resolved an issue where the recurring review on a compliance requirement did not send a reminder when the review was almost due.</p></li> <li><p>Resolved an issue that occurred where the modal was not cleared between evidence uploads.</p></li> </ul><h2 data-id="coming-soon">Coming Soon!</h2> <ul><li><p>Update to Query Language following De Morgan's Law:</p> <p>To maintain language correctness, J1QL will fulfill shorthand filters in accordance <br> with De Morgan's Law. This improvement only impacts queries that use the <br> operators <code class="code codeInline" spellcheck="false" tabindex="0">!=</code>, <code class="code codeInline" spellcheck="false" tabindex="0">!~=</code>, <code class="code codeInline" spellcheck="false" tabindex="0">!^=</code>, <code class="code codeInline" spellcheck="false" tabindex="0">!$=</code> when operating on a group of values.</p> <p>For example,</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND jira_user WITH accountType != ('atlassian' OR 'app' OR 'customer') </pre> <p>is the equivalent of</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND jira_user WITH accountType != 'atlassian' AND accountType != 'app' AND accountType != 'customer' </pre> <p>In other words, J1QL will interpret the above query to return all jira_user entities, <br> excluding those that have an accountType value of 'atlassian' or 'app' or 'customer'.</p> <p>!!! warning<br><strong>This is a breaking change!</strong> We are taking precautions to ensure <br> saved questions and queries are not inadvertently affected.</p> <p>We will run maintenance jobs to update all saved queries in questions, <br> alerts, and Insights dashboard widgets during the rollout of this change.<br> You do <em>not</em> have to make those changes manually.</p> <p>However, if you have stored queries outside of your JupiterOne account <br> (e.g. in a custom script), please update those queries accordingly.</p> <p>!!! note<br> This change is planned to be rolled out on <span style="text-decoration: line-through;">Wednesday, Aug 24, 2021</span> <strong>Tuesday, Aug 31, 2021</strong>.</p></li> </ul> </article> </main>
.png)