Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.79 Release - AskJ1 Community
<main> <article class="userContent"> <p>September 9, 2021</p> <h2 data-id="new-features-and-improvements">New Features and Improvements</h2> <ul><li><p>Introduced a new filter to define <strong>critical assets</strong> in the Assets app, <br> and a <strong>smart class</strong> query shorthand.</p> <p>Critical assets are defined using a preset combination of entities classes <br> and attributes (such as hosts and applications tagged as production). You <br> can easily customize this configuration to match your specific definition <br> of what critical assets mean for your organization.</p> <p>You can reference critical assets in a query using a specific smart class <br> shorthand: <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">#CriticalAsset</code>. This feature allows you to easily query and <br> monitor important changes and receive alerts when a drift or problem <br> occurs for any of the critical assets that are important to you. It allows <br> you to focus and prioritize on the most important risks.</p> <p>For example, to identify and alert on new critical assets added in the last 24 hours:</p> <p><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">Find #CriticalAsset with _createdOn > date.now - 24hours</code></p> <p>This is the initial release of this capability. We will be adding some pre-built alert <br> rules and Insights dashboards for critical assets soon.</p> <p>Learn more about how to customize and configure your critical assets <a rel="nofollow" href="../guides/asset-inventory-filters.md#quick-filter-the-critical-assets">here</a>.</p></li> <li><p>Updated the query language to follow De Morgan's Law.</p> <p>To maintain language correctness, J1QL fulfills shorthand filters in accordance <br> with De Morgan's Law. This improvement only impacts queries that use the <br> operators <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">!=</code>, <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">!~=</code>, <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">!^=</code>, <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">!$=</code> when operating on a group of values.</p> <p>For example,</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND jira_user WITH accountType != ('atlassian' OR 'app' OR 'customer') </pre> <p>is the equivalent of:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND jira_user WITH accountType != 'atlassian' AND accountType != 'app' AND accountType != 'customer' </pre> <p>Basically, J1QL interprets the above query to return all <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">jira_user</code> entities, <br> excluding those that have an <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">accountType</code> value of <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">atlassian</code> or <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">app</code> or <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">customer</code>.</p> <p>!!! warning<br><strong>This is a breaking change!</strong> We have taken precautions to ensure saved questions <br> and queries are not inadvertently affected.</p> <p>We have run maintenance jobs to update all saved queries in questions, <br> alerts, and Insights dashboard widgets.<br> You do NOT have to make any changes manually in JupiterOne.</p> <p>However, if you have stored queries outside of your JupiterOne account <br> (such as in a custom script), please update those queries accordingly.</p></li> <li><p>Updated the JupiterOne query language to <a rel="nofollow" href="../docs/jupiterOne-query-language.md">enable relationship direction</a> with the use <br> of double arrows,<code class="code codeInline code codeInline" spellcheck="false" tabindex="0"><<</code> and <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">>></code>. <br> Relationship direction can be important, depending on your requirements, giving J1QL <br> more specificity on exactly how entities should relate to each other. For example, <br> if you were to use the following query:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND aws_iam_role as trusting THAT TRUSTS aws_iam_role as trusted return trusting.name, trusted.name </pre> <p>The above query does not specify direction, so aliasing one as trusted and the other <br> trusting does not behave as expected. Both entities will be represented in either <br> column. By using double arrows, you can indicate the relationship direction:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND UNIQUE aws_iam_role as trusting THAT TRUSTS >> aws_iam_role as trusted return trusting.name, trusted.name` </pre></li> <li><p>Added traversal filters for use with the <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">where</code> clause to support filtering via <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">AND</code> and <br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">OR</code> operators upon a single field, for example: <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">find User where User.id=(1 or 2 or 3)</code>.</p></li> <li><p>Added search functionality to the Groups page in the Users & Access menu.</p></li> <li><p>Improved the text wrapping in the query search window.</p></li> <li><p>Query Anywhere now auto-focuses when opened so you can immediately start typing.</p></li> <li><p>Improved error messaging in the UI when bulk synchronization fails.</p></li> </ul><h2 data-id="dashboards">Dashboards</h2> <p>Added new reporting/visualization widgets to the S3 Security Insights dashboard:</p> <ul><li>Buckets granted access to AWS services without source condition</li> <li>Public buckets with sensitive data or secrets</li> <li>S3 cross account access via VPC peering</li> <li>SAML SSO users with access to production s3 buckets</li> <li>S3 buckets with server access logging enabled</li> <li>S3 buckets with object level logging enabled</li> <li>Production S3 buckets without any logging enabled</li> <li>S3 buckets publishing inventory reports</li> </ul><p>Reimport the dashboard from the Insights app to get these new widgets in your account.</p> <p>Stay tuned as additional dashboards, alert rules, managed questions, and compliance frameworks, and mappings are updated.</p> <h2 data-id="bug-fixes">Bug Fixes</h2> <ul><li><p>Resolved an issue where the Policy app would not load under certain conditions.</p></li> <li><p>Resolved an error where users could not accept an invite if they were logged into <br> another account with SSO.</p></li> <li><p>Resolved an auto-complete issue in Query Anywhere.</p></li> <li><p>Resolved the double scroll bars issue on the landing page.</p></li> </ul><h2 data-id="integrations">Integrations</h2> <h3 data-id="aws">AWS</h3> <ul><li><p>Ingested EC2 settings: <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ebsDefaultKmsKeyId</code> and <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ebsEncryptionByDefault</code>.</p></li> <li><p>Created mapped relationships between the <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_ec2</code> service entity and the default<br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_kms_key</code> entity.</p> <p>!!! note <br> This change requires the additional <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ec2:GetEbsDefaultKmsKeyId</code> and<br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ec2:GetEbsEncryptionByDefault</code> permissions in the<br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">JupiterOneSecurityAudit</code> IAM policy of each AWS account being monitored.</p></li> <li><p>Added <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ebsOptimizedByDefault</code> and <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">ebsOptimizationSupported</code> Boolean flags on<br> EC2 instance assets. See <a rel="nofollow" href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-optimized.html">AWS docs</a>.</p></li> <li><p>Ingested AutoScaling policies and built <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_autoscaling_group</code> <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">USES</code><br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_autoscaling_policy</code> relationships.</p></li> <li><p>Mapped relationships from <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_sns_topic</code> and <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_sns_subscription</code> to the<br> endpoint asset on each subscription (such as an HTTP endpoint, a person by<br> email, or a Lambda function).</p></li> <li><p>Ingested roots and OUs in an AWS organization and mapped sub-accounts to each<br> root/OU.</p></li> <li><p>Added ELB attributes to properties. The attributes are mapped to properties as<br> follows:</p></li> </ul><table><thead><tr><th>ELB Entity Property</th> <th>ELB Attribute</th> </tr></thead><tbody><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">deletionProtection</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">deletion_protection.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">loggingEnabled</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">access_logs.s3.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">loggingTargetBucket</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">access_logs.s3.bucket</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">loggingTargetPrefix</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">access_logs.s3.prefix</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">idleTimeoutSeconds</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">idle_timeout.timeout_seconds</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">desyncMitigationMode</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http.desync_mitigation_mode</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">dropInvalidHeaders</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http.drop_invalid_header_fields.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">http2</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http2.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">tlsVersionEnabled</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http.x_amzn_tls_version_and_cipher_suite.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">tlsCipherSuiteEnabled</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http.x_amzn_tls_version_and_cipher_suite.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">xffClientPortEnabled</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">routing.http.xff_client_port.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">wafFailOpen</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">waf.fail_open.enabled</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">crossZone</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">load_balancing.cross_zone.enabled</code></td> </tr></tbody></table><ul><li><p>Fixed a false positive where some buckets were incorrectly identified as <br> public (with permission relationships to <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">everyone</code>) when the policy condition <br> contains specific OrgIds or AccountIds.</p></li> <li><p>Added the <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_organization</code> asset.</p></li> <li><p>Added support for parsing <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws:PrincipalOrgID</code> IAM policy conditions and mapped<br> relationships to the corresponding <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_organization</code> asset.</p></li> <li><p>Improved IAM resource policy condition parsing to map permissions to services<br> instead of the account when certain services are specified in the action.</p></li> </ul><h3 data-id="azure">Azure</h3> <ul><li>Fixed the authorization token expiration to support steps that execute for more than one hour.</li> </ul><h3 data-id="google-cloud">Google Cloud</h3> <ul><li><p>Improved accuracy of the CIS 4.3 managed question, "Is blocking of project-wide SSK keys enabled for my Google Cloud VM instances?"</p></li> <li><p>Relationships from <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_cloud_organization</code>s and <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_cloud_folder</code>s to<br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_cloud_project</code>s are now created for deleted projects.</p></li> <li><p>Modified the <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code> step to be independent from<br><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code> step to ensure BigQuery data is ingested even <br> when KMS Keys ingestion is disabled or fails.</p></li> <li><p>Added the following new properties to these resources:</p></li> </ul><table><thead><tr><th>Asset</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_storage_bucket</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">isSubjectToObjectAcls</code></td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">readonly</code></td> </tr></tbody></table><ul><li>Updated <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">google_storage_bucket.public</code> to be <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">true</code> when the storage<br> bucket does not have Uniform Bucket Access Level enabled. We cannot determine<br> if the bucket is public or not when this setting is disabled.</li> </ul><h3 data-id="onelogin">OneLogin</h3> <ul><li><p>Application Rules are now <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">Configuration</code> assets in the graph.</p></li> <li><p>Onelogin <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">User</code>s are related to the AWS IAM roles they have access to based on the presence of IAM role ARNs in the application rules. <br> This change requires that the IAM Role asset already exists in the J1 graph (the AWS integration is installed).</p></li> <li><p>Added raw data to assets.</p></li> </ul> </article> </main>
.png)