Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.80 Release - AskJ1 Community
<main> <article class="userContent"> <p>September 24, 2021</p> <h2 data-id="open-source-projects">Open Source Projects</h2> <ul><li>Created a summary relationships script that enables you to create specific summary <br> or shortcut relationships. These relationships highlight interesting inter-service and <br> service source-to-sink connectivity. Access the script here: <br><a href="https://github.com/JupiterOne/secops-automation-examples/tree/main/summary-relationships" rel="nofollow">https://github.com/JupiterOne/secops-automation-examples/tree/main/summary-relationships</a></li> </ul><h2 data-id="integrations">Integrations</h2> <h3 data-id="aws">AWS</h3> <ul><li><p>Created <code class="code codeInline" spellcheck="false" tabindex="0">aws_lb_listener</code> entities for Classic Elastic Load Balancers so that<br> the protocol and port data can be queried.</p></li> <li><p>Changed <code class="code codeInline" spellcheck="false" tabindex="0">aws_load_balancer_connects_listener</code> relationships to<br><code class="code codeInline" spellcheck="false" tabindex="0">aws_load_balancer_has_listener</code>.</p></li> </ul><h3 data-id="github">GitHub</h3> <ul><li>Added support for ingesting the following new entities:</li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>GitHub Org Secret</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Secret</code></td> </tr><tr><td>GitHub Repo Secret</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Secret</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code></td> <td><strong>OVERRIDES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code></td> </tr></tbody></table><ul><li><p>Improved the retry logic for GitHub API response errors.</p></li> <li><p>Migrated <code class="code codeInline" spellcheck="false" tabindex="0">github_pull_request</code> ingestion to use Octokit v4 GraphQL instead of<br> the v3 REST API to enable the ingestion of related commit details more<br> efficiently.</p></li> <li><p>Commit analysis is now executed on every <code class="code codeInline" spellcheck="false" tabindex="0">github_pull_request</code>. This analysis is now<br> possible because commit details are always obtained with the pull request. Previously <br> they were collected in separate API calls that would exceed rate limits and prolong execution.</p></li> <li><p>Fixed an error where the head branch could not be determined for a pull request.</p></li> <li><p>Fixed an error fetching of too many pull requests per page.</p></li> <li><p>Fixed an error managing GitHub API "not found" responses when fetching pull requests.</p></li> <li><p>Fixed an error where the collaborators collection step could fail when one repository has<br> special permissions settings that prevent access to collaborators.</p></li> <li><p>Fixed duplicate key errors and step failures that occurred when GitHub data<br> changes during the execution of the integration.</p></li> <li><p>Fixed an error that caused <code class="code codeInline" spellcheck="false" tabindex="0">Repo ALLOWS Team</code> relationships to only appear for one<br> team in some circumstances.</p></li> <li><p>Fixed the handling of "Secondary Rate Limit" errors on GraphQL queries.</p></li> </ul><h3 data-id="bamboohr">BambooHR</h3> <ul><li>Added support for ingesting the following new entities:</li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Employee</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">bamboohr_employee</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Record</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">bamboohr_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">bamboohr_employee</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">bamboohr_user</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">bamboohr_employee</code></td> </tr></tbody></table><h3 data-id="microsoft-365">Microsoft 365</h3> <ul><li>Fixed an error where OAuth information was lost, preventing authorization.</li> </ul><h3 data-id="onelogin">OneLogin</h3> <ul><li><p>Fixed the UserApps step failure when a user has no assigned apps.</p></li> <li><p>Fixed duplicate <code class="code codeInline" spellcheck="false" tabindex="0">onelogin_user</code> <strong>ASSIGNED</strong> <code class="code codeInline" spellcheck="false" tabindex="0">mfa_device</code> relationships.</p></li> </ul><h3 data-id="tenable-io">Tenable.io</h3> <ul><li>Added support for ingesting the following new entities:</li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Asset</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">HostAgent</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new mapped relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0"><host></code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0"><host></code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0"><cve></code></td> </tr></tbody></table><ul><li>Removed support for ingesting the following entities:</li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Scan</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Assessment</code>, <code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>Vulnerability</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability</code></td> </tr></tbody></table><ul><li>Removed support for ingesting the following relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0"><host></code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_user</code></td> <td><strong>OWNS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">vulnerability</code></td> </tr></tbody></table><ul><li>Removed support for ingesting the following mapped relationships:</li> </ul><table><thead><tr><th>Source</th> <th>_class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_scan</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0"><host></code></td> </tr></tbody></table><h3 data-id="google-cloud">Google Cloud</h3> <ul><li>Added support for ingesting the following new resources:</li> </ul><table><thead><tr><th>Service</th> <th>Resource / Entity</th> </tr></thead><tbody><tr><td>DNS Policy</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_dns_policy</code></td> </tr><tr><td>Dataproc</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_dataproc_cluster</code></td> </tr><tr><td>Cloud Billing</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_billing_account</code></td> </tr><tr><td>N/A</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_billing_budget</code></td> </tr><tr><td>Cloud Bigtable</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_app_profile</code>, <code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_backup</code>, <code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_cluster</code>, <code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_instance</code>, <code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_table</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source</th> <th>class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_dataproc_cluster</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_dataproc_cluster</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_image</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_dataproc_cluster</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_storage_bucket</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_billing_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_billing_budget</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_project</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_billing_budget</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_cluster</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_backup</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_cluster</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_instance</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_app_profile</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_instance</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_cluster</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_instance</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_table</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_table</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigtable_backup</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_network</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_dns_policy</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_disk</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_compute_image</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_pubsub_topic</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_spanner_database</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_mysql_instance</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_postgres_instance</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code></td> </tr></tbody></table><ul><li>Changed the following mapped relationships to omit target creation:</li> </ul><table><thead><tr><th>Source</th> <th>class</th> <th>Target</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ANY_RESOURCE</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_service_account</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_domain</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_user</code></td> <td><strong>CREATED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_app_engine_version</code></td> </tr></tbody></table><ul><li>Added the following new properties to resources:</li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_postgres_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">logMinMessages</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">externalScriptsEnabled</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">userConnections</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">remoteAccess</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_sql_sql_server_instance</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">traceFlag</code></td> </tr></tbody></table><ul><li>Modified the <code class="code codeInline" spellcheck="false" tabindex="0">google_bigquery_dataset</code> step to be independent from the<br><code class="code codeInline" spellcheck="false" tabindex="0">google_kms_crypto_key</code> step.</li> </ul><h3 data-id="qualys">Qualys</h3> <ul><li><p><code class="code codeInline" spellcheck="false" tabindex="0">Service -> Host</code> relationships now map using <code class="code codeInline" spellcheck="false" tabindex="0">qualysAssetId</code> instead of <code class="code codeInline" spellcheck="false" tabindex="0">fqdn</code> for target <br> filters to improve accuracy.</p></li> <li><p><code class="code codeInline" spellcheck="false" tabindex="0">Finding.hostId</code> is now used to map to <code class="code codeInline" spellcheck="false" tabindex="0">Host.qualysAssetId</code>.</p></li> <li><p>Added new properties to the following resources:</p></li> </ul><table><thead><tr><th>Entity</th> <th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_host_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hostId</code></td> </tr></tbody></table> </article> </main>
.png)