Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.81 Release - AskJ1 Community
<main> <article class="userContent"> <p>October 14, 2021</p> <h2 data-id="integrations">Integrations</h2> <h3 data-id="google-cloud">Google Cloud</h3> <p>We recently discovered some ineffective relationships were being created between the <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code> and several entities, which may be causing the reporting of incorrect permissions in queries.</p> <p>To correct this issue, we added a <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code> entity to the Google Cloud integration that better represents how your permissions are associated with principals in Google Cloud.</p> <h4 data-id="what-has-changed">What has changed?</h4> <ul><li>Added support for ingesting the following new entity:</li> </ul><table><thead><tr><th>Resource</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>IAM Binding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessPolicy</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_service_account</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_group</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_domain</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">everyone</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_authenticated_users</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><strong>ALLOWS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ANY_RESOURCE</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_api_service</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">ANY_RESOURCE</code></td> </tr></tbody></table><ul><li>Removed the following relationships:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_group</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_domain</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">everyone</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_authenticated_users</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_service_account</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code></td> </tr></tbody></table><ul><li><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code> ingestion now takes place in the <code class="code codeInline" spellcheck="false" tabindex="0">fetch-iam-bindings</code> step instead of the<br><code class="code codeInline" spellcheck="false" tabindex="0">fetch-resource-manager-iam-policy</code> step, which is removed. If an integration does not use the<br> configure organization projects option in the configuration, this step uses the project scope<br> to fetch IAM policies.</li> </ul><h4 data-id="customer-impact">Customer Impact</h4> <p>As a result of these changes, please be aware of the following:</p> <ul><li><p>For the integration to properly ingest the IAM bindings, the Cloud Asset API (cloudasset.googleapis.com)<br> must be enabled in your Google Cloud account. If this API is not enabled, the step that imports the IAM<br> bindings is omitted during ingestion. For additional details on enabling the Cloud Asset API, see<br> the <a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/jupiterone.md#in-google-cloud">J1 Documentation</a><br> and the <a rel="nofollow" href="https://console.cloud.google.com/apis/library/cloudasset.googleapis.com">Google Cloud Documentation</a>.</p></li> <li><p>Traversal queries in J1 that previously queried a relationship directly between the <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_role</code> and<br> the principal member of your Google account must now go through the <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_entity</code>. For example,<br><code class="code codeInline" spellcheck="false" tabindex="0">Find google_user ASSIGNED google_iam_role</code> must change to <code class="code codeInline" spellcheck="false" tabindex="0">Find google_user that ASSIGNED google_iam_binding that USES google_iam_role</code>.</p></li> <li><p>The following queries in the question library are updated based on these changes:</p> <ul><li>“Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level"</li> <li>“Ensure that Service Account has no Admin privileges”</li> </ul></li> </ul><h3 data-id="additional-information">Additional Information</h3> <ul><li><p>For additional information, please read the <a rel="nofollow" href="https://try.jupiterone.com/blog/google-cloud-storage-access-analysis">blog post</a><br> detailing these changes.</p></li> <li><p>The code for the changes is available in the public repository on GitHub, as well as the changelog file:</p> <ul><li>Repo: <a href="https://github.com/JupiterOne/graph-google-cloud" rel="nofollow">https://github.com/JupiterOne/graph-google-cloud</a></li> <li>Changelog: <a href="https://github.com/JupiterOne/graph-google-cloud/blob/main/CHANGELOG.md" rel="nofollow">https://github.com/JupiterOne/graph-google-cloud/blob/main/CHANGELOG.md</a></li> </ul></li> </ul><p>October 5, 2021</p> <h2 data-id="announcements">Announcements</h2> <p>JupiterOne will be deploying an updated login experience in the next few weeks - stay tuned!</p> <p><img src="https://us.v-cdn.net/6035534/uploads/I2UO3AGV7VHD/new-login-screen.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="new-features-and-improvements">New Features and Improvements</h2> <ul><li><p>Delivered a refreshed landing page for querying your data.<img src="https://us.v-cdn.net/6035534/uploads/TG2A11Q7RM2V/j1-landing.png" alt="j1-landing" class="embedImage-img importedEmbed-img"></img></p></li> <li><p>Delivered a new onboarding to-do list for new J1 users to get oriented and obtain<br> value faster.<img src="https://us.v-cdn.net/6035534/uploads/4IM31PV5EB9Y/j1-new-user-todo.png" alt="j1-new-user-todo" class="embedImage-img importedEmbed-img"></img></p></li> <li><p>You can now perform bulk uploads of data in the Assets App without a file size limit.<br> Note: you must have Assets Admin and GraphViewer Admin to perform a bulk upload.</p></li> </ul><h2 data-id="integrations-1">Integrations</h2> <h3 data-id="aws">AWS</h3> <ul><li><p>Fixed validation error when supplying empty array to <code class="code codeInline" spellcheck="false" tabindex="0">macie2.getFindings</code> API.</p></li> <li><p>Added <code class="code codeInline" spellcheck="false" tabindex="0">cluster</code> parameter to <code class="code codeInline" spellcheck="false" tabindex="0">describeContainerInstances</code> to address AWS<br> notice of validation changes that began on September 24, 2021.</p></li> <li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">aws_instance</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">metadataOptionsState</code>, <code class="code codeInline" spellcheck="false" tabindex="0">httpTokens</code>, <code class="code codeInline" spellcheck="false" tabindex="0">httpPutResponseHopLimit</code>, <code class="code codeInline" spellcheck="false" tabindex="0">httpEndpointEnabled</code>,<br><code class="code codeInline" spellcheck="false" tabindex="0">enclaveOptionsEnabled</code>, <code class="code codeInline" spellcheck="false" tabindex="0">hibernationOptionsConfigured</code>.</li> </ul></li> </ul><h3 data-id="azure">Azure</h3> <ul><li><p>Improved handling of errors caused by disabled Azure accounts.</p></li> <li><p>Improved handling of some errors to better communicate the cause of the error.</p></li> </ul><h3 data-id="cloudflare">Cloudflare</h3> <ul><li><p>Migrated the integration to the latest SDK and infrastructure to allow<br> extended execution time on very large accounts.</p></li> <li><p>Improved handling and reporting of authentication and authorization errors to users.</p></li> </ul><h3 data-id="github">GitHub</h3> <ul><li><p>With this update, J1 has requested read-only access to GitHub Organization Secrets,<br> GitHub Repository Secrets, and environment secrets metadata, which must be granted<br> in the JupiterOne app in GitHub.</p> <p>Read-only access allows J1 to access information about the secrets, but not the<br> encrypted values. J1 has no access to the values of secrets at any time,<br> nor will J1 request such access.</p> <p>This access enables you to ask questions in J1 about your secrets, such as<br> "What Secrets are older than 365 days?" or "Which Repos have access to Org Secrets?" or<br> "Are there instances where Repo Secrets override Org Secrets of the same name?"</p> <p>For more information on GitHub Secrets, review the GitHub documentation<br> about the controls in place with this access:</p> <ul><li><p>Secrets: <a href="https://docs.github.com/en/rest/reference/actions#secrets" rel="nofollow">https://docs.github.com/en/rest/reference/actions#secrets</a></p></li> <li><p>Get an organization secret: <a href="https://docs.github.com/en/rest/reference/actions#get-an-organization-secret" rel="nofollow">https://docs.github.com/en/rest/reference/actions#get-an-organization-secret</a></p></li> <li><p>Get a repository secret: <a href="https://docs.github.com/en/rest/reference/actions#get-a-repository-secret" rel="nofollow">https://docs.github.com/en/rest/reference/actions#get-a-repository-secret</a></p></li> <li><p>Get an environment secret: <a href="https://docs.github.com/en/rest/reference/actions#get-an-environment-secret" rel="nofollow">https://docs.github.com/en/rest/reference/actions#get-an-environment-secret</a></p></li> </ul><p>If existing GitHub integration users do not grant these additional permissions<br> in their GitHub account, J1 automatically omits these steps in the integration and<br> does not import the organization and repository secret entities and properties. The rest<br> of the data for already approved permissions continue to be imported into J1 as expected.</p> <p>New users of the GitHub integration in J1 are required to approve these permissions<br> to use the integration.</p></li> <li><p>Added support for ingesting the following new entities:</p></li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>GitHub Environment</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_environment</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code></td> </tr><tr><td>GitHub Env Secret</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_env_secret</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Secret</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_environment</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_environment</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_env_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_env_secret</code></td> <td><strong>OVERRIDES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_env_secret</code></td> <td><strong>OVERRIDES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code></td> <td><strong>USES</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_env_secret</code></td> </tr></tbody></table><ul><li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_account</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">createdOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">updatedOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">description</code>, <code class="code codeInline" spellcheck="false" tabindex="0">email</code>, <code class="code codeInline" spellcheck="false" tabindex="0">node</code>, <code class="code codeInline" spellcheck="false" tabindex="0">databaseId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isVerified</code>, <code class="code codeInline" spellcheck="false" tabindex="0">location</code>, <code class="code codeInline" spellcheck="false" tabindex="0">websiteUrl</code>, <code class="code codeInline" spellcheck="false" tabindex="0">webLink</code></li> </ul></li> <li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_team</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">createdOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">updatedOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">databaseId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">description</code>, <code class="code codeInline" spellcheck="false" tabindex="0">node</code>, <code class="code codeInline" spellcheck="false" tabindex="0">privacy</code></li> </ul></li> <li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_user</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">company</code>, <code class="code codeInline" spellcheck="false" tabindex="0">createdOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">updatedOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">databaseId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">node</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isEmployee</code>, <code class="code codeInline" spellcheck="false" tabindex="0">location</code>, <code class="code codeInline" spellcheck="false" tabindex="0">websiteUrl</code>, <code class="code codeInline" spellcheck="false" tabindex="0">email</code></li> </ul></li> <li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_repo</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">autoMergeAllowed</code>, <code class="code codeInline" spellcheck="false" tabindex="0">databaseId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">deleteBranchOnMerge</code>, <code class="code codeInline" spellcheck="false" tabindex="0">description</code>, <code class="code codeInline" spellcheck="false" tabindex="0">homepageUrl</code>, <code class="code codeInline" spellcheck="false" tabindex="0">node</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isDisabled</code>,<br><code class="code codeInline" spellcheck="false" tabindex="0">isEmpty</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isFork</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isInOrganization</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isLocked</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isMirror</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isSecurityPolicyEnabled</code>, <code class="code codeInline" spellcheck="false" tabindex="0">isTemplate</code>,<br><code class="code codeInline" spellcheck="false" tabindex="0">isUserConfigurationRepository</code>, <code class="code codeInline" spellcheck="false" tabindex="0">lockReason</code>, <code class="code codeInline" spellcheck="false" tabindex="0">mergeCommitAllowed</code>, <code class="code codeInline" spellcheck="false" tabindex="0">pushedOn</code>, <code class="code codeInline" spellcheck="false" tabindex="0">rebaseMergeAllowed</code></li> </ul></li> <li><p>Added support for ingesting the following additional properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_pullrequest</code> entities:</p> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">databaseId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">node</code>, <code class="code codeInline" spellcheck="false" tabindex="0">commitsCount</code>, <code class="code codeInline" spellcheck="false" tabindex="0">approvalsCount</code>, <code class="code codeInline" spellcheck="false" tabindex="0">approvalLastAt</code></li> </ul></li> <li><p>Pull requests that are opened, reviewed, or approved by a user who is not part of the<br> current organization or collaborator list now have a mapped relationship to a<br> GitHub user with the login recorded in the pull request properties.</p></li> <li><p>Fixed <code class="code codeInline" spellcheck="false" tabindex="0">createdOn</code> and <code class="code codeInline" spellcheck="false" tabindex="0">updatedOn</code> properties on <code class="code codeInline" spellcheck="false" tabindex="0">github_org_secret</code>, <code class="code codeInline" spellcheck="false" tabindex="0">github_repo_secret</code>, and <code class="code codeInline" spellcheck="false" tabindex="0">github_app</code> to be Unix timestamp integers.</p></li> <li><p>Fixed step failures caused by insufficient permissions (disallowed scopes).</p></li> </ul><h4 data-id="github-analyze-commit-approval-changes">GitHub Analyze Commit Approval Changes</h4> <p>The initial version of the J1 GitHub integration provided a configuration option to enable analyze commit approvals. This feature gives you<br> the ability to see which users have opened, reviewed, and/or approved a pull request in their GitHub account.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/HHYUKXAE7LXQ/graph-github-analyze-commit-approval.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>The <code class="code codeInline" spellcheck="false" tabindex="0">analyzeCommitApproval</code> step in the integration generates the following relationships in the graph:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_user</code></td> <td><strong>OPENED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_pullrequest</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_user</code></td> <td><strong>REVIEWED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_pullrequest</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">github_user</code></td> <td><strong>APPROVED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">github_pullrequest</code></td> </tr></tbody></table><p>These entities appear in the graph, showing which users opened, reviewed, and/or approved a pull request in GitHub:</p> <p><img src="https://us.v-cdn.net/6035534/uploads/0Q4TBNXXTCBL/graph-github-pullreques-data-model.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>Initially, this feature was an optional setting because in large GitHub accounts it could result in API throttling for a GitHub account. J1 has recently made updates to include this information as part of the data imported to J1, with no adverse effect on your API usage. Because of this improvement to the integration, this data is now included in all GitHub integrations, regardless of the setting in the configuration UI. A future update will remove this setting from the UI.</p> <p><strong>Customer Impact</strong></p> <p>If you had already enabled this setting in your GitHub configurations, it continues to behave the same after J1 updates the UI.</p> <p>If you did not enable this setting due to API throttling concerns, you now have additional GitHub data available in your<br> J1 account with no adverse effect on your GitHub API usage.</p> <p>The option to ingest pull requests also exists in the J1 Bitbucket integration, however, there is no change in its behavior.<br> It is still an option that you can choose to enable or not.</p> <h3 data-id="google-cloud-1">Google Cloud</h3> <ul><li><p>Fixed <code class="code codeInline" spellcheck="false" tabindex="0">UNABLE_TO_FIND_PROJECT_ID</code> error.</p></li> <li><p>Moved J1-managed questions into the <a rel="nofollow" href="https://github.com/JupiterOne/graph-google-cloud/tree/main/jupiterone/questions">open source <code class="code codeInline" spellcheck="false" tabindex="0">graph-google-cloud</code></a> project.<br> You are welcome to create pull requests!</p></li> <li><p>Fixed missing <code class="code codeInline" spellcheck="false" tabindex="0">Internet</code> <strong>ALLOWS</strong> <code class="code codeInline" spellcheck="false" tabindex="0">google_compute_firewall</code> relationships for<br><code class="code codeInline" spellcheck="false" tabindex="0">0.0.0.0/0</code>/<code class="code codeInline" spellcheck="false" tabindex="0">::/0</code> source CIDR blocks.</p></li> </ul><h3 data-id="google-workspaces">Google Workspaces</h3> <p><em><strong>ACTION REQUIRED</strong></em></p> <p>Log in to the Google Workspace <strong>Admin Console</strong> as a super administrator and:</p> <ol><li>Click <strong>Security</strong> > <strong>API controls</strong>.</li> <li>In the <strong>Domain wide delegation</strong> pane, select <strong>Manage Domain Wide<br> Delegation</strong>.</li> <li>Click <strong>Edit</strong> near the JupiterOne Service Account and add additional entries<br> under <strong>API scopes</strong>: <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly</code></li> </ul></li> </ol><ul><li>Added support for ingesting the following new relationships:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_user</code></td> <td><strong>ASSIGNED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_role</code></td> </tr></tbody></table><ul><li>Added support for ingesting the following new entities:</li> </ul><table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Role</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_role</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">AccessRole</code></td> </tr></tbody></table><h3 data-id="heroku">Heroku</h3> <ul><li>Improved OAuth authorization error handling. The integration now reports<br> proper error messaging when Heroku responds to HTTP status codes that indicate<br> an error occurred.</li> </ul><h3 data-id="tenable-io">Tenable.io</h3> <ul><li><p>Added the <code class="code codeInline" spellcheck="false" tabindex="0">name</code> property to <code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code> entities.</p></li> <li><p>Added support for ingesting the following new relationships:</p></li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code></td> </tr></tbody></table><ul><li><p>Fixed an issue that prevented J1 from ingesting the complete set<br> of <code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding_is_cve</code> mapped relationships.</p></li> <li><p>Fixed an issue that prevented J1 from ingesting the complete set<br> of <code class="code codeInline" spellcheck="false" tabindex="0">tenable_asset</code> entities.</p></li> <li><p>Fixed an issue that prevented J1 from ingesting the complete set<br> of <code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code> entities.</p></li> <li><p>Fixed <code class="code codeInline" spellcheck="false" tabindex="0">Cannot read property 'map' of undefined</code> when iterating CVEs for <code class="code codeInline" spellcheck="false" tabindex="0">tenable_vulnerability_finding</code>.</p></li> </ul><h2 data-id="fixes-and-resolutions">Fixes and Resolutions</h2> <ul><li><p>Fixed an issue with the JupiterOne UI where a user session was terminated due<br> to inactivity and yet the UI did not refresh, delaying the response to the user.</p></li> <li><p>Resolved an issue where the overall compliant percentage was incorrectly<br> displaying as zero.</p></li> <li><p>Resolved an issue where logging out redirected a user to the incorrect URL.</p></li> <li><p>Fixed an issue in the Compliance app where the overall summary percentage<br> appeared to display 0%, even with multiple underlying compliance<br> frameworks toggled on with percentages > 0%.</p></li> </ul> </article> </main>
.png)