Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne 2021.86 Release - AskJ1 Community
<main> <article class="userContent"> <p>December 16, 2021</p> <h2 data-id="new-features-and-improvements">New Features and Improvements</h2> <ul><li>Organization administrators can now create account-level API keys, which links the key to the organization account instead of an individual user account.</li> <li><p>Organization administrators can now parameterize sensitive values such as secrets for use in J1QL queries and questions without exposing the values.</p></li> <li><p>Vendor data in the public <a rel="nofollow" href="https://github.com/JupiterOne/vendor-stack">vendor-stack</a> repository on GitHub is automatically used to enrich the<br> properties of the vendor asset when a new integration is enabled in your account. This action does not overwrite or replace any custom changes you<br> have made directly to the vendor assets. Updates to the <a rel="nofollow" href="https://github.com/JupiterOne/vendor-stack">vendor-stack</a> repository are welcome.<br> This update was also published as a <a rel="nofollow" href="https://www.npmjs.com/package/@jupiterone/vendor-stack">npm package</a>.</p></li> <li><p>On Monday, December 20th, JupiterOne will provide a new login experience for users:</p> <p><img src="https://us.v-cdn.net/6035534/uploads/FAXNMN1UWSCB/new-login-ui2.png" alt="" class="embedImage-img importedEmbed-img"></img></p></li> </ul><h2 data-id="integrations">Integrations</h2> <h3 data-id="aws">AWS</h3> <p>We are working on improvements to the logic for how we identify <code class="code codeInline" spellcheck="false" tabindex="0">public: true</code>, <code class="code codeInline" spellcheck="false" tabindex="0">public: false</code> and <code class="code codeInline" spellcheck="false" tabindex="0">public: undefined</code> on S3 buckets that are ingested to J1 so they more closely match what is displayed in the AWS Console. We expect to release these changes later this month. More details will be provided prior to the release.</p> <h3 data-id="github">GitHub</h3> <p>Issues can now discover outside collaborators for CREATED and ASSIGNED relationships. For example, to find outside collaborators that were assigned an issue in GitHub you can run the following J1QL query:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">FIND github_user WITH role="OUTSIDE" AS user THAT ASSIGNED github_issue AS issue RETURN user.username, issue.title, issue.state </pre> <h3 data-id="google-cloud">Google Cloud</h3> <ul><li>Properties added to entities:</li> </ul><table><thead><tr><th>Entity</th> <th>Property</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_storage_bucket</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">versioningEnabled</code></td> </tr></tbody></table><ul><li>Properties added to relationships:</li> </ul><table><thead><tr><th>Relationship</th> <th>Property</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_cloud_authenticated_users</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_domain</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_everyone</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_group</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_iam_role</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_iam_service_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_assigned_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectName</code></td> </tr></tbody></table><ul><li>Properties removed from entities:</li> </ul><table><thead><tr><th>Entity</th> <th>Property</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_folder</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_organization</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">folders</code></td> </tr><tr><td>folder level <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code></td> </tr><tr><td>org level <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code>, <code class="code codeInline" spellcheck="false" tabindex="0">folders</code></td> </tr></tbody></table><ul><li><p><code class="code codeInline" spellcheck="false" tabindex="0">rawData</code> is now stored for <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code></p></li> <li><p>When determining which project's <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding</code>s to ingest, if a <code class="code codeInline" spellcheck="false" tabindex="0">projectId</code> is not specified in the configuration, the service account<br><code class="code codeInline" spellcheck="false" tabindex="0">projectId</code> should be used instead.</p></li> <li><p>When making <code class="code codeInline" spellcheck="false" tabindex="0">google_iam_binding_allows_resource</code> relationships, J1 no longer checks to see if a service is enabled when determining if the<br> relationship should be mapped or direct. Because this verification is for non-organization integration instances, the Resource Manager API<br> does not need to be enabled to ingest a <code class="code codeInline" spellcheck="false" tabindex="0">google_cloud_project</code>.</p></li> </ul><h3 data-id="google-workspace">Google Workspace</h3> <ul><li>Added support for ingesting the following new resources:</li> </ul><table><thead><tr><th>Resource</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Mobile Device</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_mobile_device</code></td> <td>Device</td> </tr></tbody></table><ul><li><p>To import mobile device entities you need to adjust your permissions in your Google Workspace account:</p> <ol><li>Click <strong>Security > API controls</strong></li> <li>In the <strong>Domain wide delegation</strong> pane, select <strong>Manage Domain Wide Delegation</strong>.</li> <li>Click <strong>Edit</strong> near the JupiterOne Service Account and add a new entry under <strong>API scopes</strong> for <code class="code codeInline" spellcheck="false" tabindex="0">https://www.googleapis.com/auth/admin.directory.device.mobile.readonly</code></li> <li>Click <strong>Account > Admin roles</strong>.</li> <li>Click the JupiterOne System role, and click Privileges</li> <li>Under <strong>Services, Mobile Device Management</strong>, enable <strong>Manage Devices and Settings</strong></li> </ol></li> <li><p>Added the following new relationship:</p></li> </ul><table><thead><tr><th>Source Entity '_type'</th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">google_account</code></td> <td>MANAGES</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">google_mobile_device</code></td> </tr></tbody></table><h3 data-id="jamf">Jamf</h3> <ul><li>Added support for ingesting the following new resource:</li> </ul><table><thead><tr><th>Resource</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Computer Group</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">jamf_computer_group</code></td> <td>Group</td> </tr></tbody></table><ul><li>Added the following new relationship:</li> </ul><table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">computer_group</code></td> <td>HAS</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">user_endpoint</code></td> </tr></tbody></table><ul><li>Now ingesting extension attributes as properties that are labeled as <code class="code codeInline" spellcheck="false" tabindex="0">extensionAttribute.<name></code>. For example, deployment status is ingested as the <code class="code codeInline" spellcheck="false" tabindex="0">extensionAttribute.Deployment Status</code>.</li> </ul><h3 data-id="kubernetes">Kubernetes</h3> <ul><li>Added support for ingesting the following new resources:</li> </ul><table><thead><tr><th>Resource</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Kubernetes Volume</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_volume</code></td> <td>Disk</td> </tr></tbody></table><ul><li>Added the following new relationship:</li> </ul><table><thead><tr><th>Source Entity '_type'</th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">kube_container_spec</code></td> <td>USES</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">kube_volume</code></td> </tr></tbody></table><h3 data-id="onelogin">OneLogin</h3> <p>Fixed an issue related to ingesting <code class="code codeInline" spellcheck="false" tabindex="0">App</code> entities.</p> <h3 data-id="qualys">Qualys</h3> <ul><li><p>Added an option to include the first 300 bytes of detection results as <code class="code codeInline" spellcheck="false" tabindex="0">Finding.details</code> when the detection represents a vulnerability in the set of <code class="code codeInline" spellcheck="false" tabindex="0">vmdrFindingResultQids</code> provided in the configuration. If enabled, this adds to processing time due to the additional bytes transferred.</p></li> <li><p>Fixed an issue where <code class="code codeInline" spellcheck="false" tabindex="0">host_asset</code> properties were not correctly transferrign to <code class="code codeInline" spellcheck="false" tabindex="0">disovered_host</code> entities</p></li> </ul><h2 data-id="fixes-and-resolutions">Fixes and Resolutions</h2> <ul><li>MySecurity is removed from JupiterOne. In 2022, we expect to launch an improved version to guide you on which actions you own and need to take to improve your security posture.</li> </ul> </article> </main>
.png)