Page Comparison

1

Activate Security Command Center service

In order to receive this type of event, it is necessary to have the Security Command Center service activated.

Refer to the Security Command Center Quickstart video from the Google guide.

2

Setting up a new topic

Refer to the Configuration of the Loggingsection to know how to do it.

3

Setting up a Pub/Sub

Refer to the Configuration of the Loggingsection to know how to do it.

4

Setting up a sink

Refer to the Configuration of the Loggingsection to know how to do it.

Action

Steps

Configure Identity and Access Management (IAM) roles.

Refer to the official Google guide in which additional configurations are described.

Activate the Security Command Center API.

Setting up a Pub/Sub topic.

Creating a Notification configuration.

1

Service account with Base64.

• Collector Server

• On-Premise

2

Service account with the file credentials.

• On-Premise

v1.7.0

21 Jun 2024

Improvements

• Added small changes to make the configuration compatible with older versions than 1.2.1

• wheel upgraded from 0.42.0 to 0.43.0

• google-cloud-logging upgraded from 3.6.0 to 3.10.0

• google-cloud-pubsub upgraded from 2.18.4 to 2.21.4

• google-cloud-monitoring upgraded from 2.15.1 to 2.21.0

• pandas upgraded from 1.3.5 to 1.5.3

Recommended version

v1.6.0

29 Apr 2024

Improvements

• Upgraded DCSDK from 1.9.2 to 1.11.1

• Upgrade the Docker base image to 1.2.0

Upgrade

v1.5.0

25 Sep 2023

Improvements

• Upgraded DCSDK from 1.9.0 to 1.9.2

  • Store lookup instances into DevoSender to avoid creation of new instances for the same lookup

  • Ensure service_config is a dict into templates

  • Upgrade internal dependencies

New

features

• Added detection of SCC Findings events

• Added CHANGELOG.md

Upgrade

v1.4.0

03 Aug 2023

Improvements:

• Updated DCSDK from 1.7.2 to 1.9.0

  • Changed log level to some messages from info to debug

  • Changed some wrong log messages

  • Upgraded some internal dependencies

  • Changed queue passed to setup instance constructor

  • Ability to validate collector setup and exit without pulling any data

  • Ability to store in the persistence the messages that couldn't be sent after the collector stopped

  • Ability to send messages from the persistence when the collector starts and before the puller begins working

  • Ensure special characters are properly sent to the platform

Upgrade

v1.3.0

13 Apr 2023

Improvements:

• Improved base64 generation.

• Updated DCSDK from 1.6.3 to 1.7.2.

  • Added a lock to enhance sender object

  • Added new class attrs to the __setstate__ and __getstate__ queue methods

  • Fix sending attribute value to the __setstate__ and __getstate__ queue methods

  • Added log traces when queues are full and have to wait

  • Added log traces of queues time waiting every minute in debug mode

  • Added method to calculate queue size in bytes

  • Block incoming events in queues when there are no space left

  • Send telemetry events to Devo platform

  • Upgraded internal Python dependency Redis to v4.5.4

  • Upgraded internal Python dependency DevoSDK to v5.1.3

  • Fixed obfuscation not working when messages are sent from templates

  • Obfuscation service can be now configured from user config and module definiton

  • Obfuscation service can now obfuscate items inside arrays.

Bug fixing:

• Fixed a known issue on the DevoSender with the DCSDK update.

Upgrade

v1.2.2

Febr 27, 2023

-

-

-

v1.2.1

Nov 29, 2022

Improvements:

• Devo Collector SDK upgraded from version 1.4.2 to version 1.4.4b.

  • Added some extra checks for supporting MacOS as development environment

  • The "template" supports the controlled stop functionality

  • Some log traces now are shown less frequently

  • The default value for the logging frequency for "main" processes hsa been changed (to 120 seconds)

  • Added log traces for knowing the execution environment status (debug mode)

  • Fixes in the current puller template version

  • The Docker container exits with the proper error code

Bug Fixing:fixing

• Configurable logging traces for undelivered messages in GCP moved to thread model to avoid a special case in which is never triggered.
  pubsub_undelivered_messages_request_interval changed to pubsub_undelivered_messages_request_interval_in_seconds. New default value, every 600 seconds.

Recommended version

v1.1.4

01 Jun 2022

Improvements:

• New tag cloud.gcp.unknown.none for all services.

• When the collector processes a message that is not in JSON format, it sends it to the cloud.gcp.unknown.none table (only if the custom tag is not used).

• The behaviour of custom tags has been changed: If a custom tag is used the message will always go to the custom tag even if it is not in JSON format.

Upgrade

v1.1.3

23 May 2022

Improvements:

• Validated base64 variables from config.yaml. A new function was created to check if the base64 token in the configuration file has a valid format.

• Increase the Queue consuming throughput

Upgrade

v1.1.2

12 Apr 2022

Improvements:

• The underlay Devo Collector SDK has been upgraded to v1.1.4 to improve efficiency, increase the resilience and mitigate vulnerabilities.

• The hard-reset procedure when losing connection with Devo has been improved.

Vulnerabilities mitigated:

• CVE-2022-1664

• CVE-2021-33574

• CVE-2022-23218

• CVE-2022-23219

• CVE-2019-8457

• CVE-2022-1586

• CVE-2022-1292

• CVE-2022-2068

• CVE-2022-1304

• CVE-2022-1271

• CVE-2021-3999

• CVE-2021-33560

• CVE-2022-29460

• CVE-2022-29458

• CVE-2022-0778

• CVE-2022-2097

• CVE-2020-16156

• CVE-2018-25032

Upgrade

v1.1.1

08 Mar 2022

Improvements:

• The underlay Devo Collector SDK has been upgraded to v1.1.3 to improve efficiency and performance.

• When the collector loses the connection with Devo it executes a hard-restart protocol to force the reconnection with a fresh configuration.

Upgrade

v1.1.0

01 Mar 2022

Improvements:

• The following properties have been renamed to be more user-readable:

  • credentials_file to filename

  • credentials_file_content_base64 to file_content_base64

• Added new optional categorization mode which categorizes the events based on their fields to create the Devo Tag.

• The underlay Devo Collector SDK has been upgraded to v1.1.0 to improve efficiency.

Upgrade