Nava SIEM Agent 1.2 - Release Notes

Features

1. Support for Amazon AWS CloudTrail
   We now support AWS CloudTrail, which allows you to retrieve logs from a variety of AWS subsystems, including: 
• Amazon Elastic Compute Cloud (Amazon EC2)
• Amazon Elastic Block Store (Amazon EBS)
• Amazon Elastic MapReduce (Amazon EMR)
• Amazon Kinesis
• Elastic Load Balancing (ELB)
• Amazon Redshift
• Amazon Relational Database Service (Amazon RDS)
• Amazon Virtual Private Cloud (Amazon VPC)
• Amazon Simple Workflow
• AWS CloudFormation
• Amazon CloudFront
• AWS CloudTrail
• Amazon CloudWatch
• AWS Direct Connect
• AWS Elastic Beanstalk
• AWS Identity and Access Management (AWS IAM)
• AWS OpsWorks
• AWS Security Token Service (AWS STS)
2. Syslog Output
   Nava SIEM Agent is now able to output logs to a Syslog server.
3. Google Apps Audit Logs: Checking for lagging events
   Nava SIEM Agent now periodically checks for late-arriving logs via Google Apps APIs. The user is able to specify the period of time to check for newly inserted logs.
4. GUI Improvements
   The GUI has been modified to be more intuitive and easier to use.

Fixed Issues

1. Admin privileges
   The user will be given a prompt to permit the program to launch with Admin privileges.
2. Order of Google Apps logs
   Google Apps logs now appear in correct temporal order.
3. Google Apps suspicious login: is_suspicious now always populated, even for login_success
   Previously, in the case when the login was success, we didn't output an "is_suspicious" column since the same entry was missing from the API. Now, if the API is missing a suspicious login field, we will output is_suspicious=Undefined.

Known Issues

1. If the service is killed or crashed while the events are being downloaded, there is a slight chance that there may be duplicates for some of the event.