Axon 2024.04 Release Notes

Welcome to the April 2024 release of LogRhythm Axon! We are pleased to announce numerous exciting updates and changes for this quarter’s release that we hope you’ll enjoy. Brief explanations of the updates are grouped into the following sections:

• Detections

• Analyst Experience

• Data Collection

• Platform Improvements

Key highlights include:

• Analytics Rule Suppression

• Alert Manager & Silent Log Source Alerts

• LogRhythm System Lists

Detections

Analytics Rule Suppression

In certain cases, rules can fire multiple times in quick succession, creating a lot of extra “noise” in the form of observations and cases that contain duplicate information. To help with this, users can now suppress an analytics rule’s output to one observation for a period of time up to 24 hours.

For additional information, refer to the Analytics Rule Builder documentation.

Analytics Content

New LogRhythm-authored MITRE content has been added to out-of-the-box Analytics Rules, including:

• T1090.001:Proxy

• T1136.003:Cloud Account

• T1199:Trusted Relationship

• T1078.001:Default Accounts

• T1078.003:Local Accounts

• T1078.004:Cloud Accounts

• T1059.001:PowerShell:ProviderLifeCycle

• T1621:MFA Request Generation

• T1558.003:Kerberoasting

For more information on recently-added threat detection rules, refer to the Threat Detection Rules documentation.

Analyst Experience

Import and Export Dashboards

With the new Import and Export Dashboards feature, you’ll be able to bring custom dashboards that are used by certain compliance policies into your Axon tenant instantly. This feature can also be used to share Dashboards among other users, with the eventual goal of creating a hub for user-created Dashboards.

For more information, refer to the Export a Custom Dashboard and Import a Custom Dashboard sections of the Manage Dashboards documentation.

Case Management Metrics

The Case Management screen now includes aggregate metrics, showing open and unassigned case counts, as well as breakdowns by case priority and status.

For more information, refer to the Case List Metrics section of the Case Management documentation.

PCI-DSS Compliance Module

An Axon-specific module has been created to allow Axon users to maintain full compliance with the Payment Card Industry Data Security Standard (PCI-DSS) 4.0. This module includes custom lists, dashboards, and reports that will give you all of the information you need to ensure that you remain in compliance with ease.

For more information, refer to the module at Axon PCI Compliance Bundle.

Case Management Log List Panel

The Case Management log list panel has been updated to more accurately highlight the important data that matters most to you.

Updates to Reports

Reports have received an overhaul for this release. Notably, the cover page for exported PDF reports has been redesigned to be more appealing. Additionally, exported CSV files containing search grid results have been improved to be more reliable and user-friendly.

Search Changes

Search column layout changes are now persistent across multiple searches. Additionally, saved searches maintain the original saved layout. These changes have made the process of creating multiple searches back-to-back much more user-friendly and efficient.

Data Collection

New Log Processing Policies

Axon Agent Improvements

Axon Agent releases are now tracked separately from these general release notes to bring greater attention to this massive area of focus within the Axon product. During this quarter, Axon Agent versions 1.2 and 2.0 were released, and the current version of 2.0.0 perfects many of the changes that have been made to Axon Agents since the launch of Axon, including the Secure Syslog Collector.

For more information on the release of Axon Agent v1.2, refer to the Axon Agent v1.2 Release Notes.

For more information on the release of Axon Agent v2.0, refer to the Axon Agent v2.0 Release Notes.

Platform Improvements

Alert Manager & Silent Log Source Alerts

It is important that all log sources are up to date so that the latest data is fed into analytics and is available for search. To improve visibility into any log sources that may have fallen behind, Admins can now configure email alerts to be sent when one or more log sources fail to send new data within a configurable amount of time. Silent Log Source alerts can be configured to repeat automatically if the source continues to be silent, and they will stop automatically based on the time window selected.

Refer to the Alert Manager topic for more information.

LogRhythm System Lists

LogRhythm now publishes lists, both populated and unpopulated out of the box, to power analytics and compliance use cases. LogRhythm system lists can be identified by reviewing the Author column of the Lists grid; any list with an Author of LogRhythm was developed by our in-house threat research team and pushed to your tenant. Add list items that are relevant to your organization to the unpopulated lists, and then they will be ready to be referenced by analytics rules or searches. An inventory of system lists along with the use cases they were developed to satisfy can be found in the System Lists section of the Lists documentation.

Resolved Issues & Improvements

The following customer-found issues and improvement requests have been resolved/completed since the January 2024 release of Axon: