v3.13.0

What's Changed

🕵️ New Detections

• feat: Azure SignIn risklevel passthrough rule by @edyesed in #858

🏡 Miscellaneous

• Adding Github.Audit Actor IP to lookup tables by @yusufak-panther in #855
• Feat: panther_analysis_tool update 0.24.4 by @edyesed in #860

New Contributors

• @yusufak-panther made their first contribution in #855

Full Changelog: v3.12.1...v3.13.0

v3.12.1

What's Changed

🕵️ New Detections

• feat: some detections for Azure.SignIn log type by @edyesed in #857

Full Changelog: v3.12.0...v3.12.1

v3.12.0

What's Changed

🏡 Miscellaneous

• feat: support for azuresignin log types by @edyesed in #856
• deps: update panther_analysis_tool to 0.24.3

Full Changelog: v3.11.3...v3.12.0

v3.11.3

What's Changed

🕵️ New Detections

• New: Tailscale Detections and Pack by @andrea-youwakim in #852

Full Changelog: v3.11.2...v3.11.3

v3.11.2

What's Changed

🐛 Bug Fixes and Tunes

• fix: CS base64 rule fails for some event types by @ben-githubs in #850

🏡 Miscellaneous

• Global helpers and filters for tailscale, rules forthcoming by @andrea-youwakim in #851

New Contributors

• @ben-githubs made their first contribution in #850

Full Changelog: v3.11.1...v3.11.2

v3.11.1

What's Changed

🐛 Bug Fixes and Tunes

• fix: explicitly ignore top level enrichments that start with 'p_any_' in the key name by @edyesed in #849

Full Changelog: v3.11.0...v3.11.1

v3.11.0

What's Changed

🐛 Bug Fixes and Tunes

• fix: Update list of "safe" TLS ciphers in AWS ALB SSL/TLS policy by @reedloden in #847

🏡 Miscellaneous

• Bump PAT to 0.24. by @zacbrown in #848

New Contributors

• @reedloden made their first contribution in #847
• @zacbrown made their first contribution in #848

Full Changelog: v3.10.0...v3.11.0

v3.10.0

What's Changed

🐛 Bug Fixes and Tunes

• Rework a few GCP detections to use deep_walk by @egibs in #841

🏡 Miscellaneous

• Fixes misnaming of github_repo_collaborator_change by @bfrisbie-wiz in #844
• fix: unit testing suite should test by using the panther_analysis_tool.immutable types by @edyesed in #846

New Contributors

• @bfrisbie-wiz made their first contribution in #844

Full Changelog: v3.9.3...v3.10.0

v3.9.3

What's Changed

🐛 Bug Fixes and Tunes

• fix: when a global is used as a state machine, it is preferable to define it in rule() for Standard.ImpossibleTravel.Login by @edyesed in #840

Full Changelog: v3.9.2...v3.9.3

v3.9.2

What's Changed

🕵️ New Detections

• Tines Rule - Job Deletion (2 cases) by @josh-panther in #787
• Tines Rule - Story Items Destruction by @josh-panther in #788
• Tines Rule - Team Destruction by @josh-panther in #789

🐛 Bug Fixes and Tunes

• fix: when Panther users are modified via SCIM, alert is INFO level by @edyesed in #835

🏡 Miscellaneous

• Upgrading to pat 0.23.0 by @andrea-youwakim in #838
• Update slack_potentially_malicious_file_shared description by @denniswebb in #839
• fix: update spacing in deep_walk docstring by @egibs in #837

New Contributors

• @denniswebb made their first contribution in #839

Full Changelog: v3.9.1...v3.9.2