Uptycs Cloud 146 Release Notes

Uptycs Cloud 146 Release Notes

Disclaimer: This document is for information purposes only. It is subject to change due to ongoing product development by Uptycs. You should not interpret this information as a binding commitment from Uptycs. Without prior written consent from Uptycs, you must not reproduce, store, or transmit any part of this document through electronic or mechanical means, recording, or any other method.

Extended Detection & Response
Enhancements
● The Asset Under Management page includes filters for non-cloud assets.
● The following tabs of the Managed AV dashboard include new filters for Asset Tags and Asset Groups:
      ○ Overview
      ○ Security Center Hygiene
      ○ Defender Hygiene
      ○ Defender Status
● The Forwarding Rules configuration includes a new tab Notifications, allowing you to set forwarding rules based on various sources, including alerts and detections, and specify your preferred destinations for these notifications.
● The Detections page includes a new filter Detection Name, enabling you to refine results by including or excluding specific detection names.
● The Threats dashboard is renamed to Mitre ATT&CK Summary for enhanced clarity, encompassing the following improvements:
      ○ Time Frame Selection: Choose your preferred time frame (date and hours), with a default one-day view.
      ○ Focused Technique Display: Streamlined presentation, displaying only triggered techniques for tactics along with their names.
      ○ Improved Detections Page: The one-day view is now placed at the top for quick access to essential information
● The Alerts Management page includes a new filter Assigned to, allowing you to refine the alerts list based on their assigned recipients.
● The Virus Total integration configuration includes an option to set Aggressive or Conservative caching, allowing you to optimize redundant Virus Total calls.
● Disk scan enhancements:
      ○ The Disk Scan Configuration page enables you to define a timeout for disk scans.
      ○ The Disk Scan page includes a Refresh icon to fetch recent scan status.

Vulnerability
Enhancements
● The Vulnerability UI now includes essential path information on the Endpoint Details, Image Details, and Container Details pages, providing clear insights for informed risk assessment and remediation. This includes the following key points:
      ○ Addition of path details on both the Vulnerability UI and CSV Download reports
      ○ Single path display for a vulnerability and multiple paths condensed with an ellipsis
      ○ Tooltip functionality offering a quick glance at up to 5 paths for in-depth analysis



New Features
Endpoint Anomaly Detection

Uptycs introduces Endpoint Anomaly Detection, a feature allowing you to monitor unusual activities on your endpoints. To facilitate this, you have the following options:
● A new dashboard enables you to monitor endpoint anomalies
● The Detections page includes the Anomaly Present filter for refining the detection list based on anomaly presence 

Cloud Security
New Features
Store Custom Tags for AWS, Azure, and GCP
Added support to store essential custom tags per customer. This helps you manage and store crucial custom tags tailored to each customer, providing a more personalized and organized approach to your cybersecurity endeavors.

Dynamic Exposure Scanner for Azure
Dynamic Exposure Scanner helps you prioritize Network Security Group misconfigurations. It supplements the security graph by dynamically scanning open ports to check if they are truly reachable and reports services running on those ports. Added support for VM service.

Cloud Threat Hunting Investigation for Azure
Cloud Threat Hunting Investigation to streamline the incident analysis process across your organization's configurations, security posture, network traffic, and identity activity.
    ● Log Analytics dashboard provides a centralized platform to collect, query, and analyze logs from different sources. This helps to gain insights, troubleshoot issues, and monitor the health and performance of your Azure resources and applications.
    ● Cross Account Analysis dashboard to analyze activities across subscriptions within or outside the tenants. You can view cross-subscription activities on a per subscription that provides the details of the roles that were assumed to access from other subscriptions.

Enhancements
AWS
      ● Attack path enhancements :
               ○ Enhancement to the EC2 Attack Path graph to view the lateral movement to other instances via network reachability. You can view lateral movement via temporary SSH keys, SSH keys, and modified Security Groups.
    ○ Enhanced the existing graph view for roles to view the identities that a particular role can access including the effective permissions.
      ● Cloud Discovery enhancements:
              ○ Added support for the IAM Relationship graph to view the Effective Permissions or Service Access Path and filter the dynamic graph for Paths and Nodes.
              ○ Paths filter out types of edges, while Nodes filter various node types, such as user, role, group, or specific resources like EC2 instances and S3 buckets.
              ○ View the Effective Permissions for the roles, groups, users, and more.
     
      ● Enhanced the existing graph view for roles to view the identities that a particular role can access including the effective permissions on the Top 20 Risky Roles tab.

Azure
● Added support for the Event Hubs service for Activity Logs and NSG Flow logs and the following telemetry tables:
    ○ azure_eventhub_namespace
    ○ azure_eventhub_hub
    ○ azure_eventhub_consumer_group
    
● Attack path enhancements:
    ○ Added support for AKS service only for Load balancer for internet exposure to view the Security Graph for all security risks associated with each container.
    ○ Lateral Movement from exposed VM to other VMs via Managed Identity.

● Cloud Discovery dashboard enhancements:
    ○ Added Key vault and key association
    ○ Added AKS service

● Added support to provide manual remediation for exposed nodes. You can modify/delete rules, add access restriction rules, and more for all internet services or exposed nodes. The detailed steps help in fixing these issues via both Console and CLI, offering flexibility in your remediation approach.

● Added support to view Effective Permissions for Indirect Resources connected to roles in the Azure Effective Permissions Graph.

● Revamped the top bar for Azure Identity Risks for a more intuitive experience.

● Added new table gcp_secret_manager_secret_policy_binding for the Secret Manager Policy Binding service.
GCP
          ● Lateral movement via Stored keys such as SSH key pairs. It involves the combination of Network and Stored Keys for lateral movement from exposed VM to other VMs.

Known Issues
● The Audit events received from GKE clusters have limitations with respect to pod exec, where some of the fields are not available. Therefore correlation of detections for the pod exec event is not supported.
● While downloading Container Vulnerabilities report, for osquery versions lower than 5.9.2.x, downloaded data can contain vulnerabilities from older versions of osquery which may be missing from vulnerable images in the UI.
● Multi-architecture docker images with Fat digest are currently not supported in SDLC.

Kubernetes and Container Security
New Features
Internet Exposure Risk For Kubernetes Pods and Namespaces
View internet exposure risk for pods and namespaces on the Kubernetes Overview graph. To check for internet exposure, Uptycs checks the network policies deployed to the cluster and namespaces and checks whether those allow for internet exposure. In addition, you can view the Container Network Interface (CNI) details on the cluster overview cards.

Download Helm Charts
Added support to download the Helm charts from a public repository.

Enhancements
● Registry Scanning:
    ○ Added support to seamlessly integrate virtual repositories for Image Scan. You can integrate with repositories such as JFrog using sub-domain-based repositories or separate local repositories.
    ○ Added wildcard repository name support for ECR registry integration. This allows you to leverage wildcard repository names in the repository field allowing targeted scanning of specific registries after integration.
   
API
Added/enhanced the following APIs

API
Description
/threatbooks
Support for the POST method to update threatbooks




    • Related Articles

    • Uptycs Cloud 144 Release Notes

      Uptycs Cloud 144 Release Notes Disclaimer: This document is for information purposes only. It is subject to change due to ongoing product development by Uptycs. You should not interpret this information as a binding commitment from Uptycs. Without ...
    • Uptycs Cloud 148 Release Notes

      Disclaimer: This document is for information purposes only. It is subject to change due to ongoing product development by Uptycs. You should not interpret this information as a binding commitment from Uptycs. Without prior written consent from ...
    • Uptycs Cloud 147 Release Notes

      Disclaimer: This document is for information purposes only. It is subject to change due to ongoing product development by Uptycs. You should not interpret this information as a binding commitment from Uptycs. Without prior written consent from ...
    • Significant Improvements in Uptycs main menu

      At Uptycs, we are constantly striving to enhance your experience while using our product. As a part of these efforts, we have made significant improvements to our main menu experience. We are confident that these changes will make your day-to-day ...
    • New and Improved Uptycs Overview Dashboard

      Short Feature Video Introduction We are excited to announce the launch of our new and improved Uptycs Overview Dashboard. In our continuous efforts to enhance your experience and provide you with advanced security analytics, we have invested ...