The cs_windows_fake_windows_processes_filter filter macro, the internal cs_system_processes_run_from_unexpected_locations_internal_filter and cs_filter_windows_system_files macros, and the cs_fake_windows_processes_filter and cs_windows_system_files lookups are removed along with it.
Enhancements
Alert result aggregation to reduce noise
The following alerts now aggregate results instead of producing one row per event:
O365 - Defender XDR Detection (by alert name and alert ID)
O365 - Email from Spoofed Domain (by sender and subject)
Palo Alto - High Threats Alert (by source, destination, device, action and threat)
Fortigate - DoS Policy Alerts (by source IP and device)
MSSQL - Role Changes (by host, server instance and object)
Alert tuning updates
O365 - Defender XDR Detection: now only considers AlertTriggered, AlertEntityGenerated and InsightGenerated operations, excludes informational detections (Email messages removed after delivery*, User requested to release a quarantined message, Admin Submission Result Completed), and extracts Recipient, Sender, Subject, Sender IP, File Hash, File Name, URL and Action from the alert data.
O365 - Email from Spoofed Domain: excluded emails that were already blocked (DeliveryAction="Blocked").
O365 - Successful Login After Multiple Failed Attempts: now triggers only when a successful login is preceded by 3 or more failed logins within 1 hour.
Authentication - Bruteforce Attempt for a User: excluded unknown, invalid and masked (***) user names.
Windows - Admin Successful Logon Across Multiple Hosts: excluded computer accounts and - account names.
Windows - System Startup and Shutdown: the user field now shows the user who initiated the restart/shutdown (extracted from the event message) when available.
Palo Alto - High Threats Alert: System Compromised notable event grouping is now by dvc only.
Custom Alerts page
Filter macro name and value fields are now shown only when editing a default Cyences alert, and are required there.
Search verification now only requires the cyences_severity field; the _time/event_time format check has been removed.
Cyences Configuration UI: refreshed look and feel across all configuration pages, with consistent notification toasts on the Cyences Alerts and configuration pages.
Bug fixes
Windows - New Service Installation: fixed the known-vendor exclusion filter to use the service_name field.
Windows - DNS Server Suspicious Outbound Connections: fixed the IPv6 loopback/unspecified address (::1, ::) exclusion.
Windows - AD CS Certificate Anomaly: fixed a missing pipe before fillnull in the search query.
Palo Alto - Traffic on Non-Standard SSH Port: fixed the event time shown in the results.
Fixed the earliest/latest time not loading correctly when editing an alert on the Custom Alerts page.
Fixed the search verification loading loop on the Custom Alerts page when re-verifying an unchanged search.