Incident Workbench

Log360 Cloud now introduces an exclusive threat investigation console for advanced contextual analytics. This console is called the 'Incident Workbench' and can be invoked from multiple dashboards of Log360 Cloud. The features include the following:

• User activity overview and AD object details
• Process analytics

  This analysis comprises process spawning with parent-child process trees available in multiple graphical formats.

• Threat analytics

  This analysis is offered through the integration of Log360 Cloud's Advanced Threat Analytics for in-depth risk analysis of IPs, URLs, and Domains. Along with the threat analysis, the integration of VirusTotal, one of the largest live threat feeds, is also introduced in this release and will be available in the Incident Workbench

Users can add upto 20 analytical tabs in a single instance of the Incident Workbench and can save it to Incidents as Threat Evidences.

Device summary

Log360 Cloud now introduces an analytical console to view the overall device summary events. This console can be invoked from multiple dashboards of Log360 Cloud. Users can find event summary for the selected period,device severity events, and alerts summary.

• Correlation rule package

  Log360 Cloud now adds 50+ new predefined correlation rules complementing the new features released to level up threat detection. This new package includes rules for detecting suspicious process spawning, use of prevalent attacker tools like Mimikatz and Metasploit, and living off the land mechanisms with the exploitation of native binary tools and utilities.

• AWS ALB & NLB Analytics: Log360 Cloud now supports automatic ingestion and analytics of AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) log formats. The solution now provides:
  • Application Load Balancer Reports
  • Network Load Balancer Reports
• Custom Reports: Users can efficiently create custom reports in Log360 Cloud and view them in four different formats: table, summary, matrix, and multi-report.
• Scheduling Report Export and Distribution: Users can schedule the generation of selected reports at various frequencies and easily distribute them via email or SMS.

• Manage View: Users can create and manage multiple views of the same report. This enables you to view the report based on different parameters such as time, domain, source, etc. The different views will be generated from the same set of log data.
• Manage Pre-defined Reports: Users can now personalize the arrangement of reports based on their specific requirements.
• Notification Template: Users can now customize notification messages and recipient lists for specified events, enabling them to receive email or SMS alerts as needed.
• Windows Group Reordering: Windows reports have been reorganized for improved usability through group reordering, and a few obsolete reports have been removed.
• Increase in Real-Time Devices: The earlier restriction of 25 real-time devices for a Log360 cloud account has been increased to allow 25 real-time devices per agent. This will enable users to configure as many real-time devices as required by using multiple agents.
• Streamlining Device Selector Window: While adding devices for log collection, the device selector window will not display devices that have already been added. If there are no more devices to be added from a domain, a message saying "All devices are already added" will be shown.

• The log collector has been improved for stabilized operation from crashes. This will enhance seamless log collection.
• Duplication of devices that share IP addresses or other factors will no longer occur as they will be differentiated using a unique ID or the FQDN.
• Performance issues associated with exporting 100,000 log records from a larger data pool of around 10 million records have been resolved.

• Log360 Cloud incorporates cloud access security broker (CASB) capability by providing a cloud protection server in networks to help organizations:
  • Monitor cloud application usage
  • Track data transfer to cloud
  • Monitor and control the use of shadow applications
  • Block high-risk cloud applications

• Monitor and audit AWS accounts: Log360 cloud now supports monitoring changes made to AWS accounts. It allows you to audit access to AWS S3 buckets and track Elastic Load Balancing (ELB) traffic.