Contents and detection

A list of the improvements for the Contents and Detection that have been introduced in this release.

• The scan for Windows executable files for unknown protocols is now disabled by default. It can be enabled via a dedicated entry in the configuration file.
• Alerts stemming from YARA and Structured Threat Information Expression (STIX) rules about files in compressed archives now expose both the archive's and the extracted file's hashes.
• Retired legacy index matching and microsoft hotfixes engines. Those capabilities have been improved and standardised in cpe2cve.
• STIX indicators can now be assigned a custom scoring to be reflected in the alert risk.
• Added DUALUSE and PUA alerts for STIX Indicator alerts.
• The extraction and analysis of files can now be enabled or disabled according to the node's identifier (ID), zone and type.
• Improved stability of packet rules when generating an alert during the reload of packet rules contents.
• Packet Rules and Sandbox Engine can now automatically scale the central processing unit (CPU) and random-access memory (RAM) allocation to offer increased protection under high network traffic.
• Improve the consistency of asset merge for passive and active discovery.
• Improved the robustness of the byte option for Packet Rules against malformed input.
• Improved the ability to scan streams of unknown protocols for executable files. This is disabled by default and can be enabled via a documented instruction.
• n2os_va is now considered under high load if more than 10% of recalculation tasks are discarded in the last minute.
• Introduced generic Microsoft Windows signature for nodes and assets for which a precise build version cannot be inferred from passive monitoring. When more accurate information is captured from any other data ingress method, it will override the generic signature.
• Improve the robustness of Sandbox while analyzing invalid and corrupted VBA macros.