Contents and detection

A list of the improvements for the Contents and Detection that have been introduced in this release.

  • Alerts raised through Structured Threat Information Expression (STIX) indicators now set the corresponding STIX indicator identifier (ID) as Trigger ID, allowing for tuning based on specific indicators.
  • Nozomi Networks Operating System (N2OS) introduces the ability to distribute custom protocols via Threat Intelligence/Asset Intelligence, thus allowing new detection methods and asset identification strategies to be delivered on a daily basis.
  • The executable file scanner for all unknown protocols is on by default.
  • Improved resources auto-scaling for core N2OS processes resulting in optimized performance-to-resource-usage ratio.
  • Improve the memory handling of Common Platform Enumeration (CPE) maps for N2OS VA.
  • Improve the performance of Sandbox. More than eight workers can now be allocated to analyze files.
  • Improve the robustness and performance of N2OS Sandbox while processing files with unpackers.
  • Alerts of the types SIGN:ILLEGAL-PARAMETERS and SIGN:UNSUPPORTED-FUNC and SIGN:PROC:MISSING-VAR are now raised at most 10 times per hour for each link.
  • Improved the memory stability and dissection of Sandbox with respect to VBA macros.