Contents and detection

A list of the improvements for the Contents and Detection that have been introduced in this release.

• Alerts raised through Structured Threat Information Expression (STIX) indicators now set the corresponding STIX indicator identifier (ID) as Trigger ID, allowing for tuning based on specific indicators.
• Nozomi Networks Operating System (N2OS) introduces the ability to distribute custom protocols via Threat Intelligence/Asset Intelligence, thus allowing new detection methods and asset identification strategies to be delivered on a daily basis.
• The executable file scanner for all unknown protocols is on by default.
• Improved resources auto-scaling for core N2OS processes resulting in optimized performance-to-resource-usage ratio.
• Improve the memory handling of Common Platform Enumeration (CPE) maps for N2OS VA.
• Improve the performance of Sandbox. More than eight workers can now be allocated to analyze files.
• Improve the robustness and performance of N2OS Sandbox while processing files with unpackers.
• Alerts of the types SIGN:ILLEGAL-PARAMETERS and SIGN:UNSUPPORTED-FUNC and SIGN:PROC:MISSING-VAR are now raised at most 10 times per hour for each link.
• Improved the memory stability and dissection of Sandbox with respect to VBA macros.