IT Security Search 11.4.1 - What is new and resolved (4220058)

New Features:

• Improved Hybrid Active Directory forensics
  A number of new Azure object properties are now available in search results, including the following:
  • Permissions for Azure applications
  • Security rules for network security groups
  • Membership details for Azure users and groups

In addition, Azure events collected by Change Auditor now contain links to the details of Azure objects that occur in the Who and Whom fields

• Fine-grained scope definition for IT Security Search operators
  You can now use regular search queries to fine-tune the scope of objects visible to IT Security Search operators. For example, this helps segregate information that users can see based on Active Directory domain or a Azure tenant
• FIPS 140-2 mode compatibility
  IT Security Search can now function in Microsoft Windows environments where FIPS 140 revision 2 ( FIPS 140-2) mode is enabled. For more information about FIPS 140-2 mode, see https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing

Enhancements:

• There have been across-the-board performance improvements: searches now start faster, and the user interface is generally more responsive - IS-1293
• You can now fine-tune the column layout for export of search results to CSV or PDF. For that, use the new ITSS-ExportFields.psm1 PowerShell script that comes with IT Security Search. The script lets you rearrange and resize columns for arbitrary object types. For details, see Additional Utility Scripts - IS-1220
• The welcome wizard that was previously shown by default on the IT Security Search landing page has been replaced by an unobtrusive notification popup - IS-1003
• In the Active Roles connector settings, error reporting has been improved for connection tests - IS-936
• The Warehouse installer now automatically supplies the current user account in the Account name field - IS-703
• A major update of third-party components was made, including an update of Elasticsearch to version 2.4.4. The newer Elasticsearch component helped resolve a known issue where IT Security Search generated huge logs daily - IS-1456
• During installation and upgrade, IT Security Search setup now clearly states which services it requires and tells you what to do if they are stopped - IS-1427
• IT Security Search setup now lets you customize where Warehouse keeps its data stores - IS-807
• Display of Azure objects in search results has been improved: more properties are shown for them, and each Azure object type has its own set of relevant columns – IS-1750, IS-1596

Resolved Issues:

• In some cases the Warehouse connector can produce huge error messages - IS-1282, IS-1719
• In some cases, if you pin an object type as a tab and the object type name is not all-lowercase, then you get duplicate tabs for it: one has your original spelling and the other is all-lowercase - IS-1320
• Sometimes if you copy a value from the search grid, garbage can be appended to the copied string – IS-1310
• For computer local users, "null" is shown on the Member Of tab - IS-781
• For some types of object (particularly, objects that reference other objects through attributes), when you click the VIew Details link, you get the details for the wrong object - IS-1465
• If you expand or collapse the contents of a facet while a search is in progress, you may get an incomplete list of results - IS-1421
• The Warehouse store index may become corrupted if the Warehouse service is stopped while the index is being built - IS-1411
• If you use negative expressions in Warehouse searches, you may get incorrect search results for Enterprise Reporter data - IS-1440
• The web UI doesn't get dates from the IT Security Search server in a consistent format. It isn't always clear which number is the month and which is the day - IS-1659
• The details view for an Active Directory account shows the Last Logon field with a timestamp taken from Active Directory. However, it's possible that there are more recent logons by the account. Information about the last logons should be available in the events view instead of the details view - IS-1751
• When you try to click a facet to filter results, it can suddenly move away from the cursor - IS-1880
• If you use the Warehouse connector for working with Enterprise Reporter data in an environment with a large number of Active Directory objects, then data for container objects with a lot of members may fail to be saved in the Warehouse store - IS-1580
• If multiple events of the same kind (meaning, with the same values in fields such as What, Who, Whom and Where) occur less than a second apart, then the View Details link for all of these events may point to the newest of them – IS-1043