Support
 
Support Get Quote
 
 
 
 
 
Email Download Link

Release notes

Build 12521

Released on 14 Nov 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements:

  • Updated internal parameters to reduce false positive events in Apache SQL Injection reports.
  • Added Action log field for Fortinet IDS/IPS device reports, offering additional insights for threat analysis.
  • Added new predefined reports for the following:
    • Configuration change in Palo Alto devices.
    • VPN logout in Sophos devices.

The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12520

Released on 28 Oct 2024

  • Standalone Edition
    •  
  • Distributed Edition

 New feature:

Out-of-the-box compliance reports are now available in EventLog Analyzer for the following compliance standards:

  • PCI-DSS, updated to version 4.0
  • ISO 27001-2022

 Issue fix:

The Out of Memory issue that occurred while allocating memory for importing large MySQL log files has been fixed.

 Issue Fixes:

  • An issue with the product restarting after a successful upgrade or revert during auto-upgrade from 12500 build has been fixed.
  • Auto upgrade failure due to improper schedule and shutdown delay (native agent shutdown and DB shutdown) has been fixed, making the auto-upgrade pipeline more fail-proof.
  • The Out of Memory issue that occurs during patch verification for auto-upgrade in Managed Server has been fixed, preventing disruptions during the upgrade process.
  • Managed Server downtime that occurred during auto-upgrade, when the Managed Server was not found by the Admin Server, has been fixed.

Build 12500

Released on 27 Sep 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancement:

  • The bundled PostgreSQL version has been upgraded to 14.12.

 Enhancements:

  • Asymmetric encryption for credentials has been employed when the admin server attempts to log into a managed server. This will enhance security over sensitive credentials data.

 Issue fixes:

  • Resolved minor irregularities in the managed server database, allowing for smoother version upgrades and better database operations.
  • Updated an API signature to improve backward compatibility in the admin server. This will resolve auto-upgrade issues in versions below 12300.
  • Introduced stored buffers for service pack file checksums instead of actively calculating them during each upgrade call from managed servers, thereby optimizing the admin server's memory consumption and reducing the risk of memory overflow.

Build 12477

Released on 17 Sep 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fixes:

  • The STIX/TAXII server polling issue occurring after the release of build 12320 has been fixed. This will ensure continuous data collection.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12476

Released on 05 Sep 2024

  • Standalone Edition
    •  
  • Distributed Edition

 New feature:

  • Integration with ManageEngine ServiceDesk Plus: Eventlog Analyzer now supports log collection and report generation for the application logs (Access and Debug logs) from ServiceDesk Plus. This will improve incident detection and assist in resolving issues within the detailed log data of the ServiceDesk Plus application server.

 Enhancements:

  • Enhanced integration with the ManageEngine ITOM Suite: EventLog Analyzer now offers enhanced capabilities, including log collection via import protocol and comprehensive report generation. This feature supports Access and Debug logs from Network Configuration Manager, Firewall Analyzer, and NetFlow Analyzer.
  • Maverick SSH library has been upgraded to support OpenSSH v7.8+ SSH keys.
  • User interface enhancements on the reports page for better usability.
  • Eventlog Analyzer now supports direct export option(pdf, csv) for log source device details table.
  • Old data migration has been added as a prerequisite for the Search Engine Upgrade.
  • Search enhancement:
    • Save search with time selection: Search can now be saved along with the selected calendar date and time.
    • Save graph: The search graph has been enhanced to allow customers to save their graph options, including the newly added 'Graph color' feature.
    • Add to search: When clicking on a field in a table row, we can now add the criteria to the query with additional options.
    • Graph selection: A portion of the graph can be selected, which highlights it, and the details of the selected portion are updated in the table logs.
    • Search history: Search history is maintained to showcase recent queries.
    • Share search: Saved searches along with all search preference details can now be shared with other technicians or roles within the organization.
    • Sort: Logs in the table can be sorted based on the timestamp of the calendar.
    • Time value click action: Clicking on the time field in the table row now provides options to update the calendar time based on the selected time value.

Enhancements:

  • Space availability check for the Managed Server auto upgrade process will happen without stopping the managed server. This will ensure continuous operations.
  • Pre-upgrade failures in managed server auto upgrade are shown in the admin server UI, allowing for prompt resolution.
  • User can retry or skip the pre upgrade process from the Admin server UI itself, reducing any operational disruptions.

Build 12468

Released on 16 Jul 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancement:

  • Minor usability enhancements have been implemented in EventLog Analyzer to improve the user experience.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12467

Released on 12 Jul 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fixes:

  • A policy issue that occurred when configuring AWS S3 and ELB log sources has been fixed.
  • Issue with enabling and collecting the logs for IIS server's configuration monitoring has been fixed.

 Issue Fixes:

  • Domain objects and events sync from Managed Server to Admin Server has been stopped if the user has not configured Log360, for better resource and data utilization.
  • Restriction for more than one domain object and events discovery thread has been applied in the sync pipeline. This will help in avoiding duplicate data sync.
  • For Managed Servers in the auto-upgrade pipeline, heart beat calls (every 10 seconds) and an upper limit of 15 minutes wait time have been implemented to confirm shutdown status. This will avoid any disruption during the upgrade process.

Build 12466

Released on 11 Jun 2024

  • Standalone Edition
    •  
  • Distributed Edition

 New LogFormat support:

  • EventLog Analyzer now offers out-of-the-box reports for Topsec and Sangfor network devices. These reports include Firewall Allowed and Denied Traffic, System Events, Device Severity Reports, and Firewall IDS/IPS Events.
  • EventLog Analyzer now supports ESXi devices up to version 8.

 Issue Fixes:

  • Log parsing issues for the following devices have been fixed:
    • Cisco
    • Check Point
    • IIS
    • Stormshield
    • Firepower
    • ESXi
    • Palo Alto
  • A few minor fixes in the GUI of EventLog Analyzer's Search, Dashboard and Reports tabs have been made, making it more user-friendly.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12462

Released on 03 Jun 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • EventLog Analyzer now enables both sudo and non-sudo users, with the appropriate permissions, to install agents on Linux machines and configure auto log forwarding. This will improve security by limiting the need for root users to configure and manage agents.
  • The limit for the maximum number of alerts that can be triggered in a day has been increased to 100,000. This will provide flexibility for security teams to scale their alerting capabilities.
  • Memory consumption of SysEvtCol has been reduced by 90% to optimize product performance. This will improve the overall efficiency and speed of the product.
  • The 'User not discovered' error when configuring technicians for EventLog Analyzer from Log360 Technician Management has been fixed. AD users are now discovered upon domain addition or modification.

  Fixes

  • An issue related to the server output file growth caused by the correlation module has been fixed to optimize storage.
  • An issue that generated agent registration requests for Linux Agents after Upgrade has been fixed. This will ensure accurate device inventory and easy administration.
  • The Load Suspended issue that came up despite having sufficient disk space has been fixed. This will prevent unnecessary load suspension and improve the system reliability.
  • The issue of SFTP sessions not closing after import completion has been resolved. This enhances overall security by reducing the risk of hanging sessions.
  • The issue of the criteria builder not opening when editing saved Predefined Alert Profiles has been fixed. This improves user experience by allowing seamless editing of alert profiles.
  • Issues related to Log Import based on file name pattern have been fixed. This will increase the reliability and accuracy of data imports, ensuring imported data is correctly processed and utilized.
  • Parsing issues in the below reports have been fixed.
    • Checkpoint Critical Attack
    • Sophos Failed Logon Report
    • Fortinet Web Filter Report
    • Unix Mail Rejected Report
    • Meraki VPN Report
    • Cisco ASA Traffic Allowed Report
    This ensures accurate and reliable security and network monitoring.
  • The issue with time conversion when switching a Windows device LogCollection Mode from real-time to scheduled has been fixed.

 Issue Fix

  • A minor issue with the registerWithAdminServer.bat file has been fixed. This fix will facilitate an easy connection check between the managed server and respective admin server.

 Enhancement

  • A stronger and fixed primary identifier of managed servers has been introduced, leading to increased connection stability between the admin server and managed server.

Build 12460

Released on 06 May 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • Dark web monitoring

    You can now scan the deep and dark web continuously for leaked credentials and personal information associated with your organization, employees, and third-party vendors in EventLog Analyzer through our partnership with Constella Intelligence.

    You can identify if your domains or other digital assets have been compromised in supply chain breaches through real-time alerts and investigate and respond to threats quickly and efficiently.

    Learn more
  • Integration with ManageEngine's EDR, Endpoint Central

    EventLog Analyzer now integrates seamlessly with ManageEngine Endpoint Central, fortifying your endpoint security posture. This integration enables you to:

    • Leverage advanced correlation rules and custom alert profiles to detect potential exploits targeting vulnerabilities and misconfigurations.
    • Detect privilege escalation and lateral movement attempts, zero-day vulnerability exploitation, and more.
    • Mitigate threats efficiently by approving and deploying patches directly through new incident workflow actions.
    Learn more
  • External threat feeds integration:

    You can now import Sigma rules into EventLog Analyzer as alert profiles and detect security threats.

    Sigma is a widely adopted format for security signatures, allowing you to detect suspicious activities in your environment.

  • EventLog Analyzer now supports comprehensive monitoring of your Salesforce Cloud environment.
  • Archives upload to Amazon S3 bucket: EventLog Analyzer now enables you to store archives in an Amazon S3 bucket, providing users with an additional storage option for storing archived files.
  • System resource calculator: System diagnostics in EventLog Analyzer now include a system resource calculator, which provides recommendations for required resources. This enhances effective setup planning, thereby improving user experience.
  • SNMP v3 support: EventLog Analyzer now offers SNMP v3 support for discovery, log collection, and workflows, helping users optimize the product and improve its performance.
  • Global search: The Global Search feature has been added to EventLog Analyzer, enabling searches across all sections, including Reports, Compliance, and Administrative Settings.

 Enhancements

  • You can now create an external share link for a specific tab or widget within the dashboard for streamlined collaboration using the Embed Dashboard capability.
  • Log forwarding: EventLog Analyzer's syslog forwarder now enables log filtering based on specific criteria and also allows you to forward logs in customized formats. Additionally, it supports TCP connections and allows the creation of five distinct forwarder profiles, making log forwarding seamless and streamlined.
  • Archives: EventLog Analyzer now allows you to store archives in shared locations accessible with specific credentials. Additionally, you can configure separate locations for storing flat files and zip files. Storing the flat files in the local storage location ensures optimal performance during the archival process.
  • System diagnostics: The system diagnostics feature in EventLog Analyzer has been upgraded to provide comprehensive system information for enhanced user experience.
  • Offline agent log collection: Agents in EventLog Analyzer can now facilitate log collection from roaming machines despite interruptions in the connection between the agent and the server, provided that the size of collected logs remains within the configured limit of the installation directory.
  • Correlation rule: A new rule category called 'Living Off The Land Attack' has been added to the list of correlation rule categories in EventLog Analyzer. New predefined correlation rules have also been added.
  • The GUI of the compliance page has been revamped. This will enable enhanced navigation and management of compliance reports.
  • In new Linux installations, user access permissions to the product's folder have been updated to restrict unauthorized access to sensitive product files. Access is now limited to the installing user and the root user, ensuring heightened security. Check out this guide to learn more.
  • Precise reports of technicians' activities have been improved to provide precise and concise reports of their actions. In addition to resource name and action, new fields include a descriptive text message, user IP address, edit country, and status. You will also be able to view the old and new values in case an update is made.
  • The internal flow has been modified to improve security. Furthermore, a product clean up has been conducted with the intention of eliminating unused libraries and files. This also contributes to the reduction of overall installation size.

 Fixes

The following issues in IIS server log collection have been fixed.

  • Previously, any modifications to the log location or file patterns in the IIS server did not reflect in EventLog Analyzer. This issue has been resolved, and all changes will be auto-updated in EventLog Analyzer.
  • For IIS Servers added under Other Devices, the issue in collecting logs via WMI has been fixed. Additionally, users will now have the option to provide their WMI credentials or Admin credentials for WMI and site log collection.
  • An issue in collecting ETW log format has been fixed. Opting for "Both Log file and ETW" while Configuring IIS Server will now ensure the logs are collected.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12438

Released on 26 Apr 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fix

  • A startup failure issue due to the creation of multiple indices has been fixed, ensuring that probable performance issues do not occur.
  • An issue with rendering HTML content in alert emails has been fixed.
  • A memory leak issue associated with log collection leading to 'Undefined Error' has been fixed. This will lead to improvement in performance.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12437

Released on 04 Apr 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fix

  • An issue with the Transport Layer Security (TLS) version dropdown in the mail settings page has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12436

Released on 28 Mar 2024

  • Standalone Edition
    •  
  • This build is a compatibility release to support enhancements and fixes in Log360 UEBA build 4065.

Build 12435

Released on 25 Mar 2024

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Custom log format: Users can now create custom log formats entailing multiple parsing rules. These log formats, along with their respective parsing rules, can be applied to any new or custom log sources that are added as syslog or via file import. This will streamline how users manage parsing rules for various log source types in the network.

 Enhancements

  • Custom log parsing rule editing support provided. Users can edit the regex pattern, enable or disable rule, and modify fields.
  • Duo Security Web v4 SDK (Universal Prompt) support is given in Two-Factor Authentication. You can now configure Duo Security using Web v4 SDK as a secondary authentication factor to verify users when they log in to EventLog Analyzer. Duo security has announced end-of-life for Web v2 SDK on 30 March, 2024. We recommend all users to configure Web v4 SDK immediately.
  • Tomcat upgrade from 9.0.82 to 9.0.83. Tomcat's session timeout issue has been fixed in this upgrade.

 Issue Fix

  • An issue with the syslog receiver that led to the log collector process being killed has been fixed. This will ensure that the log collector process remains stable while receiving high volume of syslog.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12430

Released on 20 Feb 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Features

Incident Workbench

EventLog Analyzer now introduces an exclusive threat investigation console for advanced contextual analytics with multiple integrations. This console is called the 'Incident Workbench' and can be invoked from multiple dashboards of EventLog Analyzer. The features include the following:

  • User behavior analytics and activity overview
    This analysis is offered through the integration of UEBA from Log360 suite
  • Process analytics
    This analysis consists of process spawning with parent-child process trees available in multiple graphical formats.
  • Threat analytics
    This analysis is offered through the integration of EventLog Analyzer's Advanced Threat Analytics for in-depth risk analysis of IPs, URLs, and Domains. Along with the threat analysis available under Log360 Cloud Threat Analytics, the integration of VirusTotal, one of the largest live threat feeds, is also introduced in this release and will be available in the Incident Workbench

Users can add upto 20 analytical tabs in a single instance of the Incident Workbench and can save it to Incidents as Threat Evidences.

Device summary

EventLog Analyzers now introduces an analytical console to view the overall device summary events. This console can be invoked from multiple dashboards of EventLog Analyzer. Users can find event summary for the selected period, top active users, file monitoring events, device severity events, alerts summary, and activity overview for the applications configured in the device.

 Enhancements

  • Correlation rule package

    EventLog Analyzer now adds 50+ new predefined correlation rules complementing the new features released to level up threat detection. This new package includes rules for detecting suspicious process spawning, use of prevalent attacker tools like Mimikatz and Metasploit, and living off the land mechanisms with the exploitation of native binary tools and utilities.

  • ADMP workflow actions

    EventLog Analyzer's workflow profile builder now supports Active Directory actions using ManageEngine ADManager Plus Integration. Users can take remedial actions using the pre-built workflow profiles to perform actions like enabling or disabling users and computers, resting user passwords, adding users to groups, and deleting users and computers.

  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12420

Released on 16 Feb 2024

  • Standalone Edition
    •  
  • Distributed Edition

 New Features

Database settings:

  • Auto backup: You can schedule database backups through the user interface, and can restore the database as needed. Therefore, in the event of data loss or system failures, you can easily restore the databases and ensure business continuity.
  • Database migration
    • Database migration is supported in various ways, including from PostgreSQL to MS SQL, MS SQL to external PostgreSQL, MySQL to PostgreSQL, and MySQL to MS SQL. Migrating from an external database to the built-in PostgreSQL database is also supported now. For this migration, please contact the support team.

      For this kindly contact the support team.

      This capability will enable you to adapt and scale the infrastructure as per your needs, thus reducing operational costs and improving performance.

Password Policy:

  • In the Password Policy tab, you can now enforce password change requirements and restrict the reuse of passwords.

    This enhances the data security levels for users, and reduces the risk of systems being compromised.

 Issue Fixes

  • An issue in importing ADSelfService Plus logs under ManageEngine applications has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12414

Released on 15 Feb 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • New reports have been added for Sysmon application and Windows log sources. This includes Process Tampering, Event Logger Started, Service Paused, and more. This will help security teams better monitor and detect potential security threats on their systems.
  • The earlier restriction of 25 real-time devices for an EventLog Analyzer instance has been increased to allow 25 real-time devices per agent. This will allow users to configure as many real-time devices as required by using multiple agents.
  • While adding devices for log collection, the device selector window will not display devices that have already been added. If there are no more devices to be added from a domain, a message saying "All devices are already added" will be shown.

 Issue Fixes

  • The log collector has been improved for stabilized operation from crashes. This will enhance seamless log collection.
  • Duplication of devices that share IP addresses or other factors will no longer occur as they will be differentiated using a unique ID or the FQDN.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12411

Released on 07 Feb 2024

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • HTTP Request action in Workflow builder now supports Headers. Headers can be used to pass additional information such as authorization tokens and content type specifications such as XML or JSON. This will help security teams to send HTTP requests to a wider range of targets while improving HTTP Request the flexibility and functionality.

 Issue Fixes

  • A log collection issue with respect to syslog headers while collecting syslog from Dell Switches has been fixed.
  • An issue with alerts not being triggered for devices added or moved to newly created device groups has been fixed.
  • The issue in generating scheduled All Devices reports has been fixed.

The following issues in log parsing have been fixed.

  • An issue in parsing IP fields from Sophos XG WAF logs has been fixed. You can now find the logs under Web filter reports.
  • An issue in parsing Mac address and IP address fields from DHCP log sources has been fixed.
  • An issue in parsing Trend Micro Cloud log format has been fixed.
  • An issue in parsing RFC-3339 format based Unix logs has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12410

Released on 27 Dec 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fix

  • This release automatically removes the duplicate devices within a domain that were erroneously added due to an issue in build 12260.
  • A sync issue when updating domain category in Log360, that led to incorrect device names in EventLog Analyzer, has been resolved.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12400

Released on 12 Dec 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

The public key certificate used for service pack upgrades has been updated. This will enable seamless application of upcoming service packs.

  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12336

Released on 29 Nov 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Features

Integration with ManageEngine ITOM solutions:

EventLog Analyzer now supports log collection and report generation for the application logs(Access and Debug logs) for solutions from our ITOM suite such as OpManager, OpManager Plus and OpManager MSP.

Threat feeds integration:

  • EventLog Analyzer now offers Quick Deploy Servers to easily integrate and enhance the threat feeds.
    Supported threat feed vendors:
    • AlienVault OTX
    • Cyware
    • IBM X-Force
    • Kaspersky Threat Intelligence
    • PulseDive
    • Sectrio
    • SecAlliance-ThreatMatch
  • EventLog Analyzer now supports custom STIX/TAXII servers.
    Supported versions: STIX 1.x and STIX 2.x

ML based automation for alerts threshold:

EventLog Analyzer now offers smart threshold option for advanced alert configuration. This feature uses ML algorithms to analyze the usual occurrence of events and automatically determine the threshold values to trigger alerts. Compared to the manual option, the smart threshold option helps optimize the functioning of alerts by consistently reducing the false positives and steering towards improving the true positive triggers.

 Enhancements

Product Security

  • In new Windows installations, user access permissions for the product's root folder has been modified. It can now be accessed only by the user who installed it, and the users in the administrators group with approved permanent access. This will provide enhanced security. Check out this document to learn more.
  • JSON Library used in the product has been upgraded to the latest version (json-20231013), thereby preventing a potential vulnerability (CVE-2023-5072).
  • The Tomcat version bundled within the product has been upgraded to 9.0.82 for enhanced security and performance.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12331

Released on 03 Nov 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fixes

  • The issue in parsing Allowed and Denied Traffic reports from Meraki firewall sources has been fixed.
  • The issue with alerts not being triggered for custom parsed fields has been fixed. Users can now receive alerts from alert profiles built using custom fields.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12330

Released on 30 Oct 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Device and group-based log archival: You can now configure device(s)/group(s)-based log archival by creating multiple policies. This will help manage log storage more efficiently.
  • Log archival tool: You can use this tool to perform the following archival-related tasks from within the EventLog Analyzer UI:
    • Update archive path: The new location of the archived files can be updated when the archives are relocated from one location to another. This will help determine the quantity of archive files moved from a certain location, and whether or not the files were entirely transferred.
    • Update archive status: The integrity status of the archive file will be promptly verified and updated by clicking the refresh button located on the "Archive Data - Update Paths" page. This will make it simpler to assess if the archive files location is accurate or not.
    • Add missing archive entries: When the file is physically present but not reflected in the UI, the missing archive records can be added to the product. Reports can be generated only when the files are present in the UI. Thus, you can load the archives and generate the reports by adding the entries to the UI.
    • Rebuild elastic search indexes from archive: The archive logs will be directly indexed in the Elasticsearch. This will be helpful when the index logs need to be restored right away due to corruption or loss.

 Enhancement

Mail Server:

  • Mail Server authentication now supports OAuth and API protocols.
  • Introduced compatibility for Azure cloud source for China and US.

New Feature

  • Log archival tool in admin server: You can use this tool to perform the following archival-related tasks available in the admin server from within the EventLog Analyzer UI:
    • Update archive path: The new location of the archived files can be updated when the archives are relocated from one location to another. This will enable us to determine the quantity of archive files moved from a certain location and whether or not the files were entirely transferred.This is applicable only if centralized archiving is enabled in admin server.

The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12328

Released on 20 Oct 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New feature

New out-of-the-box compliance reports: Audit ready and out-of-the-box compliance reports are now available for the following compliance standards:

  • Qatar Cybersecurity Framework (QCF)
  • Trusted Information Security Assessment Exchange (TISAX)
  • Saudi Arabian Monetary Authority (SAMA)
  • Kingdom of Saudi Arabia Essential Cybersecurity Controls (KSA-ECC)
  • Saudi Arabia's Personal Data Protection Law (PDPL)
  • Criminal Justice Data Communications Network (CJDN)
  • United Arab Emirates National Electronic Security Authority (UAE-NESA)
  • Systems and Organization Controls 2 (SOC 2)
  • General Law for the Protection of Personal Data (LGPD)

These out-of-the-box compliance reports will help monitor the security posture of the network, and stay compliant to the respective compliance mandates.

  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12327

Released on 18 Oct 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New feature

Integration with ManageEngine Endpoint Central

You can now integrate EventLog Analyzer with ManageEngine Endpoint Central. With this integration, IT teams can delve deeper into endpoint activity, and store critical Endpoint Central logs for a longer time for security auditing. The integration enables you to:

  • Monitor remote actions on endpoints performed by Endpoint Central admins.
  • Monitor policy and software license modifications.
  • Create alerts from Endpoint Central logs, conduct log forensics using search, and create incidents automatically.
  • The updates for the Distributed Edition are the same as those of the Standalone Edition.

Build 12326

Released on 09 Oct 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fix

  • A critical issue in log collection sync, which lead to the duplicate collection of Windows log whenever the EventLog Analyzer server restarted, has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12325

Released on 29 Sep 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fixes

  • Issue in showing Schedule Frequency Date Format under Edit Compliance Schedule has been fixed. Users can schedule on an hourly, daily, weekly and monthly basis and set the time frequency accordingly.
  • Issue in updating the Device Display Name field in the alerts page has been fixed. Users can now see the updated Device Display Name for the corresponding Alerts in the alerts page.
  • Parsing issues in the CISCO System Events report group has been resolved.
  • Parsing issues in the following Mitre ATT&CK reports have been resolved: - USB Device Plugged Report under Hardware Additions.

 Enhancements

  • JSON format has been added to Log Forwarding standards. JSON is more concise and lightweight, making parsing and log ingestion faster.
  • Host IP address macro has been added in alert notification mail. Users who receive alert emails will now have greater visibility.

 Issue Fixes

  • Issue during device specific search in environments having more than 3 managed servers has been resolved. User can now perform device search across managed servers more effectively.

Build 12324

Released on 25 Sep 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Retention setting for technician audit can now be configured in Retention Settings page.
  • The correlation performance has been enhanced to lower the detection latency.

 Issue Fixes

  • The issue in editing, enabling, and sharing custom reports has been fixed.
  • The following issues in Search have been fixed.
    • Issue in rearranging Display Name column during Search and CSV export.
    • Issue in displaying Message field values.
    • Issue in searching Message field values.
    • Missing field names in SQL audit logs.
    • Issue in displaying field-based operators while entering field names in basic search.
    • Issue in populating imported logs on the Search page.
    • Disappearing last characters while performing basic search.
  • Rectifying the brute force correlation rule: An issue in the brute force correlation rule that resulted in false positive detections has been fixed. This will help improve the detection accuracy.
  • The release is same for both Standalone and Distributed editions.

Build 12323

Released on 11 Sep 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New Feature

Security and risk posture management for MSSQL servers

EventLog Analyzer is now equipped with the security and risk posture management feature for MSSQL servers. With this, the users can:

  • Check whether the MSSQL servers meet the benchmark requirements set by CIS (Center for Internet Security). The feature uses rule sets based on this framework to verify the security of MSSQL server.
  • Calculate the risk percentage of MSSQL servers based on the failure or success of rules.
  • Get insights and remedial steps for failed rules to reduce risk percentage.

 Issue Fix

  • The Libcurl.dll version has been upgraded to version 7.77 to fix the performance issue with log file upload.
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12322

Released on 25 Aug 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • Introduced the capability to integrate and monitor application logs from other ManageEngine (ME) applications, including ADManager Plus, ADAudit Plus, and ADSelfService Plus, via EventLog Analyzer.
  • Introduced support for Fortiweb logs.

 Enhancements

  • Resolved server output growth issues.
  • Fixed agent installation issues in Windows Server 2008.
  • Resolved false positive NodeDown notification issues. If integrated with Log360, NodeDown notifications might not work properly if Log360 isn't updated to its latest version.

 Hot Fixes

  • Parsing issues in Cisco Firepower FTD and PMP logs have been fixed.
  • Parsing issues in the following report types have been resolved:
    • Fortinet VPN session reports
    • MSSQL index reports
    • Barracuda VPN reports
    • Palo Alto VPN reports
    • CheckPoint firewall denied connection reports
  • The updates for the Distributed Edition - Managed Server are the same as those of the Standalone edition.

Build 12321

Released on 07 Aug 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Get to know the compliance mandates that EventLog Analyzer adheres to in the Support tab.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12320

Released on 31 Jul 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Elasticsearch will now automatically restart if it crashes.
  • Internal memory performance has been enhanced.
  • Backup data for the default threat server in air-gapped systems has been updated with the latest data.
  • Switching between disk-based threat storage and in-memory threat storage can now be done from the User Interface itself.
  • Minimum reputation score for Advanced Threat Analytics threat data can now be modified by the user.

 Enhancements

  • Auto upgrade of managed servers can now be disabled by the user.
  • Managed server upgrade can be done one by one from the admin server User Interface.

Build 12306

Released on 21 Jul 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Feature

  • Default support for standard syslog protocol in Sophos format has been added.

 Issue Fixes

  • Deleted devices in Active Directory will not be shown in the Device Picker pop-up.
  • The synchronisation problem between EventLog Analyzer and Log360, caused by integrating Data Security Plus with Log360, has now been resolved.

 Issue Fix

  • In the event of a backup failure, auto-upgrade of the Managed Server will proceed without any issues.

Build 12304

Released on 03 Jul 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issues fixed

  • This release fixes the log collector collapse reported due to the collection of logs with a future time stamp.
  • The performance issues due to real-time log collection have also been fixed.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12303

Released on 22 Jun 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Minor enhancements in the EventLog Analyzer Dashboard and Reports GUI.
  • Collect Configuration Change Logs option has been added under IIS Servers tab in the Application Source Management page.
  • Configure manually option has been added for adding sites under IIS Servers tab in the Application Source Management page.

 Issue fixes

  • Hyper-V, IIS server, ESXI, Checkpoint, Huawei, SAP ERP, Juniper and MySQL log parsing issues have been fixed.
  • Minor fixes in the EventLog Analyzer Dashboard and Reports GUI.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12302

Released on 19 Jun 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fix

  • This release fixes the security vulnerability (CVE-2023-35785), reported by dalt4sec.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12301

Released on 16 Jun 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Features

IP-based Access Restriction:

  • Users can now allow and restrict access to EventLog Analyzer on their premises for specific IP addresses or a range of IP addresses. Exceptions can be made to allow API calls and product URLs.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12300

Released on 19 May 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Features

Ticketing Tool Status:

EventLog Analyzer now supports the following ticketing tools:

  • On-demand - ManageEngine ServiceDeskPlus Cloud, ManageEngine AlarmsOne, Jira ServiceDesk Cloud and Freshservice Cloud
  • On-premise - ManageEngine ServiceDeskPlus MSP

Users can view the ticket details and the live status fetched from the configured ticketing tools in the EventLog Analyzer Alerts page.

Use our help guide and learn how to configure the ticketing tools.

Delete/Update Alerts in Bulk:

Delete alerts or update alerts based on the selected criteria in bulk without any count limit.

 Issue Fixes

  • SSL Ciphers have been upgraded to support Forward Secrecy.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12292

Released on 17 May 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes

  • The issue where the Log Collector crashes when attempting to fetch Windows event logs with future timestamps has been resolved.
  • An issue that caused an empty search response when employing a 'contains' filter has been resolved.
  • The disassociation of agents that occurred during registration has been corrected.

 Enhancements

  • The option to archive tamper check will be removed upon reopening the current file to eliminate false positive archive tampering alerts.
  • The 72 hour log collection restriction when EventLog Analyzer is down and later resumed has been removed as customers prefer to collect all logs from the last message timestamp.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12291

Released on 05 May 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • The out of memory issue has been fixed in larger environments.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12290

Released on 02 May 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New feature

  • Enhanced threat detection and investigation analytics: Consolidated and intuitive analytical dashboard for MITRE ATT&CK matrix that displays the top used techniques, tactics, impacted systems, and more for quicker threat detection and investigation.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12282

Released on 24 Mar 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • Log collector crash in the log collection filter module has been fixed.
  • The data load delay issue in the alert page has been fixed.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12281

Released on 10 Mar 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Product will now automatically increase the heap allocated (when not sufficient) for Elasticsearch.
  • Support for ThreatFox domains in default threat server.
  • The version of Tomcat bundled with the product has been upgraded to 9.0.65.
  • The version of 7zip bundled with the product has been upgraded to 21.6.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12280

Released on 20 Feb 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • EventLog Analyzer now supports AWS Cloud source logs.

Note: The enhancements and fixes for the Distributed Edition are the same as that of the Standalone edition.

  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12275 (Service Pack Build)

Released on 13 Feb 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue Fixes

'Wrapper in use' error that occurred while upgrading PPM has been fixed.

PPM only release

 Issue Fixes

  • Issue with auto upgrade that occurred due to certificate corruption has been fixed.

 Enhancements

  • The user can disable the option to obtain a certificate from admin server during manual upgrade of managed server.

Build 12274

Released on 03 Feb 2023

  • Standalone Edition
    •  
  • Distributed Edition

 New Features

Eventlog Analyzer now monitors the data folder(s) of Search Engine (Elasticsearch) and will automatically stop indexing if the drive where the indexed data is stored, has only 5GB of disk space left. It will automatically start indexing once the drive is free.

Note:

  • Log360 needs to be upgraded to build 5297 for this feature to be available.
  • The enhancements and fixes for the Distributed Edition are the same as that of the Standalone Edition.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12273

Released on 17 Jan 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • The issue with enabling inherited devices from managed servers has been fixed.
  • Issues related to the IIS server site status have been fixed.
  • The hidden option to reload the domain object in the admin server has been resolved.
  • The graph data issue with the Sonicwall VPN login failed report has been fixed.
  • The issue with corrupt configuration files caused by a full disk has been fixed.
  • Issues in exporting devices from the log source page have been fixed.
  • The issue in adding domain users to the admin server has been fixed.
  • Agent upgrades can be performed manually without uninstalling and reinstalling.
  • The parsing issue in the Fortinet firewall logon session report has been fixed.
  • The parsing issue with the name field for EventID 4624 has been fixed.

 Enhancements

  • Transmission protocol conversion in Juniper logs has been introduced.
  • Huawei reports will now have Added Rule Name field.
  • MSSQL reports will now include Added Time field.
  • Changing the timezone in the system will now reflect in the product once you login to the account.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12272

Released on 09 Jan 2023

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes

  • Synchronization issue with default threat and IP GeoSync has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12271

Released on 30 Dec 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes

  • The issue in loading Log360's dashboard widgets in builds subsequent to 12242 has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12270

Released on 16 Dec 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • An Incident Overview dashboard has been introduced to provide insights on the status of incidents.
  • EventLog Analyzer now supports RestAPI to enable users of other applications to access and search for events from within its console.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12261

Released on 09 Dec 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes

  • An upgrade issue in 12260 has been fixed.
  • A bug in the File Integrity Monitoring feature in build 12260 has been fixed.
  • Issues related to manually installing agents with the Windows MSI file have been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12260

Released on 02 Dec 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • Real-time log collection - Windows logs can now be collected in real time via agent-based and agent-less log collection.
  • Resource utilization - Users can monitor disk usage, log flow, RAM usage and CPU usage in EventLog Analyzer.
  • Connection Settings -
    • The Connection Settings page has been enhanced for better user experience.
    • Users can customize TLS and cipher versions for EventLog Analyzer if they choose a HTTPS application port.
    • The web server port where EventLog Analyzer is accessible in the browser, or EventLog Analyzer's internal ports such as UDP, TCP used for listening for syslogs can now be bound to a specific IP address.
  • Mail Settings - TLS version selection for mail server configuration is now supported.
  • Log Level Settings - Users can specify server log retention period in Eventlog Analyzer.
  • Active directory Device Cleanup -
    • Inventory Synchronization: When Windows devices are renamed in Active Directory, the updated names will also be reflected in EventLog Analyzer. When Windows devices are deleted from Active Directory, they will be shown as decommissioned devices in EventLog Analyzer.
  • Workflow Firewall Actions - EventLog Analyzer's workflow profile builder now supports Fortigate, PaloAlto Networks, SophosXG, and Barracuda firewalls. Users can take remedial actions such as adding deny access rules to these firewalls using pre-built workflow profiles.

 Enhancements

  • Log collection filter user interface has been enhanced to improve its usability.
  • Password and username can be simultaneously updated for multiple devices.
  • The IP address can be updated by refreshing all devices or selected devices in EventLog Analyzer.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12251

Released on 16 Nov 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • In-app push notifications for security releases and vulnerability fixes have been introduced.

 Issue fixes

  • This release includes a fix for the reflected XSS in error page (ZVE-2022-2848).
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12250

Released on 26 Oct 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now supports logs from PostgreSQL database.
  • Log import through SSH private key file sharing with SFTP protocol has been introduced.

 Enhancements

  • Drilldown popups:
    • Log sources: The event counts will be shown in Devices, Applications, and File Integrity Monitoring tabs. When click action is implemented in the devices tab, the last ten events will be displayed in the form of a drilldown popup.
    • Alerts and incidents: Clicking more details for correlation alerts will display correlation data in timeline view.
    • Device management settings: The ten latest events of devices, syslogs, and others will be displayed in drilldown popup.
    • Dashboard: Most of the dashboard widgets will have drilldown popup, which will show the underlying data of the widget report. You can export the data for further analysis.
  • Sorting option has been added to the reports table on the reports page.

 Fixes

  • Parsing issues in PaloAlto, Juniper, McAfee, Oracle and Unix devices has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12242

Released on 17 Oct 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Security Fix

  • The security vulnerability while using RemCom has now been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12241

Released on 28 Sep 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now provides out-of-the-box compliance reports for Protection of Personal Information Act (POPIA) and California Privacy Rights Act (CPRA).

 Fixes

  • Japanese and Chinese translation issue while exporting the Compliance Overview reports as a PDF has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12240

Released on 02 Sep 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The name of the server in which log collection failure occurs will be included in the corresponding alert emails.
  • The version of spring core jar bundled with the product has been upgraded from 5.3.18 to 5.3.21.
  • Enhanced security by upgrading key size from 1024 bits to 2048 bits for SSL/TLS key exchange.

 Fixes:

  • Log collection filter failure that occurred due to the usage of 'contains' conditions in message field, has been fixed.
  • A security and date parsing issue that occurred while exporting Admin server's archives has been fixed.
  • Archive location will revert to the default path if the location value is rendered invalid after instance migration.
  • When integrated with Log360, the devices that have been inherited from EventLog Analyzer into ADAuditPlus, could not be enabled or disabled from the ADAuditPlus console. The issue has been fixed in EventLog Analyzer 12240.

 Enhancements

  • Improved security for centralized archiving SSH server by disabling the support of weak ciphers.

 Fix:

  • A security and date parsing issue that occurred while exporting Admin server's archives has been fixed.

Build 12239

Released on 19 Aug 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes:

  • Elasticsearch cluster
    • When integrated with Log360, if EventLog Analyzer's Elasticsearch node is down or disconnected, starting Log360 will restart EventLog Analyzer's Elasticsearch and add EventLog Analyzer to Log360's cluster.
    • Note: Log360 needs to be upgraded to build 5275 for this feature to be available.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12237

Released on 04 Aug 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes:

  • Login issue due to security hardening feature has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12236

Released on 29 Jul 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Introducing EventLog Analyzer MSSP edition. Security service providers can now manage all their clients' servers and oversee log operations from a single console.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12235

Released on 19 Jul 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Java Runtime Environment (JRE) package has been upgraded to Zulu JRE 1.8.0_282.

 Fixes

  • Apache Struts dependency has been removed from EventLog Analyzer to fix the vulnerabilities.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12231

Released on 14 Jun 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fixes

  • Issues in log collection due to log collection filter are resolved.
  • Issue while importing Openvas XML file is fixed.
  • Issue in logging file deletion via c$ Share in File Integrity Monitoring is fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12230

Released on 13 Jun 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • Predefined correlation actions for Mitre ATT&CK TTP(s).
  • Details regarding unarchiving log data will now be available as 'Search unarchive status' when searching for data beyond archived period.

 Enhancements

  • Threat Store Management - An option to switch between in-memory threat store and disk-based threat store is provided via included switchThreatStore script.
  • On-Demand Workflow -
    • Users can run workflows, trigger alerts, and view their statuses directly from the alerts console of EventLog Analyzer.
    • Run Workflow option is directly available on the evidence tab under each incident.
    • Users can also run multiple workflows for a single alert or evidence.

 Fixes

  • Disk-based threat store corruption handling.
  • Added threat feeds support for EU region.
  • Compliance scheduled exports can now be downloaded by an admin technician.
  • Compliance scheduled exports (CSV) with corrupted zip in mail has been fixed.

 Enhancements

  • The Managed Server settings page has been revamped to enhance user experience.

 Fixes

  • Issue with computing URL for Managed Servers during automatic upgrade has been fixed.

Build 12226

Released on 19 May 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The version of Spring Framework jar bundled with the product has been upgraded to 5.3.18.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12225

Released on 20 Apr 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The GUI of EventLog Analyzer's log collection module has been updated to enhance user experience.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12220 (Service Pack Build)

Released on 29 Mar 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • Minor issues in archiving have been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12219

Released on 24 Mar 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • Issues due to security hardening during agent upgrade are fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12218

Released on 4 Mar 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now allows you to configure Log Collection Filters for internal applications.

 Enhancements

  • DCOM Security Hardening feature has been updated. The WMI authentication level has been increased to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY as suggested by Microsoft.

 Issue fixes

  • Parsing issues in SonicWall, Unix FTP and Palo Alto have been fixed.
  • The issue with column integrity monitoring reports not being generated has been fixed.
  • Schema name has been added to MSSQL tables.
  • The issue with MSSQL logs being displayed as Windows logs has been fixed.
  • False positives on monitoring /bin folders in Linux FIM have been controlled and useradd/userdel commands not being audited on /etc/passwd has been fixed.
  • Device details export status was shown wrongly in pdf. This has been fixed.
  • Issues occurring in Windows agents startup and log collection after a long interval in communication between agent and server have been fixed.
  • A device configured to collect Windows events and syslog, failed to collect Windows events. This issue has been fixed.
  • Mail server synchronization from Log360 to EventLog Analyzer took place only after a restart operation. This issue has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12216

Released on 9 Feb 2022

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now includes a Security Hardening tab to manage and configure all security settings from one place.
  • Mandatory default password change for built-in admin account.

 Enhancements

  • The Settings UI in EventLog Analyzer has been revamped to enhance user experience.
  • For WAF adoption and to enhance security, internal code refactoring has been done.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12215

Released on 7 Jan 2022

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-44832).
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12214

Released on 24 Dec 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fix

  • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-45105).
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12213

Released on 17 Dec 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Issue fix

  • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-45046).
  • JAR-hell issue post 12212 service pack is fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12212

Released on 14 Dec 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • This release includes a fix for the Apache Log4j vulnerability (CVE-2021-44228).
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12211

Released on 26 Nov 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • EventLog Analyzer now has out-of-the-box compliance reports for the Cybersecurity Maturity Model Certification (CMMC).

 Fixes

  • Minor bugs have been fixed to resolve performance issues in the log processing, indexing and alert processing modules.
  • Issues in parsing Oracle logs for Linux based File Integrity Monitoring (FIM) have been fixed.
  • Issues in Windows agents startup and log collection, created after longer gap in communication between agent and server have been fixed.
  • Issues in Check Point attack report have been fixed.
  • Issues in parsing SonicWall and Unix devices have been fixed.
  • Issues in auditing file/folder deletions from a share location, with Windows FIM have been fixed.
  • ZVE-2021-3375 - Unauthorized command injection vulnerability in EventLog Analyzer service installation has been fixed.
  • Issue with update in IP geolocation has been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12206

Released on 8 Nov 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The version of PostGreSQL bundled with the product has been upgraded to 10.18. This version of PostGreSQL will be available to users who have newly installed the product, not for users who have upgraded from a previous build.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12204

Released on 12 Oct 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • Internal code refactoring has been done.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12203

Released on 4 Oct 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • Internal code refactoring has been done.
  • Issue in the Reports tab in EventLog Analyzer instances with 500 or more devices, has now been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12201

Released on 9 Sep 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Security Issue fix

  • An authentication bypass vulnerability affecting REST API URLs, rated critical, has now been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12200

Released on 1 Sep 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Features

  • EventLog Analyzer now supports historical log collection for AS/400 and customized historic log collection for Windows.
  • An intuitive Apache overview dashboard to provide real-time insights on Apache web server activities.
  • Support for logs from Dell and Forcepoint devices.
  • EventLog Analyzer now supports logs from Qualys-Vulnerablity Management.

 Enhancements

  • The performance of XML file import has been enhanced and the size restriction in Manage Vulnerability Details has been removed.
  • Parsing and support for new Huawei devices has been enhanced.
  • Option to stop sending emails with Empty Reports.
  • A Correlation Diagnostics pop-up has been added to provide information on the memory consumed by the Correlation module.
  • The Alerts and the Manage Profile columns can now be resized.

 Fixes

  • Issues in parsing logs from PaloAlto and Stormshield devices have been fixed.
  • Issues in parsing logs from Oracle WMI and Syslog have been fixed.
  • Search filtering in IIS Logs is fixed.
  • Search to custom report redirection issue is fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12166

Released on 11 Aug 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • EventLog Analyzer was not loading properly when accessed from Log360's apps pane. This issue was observed in builds released post 12160 and 5220 of EventLog Analyzer and Log360 respectively. It has now been fixed.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12165

Released on 5 Aug 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fix

  • This release includes a fix for the pre-authenticated remote code execution (RCE) vulnerability (CVE-2021-37539) in SmartCard, reported by bmtd from ECQ.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12164

Released on 30 Jul 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • This release also includes a fix for the arbitrary file upload issue in Smart Authentication (ZVE-2021-2428) that led to remote code execution vulnerability, reported by Duc from ECQ.
  • The updates for the Distributed Edition - Managed Server the same as the Standalone Edition.

Build 12163

Released on 6 Jul 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • Issues related to categorization of Windows Workstation reports if a device is identified as a workstation with some delay are fixed.
  • Issues related with reports of network devices including Juniper, Fortinet, Barracuda, Paloalto, pfSense and Syslog Applications due to complications in parsing are fixed.
  • Issues related to device selections on configuring custom reports for AS400 are fixed.
  • Distributed editions are now allowed to have different databases among Admin and Managed servers.
  • Issues related to installing agents in Linux machines, if the audit version is 3.0, are now resolved.
  • Issues while integrating JIRA desk ticketing tool with ELA are now fixed.
  • Issues with TLS log collection, when PFX is configured, have been resolved.
  • Issues related to Windows system reports, alerts, and correlation from Chinese OS are fixed.
  • Issue in file or folder modified reports from Linux devices for Linux kernel version greater than 3.10 is now fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12160

Released on 3 Jun 2021

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer provides reports for Sysmon application.
  • EventLog Analyzer will now assign a dedicated access key from Log360 feeds and provide sign up instructions for threats.
  • A new ATA Whois Info tab has been added to provide exhaustive information on URL and Domain sources.

 Enhancements

Custom Pattern enhancements
  • The Custom log parsing UI has been enhanced for better user experience.
  • You can now use delimiters to extract additional fields while parsing logs.
  • An Auto-Identify option has been included to detect standard fields and key-value pair logs.
Application & Windows Reports Enhancements
  • The Application and File Monitoring device drill down can now be viewed under Reports.
  • Reports for Windows File Monitoring have been added.
  • You can now get All Events and Important Reports for Applications.
  • Windows Reports have now been regrouped to provide significant information.
  • The packet capture tool for troubleshooting in Syslog Viewer has been enhanced for better filtering.
  • The performance of the log collector has been enhanced to ensure optimum utilization of resources.
  • The service pack installation has been made secure by checking the PPM file for any tampering.
  • EventLog Analyzer now supports vCenter version 7.
  • EventLog Analyzer now supports SMB version 3.

 Fixes

  • Issue with incorrect or null field values being sent via SMS notification has been fixed.
  • It was observed that Archives were being wrongly flagged as tampered during unanticipated shutdowns of EventLog Analyzer. This has been fixed.
  • A memory issue while loading archived logs with parsed fields has been fixed.
  • The incorrect log count issue in device drill down of Application and File Integrity Monitoring in log sources has been fixed.
  • The issue of excessive storage consumption of databases has been fixed.
  • Issue in HSTS and XSS has been fixed.
  • SQL injection and RCE vulnerabilities have been fixed.
  • Parsing issues in Unix, Firepower, Oracle and PaloAlto have been fixed.
  • The issue with importing eventlog archives in import page has been resolved.
  • Duplicate windows agent was created automatically due to multiple IP addresses. This issue has been resolved.
  • It was observed that verification was successful even with spurious credentials. This issue has been fixed.
  • The issue with Removable disk auditing reports has been resolved.
  • It was observed that the Admin Server did not get timed out even after the session timeout. This issue has been resolved.
  • While loading archive files, the 'To' field value changed into loading time value. This issue has been fixed.
  • Issues with parsing 'date' and 'time' fields in Cisco logs while loading archive files have been resolved.
  • IIS Log collection issues have been fixed.
  • The Stored XSS vulnerability (ZVE-2021-1220) has been fixed.
  • Issue with parsing AD object access logs (Event ID 4662) has been fixed.
  • Issues with data authorization for File Integrity Monitoring (FIM) Configurations have been fixed.
  • Sensitive Data Exposure issue (ZVE-2021-0879) reported by Kevin Dawe has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12157

Released on 16 Mar 2021

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The version of JSON jar bundled with the product has been upgraded to 20190722.0.0.
  • The version of PostGreSQL bundled with the product has been upgraded to 10.15. This version of PostGreSQL will be available to users who have newly installed the product, not for users who have upgraded from a previous build.
  • The EventLog Analyzer build image has been upgraded.
  • Predefined VPN reports have now been added for CheckPoint and Barracuda Firewall.
  • The threat detection in Correlation tab has been enhanced for improved performance.
  • Logon reports for Firepower have now been added.
  • The Windows and Linux agent versions have been upgraded to 4.5 and 1.3 respectively.
  • You can now use either the Auto detect option or use the server time to revert the timezone.
  • The performance of STIX/TAXII threat feeds operations and Advanced Threat Analytics has been enhanced.
  • EventLog Analyzer now supports in-memory threat look-ups. This can be availed by getting in touch with support@eventloganalyzer.com.

 Fixes

  • Application sources from which the agent collects logs, have been added to local log collection poll where it can be used for syslog collection.
  • SysEvtCol wasn't starting after the version upgrade. This issue has been fixed.
  • It was noticed that the Syslog devices when pinged, continued to ping until the device is restarted. This issue has been fixed.
  • Issues in the IPSec VPN reports have been fixed.
  • Issue in parsing of Source IP field for Cisco Failed VPN Logon events has been fixed.
  • Issues in Archive Integrity Cycle have been fixed.
  • Issue in parsing PaloAlto VPN logs has been fixed.
  • Log collector down alert was wrongly generated when a syslog device was added as a LinuxFIM. This issue has been fixed.
  • The timezone issue while fetching data for Dashboard has been fixed.
  • Issues in Apache web server attack reports have been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12155

Released on 13 Jan 2021

  • Standalone Edition
    •  
  • Distributed Edition

 New features

EventLog Analyzer now provides reports and alert profiles based on the MITRE ATT&CK framework.
Streamlining security incident management
  • Investigate and track security incidents
    • You can create incidents and assign technicians to investigate them.
    • Track the status, severity, and the progress made in the investigation of incidents.
Automate incident creation using incident rules
  • Configure incident rules to automatically create incidents when specific alerts get triggered within a given time frame.
Map alerts as incidents
  • You can also map triggered alerts, reports, and log search results as incidents and assign a technician to investigate them.

 Enhancements

  • To mitigate the cross-site scripting vulnerability, jQuery has been upgraded to version 3.5.1
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12150

Released on 4 Jan 2021

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Attack detection and mitigation
  • New out-of-the-box correlation rule:
    • Prebuilt correlation rule to detect Ragnar Locker ransomware attack has been added.
  • Workflow actions:
    • The workflow profiles now support Cisco ASA firewalls. You can now take remedial action of adding inbound or outbound firewall rules on Cisco ASA firewall with pre-built workflow profile.
Remote employee monitoring
  • VPN usage monitoring dashboard:
    • Exclusive VPN activity dashboard that provides insights into VPN usage trends and VPN user activity.
  • Session activity view and reports:
    • Session activities can now be viewed using the Weekly View timeline graph.
    • Session activity reports on Palo Alto Networks and WatchGuard devices have been added.
Enhanced user experience
  • Custom user roles:
    • You can create multiple user roles in EventLog Analyzer in addition to the existing Admin, Operator, and Guest roles and define permissions to them.
  • Log collection filters:
    • Create log collection filters with multiple field criteria and logical operators to collect or exclude logs from select devices.

 Enhancements

  • The Calendar feature has been enhanced to display the day's records when you click on the Today option.
  • Get contextual threat data for specific IP addresses or URLs from the search result.
  • Cookie based Active Directory (AD) sync has been enabled to resolve license restriction issues.

 Fixes

  • Pre-defined alert criteria migration issue that arose in the 12000 PPM release has been fixed.
  • The auto-resetting of the member server while changing tabs has been fixed.
  • The latest build release notifier for local Linux builds has been fixed.
  • The Zip Slip vulnerability reported by zhighest has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12147

Released on 13 Nov 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • This release includes a fix for the unrestricted file upload issue that led to remote code execution vulnerability, which allowed unauthorized access to the server, as reported by Zhighest.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12146

Released on 20 Oct 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Prepackaged Stormshield device reports:
  • EventLog Analyzer now provides out-of-the box reports for Stromshield device events such as Logon, Firewall Rule Management, System Event, Severity, and more.

 Enhancements

  • Correlation metadata will now be stored in ElasticSearch instead of the product database for better performance.
  • The version of Tomcat bundled with the product has been upgraded to 8.5.57
  • The version of PostGreSQL bundled with the product has been upgraded to 10.12. This version of PostGreSQL will be available to users who have newly installed the product, not for users who have upgraded from a previous build.

 Fixes

  • Issue in Geo location performance has been fixed.
  • Issues in Unix parser have been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12145

Released on 27 Aug 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • New report groups for monitoring logons, failed logons, processes, and scheduled tasks in Windows workstation devices have been added.
  • Quick links to MSSQL Server Events, IIS Webserver Events, Terminal Server Events, and Printer Events have been added.

 Fixes

  • Issue in collecting Applocker eventlogs has been fixed.
  • Issue with parsing usernames in eventlogs is now fixed.
  • Port update issue in the agent during connection changes in the EventLog Analyzer server is fixed.
  • Issue with populating usernames in Linux File Integrity Monitoring reports is fixed.
  • A logon failure on clicking "Verify Credential" during device updates is resolved.
  • False positives while generating alerts for missing archive files have been fixed.
  • Issue in importing a compressed CSV file is fixed
  • Issue related to delay in start up of EventLog Analyzer server due to collection of OS related information is fixed.
  • The "URL Site" field has now been added to the SonicWall Denied connections report.
  • Issue with CEF Destination IP parsing has been fixed.
  • Issue with generating the Anyconnect VPN report has been fixed.
  • Issue with parsing Firepower traffic logs is now fixed.
  • The destination IP address will now be shown in Trend Micro reports.
  • Issue with loading the server diagnostics page has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12141

Released on 31st Jul 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

Agent Enhancement
  • Filters for Agent Status, Domains, etc. have been added to Agent Administration.
Device Group Enhancement
  • Device Group pages now offer filters for Device Type, Device Groups, and Sub Type.
  • Option to export and import correlation rules.
Enhancements to IIS Configuration Report
  • Out-of-the-box report to view IIS Configuration changes such as Logging Changes, Modules Changes, SSL Changes, and more.
Enhanced FIM module
  • The File Integrity Module user interface has been enhanced for improved user experience.
Reports enhancement
  • Top and Trend, User Based, and Device Schedule Reports' UI have been enhanced for better user experience.
  • Option to not notify the customers over email when the report has no data.
Dashboard enhancements
  • Dashboard tile customization: Flexibility to customize the dashboard tiles to view multiple reports.
  • The graphs will be updated in real-time when new data is available.
Enhanced archive process
  • The archive process has now been enhanced. It also includes notification to intimate details on the storage space while unarchiving.
Import Log(s) performance enhancement
  • The performance of Import Log(s), IIS, and MySQL modules' has been enhanced to reduce the file read time thereby lessening the time taken for importing the logs.

 Usability Enhancements

Upgrade notification
  • You will receive in-product notification as soon as a new update is available for upgrade.

 Fixes

This release includes fixes for issues related to:

VPN
  • Issue in session logs not getting recorded when a user disconnects VPN, has been fixed.
  • Fortinet session reports were not available under New Report. This issue has been fixed.
  • Issue in username field value in predefined Fortinet VPN Session reports has been fixed.
  • Issue in populating Fortinet VPN logoff report has been fixed.
Agent
  • Due to delay in synchronization, agent status was displayed wrongly in the UI. This has been fixed.
  • In Linux agents, issues related to high CPU usage have been fixed.
Syslog
  • Issue in Syslog getting disabled in log collector even when enabled in the UI has been fixed.
  • Issue in Syslog devices being unreachable has been fixed.
Log parsing
  • Parsing support has been included for Fortimail logs.
  • For Unix logs, milliseconds will be considered while sorting the logs.
  • Support provided now for the latest versions of Symantec log structures.
  • Out-of-the box support has been provided for F5 Application Security Manager.
Vulnerability fixes
  • The version of PostGreSQL bundled with the product has been upgraded to 10.12 for Linux . This version of PostGreSQL will be available to users who have newly installed the product, not for users who have upgraded from a previous build.
  • The older versions (1.x and 2.x) of JQuery have been removed.
Other fixes
  • You can now specify the number of days, weeks, or months in the 'log retention period' option for the archives loaded by the user. EventLog Analyzer will unload these logs after the specified period.
  • Issue in TLS log collection when the password is encrypted. This has been fixed.
  • Issue in username missing from the logs has been fixed.
  • Issue in filter when eventlog ID and message are requested has been fixed.
  • Issues in newly added devices taking old hostnames have been fixed.
  • Issue in auto updating of IP in host table has been fixed.
  • Event log collection failures were observed when the number of cores exceeded a certain limit. This issue has been fixed.
  • The Repo (repository) folder was not getting cleared when product logs off while unarchiving data. This has been fixed.
  • Issue in device count displayed on the dashboard for Managed Servers has been fixed.
  • Issues in indexing were observed when ES connection is reset. This has been fixed.
  • In Linux, the service auto startup issue has been fixed.
  • When all the associated devices are disabled, Agent Down notification will be skipped.
  • The archive data loaded in the centralized archive can now be viewed flawlessly.
  • Issue in configuring multiple SQL Server instances that are listening on the same port of a machine has been fixed.
  • Appropriate notifications will be displayed for different connectivity issues between the admin server and the managed server.

Build 12137

Released on 9th Jun 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

NIST compliance
  • EventLog Analyzer now has out-of-the-box compliance reports for meeting NIST standards.
PDPA compliance
  • EventLog Analyzer now has out-of-the-box reports to comply with the Philippines Data Privacy Act.
Correlation rules to detect ransomware
  • EventLog Analyzer now has correlation rules to detect the MailTo and Coronavirus ransomware execution.

 Enhancements

SQL Performance
  • SQL Server Advanced Auditing performance has been enhanced to optimize CPU usage.
WMI Log Collection Performance
  • There will be a higher throughput of logs collected via WMI from windows devices.

 Fixes

  • VPN logon reports have been fixed and new VPN logoff reports have been added.
  • The issue with configuration of devices with device names in Japanese has been fixed.
  • Removing the auto-log forward entry for the devices deleted from EventLog Analyzer is fixed.
  • Disabling radius authentication for disabled users has been fixed.
  • Issue with detecting domain names in the login page has been fixed.
  • Issue with updating the status of files in the central archive following integrity checks has been fixed.
  • Exporting applications reports for the current date irrespective of time range is possible now.
  • Suspicious URLs that were not flagged in Advanced Threat Analytics will be detected now.
  • Hostname handling issues while adding a threat source has been fixed.
  • Blocks in the incident management workflow with regard to SNMP localhost forwarding, URL validation, and port validation are now refined.
  • A mismatch with the log count and the issue with the popup in the application log sources page has been fixed.
  • Issue with the parsing of logs for Linux File Integrity Monitoring in RedHat has been fixed.
  • Issue with configuring event sources has been fixed.
  • Appropriate notifications will be displayed for different connectivity issues between the admin server and the managed server.

Build 12136

Released on 15th May 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • This release includes fix for the CVE-2020-24786 vulnerability, which allowed unauthenticated changes to integration system configuration, reported by Florian Hauser.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12135

Released on 6th May 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Custom VPN sessions alert

You can now create custom alert profile for VPN sessions in EventLog Analyzer to trigger an alert when:

  • The number of active VPN sessions exceeds a custom threshold value.
  • A VPN connection is established from a blacklisted VPN source location.
Correlation alerts

You can now create alert profiles to trigger correlated alerts when:

  • Multiple VPN logon failures occur from a user account within a specific period.
  • Multiple successful connections have been established by the same user from different locations within a specific period.

 Fixes

  • The Remote Code Execution vulnerability in the product pages has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12130

Released on 13th April 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Trend Micro-deep security support
  • Out-of-the-box reports on Trend Micro-deep security devices.
Smart card- based authentication
  • If you have a smart card authentication system enabled in your environment, you can configure EventLog Analyzer to authenticate users through it, bypassing other first-factor authentication methods.
New logon security options
  • CAPTCHA support - Flexibility to display a CAPTCHA always, or after a certain number of invalid login attempts. Besides image, you can also enable Audio CAPTCHA.
  • Account lockout: Option to lock user accounts for a specific duration after a certain number of invalid or failed login attempts. The locked out user account cannot be used to access EventLog Analyzer until the specified duration is completed.
IP geo location for IIS logs
  • EventLog Analyzer now enables you to know the location of your visitors from their IP addresses.

 Enhancements

Revamped alerts
  • The Alert tab now features a revamped GUI to facilitate improved management and faster response to alerts created.
Juniper structured log format
  • Support for structured logs from Juniper firewall .

 Fixes

  • HTTP vulnerabilities in ES have been fixed.
  • Issue in listing IBM AS400 in report scheduler has been fixed.
  • Issue in parsing Oracle logs has been fixed.Issue in parsing NPS (Network Policy Server) logs have also been fixed.
  • The problem with file auditing when the 'username' field is enabled has been fixed.
  • Issue in generating USB report in Chinese machines have been fixed.
  • Issue in generating FIM report in German machines have been fixed.
  • Issue in deleting import logs, and importing logs has been fixed.
  • Issue in removing custom pattern has been fixed.
  • Agent startup issue has been fixed.
  • In the Oracle Predefined reports, issue in presenting all the search fields in 'Add/Remove columns' has been fixed.
  • In agent auditing, incorrect device-down alerts sent via mail has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12126

Released on 3rd April 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

VPN sessions monitoring report

When employees work from home, it's mandatory to accurately monitor their VPN sessions. EventLog Analyzer has added an exclusive "VPN Session Monitoring" analytical report that gives information on:

  • Number of active VPN sessions
  • Duration of each VPN session
  • Status of individual user's VPN connection

These information help not only in monitoring and auditing VPN user activities but also in VPN capacity planning.

EventLog Analyzer supports Cisco, Fortinet, SonicWall, Huawei, Meraki, and H3C VPNs right out of the box.

  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12125

Released on 19th March 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The Log receiver option is now enabled only for administrators.
  • Read access is now provided for the current archive file, so that other applications can access it.
  • OpenSSL has been upgraded from openssl_1_1_0c to openssl_1_1_0l.
  • Option to disable the population of trend tables (tables containing hourly log count) has been added.
  • Parser rules for Windows Event ID 800 has been added.

 Fixes

  • Issue with switching the managed server in the Compliance page has been fixed.
  • Issues with parsing of severity information from old Windows archive files have been fixed.
  • The dashboard now renders perfectly for all date formats.
  • Sophos, pfSense, and Juniper devices' logs can now be parsed without errors.
  • The Syslog Viewer no longer stops displaying incoming logs when the language is changed from English.
  • Issue which caused log collection to be stopped when an existing ELA installation was migrated to a different device has been fixed.
  • Issue in deletion of custom fields created from preview of import log has been fixed.
  • Issue which caused the alert dumps to accumulate when a correlation rule is built with "is variable" condition has been fixed.
  • Updates and improvements to ensure ELA works in the "High Availability" mode when started as a service.
  • Fixes to ensure archive logs don't get corrupted when Java virtual machine hangs or shuts down abruptly.
  • Problems concerning crashes in native logger have been fixed.
  • Problem of disconnection of SSH during agent sync has been fixed.
  • Problem with Linux File Integrity Monitoring filters has been fixed.
  • Problems with permissions being escalated for non-privileged users while importing logs have been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12123

Released on 6th March 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • The issue with processing of cached records created before 12120 build has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12121

Released on 19th February 2020

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Enhanced performance with redundant log prints detection, centralized log entry point, and more.

 Fixes

  • Reduced Elasticsearch recovery time, and product startup time.

 Fixes

  • Issues with changing a managed server in the reports tab has been fixed.
  • Issues with viewing the last 10 events of a managed server in the admin server has been fixed.

Build 12120

Released on 16th January 2020

  • Standalone Edition
    •  
  • Distributed Edition

 New features

FERPA compliance
  • EventLog Analyzer now has out-of-the-box compliance reports for the Family Educational Rights and Privacy Act (FERPA).

 Enhancements

Agent administration

EventLog Analyzer's agent has been upgraded to make it more versatile and achieve the following:

  • You can deploy Windows agents from EventLog Analyzer running on a Linux server.
  • The agent administration UI has been enhanced to facilitate easier agent installation, uninstallation, restart, and upgrade.
  • You can now collect syslogs from applications running on Windows machines. 
  • You can upgrade the EventLog Analyzer agent deployed in demilitarized zones (DMZs).
  • Communication between the agent and EventLog Analyzer is now more secure.
  • You can collect logs of Oracle applications running in Windows devices.
  • New blocks in workflow including Send SNMP Trap, HTTP Request, CSV Lookup, and Forward Logs have been added.
  • You now have the option of collecting only the application logs from Windows devices.
  • The log collector's dependency on databases has been eliminated.
  • The product settings UI has been revamped for easier configuration.

 Fixes

  • Traces of clickjacking vulnerability have been removed. 
  • Issue in 'Save to folder' option for scheduled reports has been fixed. 
  • Issue in the SonicWall web traffic dashboard widget has been fixed. 
  • Issues in parsing HTML tags and logs from recent Windows versions have been fixed. 
  • Issue in log correlation for imported logs has been fixed.
  • Issue which caused Linux agent to crash has been fixed.
  • Issue in notification for AMS license expiry has been fixed. 
  • Issue in importing vulnerability logs from the Windows agent has been fixed. 

 Fixes

  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12115

Released on 14th December 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Support for IBM Db2 logs
  • EventLog Analyzer now supports IBM Db2 logs and provides out-of-the-box reports.
Threat whitelisting
  • You can configure EventLog Analyzer with an index of approved IPs, URLs, and domain names to minimize false positives.

 Enhancements

  • The alerts section now has a set of default alert profiles.
  • The dashboard has predefined profiles for Cisco devices and SQL and IIS servers.
  • The dashboard gets a new dark theme for better visual experience.

 Fixes

  • Issue with zipping AS/400 archive logs has been fixed.
  • Issue with categorizing IIS FTP server logs has been fixed.

 Fixes

  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12110

Released on 6th November 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Support for F5 devices
  • Out-of-the-box reports are now available for F5 devices.
CCPA compliance reports
  • Predefined reports for CCPA compliance are now available.

 Enhancements

  • Receive email notifications to monitor user actions in EventLog Analyzer.
  • Option to customize the existing correlation rules to detect sophisticated threats.
  • All the generated alerts are now stored in Elasticsearch instead of database, for faster search and retrieval of data.
  • Custom reports can now be shared with other users.
  • Alert retention is now configurable.

 Fixes

  • Issues with multiple admin-managed server synchronization has been fixed.
  • An option has been added to enable or disable periodic email alerts when a device is down.
  • Issue with taking backups of the built-in pgSQL database in EventLog Analyzer while upgrading to versions 12000 and above has been fixed.
  • Issue with displaying executed commands for older library versions of Linux File Integrity Monitoring has been fixed.
  • Issue with viewing the last 10 events in machines with Turkish operating systems has been fixed.
  • Issue wit sending emails from EventLog Analyzer using TLS 1.2 has been fixed.
  • Issue with displaying agent log counts has been fixed.
  • Issue with displaying Configuration Changes Reports in Checkpoint devices has been fixed.
  • Issue with updating the values in alert profiles has been fixed.
  • Issue with displaying event log counts for PCI DSS compliance has been fixed.
  • Issue with processing alert profiles created with Regex pattern criteria has been fixed.

 Enhancements

  • The process of converting a standalone server to a managed server has been enhanced for improved user experience.

 Fixes

  • Issue in updating the managed server with compatible service packs from the admin server has been fixed.
  • Connection failure issue after updating managed server credentials in admin server has been fixed.
  • Issue with automatically updating managed server devices to the admin server has been fixed.

Build 12100

Released on 8 October 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Customizable dashboard

EventLog Analyzer's dashboard now has a range of customization options.

  • Dashboard data will be updated in real time.
  • New tabs can be created with predefined widgets or with a blank template where any report can be pinned to the tab.
  • The color of the charts can be customized for more visual impact.
Advanced Threat Analytics
  • Crucial information on the severity of threats can be obtained when potentially malicious URLs, domains, and IP addresses intrude into the network.

 Enhancements

Enhanced archival process

The log archival process has been enhanced for better usability, reporting, and for ensuring the integrity of log data. With the enhanced archive:

  • Multiple archives can be loaded and unloaded simultaneously.
  • The data in the loaded archive files is now searchable and reports can be generated.
  • An alert will be raised if the archived logs are tampered with.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12060

Released on 23 August 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Automatic discovery of MySQL servers.
  • SAP ERP logs and McAfee ePolicy Orchestrator syslogs support.

 Enhancements

  • Support for seamlessly processing syslogs that have different encodings and are from different time zones.
  • REST API support for ServiceDesk Plus, an Incident Management tool.
  • Performance of searching through compressed log data has improved.

 Fixes

  • Issue of creating alert profiles using custom fields has been fixed.
  • SQL server audit reports not being populated with data has been resolved.
  • Issue of parsing username with sudo commands has been fixed.
  • Issue of identifying false positives when the log collector is manually stopped has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12050

Released on 26 July 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Incident workflow management
  • Create and manage incident workflows in EventLog Analyzer. These workflows are automatically executed when the associated incident alerts are triggered. You can even track the execution of each workflow and view its status.
CoCo and NERC compliance reports
  • Predefined compliance reports have been added for CoCo and NERC regulations.

 Enhancements

  • Technician audit logs are now maintained separately in the database, to facilitate future forensic investigations if needed.
  • Alert severity can now be passed as an argument to scripts in the run program option, or to be displayed in email and SMS notifications.

 Fixes

  • Issue with displaying the Next 10 archives in the Archive Settings page has been fixed.
  • Issue with loading the Malware Detected report under Windows Defender has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12041

Released on 20 June 2019

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The Search tab has a new UI with enhanced Advanced Search Criteria, Save Search, and Tag settings, for better user experience.

 Fixes

  • Issue in the terminal server agent has been fixed.
  • Issue in migrating from PostgreSQL to Microsoft SQL Server has been fixed.
  • Issue in Microsoft SQL Server Auditing Configuration when SSL is enabled in a SQL Server instance has been fixed.
  • Issue in changing EventLog Analyzer's back-end database to SQL Server when SSL is enabled has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the Standalone Edition.

Build 12040

Released on 31 May 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Support for Arista switches
  • EventLog Analyzer now offers predefined event-based reports on Arista switches.

 Enhancements

  • The settings tab has been refurbished for enhanced user experience.
  • The reporting module has been tweaked to process queries faster.

 Fixes

  • Issue in archiving correlated data has been fixed.
  • Issue in sending a test email without authentication has been fixed.
  • Timestamp issue in forwarded Windows logs has been fixed.
  • Issue in scheduled reports exported with empty PDF attachments has been fixed.

 Enhancements

  • Synchronized data will be auto-recovered in the admin server if synchronization fails.

 Fixes

  • Issue in synchronizing data and service pack if the admin server is down during managed server startup has been fixed.
  • Issue in device reports in the admin server dashboard has been fixed.
  • Issue in removing managed servers configured with applications from the admin server has been fixed.
  • Synchronization issues between the admin server and managed servers have been fixed.

Build 12030

Released on 27 Mar 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Compliance reports for NRC and Cyber Essentials
  • EventLog Analyzer offers out-of-the-box reports for complying with the mandates prescribed in the Nuclear Regulatory Commission RG 5.71 and Cyber Essentials.

 Enhancements

  • You can now import logs stored in Amazon Simple Storage Service (Amazon S3) buckets.
  • EventLog Analyzer now supports server message block (SMB) 2.0 for importing logs, discovering IIS Servers, and file integrity monitoring.

 Fixes

  • Issue in log collector caused by packet size being bigger than the buffer size has been fixed.
  • Issue in sending test emails from the product has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 12020

Released on 8 Feb 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Support for SNMP traps and MySQL logs
  • EventLog Analyzer now has the ability to process SNMP traps, and also supports import and analysis of MySQL general and error logs.
H3C device support
  • EventLog Analyzer now provides out-of-the-box support for H3C devices.

 Enhancements

  • The different views of a report, such as table, summary, matrix, and multi-report, can now be exported as PDFs.
  • Option to enable or disable headers in CSV files has been added.
  • Option to select log file name patterns while periodically importing log data has been added.

 Fixes

  • Issue in deleting log import schedules has been fixed.
  • Issue in adding multiple email addresses in the recipient field of the Log Collection Failure alert has been fixed.
  • Issue in alert processing has been fixed.
  • Issues in report schedules and severity-based pivot reports have been fixed.
  • Issue in log collection schedules when collecting Syslog from Windows devices has been fixed.
  • Issue in parsing Firepower and Check Point logs has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 12012

Released on 23 Jan 2019

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Two-factor Authentication
  • EventLog Analyzer's login security has been bolstered with two-factor authentication via email, SMS, Duo Security, RSA SecurID, and Google Authenticator.

 Enhancements

  • Mail notification settings have been completely revamped for enhanced user experience.
  • Option to configure proxy server has been added.
  • SMS notification settings now supports additional protocols such as HTTP, SMTP, and SMPP.
  • jQuery version has been upgraded to 3.3.1 for greater security.

 Fixes

  • Issue in connecting to a Microsoft SQL database when the password size exceeds 15 characters has been fixed.
  • Issue in sending alerts to Windows Event Viewer has been fixed.
  • Issue in MySQL backup has been fixed.
  • Issue in forwarding logs from AS/400 devices has been fixed.
  • Issues in parsing logs for file integrity monitoring and SQL column integrity monitoring have been fixed.
  • Issue in resolving IP addresses which caused the log collector to quit has been fixed.
  • Issue in scheduling predefined reports has been fixed.
  • Issue in loading archived logs has been fixed.
  • Issue in sorting report profiles has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 12010

Released on 30 Nov 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Linux File Integrity Monitoring
  • Predefined reports to track creation, modification, deletion, renaming, and permissions changes in files and folders on Linux devices.

 Enhancements

  • The File Integrity Monitoring module configuration has been enhanced for better user experience.
  • The capability to audit all activities of users with Technician roles in the File Integrity Monitoring module.
  • ICMP traffic logs are now parsed.

 Fixes

  • Issue in the scheduler when multiple criteria are selected for File Integrity Monitoring has been fixed.
  • Issue which caused a mismatch in the number of events displayed in the File Integrity Monitoring dashboard and the underlying data has been fixed.
  • Issues in graph and data in exported reports in the CSV format has been fixed.
  • Issue in exporting reports with more than eight columns has been fixed.
  • Issue in parsing Palo Alto logs without serial numbers has been fixed.
  • Issue in displaying Symantec system events in the appropriate report has been fixed.
  • Issue in parsing Unix device logs to track file uploads has been fixed.
  • Issue in displaying the content in alerts mails has been fixed.
  • Issue in updating the time at which logs were last received from Windows devices with third-party agents has been fixed.
  • Issue in displaying the status of log collection of the syslog receiver has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

 Fixes

  • Issue in configuring centralized log archival from the Admin server using some browsers has been fixed.

Build 12000

Released on 13 Nov 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Brand-new UI for reports

A completely revamped reports tab with a fresh UI and the ability to:

  • Create custom reports more swiftly and also view them in four different formats— Table, Summary, Matrix, and Multi-report.
  • Generate new views for the prebuilt reports.
ISLP compliance reports
  • EventLog Analyzer now has out-of-the-box reports to help you comply with Information Security Level Protection's (ISLP) requirements.
Support for Cisco Firepower & pfSense

Ability to process logs from Cisco Firepower and pfSense, along with exclusive reports and alert profiles to easily audit events from these devices.

 Enhancements

  • Correlation rules have been enhanced with the option to add these new conditions: less than, greater than, between, not contains, not starts with, not ends with, not between, and is variable.
  • Advanced auditing of Microsoft SQL supports all collations.
  • The Favorite reports category has been enhanced to become user-specific.
  • All the report categories have been enhanced for better usability and searching.
  • The GPG compliance reports under the Windows reports category have now been moved to the dedicated group under the Compliance tab.

 Fixes

  • Issue in user-specific language settings has been fixed.
  • Issue causing the unavailability of EVTX log files' description has been resolved.
  • Issue in parsing DHCP and Huawei logs has been fixed.
  • Issue in updating report summary in database has been resolved.
  • Issue causing log collector to shut down while processing logs collected using TLS 1.0 has been fixed.
  • Issue in editing the log collection filters page has been resolved.
  • Issue causing inconsistency in Application page's severity log reports has been resolved.
  • Issues in selecting fields for search and changing work-hour configurations in Internet Explorer browser have been fixed.
  • Issue in fetching data for previous day's non-working hours reports has been fixed.
  • Issue in searching while having space in field names has been resolved.
  • Issue in Save to Folder option in scheduled reports has been fixed.
  • Issue in time format when exporting user-based reports has been fixed.
  • Issue in rearranging actions in correlation rules has been fixed.
  • Issue in deleting correlation rules in the off-heap mode has been fixed.
  • Issue in saving search criteria that contain regex expressions as an alert has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

 Fixes

  • Issue in View Old Data option in the managed server correlation tab has been fixed.

Build 11212

Released on 5 Oct 2018

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Log processing has now been made faster for enhanced performance and user experience.

 Fixes

  • Issue with scheduled imports of multi line logs has been fixed.
  • Issues in building custom alerts have been fixed.
  • Issue with parsing SonicWall logs has been fixed.
  • Issue with emailing scheduled reports has been fixed.
  • Issue with populating data in reports pertaining to ManageEngine Password Manager Pro has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 11211

Released on 28 Sep 2018

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • Issue in viewing events of the correlation history in Build 11210 has been fixed.
  • Issue in applying the service pack in Build 11210 has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 11210

Released on 10 Sep 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

HP switch monitoring
  • EventLog Analyzer offers predefined reports and alert profiles to monitor the security events of HP switches exclusively. It also comes with the capability to analyze log data of HP switches.

 Enhancements

  • The import log module now supports multiple file encodings.
  • An option to specify the imported log data's timezone.
  • Date format can now be set in the product.

 Fixes

  • Issue with importing EVTX format files from a shared path has been fixed.
  • Issue with importing files from a shared path when the device credentials have already been configured has been fixed.
  • Issue in displaying data for compliance reports in the free version of the product has been fixed.
  • Issue in timestamp when scheduled compliance reports are saved has been fixed.
  • Issue in not parsing the username field in Windows application logs has been fixed.
  • Issue in reports not populating data from IBM AIX systems has been fixed.
  • Issue in fields of the Windows Services reports in the compliance report section has been fixed.
  • Issue in not being able to import CRT files into the ssl.keystore has been fixed.
  • Issue in product not starting when HTTPS is enabled and the password contains a special character has been fixed.
  • Issue in parsing Barracuda device logs has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 11204

Released on 30 Jul 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Threat Management
  • EventLog Analyzer's threat intelligence module has been further enhanced by extending support for real-time updates from custom STIX/TAXII servers.

 Fixes

  • Issue in saving scheduled reports and also changes to favorite reports has been fixed.
  • Sparsely-occurring issue while loading archive logs has been fixed.
  • Issue causing malfunction of TLS log collection server when PFX certificate has certificate chain has been fixed.
  • Issue in parsing H3C logs has been fixed.
  • Issue encountered while resetting passwords has been fixed.
  • Issue in alert mail rebranding has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 11200

Released on 18 Jun 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Selective activity monitoring
  • Monitor Windows and Unix sessions of users with predefined or custom session activity rules.
Meraki security appliances auditing
  • Predefined reports and alert profiles to audit security events of Meraki security appliances easily.
Support for CEF format logs.

 Enhancements

  • The scope of Microsoft SQL Server auditing has been widened with the ability to audit and track more activities such as logins, integrity of data on the server, and more.
  • Reports on session activity have been enhanced for better usability.
  • The correlation scheduler has been given a facelift.

 Fixes

  • Issue in establishing an ODBC Connection when TLS 1.0 is disabled has been fixed.
  • Issue which identified other application logs as Microsoft SQL Server logs has been fixed.
  • Issue in data not being displayed in reports if the table header and database name exceeds fifty characters has been fixed.
  • Issue in monitoring interval scheduler for AS400 devices has been fixed.
  • Issue in AIX reports not showing accurate data has been fixed.
  • Issue in VPN user reports not populating data for network devices has been fixed.
  • Issue in the format of the Palo Alto logon report has been fixed.
  • Vulnerability issues in the product settings have been fixed.
  • Cross-Site Scripting vulnerability (CVE-2018-10075) that allowed remote attackers to inject arbitrary web script or HTML via the import logs function has been fixed.
  • Cross Site Scripting vulnerability (CVE-2018-10076) that allowed remote attackers to inject arbitrary web scripts or HTML via the search function has been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.
  • Issue in copying the service pack and license from the Admin server to Managed servers has been fixed.

Build 11140

Released on 25 May 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Password protection can be enabled for reports that are exported in PDF and CSV formats.
  • Users with administrator privileges can now audit the report export activities.
  • Guest users will not be able to export reports.

 Enhancements

  • When you enable the GDPR configuration settings, you will be prompted for consent during third party tool integrations.
  • The new features and enhancements for the Distributed Edition - Managed Server are the same as the above.

Build 11134

Released on 21 May 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • A rich text editor has been provided in the alert profile configuration page to compose the alert email.

 Enhancements

  • The correlation rule builder has been revamped for better usability.
  • The correlation engine can now detect malicious IP addresses from threat feeds.
  • The alert mail content has been enhanced.

 Fixes

  • The issue in the correlation alert mail has been fixed.
  • Several other minor issues have been fixed.
  • The updates for the Distributed Edition - Managed Server are the same as the above.

Build 11133

Released on 11 May 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Support for more ticketing tools
  • EventLog Analyzer's incident management module now supports Jira Service Desk, Zendesk, Kayako, and BMC Remedy Service Desk.

 Enhancements

  • The user interface of the Incident Management tab has been enhanced for better user experience.
  • The updates and fixes for the Distributed Edition - Managed Server are the same as the above.

Build 11130

Released on 13 April 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • IIS web site auto discovery which makes it easier to configure IIS web sites for monitoring.

 Enhancements

  • Multiple files can now be imported simultaneously.
  • Server Message Block (SMB) protocol has been added as one of the protocols to access files.
  • Customization options have been added for scheduling of log imports.
  • Dynamic patterns and numerical increments for file rollovers have been added.
  • Option to import and store logs for short durations has been added.

 Fixes

  • Issue in the device name and display name fields in custom reports has been fixed.
  • Issue in adding syslog hosts has been fixed.
  • Parsing issue in Cisco device logs has been fixed.
  • The updates and fixes for the Distributed Edition - Managed Server are the same as the above.

Build 11123

Released on 27 March 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Secure archival of log files
  • Checksums are now used to maintain the integrity of archived log files, thus helping meet compliance requirements.
Supports Huawei firewall
  • Predefined reports and alert profiles help easily audit security events of Huawei firewalls.
Supports Malwarebytes
  • Predefined reports and alert profiles help in auditing logs from Malwarebytes, thereby improving the threat detection mechanism.

 Enhancements

  • Kerberos has been added as an authentication method for log collection.
  • Removable Disk Auditing now supports more device types.
  • The object access policies enabled by default in an agent have been optimized to reduce log dropping.
  • The IP address of the remote device has been added as a field in file integrity monitoring logs.
  • Permission changes for files are now audited.
  • All logs generated during agent downtime will be collected from the Event Viewer, once the agent recovers.

 Fixes

  • Issue with restarting of the log collector has been fixed.
  • Issue in specifying multiple entries in the fields of database filters has been fixed.
  • Issue in log collection filter for Windows logs forwarded as syslog has been fixed.
  • Consistency issue in deletion events of folders with child objects has been fixed.
  • Sync issue between the admin server and managed servers has been fixed.
  • The new features, enhancements, and bug fixes for the Distributed Edition - Managed Server are the same as that of the Standalone Edition.

Build 11122

Released on 19 March 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • The correlation module now supports logs from ManageEngine OpManager and Password Manager Pro.
  • Forensic analysis can be performed on the actions of the user(s) and device(s) involved in a successfully correlated event.

 Enhancements

  • Reports of network devices can now also be viewed in the Compliance tab.
  • An option to enable or disable the out of memory alert notification.
  • The mail subject of low disk space and out of memory alerts can be customized.
  • Automatic assignment of alerts to technicians based on alert profiles.
  • An option to delete generated alerts, when deleting the alert profile that they are associated to.
  • Exporting compliance reports has been made faster.
  • The compliance report scheduler has been enhanced.

 Fixes

  • Issue in parsing of File Integrity Message in the alert mail has been fixed.
  • Issue in automatically adding agent has been fixed.
  • Issue which generated alerts with wrong criteria for AS400 has been fixed.
  • Issue in Compliance report scheduler has been fixed.
  • The new features, enhancements, and bug fixes for the Distributed Edition - Managed Server are the same as that of the Standalone Edition.

Build 11120

Released on 7 March 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

SQL Server auto discovery
  • which makes it easier to configure SQL servers for monitoring.
Column Integrity Monitoring in SQL Server
  • Track changes in a monitored column including who changed the value, at what time the value was changed, and the database table in which the value was changed.
SQL Server Advanced Audit reports
  • SQL Server Advanced Audit reports provide information on the history of schema and object changes, most used tables, and more.

 Enhancements

  • Auditing can now be enabled only for the selected SQL Server instances.
  • Audit policies can now be created or deleted from EventLog Analyzer.
  • The user interface of the Manage Applications tab has been enhanced for better user experience.

 Fixes

  • Issue in password with special characters entered during the configuration of mail server has been fixed.
  • Issue which added duplicate entries to reports exported in CSV format has been fixed.
  • Issues in parsing and indexing of SolarWinds and Snare logs have been fixed.
  • Cross Site Scripting (XSS) in the search and reports page (CVE-2018-7405) raised by Suresh Khutale has been fixed.
  • Vulnerability issue of remote code execution when uploaded by an agent has been fixed.
  • The new features, enhancements, and bug fixes for the Distributed Edition - Managed Server are the same as that of the Standalone Edition.

Build 11110

Released on 9 February 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Supports Barracuda devices: Predefined reports and alert profiles help easily audit security events of Barracuda Firewalls, Web Application Firewalls, and Email Security Gateway.
  • Implementation of slow query graphs for the dashboard.

 Enhancements

  • Provision to customize the subject, content of email, and SMS alerts.
  • Add alerts and manage alerts pages have been enhanced for improved user experience.

 Fixes

  • Issue in handling special characters in Microsoft SQL migration has been fixed.
  • Issue in wildcard search has been fixed.
  • Issue in triggering alerts when the buffer size is reached has been fixed.
  • Issues in parsing Sonicwall signature ID, Cisco Firepower custom fields, and denied traffic in Fortinet have been fixed.
  • Issue in SQL Login Altered report has been fixed.
  • Issue in updating aggregated data in MySQL database has been fixed.
  • Issue which caused multiple UDP ports to listen has been fixed.
  • The new features, enhancements, and bug fixes for the Distributed Edition - Managed Server are the same as that of the Standalone Edition.

Build 11102

Released on 24 January 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Integration with Log360 Cloud
    • The logs collected by EventLog Analyzer can now be stored and managed on a secure cloud platform - Log360 Cloud.

 New features

  • The new features for the Distributed Edition - Managed Server is the same as the Standalone edition (Build 11102).

Build 11101

Released on 12 January 2018

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Three new predefined correlation rules that detect suspicious SQL backup, installation of services and software.
  • Logs from syslog and other devices can be forwarded to any server including file servers and Windows servers.

 Enhancements

  • Parsing of new fields in Juniper and Fortinet firewall logs.
  • Support for Snare in the RFC 5424 format.
  • The new features for the Distributed Edition - Managed Server is the same as the above.

Build 11100

Released on 9 December 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

GDPR compliance reports
  • Offers predefined report templates to help you easily comply with the GDPR's requirements.

 Enhancements

  • A new report for Juniper application tracking has been added.
  • Mail subject can now be added in the custom report scheduler.

 Fixes

  • The alignment issue in reports exported as CSV files from the search tab has been fixed.
  • The issue in parsing SonicWall botnet logs has been fixed.
  • WatchGuard firewall logs are now parsed.
  • The issue with not being able to view devices in the admin server when the user logs in via AD has been fixed.
  • The issue in displaying the report fields for Oracle devices has been fixed.
  • The issues in parsing the timestamp of imported logs have been fixed.

 Fixes

  • The new feature for the Distributed Edition - Managed Server is the same as the above.

Build 11090

Released on 29 November 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Supports Sophos-UTM, Sophos-XG, and Cyberoam devices
  • Predefined reports and alert profiles help easily audit security events of Sophos-UTM, Sophos-XG, and Cyberoam devices.
  • Provides an option to discover and configure event sources for individual devices.

 Enhancements

  • The mechanism of recording the log flow rate has been optimized.
  • An extra field "Display name" has been added to the pre-defined reports and search section.

 Fixes

  • The issue with parsing of fields for NPS events occurring on Windows Server 2016 has been fixed.
  • Addition of VMware reports for created and deleted VMs (Event IDs: 13002 and 13003).
  • The issue with the Solaris user account management report and SUDO command execution report has been fixed.
  • Issue with populating web traffic reports for WatchGuard has been fixed.
  • The issue with the policy changes report for Symantec devices has been fixed.
  • The issue with exporting reports from the "My Reports" category has been fixed.

 New features

  • The new features are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11080

Released on 17 October 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

The Correlation Engine has been completely upgraded to bring you complex attack detection across all devices on your network, enhanced field-level correlation, improved incident reports with timeline view, and much more:

Multiple log format support
  • Correlation is now carried out across multiple log formats, enabling you to correlate logs from Windows and Unix systems, network devices, and more.
Enhanced field-level correlation
  • Correlation can be done based on multiple log field values to provide fine-grained attack detection.
Predefined rules
  • The module is packaged with 25 predefined complex attack patterns.
Custom rule builder

The custom correlation rule builder has been upgraded to include over 250 predefined network actions and advanced filters.

  • Check for unique, constant, or shared field values among the actions that make up a rule.
  • Use multiple comparison conditions for fields, namely 'equals', 'not equal to', 'starts with', or 'ends with'.
  • Create rules for individual log types using specific network actions, or rules common to all log types with generic network actions.
Incident management integration
  • All correlation alerts can be viewed and managed with the in-built incident management console.

 Enhancements

  • The correlation user interface has been upgraded with an all new look and feel, incorporating all the above new features.
  • The time between each individual pair of actions can now be specified when creating a rule.

 New features

  • The new features are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11073

Released on 4 October 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now supports WatchGuard firewall devices. Exhaustive reports and predefined alert profiles makes it easier to audit WatchGuard firewall.

 Fixes

  • White space characters that caused issue in mail server configuration has been fixed.
  • Predefined Symantec reports now display graphs.
  • "Windows unexpected shut down" report was not updated. This issue has been fixed now.
  • I18N issue in the device and status tab of admin server fixed.
  • Issue with exporting loaded archives in admin server fixed.
  • Issue with parsed product names in Checkpoint logs fixed.
  • Receiving alerts that logs are not being collected from various servers while they are actually being collected. This issue has been fixed.
  • Display issue with EventLog Analyzer's centralized archive page in Linux has been fixed.
  • Issue with "root" being not accepted as a username in centralized admin server is fixed.
  • Changes made in centralized archives setting page was not saved. This bug has been fixed.
  • Operator access to Syslog Listener Port Settings restricted.

 New features

  • The new features are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11072

Released on 22 September 2017

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • EventLog Analyzer's security is further strengthened by using unique key to encrypt database for every installation.
  • The solution now correlates the logs from Cisco firewalls with that of the threat feeds and global IP threat database data to instantly detect traffic from malicious URLs and domains.
  • Custom log patterns (or regex patterns) can be created for specific devices and can be saved for future log imports.
  • Symantec Endpoint Protection support is now enhanced with the set of prebuilt reports on successful logons, failed logons, admins added, admins modified, admin deleted and policy changes.

 Fixes

  • Multiple vulnerability issues including XSS, XML injection, authorization issues, and path traversal has been fixed.
  • New entries in registry were not added when databases was changed. This issue has been fixed.
  • All fields in 'Manage Agents' under 'Admin Settings' tab now supports non-ASCII characters as well.
  • IP address of configured devices were not updated properly. This issue has been fixed.
  • Parsing errors occurred when importing multi-line logs. This issue has been fixed.

 Enhancements

  • The enhancements are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11070

Released on 29 August 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Transport layer security (TLS) based log collection is now supported.
  • Port management options have been enhanced for better usability.
  • Out-of-the-box support for NetScreen and Checkpoint firewall devices log data. The new version comes with exclusive predefined reports and alert profiles that makes NetScreen and Checkpoint device auditing and monitoring easier.
  • The new version supports Nexpose vulnerability scanner log imports.
  • Exclusive reports for monitoring SonicWall VPN activities comes bundled with the new version.
  • The new version includes predefined reports that provide information on web traffic for Cisco firewall and routers.

 Enhancements

  • External agent support is now being provided for Windows server core machines.
  • TLS 1.2 is used for enhanced agent-server communication.
  • File integration monitoring support has been extended for Windows file servers.
  • It is now possible to get the details of the users who renamed the file or folder in the predefined file integrity monitoring reports.
  • You can now directly apply the self-signed certificate directly from within EventLog Analyzer web-console.
  • EventLog Analyzer now extends the log querying capability to Nessus, OpenVas, Nmap and Qualys vulnerability scanner log data.
  • Reports for "Host migration in vCenters" and "VM Relocated Events" is now provided.
  • Option to search for a specific managed server from admin server console is now being provided.
  • Device display name enhancements has been done.

 Fixes

The following bug fixes are done in addition to a range of minor bug fixes.

  • The issue in displaying host count in the "Home" tab of "Device details" page in distributed edition is fixed.
  • Occasional sync error between managed server and admin server in distributed edition is fixed.
  • Log count aggregation in trend table has been revamped.
  • File integrity monitoring report profile now accepts file extension with spaces.
  • Bugs in Apache report's status code has been fixed.
  • The issue with log format icon in log collection filter profile is rectified.
  • Multiple bugs fixed for Fortinet and Juniper firewalls reports.
  • Bug fix for the summary count in the scheduled file integrity monitoring reports.
  • The Username is now parsed for event IDs 4658 and 4952 in event logs.
  • False alerts for "log collection failure" fixed for syslog.
  • Encoding issue for non-English languages in CSV export reports is fixed.
  • Multiple log parsing issues fixed.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.7 Build 11056.
  • No changes specific to Distributed Edition Admin Server in this release.

Build 11066

Released on 15 August 2017

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

Enhanced threat intelligence platform
  • The solution now supports STIX/TAXII threat feeds. The global threat feed database will be updated automatically.
Malicious IP and URL alerts
  • Upon analysing the threat feeds and log data from the network, the solution sends out real-time alerts if suspicious traffic or out going traffic to malicious domain is detected.

 Enhancements

Enhanced threat intelligence platform
  • The solution now supports STIX/TAXII threat feeds. The global threat feed database will be updated automatically.
Malicious IP and URL alerts
  • Upon analysing the threat feeds and log data from the network, the solution sends out real-time alerts if suspicious traffic or out going traffic to malicious domain is detected.

Build 11065

Released on 04 August 2017

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Elastic Search is enhanced to handle unprocessed files.
  • In the search option, custom fields are pre-populated with values that are previously configured by users.
  • In a current session, if you navigate to other tabs while viewing a specific report, the 'Reports' tab saves the view and shows it to you when you're back.

 Fixes

  • Issues with Cisco parsing have been fixed.
  • Issues in parsing VNC logs from Mac OS have been fixed.
  • The values used in the compliance reports are directly taken from the indices to avoid value mismatch.

 Enhancements

  • The enhancements are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11060

Released on 19 July 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer now offers exclusive reports and alert profiles for Fortinet device to help to detect anomalous activities, monitor user activities, changes in configuration, and ,more.

 Enhancements

  • EventLog Analyzer supports all SonicWall device log format. Previously, we had been supporting only SonicWall firewall logs.
  • Active Directory user import feature has been revamped for better user experience.
  • Configuring domains and workgroups is made easy with a dedicated log configuration page for the same.
  • The solution can now import AD users at regular intervals using schedules along with provisions to view the schedule history.

 Fixes

The following issues have been fixed:

  • The alert profiles that are being created as tickets in ServiceDesk Plus have been provided with the l18n option.
  • The values for graphical representation in the dashboard is directly taken from the indices to avoid value mismatch.
  • Issue with loading archives in MSSQL Windows authentication has been fixed.
  • The issue with importing users with same username from multiple domains has been fixed.
  • Issue with adding users has been fixed now.
  • When users were moved to different host groups, the change wasn't reflected in the 'All host group' list. This issue has been fixed.
  • Issues with the single-sign-on feature have been fixed now.
  • Importing users from some organizational unit had some issues . This has been fixed now.
  • Authentication of users imported from AD groups didn't happen. This has been fixed now.
  • Technician roles can be assigned to multiple users at one go.
  • Vulnerabilities in 'Keep me signed in' option in the login page has been fixed using dynamic key based encryption.
  • Issues with log collector have been fixed.
  • False positives for Windows device down alerts has been fixed.
  • You can now collect event logs through a fully qualified domain name (FQDN).
  • Issues with index archiving have been fixed now.
  • Issue with searching a renamed device in 'Device' page, has been fixed.
  • Synchronization issues with Admin and Managed server in MSSQL database have been fixed.
  • In File Monitoring Summary page, the device names were not listed, if it's included in the DHCP device list. This issue has been fixed.

 Enhancements

  • Admin servers can now be assigned groups from multiple managed servers.
  • Exact host count was not reflected in the licence page of admin server. This has been fixed now.
  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.6 Build 11060.

Build 11056

Released on 30 May 2017

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • Reports to track user VPN connections and disconnections on Cisco ASA devices have been added.
  • The 5424 log format is now supported for Juniper devices.
  • Juniper traffic reports have been enhanced.

 Fixes

  • The log collector quit occasionally while parsing Oracle logs. This has been fixed.
  • SSL versions 2 and 3 have been removed.
  • SSL weak cipher suites have been changed.
  • The following vulnerabilities have been removed from several pages of the product:
    • Stored and reflective cross site scripting
    • Cross site request forgery
    • Clickjacking
    • Username harvesting

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.5 Build 11056.
  • No changes specific to Distributed Edition Admin Server in this release.

Build 11055

Released on 3 May 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

EventLog Analyzer now comes with an in-built ticket-based incident management system.

  • A separate ticket can be created for each incident, and assigned to any specific administrator for resolution.
  • Includes a provision to add notes, in the ticket, once it is resolved. This makes it easier to resolve similar issues that might arise in the future.
  • Integrates with popular help desk tools – ServiceNow and ManageEngine’s ServiceDesk Plus to allow creation of tickets using them.

 Enhancements

  • The GUI of alerts reporting page has been enhanced for better usability.
  • Users can now configure the alert profiles based on time frames viz., working hours, non-working hour, and even custom time range.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.5 Build 11055.
  • No changes specific to Distributed Edition Admin Server in this release.

 Fixes

  • Users with roles other than the default admin and guest were not able to view the dashboard. This has been fixed.

Build 11050

Released on 17 Apr 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

EventLog Analyzer supports:

  • Juniper and Palo Alto device logs; offers predefined reports and alert profiles exclusively for Juniper and Palo Alto devices to audit them easily.
  • TCP based log collection for Syslog devices.

 Enhancements

  • New SonicWall device reports have been added for IDS/IPS and under the user account management category.
  • View the top and least values of the log data fields in all the predefined reports.
  • Full support for SolarWinds Windows Log Forwarder.

 Fixes

  • The issue with IBM AS/400 date format has been fixed.
  • AS400 alerts were getting sent for devices not specified in the alert profile. This has been fixed.
  • Shared files and folders deleted via right clicks were not showing in the reports. This has been fixed.
  • The elastic search engine now resets the date in the log message and shows the results for the last 30 days if the start or end time in the log message time stamp exceeds the elastic search engine time range limit.
  • The issue with working of FTP scheduled import option when the file is specified as the root path has been fixed.
  • The issue with the working of Windows Snare agent has been fixed.
  • The issue with the working of log filter for Windows log collection via Snare agent has been fixed.
  • The issues with the update of 'Last Message Time' for devices in the Device Management page have been fixed.
  • The issue with generation of removable disk auditing reports has been fixed.

 Enhancements

  • Managed server contains all the features of EventLog Analyzer Standalone Edition Version 11.5 Build 11050.

 Fixes

  • Users with roles other than the default admin and guest were not able to view the dashboard. This has been fixed.

Build 11045

Released on 30 March 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • The 'Settings' tab now has a search option with which you can search for options available in configuration, system, and product settings sections.

 Enhancements

  • The GUI of 'Settings' page has been enhanced for easy accessibility.
  • I18N is now supported for "Log Me" tab.

 Fixes

  • Issues in archiving log data from Elasticsearch index has been fixed.
  • Minor i18n issues have been fixed.

 Enhancements

  • There are no changes specific to Distributed Edition Admin Server in this release
  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.4 Build 11045

Build 11043

Released on 28 Feb 2017

  • Standalone Edition
    •  
  • Distributed Edition

 Fixes

  • The logs processed using SolarWinds logs forwarder was only partially compatible. This has been fixed now.
  • Issue in receiving Cisco logs that represented severity with numbers instead of letters has been fixed.
  • While scheduling reports, filter option wasn't working consistently in non-English user interfaces. This has been fixed.
  • While searching for logs using event numbers, the search bar malfunctioned in non-English user interfaces. This has been fixed.

 Enhancements

  • No changes specific to Distributed Edition Admin Server in this release
  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.4 Build 11043

Build 11042

Released on 9 Feb 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • EventLog Analyzer simplifies the log collection and device configuration by automatically discovering Syslog devices on your network based on the IP and CIDR range values. SNMP (Version 1) credentials is used for automatic device discovery.
  • The solution also enables automatic log forwarding for UNIX devices with the root credentials.

 Enhancements

  • Email notification option has been provided for the default threat alert profile.

 Fixes

  • The issue with EventLog Analyzer's log collector when the database password is encrypted has been fixed.
  • The issue in updating IBM AS400 password has been fixed.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.4 Build 11042
  • No changes specific to Distributed Edition Admin Server in this release

Build 11040

Released on 6 Jan 2017

  • Standalone Edition
    •  
  • Distributed Edition

 New features

EventLog Analyzer now offers out-of-the-box support for:

  • SonicWall firewall. You can now use exhaustive reports and predefined alert profiles that make SonicWall firewall auditing easier.
  • RFC 5424 log format for Unix and Linux machines.

 Enhancements

  • Syslog data processing performance has been enhanced.
  • ‘Pick device' option has a new filter, 'username', for enhanced usability.
  • CSV files with just two columns can also be imported.
  • For devices that use agent for log collection, "Device down" alerts are enabled.
  • 'Network Logon' event has been included under one of the rules in 'Correlation'.
  • Error message for logon authentication failure events is displayed for firewall devices.

 Fixes

  • Issues with event source based database filter have been fixed.
  • Issue when exporting alert profile into XML format have been fixed.
  • Issues with Run Program Notification Setting in correlation have been fixed.
  • Issue with the SysEvtCol process in Linux-64 bit machine has been fixed now.
  • When alert profile is set up for certain devices in a group, all the devices in that group are included in the 'Devices' criteria. This issue has been fixed.
  • The issue with the 'Archive>Settings' option in Chrome browser has been fixed now.
  • Issues with the administrator and operator privileges for managing alert profiles have been fixed.
  • The issue with 'contains' filter option in log search has been fixed now.
  • Issues with generating File Integrity Monitoring reports for DHCP agents have been fixed now.
  • File or folder rename events were not reflected in File Integrity Monitoring reports. This has been fixed now.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.4 Build 11040
  • No changes specific to Distributed Edition Admin Server in this release

Build 11030

Released on 19 Dec 2016

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Auto-discovery of domain and non-domain devices for enhanced user experience in adding Windows devices.

 Enhancements

  • Devices management and configuration has been improved for better usability. You can now check the log collection status, change the log monitoring interval, and enable or disable the device from a single window.
  • FIM events for agent directory folders are excluded by default.

 Fixes

The following issues have been fixed:

  • Archive location path containing special characters has been aligned with Windows standards.
  • XSS vulnerability issue in rebranding and index pages has been fixed.
  • Server has been optimized for FIM folders exclusion to accept several agent requests.
  • JVM crashes no longer occur when importing log files.
  • Changes in filenames are dynamically reflected while updating the schedule.
  • Trend Reports does not reflect event counts with zero logs.
  • The issue with the count in the report export list has been fixed.
  • IP address based device search is now possible.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 11.3 Build 11030
  • No changes specific to Distributed Edition Admin Server in this release

Build 11025

Released on 17 Nov 2016

  • Standalone Edition
    •  

 Fixes

  • The file integrity monitoring template update has been fixed.
  • Working of script notifier in Linux installations has been fixed.
  • Displaying the archive status during archive loading has been fixed.
  • Export report download (due to special character references in the report name) has been fixed.
  • Compliance report graph's drill-down functionality has been fixed.
  • Time criteria for archive report exports has been fixed.
  • Syslog collection has been fixed.
  • The email address field now has a limit of 250 words.
  • We now monitor SSH2 sessions as well for Unix/Linux SSH session reports.
  • If Oracle application log data contains raw commands executed in the database, then that log data will not be categorized under reports.

Build 11020

Released on 26 Aug 2016

Service Pack build 11023 released on 24 Oct 2016

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Threat analysis
  • Without any configuration, automatically get alerted whenever you receive traffic from blacklisted or suspicious IPs.
All new UI
  • EventLog Analyzer now comes with a flat user interface
Monitor log data of EventLog Analyzer
  • Offers the capability to forward EventLog Analyzer's log data (in syslog format) to any source.

 Enhancements

  • Log search engine performance has been enhanced.
  • The product's log trend graph, event category graph and host count variable are now directly loaded from the 'Elastic Search' module so as to facilitate better
  • Now, the report, alerts for the client console uses the local (client) machine's time zone for better interpretation.
  • IBM AS400 BRMS log parsing is now supported.
  • EventLog import for non-english languages is now supported.

 Fixes

  • Alignment issues in 'Settings', 'Hosts', 'Search' and 'Correlation' tabs had been fixed.
  • The log search event count mismatch when hovered over the graph has been fixed.
  • The issue in knowing the exact number of event types in dashboard graphs has been fixed.
  • The issue with triggering action upon clicking 'Calendar' icon has been fixed.
  • Alignment issues in displaying the content
  • The export as report feature was not working for archive search results when using MSSQL database. This has been fixed.
  • Edit report feature under My Reports section was not working when reports were sorted. This has been fixed.
  • When exporting reports in PDF format, username fields above 8 characters were getting truncated. This has been fixed.
  • Some hosts were not getting listed under the Hosts tab due to a data mismatch. This has been fixed.
  • Parsing timestamp from Apache logs has been tuned.
  • The issue in parsing timestamp from ESXi logs has been fixed.
  • The issue in parsing Unix FTP logs has been fixed.
  • When upgrading an agent, if any error is encountered, an error message is now displayed under the Agent Status.
  • Issues causing agent installation and upgrade failure have been fixed.
  • Issues with agent deletion, and agent association when its corresponding host was renamed, have been fixed.
  • The issue in displaying File Monitoring for Shared Deleted Events for Windows 2012 R2 has been fixed.
  • The issue with registering when file monitoring is in DHCP environment has been fixed.
  • The issue with event log skipping after applying Windows anniversary update, or when recordID is wrapped in WMI, has been fixed for both agent and agentless methods.
  • The issue with logon failure when logs are being collected from EventLog Analyzer has been fixed.
  • Script notification under alert profiles was not working in case of space constraints in the installation directory. This has been fixed.
  • Multiple issues with File Integrity Monitoring configuration and templates have been fixed.
  • The issue with syncing after editing Managed Server details in Admin server has been fixed.
  • Logagent quit when path length in File Integrity Monitoring was very large. This has been fixed.
  • The record ID mismatch between multiple hosts in an agent has been fixed.
  • Auditing is now enabled when adding hosts for File Integrity Monitoring, instead of when enabling the username.
  • SQL Injection vulnerability in Hosts tab has been fixed.
  • Session ID getting exposed in Access Log vulnerability has been fixed.

 Enhancements

  • The features, enhancements and fixes are same as in Standalone Edition.

Build 11012

Released on 23 Jul 2016

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • EventLog Analyzer now provides you with an option to export the generated alert messages.
  • You now have the option to select all the available host groups while creating a report, alert profile, or filter.
  • We have now enhanced the edit, disable, and delete icons available in the alert message section.
  • EventLog Analyzer's calendar will be automatically updated every 10 minutes.
  • You can now edit the report schedules to change the report formats (PDF or CSV).
  • Help card is now added to assist the vulnerability import option.

 Fixes

  • The alignment in CSV reports has been fixed
  • The deletion of original file while importing application logs using Internet Explorer browser has been fixed.
  • Scheduling the predefined reports for large number of hosts has been fixed.
  • The 'Pick host' option in correlation rule filter page has been fixed.
  • The option to disable AD authentication has been fixed.
  • Archive status change in Internet Explorer 11 has been fixed.
  • 'View Per Page' option in 'Hosts' page has been fixed.
  • Selected hosts count in 'the Search' and 'Pick host' feature has been fixed.
  • Feature request link for Log360 has been fixed.

 Enhancements

  • The enhancements are same as in the Standalone Edition.

 Fixes

  • All fixes to the Standalone Edition are applicable to the Distributed Edition as well.

Build 11010

Released on 17 Jun 2016

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • The EventLog Analyzer web client language is automatically set based on the language setting of the browser. Also, the server side language is automatically set based on the machine in which it is installed.
  • Search option added within Pick Hosts option (found in add new report/alert/filter and report schedule pages).
  • vCenter log collection process enhanced in performance.
  • Support for AS400 log collection through secure ports.
  • CEF format support for FireEye logs.
  • 'Message' column added to FireEye overview report.
  • 'Username' column added to following Windows predefined reports: Software installed/uninstalled/updated, Failed software installation due to privilege mismatches.

 Fixes

  • Username was not getting parsed from logs with event ID 104. This has been fixed.
  • Username is now parsed from the object string if not present in log message.
  • The issues in parsing time and source from syslog messages are now fixed.
  • Logs from add-on sources were not getting parsed upon restart of the log collector service. This has been fixed.
  • The issue causing failure in updating logs to the database, due to inaccessible data files, has been fixed.
  • Only Key_Read permission (rather than all permissions) is granted when required to read RemoteRegistry values.
  • Issue with agent-server communication in DHCP environment has been fixed.
  • Log collection status shown as 'Access Denied' if a filter was created which dropped all logs. This has been fixed.
  • The issues causing memory leak due to object access events are fixed.
  • Historic log collection was not occurring for few log types. This has been fixed.
  • Multiple log collector crashes fixed.
  • Invalid log types were queried during the log collection process. This has been fixed.
  • Log indexing was not occurring if device type was changed manually from Syslog to Cisco. This has been fixed.
  • Unnecessary escape characters were added while importing archived logs from PGSQL. This has been fixed.
  • Application log archive files were getting duplicated due to scheduling clash. This has been fixed.
  • Loading status would not be updated when attempting to access an archive file that was moved or deleted. This has been fixed.
  • The issue in using the 'AND' boolean operator in predefined report searches has been fixed.
  • Search page queries with single quotes were not working. This has been fixed.
  • The issue causing failure to refine data by double-clicking host names in reports has been fixed.
  • Application sub tab under Reports was not opening. This has been fixed.
  • Criteria field was missing under edit predefined reports schedule window. This has been fixed.
  • Uploading of log files to database was not occurring if PGSQL database was password protected. This has been fixed.
  • Vulnerability fixes:
    • Guest user could change the admin password. This has been fixed.
    • Reflected XSS and Store XSS vulnerabilities are fixed.
    • Clickjacking vulnerability has been fixed.
    • Username harvesting vulnerability has been fixed.

 Enhancements

  • The enhancements are the same as in Standalone Edition.

 Fixes

  • Centralized archive issue in Admin Server has been fixed.
  • All fixes to standalone edition are applicable to Distributed Edition as well.

Build 11005

Released on 28 Apr 2016

  • Standalone Edition
    •  

 Fixes

  • The issue leading to LogAgent crash while decrypting the password for the added host has been fixed.
  • The issue leading to LogAgent crash while decoding the server response has been fixed.
  • The issue leading to LogAgent does when File Integrity Monitoring is set up has been fixed.
  • The issue causing LogAgent memory growth has been fixed.

Build 11001

Released on 7 Mar 2016

Service Pack Build 11003 released on 15 Mar 2016

  • Standalone Edition
    •  

 Enhancements

  • EventLog Analyzer and ADAudit Plus have been integrated into a single log management and auditing solution viz., Log360.

 Fixes

  • The issue with edit filter has been fixed.
  • The users can now provide space in the account name while logging into EventLog Analyzer.
  • The issue related to the import action after the field extraction operation has been fixed.
  • The issue with auto upgrade of LogAgent while applying the PPM over 8.0 has been fixed.
  • The issue during the application of SACL from LogAgent for huge folders has been fixed.
  • While applying PPM, the issue related to agent's auto upgrade when domain name is NULL has been fixed.
  • The issue with report zipping when the save type is 'Save Alone' has been fixed.
  • The issue related to parsing of cisco logs when the device type is manually changed, has been fixed.
  • The issue with the log collector stopping the remote registry service of the host from which it is collecting logs, has been fixed.
  • The issue related with the password update while editing the host details has been fixed.
  • The issue related with log parsing when Cisco meraki logs are forwarded from the relay server, has been fixed.
  • File Integrity Monitoring can now record the registry events as well.
  • The vulnerability issue of guest user changing the admin credentials has been fixed.
  • In LogAgent, if the users are providing any other credentials other than administrator, and if they do not have credentials to access the WMI namespace, then log collection will fail.
  • In SysEvtCol, if the local host is added with a user who doesn't have credentials to access WMI namespace, then log collection will fail.
  • The issue related to back up and restoration operation for MS SQL 2012 server has been fixed.
  • During log collection, if a single log is not returned within 2 seconds, then the log collection will be skipped after retrying 5 times with the same interval of 2 seconds.
  • The issue related with the installation of FIM agent after renaming the host, has been fixed.
  • The issue of considering the DB filter string's tab sequence as a space has been fixed.
  • The issue with advanced search criteria not getting updated in the database has been fixed.
  • The time delay with the log collection while applying FIM with user name option on a folder which contains many sub folders, has been fixed.
  • Only image file formats can now be uploaded for rebranding.
  • The issue with html tags injection through error messages has been fixed.
  • Fixed various SQL injection vulnerabilities.
  • Fixed the alert script arguments issue.
  • Fixed the bug related to 'Keep me signed in' option for AD and radius login.
  • Fixed directory traversal vulnerability through URL parameter.
  • Fixed the issue with the import file check for evt files.
  • Restricted non administrator users from accessing other users' data via parameter manipulation.

Build 10081

Released on 12 Jan 2016

Service Pack build 10081 released on 12 Jan 2016

  • Standalone Edition
    •  
  • Distributed Edition

 Enhancements

  • EventLog Analyzer server can now be configured to run in the HTTPS protocol as well. Option to provide the corresponding port numbers is also available.
  • Option to encrypt the Keystore password is now available.
  • You can now set the web session expiry time limit.
  • The solution now provides you the flexibility to change the language of EventLog Analyzer web client, after the solution had been installed.
  • Get to know the status of the report export process with the help of sleek progress bar.
  • We've now provided an option to get administrator credentials during service mode installation.
  • Log collection capability is strengthened to include both log type and time in the query mechanisms.

 Fixes

  • File Integrity Monitoring feature
    • The 'Select All' option in the 'Settings' tab wasn’t working. This issue has been fixed.
    • The 'Back' button issue in the drill down pages has been fixed.
  • The issue related to the inclusion of Japanese, Chinese characters in 'Schedule' names has been fixed.
  • The blank home page issue when the Managed Servers are down has been fixed.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 10.8 Build - 10080
  • No changes specific to Distributed Edition Admin Server in this release

Build 10072

Released on 5 Nov 2015

  • Standalone Edition
    •  

 Enhancements

  • Application Local User Enable / Disable option integrated.
  • Agent Installation error and status messages in the tool-tip.
  • Apache logs common log format supported.

 Fixes

  • Test port not working in SMS configuration in Alerts (due to the page being opened in new window) - has been fixed.
  • Criteria for scheduling Predefined Reports - OR function not working properly - has been fixed.
  • Unix mail server reports - username classified as undefined - has been fixed.
  • Uninstallation of agent with different username (from the username used for installation) not working - has been fixed.
  • Loss of data during transfer from agent due to check-sum error - has been fixed.
  • All check box selection functions have been fine tuned.
  • AllLogsCurrentHourlyTrend and AllLogsHistoricalHourlyTrend are ordered by hour.
  • FIM - Not able to enable username for the directories with space - has been fixed.
  • When same agents are installed, slid is not updated during fresh install in agent side - has been fixed.

Build 10071

Released on 25 Sep 2015

Build 10070 released on 25 Sep 2015

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • High availability feature has been integrated within the product.

 Fixes

  • Fixed the issue in field extraction that arise while creating more than two fields or whenever a special cha racter is included in the field value
  • Fixed issue with alert delay in case of slow log rate
  • Fixed time stamping issue for syslogs.
  • Fixed the time range selection issue in report and correlation data generation
  • Guest user promotion as Admin by accessing user management page has been fixed
  • Vulnerabilities on session hijacking using cookie value JSESSIONID has been fixed
  • XSS vulnerability in EventLog Analyzer server login page has been fixed

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 10.6 Build 10600
  • No changes specific to Distributed Edition Admin Server in this release

Build 10060

Released on 29 May 2015

  • Standalone Edition
    •  
  • Distributed Edition

 New features

Supports vulnerability data analytics
  • EventLog Analyzer 10.6 supports log collection and analysis of vulnerability scanners such as Nessus, Qualys, NMAP, and OpenVas.It provides 50+ predefined reports and alert conditions exclusively for vulnerability data analytics that help prioritizing the vulnerabilities and thus help to proactively mitigate security attacks.
Supports threat intelligent solution's log data
  • The latest version of EventLog Analyzer supports log data analysis of endpoint security solutions such as FireEye, Symantec Endpoint solution, and Symantec DLP application. The solution provides predefined reports and alert criteria that helps identifying and containing security threats at the earliest
vCenter log monitoring
  • EventLog Analyzer 10.6 supports vCenter log monitoring. It provides on-the-fly reports and alert conditions that help monitoring vCenter activities such as Datastore changes, permission changes, host changes, Resourcepool changes and more.
Supports GPG13 compliance
  • as EventLog Analyzer now provides out-of-the-box reports and alerts that help HMG organizations comply to GPG13 compliance.

 Enhancements

  • Added new rule to parse the shun-attacks.

 Fixes

  • Fixed the issue of Database folder increase due to improper cleaning of throwaway tables.
  • Fixed Firefox Unix icon display issue.
  • Fixed the issue associated with Universal Log Parsing and Indexing (ULPI) for user specified logs.
  • Fixed the parsing issue with IBM AS400.
  • Issues related to juli log growth and serverout growth had been fixed.
  • emoved weak cipher 'Ephemeral DH ciphers' from the secure connection.
  • Fixed the time order issue on trend reports.
  • Fixed the false disk space alert with remote desktop connection.
  • Issue related to RunQuery.do has been fixed.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 10.7 Build 10070
  • No changes specific to Distributed Edition Admin Server in this release

Build 10000

Released on 23 Jan 2015

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Log collection and processing rate has been improved to 10x from the previous mark. EventLog Analyzer version 10 and above can handle 20,000 logs per second with the peak log handling capacity of 25,000 logs per second
  • 1000+ out-of-the-box reports for security, compliance and operations needs
  • Enhanced real-time event response system with 600+ predefined alert criteria for Windows, Linux/Unix, Applications and Network Device environment.

 Enhancements

File Integrity Monitoring
  • Ability to filter critical changes to files/folders based on the file type
  • Ability to display the process name and domain name in file integrity monitoring reports
  • Option to enable and disable File Integrity Monitoring
  • Addition of more default templates
  • Ability to save/edit alert and report enhancement with option to select User Name & Change Type
  • Ability to drill down the file integrity monitoring report graph
  • File attribute changes and ownership changes are now being captured under critical file/folder changes
Search
  • Ability to save the search results as alerts
  • Inclusion of auto suggestions for field values
  • Sorting of the index data for improved search performance
Correlation
  • Custom correlation rule builder that allows to create pattern based alerting by selecting the existing correlation rules
  • Ability to specify the threshold limits for each rule in the defined pattern.
Session Activity Changes
  • Added Duration and Log off time fields at 'Session Activity' page
  • Ability to search through the session activity reports
  • Session activity reports can now be saved

 Fixes

  • Fix to enabling AD authentication issue while importing user from AD groups.
  • Fix to the search pagination issue
  • Vulnerability fixes - URL Injection
    • Authentication problems
    • Database injection
    • Stored password encryption changes
    • Agent zip extraction
  • Fix to the User based and iSeries User based Reports breaks while exporting with no user name in the database
  • Fix to the PDF export issue that occurred after mouse hover search from Custom Reports, while exporting all the events instead of filtered events.
  • Fix to Event ID based direct export breaks when severtity parameter is not appended in URL
  • Custom alert 'Not Equals' was not working for option 'Type'. This issue was fixed.

 Enhancements

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 10.0 Build 10000
  • No changes specific to Distributed Edition Admin Server in this release

Build 9000

Released on 23 Apr 2014

  • Standalone Edition
    •  
  • Distributed Edition

 New features

  • Real-time Event Correlation
    • Real-time correlation for proactive threat management
    • 50+ out-of-the-box correlation rules on various categories viz., File Management, Group Management, Authentication, Authorization, Audit Policy, Software Management and more
  • Out-of-the-box reports for ISO 27001:2013 Standards
  • Supports Terminal Server Log Analysis out-of-the-box
  • Supports EventLog Analyzer user audit trail

 Enhancements

  • File Integrity Monitoring
    • File Integrity Monitoring reports now include the name of the user who made the change
    • Modified File Integrity Monitoring Report page
  • Field Extraction for SFTP application log import is now added
  • Archive encryption using AES 256 algorithm is now supported
  • Supports EventLog Analyzer user audit trail
  • Reports Enhancements
    • Performance of Report Extraction in PDF and CSV format is enhanced
    • Summary details for User Based Reports is now included
  • Adding Hosts
    • Supports import of host list from a CSV file
    • Existing hosts that are added will be automatically hidden from the Pick List Window
  • Customize Notification settings
    • Supports sending notification only once and pausing the notification for a day/week/month

 Fixes

The following issues have been fixed in this release:

  • In predefined compliance alert profile creation can now have the Windows 2008 type event IDs
  • EventLog Analyzer version 9.0 can now handle the string '\' in Log message fields of reports, alerts and filters
  • Issue with the resetpwd.bat file in troubleshooting folder is fixed
  • Out of memory error during log import is fixed
  • 'Notes' field in the Custom Report Creation wizard now has the character limit of 250
  • Issue with the specification of multiple log messages separated by a comma, in report creation wizard is fixed
  • Issue with the working of Radius Authentication is fixed
  • Supports syslog import with 'Automatically Identify' option
  • Issue in log import schedule for a multiline log is now fixed
  • Issue in archive purging of Postgres database is fixed
  • 'Advanced Alert' option in 'Custom Alert Profile' creation page
    • Supports specification of multiple Event IDs separated by a comma
    • Supports alert criteria edit even if the criteria is specified within double quotes
  • Issue with updation of SQL information in ChangeDBServer.bat file with $ in the password section is fixed
  • Specific Scheduled AD User import issue is fixed
 

 Enhancements

GA release of EventLog Analyzer Distributed Edition.

  • Managed Server contains all the features of EventLog Analyzer Standalone Edition Version 9.0 Build 9000
  • No changes specific to Distributed Edition Admin Server in this release
  Try out our latest features now!
Download the service pack

Be our voice

 

Tell us your story

Fill simple case studies and win exciting gifts.

Do it now!
 

We are all ears

Would you take a moment and write a review for us?

Yes, I'd love to
 

Be a part of our alpha group

You can access our beta builds exclusively before we release them.

Subscribe now

Did you know?

  • QWhat is the difference between the Free and Paid editions? 
    A

    The Free Edition of EventLog Analyzer is limited to handling event logs from a maximum of five log sources, whereas the Standalone and Distributed editions can handle event logs from 10 - 1,000 log sources and 50 - unlimited number of log sources respectively.

  • QDoes the trial version have any restrictions? 
    A

    The trial version is a fully functional version of EventLog Analyzer Standalone edition. When the trial period expires, EventLog Analyzer automatically regresses to the Free Edition.

  • QDo I have to reinstall EventLog Analyzer to upgrade from the free version to the paid version?  
    A

    No, you do not have to reinstall or shut down the server. You just have to upload the new license file.

Events

We can't wait to meet you!

Upcoming events
 

Resources

Get your hands on the latest ebooks, whitepapers, and videos curated by our experts

Get resources now
 

Expert talks

We've demystified cybersecurity. Dwell into these easy reads and be at the top of your IT security game.

Take me there
 
 

Features

Quick link

Cybersecurity

Resources

EventLog Analyzer Trusted By

Los Alamos National Bank Michigan State University
Panasonic Comcast
Oklahoma State University IBM
Accenture Bank of America
Infosys
Ernst Young

Customer Speaks

  • Credit Union of Denver has been using EventLog Analyzer for more than four years for our internal user activity monitoring. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. This product can rapidly be scaled to meet our dynamic business needs.
    Benjamin Shumaker
    Vice President of IT / ISO
    Credit Union of Denver
  • The best thing, I like about the application, is the well structured GUI and the automated reports. This is a great help for network engineers to monitor all the devices in a single dashboard. The canned reports are a clever piece of work.
    Joseph Graziano, MCSE CCA VCP
    Senior Network Engineer
    Citadel
  • EventLog Analyzer has been a good event log reporting and alerting solution for our information technology needs. It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts.
    Joseph E. Veretto
    Operations Review Specialist
    Office of Information System
    Florida Department of Transportation
  • Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application.
    Jim Lloyd
    Information Systems Manager
    First Mountain Bank
TestimonialsCase Studies

Awards and Recognitions

  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
  •  
A Single Pane of Glass for Comprehensive Log Management
Log ManagementLog AnalysisIT ComplianceSIEMQuick LinksRelated Products

A Single Pane of Glass for Comprehensive Threat Management

Free Trial Get Quote
Email Download Link