Community Blog

[#1]

Palo Alto Networks Live Community describes some new features for Evident™ being introduced in October 2018. Some new features include new custom signatures for Azure, Audit Log exports, and new report search parameters among many others. You may also find a list of all the new Azure Signatures.

The following table provides a snapshot of new features introduced for Evident™ in October 2018. Refer to the Evident documentation for more information on how to use the Evident service.

Feature	Description
Audit Log Export for Amazon SNS Integration	With the Amazon SNS Integration, you can now export Audit Logs. This capability is available to a manager with organization-level access on the Evident service.
Custom Signatures for Azure	In Beta, you can write custom signatures to monitor Azure resources and create security checks for services that are not natively available with the predefined signatures, so you can secure new services as they become available. In addition, you can create custom signatures for your internal compliance requirements.
New Report Search Parameter	Within a report, you can now match multiple keywords that are separated with a comma in the Signature ID field. For example, to view alerts from multiple signatures for iam and sss, you can search for alerts containing "iam,sss" to view all alerts for these two keywords.
New Azure Signatures	Eleven new Azure Signatures were added in October. Click on the links below to open them directly on the Evident platform: AZU:ALA-001 - Activity Log Alert for Create or Update Network Security Group AZU:ALA-002 - Activity Log Alert for Delete Network Security Group AZU:ALA-003 - Activity Log Alert for Delete SQL Server Firewall Rule AZU:ALA-005 - Activity Log Alert for Delete Security Solution AZU:ALA-006 - Activity Log Alert for Create or Update Security Solution ZU:ALA-007 - Activity Log Alert for Create or Update SQL Server AZU:ALA-008 - Activity Log Alert for Delete Network Security Group Rule AZU:ALA-009 - Activity Log Alert for Create or Update Network Security Group Rule AZU:ALA-010 - Activity Log Alert for Create Policy Assignment AZU:GR-004 - Ensure No Custom Subscription Owner Roles Exist AZU:NET-011 - Network Watcher Enabled AZU:SC-018 - Azure Security Center: Standard Pricing Enabled.

Thanks for taking time to read this. If you found this useful, please make sure to give it a Thumbs Up.

We welcome all feedback and comments below.

Kiwi out !