1. Incident Notifications via Telegram
   You can now receive real-time incident notifications via Telegram!
   With this feature, you’ll get instant updates on security incidents, including:
   • Incident category and severity (High, Critical, Medium, etc.)
   • Brief incident details, including the affected device and its IP address
   • Attacker IP (if available) – clicking on it allows you to check its details using a public lookup service
   • Attacker geolocation data – see where the IP is located
   • Direct access to the incident overview – clicking the “View Incident” link will take you to ACSIA SOS for a full analysis (login required)
     
     Why is this important?
   • Stay informed instantly, without needing to check emails or dashboards.
   • Respond to security threats faster, improving your organization’s protection.
   • Get critical insights at a glance, including attacker details and geolocation.
     
     Important: We strongly recommend using a private Telegram channel for notifications to keep your security data safe and confidential.
     
2. Incident Notifications via Mattermost
   You can now receive incident notifications via Mattermost, just like with Slack and Teams!
   With this integration, you’ll get real-time alerts directly in your Mattermost workspace, including:
   • Incident category and severity (High, Critical, Medium, etc.)
   • Brief incident details, including the affected device and its IP address
   • Attacker IP (if available) – allowing quick identification of potential threats
   • Direct access to the incident overview – click the “View Incident” link to jump straight into ACSIA SOS for further analysis (login required)
     
     Why is this important?
   • Instant visibility: No need to check emails or external dashboards—get alerts where your team already collaborates.
   • Faster response times: Immediate awareness means quicker action to mitigate threats.
   • Seamless integration: Works like Slack and Teams, making it easy to adopt.
     
     By enabling Mattermost notifications, you ensure your security team stays informed and ready to respond—without disrupting their workflow.

Improvements in v.7.7.0

1. Enhanced Incident Details Visibility More details are now displayed directly in the incident list, reducing the need to open each incident.
   • Executable File Dropped: Detected processes are now shown directly in the list.
   • Multiple Windows Logon Failures: The username that failed to log in is now shown directly in the list.
   • Sysmon: Detected processes are now shown directly in the list.
     
2. Incidents and Devices Section
   Added the option to sort incidents by IP for easier investigation.
3. Incident Filters Introduced a dropdown menu to filter incidents by category without manually entering the category name, making filtering faster and more user-friendly.
   

If you have questions or need assistance, please reach out to our support team.

The post Release Note ACSIA SOS V.7.7.0 appeared first on Dectar.

New Features in v7.6.0

1. Firewall Integration ACSIA SOS now integrates with Fortigate firewalls, offering a unified view of your infrastructure and enabling seamless communication for enhanced threat response.
   • Unified Device Overview:
     The ACSIA SOS interface now displays detailed information about your firewall alongside your other devices (servers and clients). This centralized view allows you to monitor and manage your entire infrastructure from a single platform.
   • Dynamic Rule Creation via API:
     When ACSIA SOS detects a threat and applies an IP ban as remediation, it communicates with the firewall via API to automatically create corresponding rules. These rules are not pre-existing in the firewall, ensuring effective enforcement of bans at both the ACSIA SOS and firewall levels.
   • Secure Token-Based Communication:
     The communication between ACSIA SOS and Fortigate is secured with token-based API authentication. The token must be generated by an administrator using the Fortinet GUI and is designed to be exclusively used by ACSIA SOS for security purposes.
   • Guided Setup:
     When adding a device of type “firewall” in the ACSIA SOS interface, users are provided with a detailed guide on generating the API token in the Fortinet GUI, making the integration process straightforward and secure.
     
2. Device Tags
   Users can now create and apply custom tags to multiple devices within the same tenant. This feature simplifies device organization and enhances management capabilities, making it easier to classify and track devices based on specific criteria.  

Improvements in v.7.6.0

1. Enhanced Password Security
The length of passwords automatically generated for accessing the compliance Wazuh dashboard has been increased from 10 to 32 characters, providing significantly stronger protection against unauthorized access.

2. Bulk Actions in Device Management
A new bulk actions feature has been added to the device management section, allowing users to select multiple devices and perform actions on them simultaneously. The supported actions include:

• Uninstall: Remove the ACSIA SOS agent from selected devices in bulk.

If you have questions or need assistance, please reach out to our support team.

The post Release note ACSIA SOS v.7.6.0 appeared first on Dectar.