1. Incident Notifications via Telegram
   You can now receive real-time incident notifications via Telegram!
   With this feature, you’ll get instant updates on security incidents, including:
   • Incident category and severity (High, Critical, Medium, etc.)
   • Brief incident details, including the affected device and its IP address
   • Attacker IP (if available) – clicking on it allows you to check its details using a public lookup service
   • Attacker geolocation data – see where the IP is located
   • Direct access to the incident overview – clicking the “View Incident” link will take you to ACSIA SOS for a full analysis (login required)
     
     Why is this important?
   • Stay informed instantly, without needing to check emails or dashboards.
   • Respond to security threats faster, improving your organization’s protection.
   • Get critical insights at a glance, including attacker details and geolocation.
     
     Important: We strongly recommend using a private Telegram channel for notifications to keep your security data safe and confidential.
     
2. Incident Notifications via Mattermost
   You can now receive incident notifications via Mattermost, just like with Slack and Teams!
   With this integration, you’ll get real-time alerts directly in your Mattermost workspace, including:
   • Incident category and severity (High, Critical, Medium, etc.)
   • Brief incident details, including the affected device and its IP address
   • Attacker IP (if available) – allowing quick identification of potential threats
   • Direct access to the incident overview – click the “View Incident” link to jump straight into ACSIA SOS for further analysis (login required)
     
     Why is this important?
   • Instant visibility: No need to check emails or external dashboards—get alerts where your team already collaborates.
   • Faster response times: Immediate awareness means quicker action to mitigate threats.
   • Seamless integration: Works like Slack and Teams, making it easy to adopt.
     
     By enabling Mattermost notifications, you ensure your security team stays informed and ready to respond—without disrupting their workflow.

Improvements in v.7.7.0

1. Enhanced Incident Details Visibility More details are now displayed directly in the incident list, reducing the need to open each incident.
   • Executable File Dropped: Detected processes are now shown directly in the list.
   • Multiple Windows Logon Failures: The username that failed to log in is now shown directly in the list.
   • Sysmon: Detected processes are now shown directly in the list.
     
2. Incidents and Devices Section
   Added the option to sort incidents by IP for easier investigation.
3. Incident Filters Introduced a dropdown menu to filter incidents by category without manually entering the category name, making filtering faster and more user-friendly.
   

If you have questions or need assistance, please reach out to our support team.

The post Release Note ACSIA SOS V.7.7.0 appeared first on Dectar.