ASGARD 2.11 Release

by Nov 10, 2021

We are glad to announce a new ASGARD Management Center (AMC) release with exciting new features and improvements.

Sigma LogWatcher

LogWatcher is a new service that applies Sigma rules to Windows Eventlog entries. It uses the big public Sigma rule base and has access to the upcoming private Sigma rule feed maintained by Nextron Systems. It’s the first additional service that can be managed and configured in the new “Service Control” section. (add the “Service Control” right to roles to enable the section for these roles)

Improved LDAP Support

The new LDAP configuration now supports all kinds of different selection options to authenticate against Microsoft Active Directory.

Improved IOC Management

The IOC Management moved into the Scan Control section and now allows you to import single or groups of IOCs in a special interface that abstracts from the underlying format required by THOR.

A ruleset contains IOC groups which contain IOCs. Integrated checks verify the provided expressions and give you direct feedback. 

Persistent Column Settings per User

Each user can now configure the table views in each section according to their needs, which persist across sessions.

Performance Improvements

The new version improves the performance of large installations (>10,000 endpoints) significantly. 

THOR and THOR TechPreview Support

It’s now possible to scan with all kinds of THOR version, the current stable version Tech Preview versions and even THOR Lite. 

 

Before you update:

  • the upgrade can take up to one hour in large installations, so please wait and do not reboot during the installation
  • the API has been completely revised so that old API endpoints that you currently use may not work anymore
  • to prevent an inconsistent state, you have to upgrade the Master ASGARD before upgrading the connected ASGARDs

More changes:

  • improved stability and error handling of THOR scans
  • extended CSV output and availability in many more sections
  • requirements for password complexity has been increased

About the author:

Florian Roth

Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.

Newsletter

New blog posts (~1 email/month)

GDPR Cookie Consent with Real Cookie Banner