Prepare for release v3.109.0

[alessandrarizzo]

Background

Changes

Testing

[cursor]

PR Summary

Medium Risk
Changes alter correlation log types, baseline/lookup SQL, and alert severity mapping for vendor passthrough rules, which can shift alert volume and fidelity until validated in tenant data.

Overview
Release v3.109.0 prep bumps the release workflow’s AWS configure-credentials action to v6.1.1 and refreshes detection catalog/index entries for Snowflake.

Snowflake: The Snowflake Data Exfiltration correlation detection is repointed from streaming/QueryHistory to snowflake_data_exfiltration.yml on Snowflake.AccountUsage. The configuration-drift scheduled query now excludes EXPLAIN, tightens which successful non-SELECT activity counts (including Panther lookup COPY INTO noise), and the user created alert title parses usernames with a regex (including IF NOT EXISTS).

Okta baselines: AD-agent and main baseline queries drop system@okta.com, cap per-user distribution aggregates to the top 50 values, and rebuild SWA “known IP/UA” lists as frequency-ranked top 50 instead of unbounded distinct arrays.

CrowdStrike / Wiz: Adds disabled lookup crowdstrike_aid_device_info (AID → device metadata from FDR) to the CrowdStrike pack; passthrough rules normalize severity from name or numeric fallback (CrowdStrike summary uses safer string handling). Wiz maps INFORMATIONAL → INFO and dedupes informational/low similarly.

Packs & rules: New Anthropic pack; Anthropic rules lose Experimental status. Standard.OTX.MaliciousIndicator and panther_otx_helpers join the standard ruleset pack (OTX rule no longer Experimental).

^{Reviewed by Cursor Bugbot for commit 666baee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 666baee. Configure here.}

[cursor]

Missing SeverityName crashes passthrough

High Severity

The updated severity handler calls .upper() on get_crowdstrike_field(event, "SeverityName") without guarding missing values. When SeverityName is absent, that value is None, so alert generation raises AttributeError instead of using the numeric fallback.

 

^{Reviewed by Cursor Bugbot for commit 666baee. Configure here.}

[cursor]

Lookup window contradicts description

Medium Severity

The new crowdstrike_aid_device_info lookup describes device data from the last 90 days, but its SQL filters with p_occurs_since('10d'). Enabling the table yields only ten days of AID mappings, not the documented window.

 

^{Reviewed by Cursor Bugbot for commit 666baee. Configure here.}