What's Changed

🐛 Bug Fixes and Tunes

• AWS RDS Instance Encryption Tuning by @zaynahsmith-dasilva in #2161

🏡 Miscellaneous

• build(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in #2152
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #2151
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #2150
• Harden GitHub Actions workflows against script injection (EPD-6521) by @gdim1 in #2160
• v3.114.0 by @zaynahsmith-dasilva in #2164
• Auto-generated .versions.yml file by @panther-bot-automation in #2165

New Contributors

• @gdim1 made their first contribution in #2160

Full Changelog: v3.113.0...v3.114.0

What's Changed

🐛 Bug Fixes and Tunes

• Databricks SQL Addition Snowflake Queries by @zaynahsmith-dasilva in #2137
• Databricks SQL Addition Okta Queries by @zaynahsmith-dasilva in #2142
• Change ActivityType from int to str in SentinelOne Alert Passthrough by @alessandrarizzo in #2146
• fix: correct DatabricksQuery table paths and field access notation by @zaynahsmith-dasilva in #2154
• Databricks SQL Addition Crowdstrike Lookup Tables by @zaynahsmith-dasilva in #2143
• Databricks SQL Addition Okta Lookup Tables by @zaynahsmith-dasilva in #2144

🏡 Miscellaneous

• build(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.2 by @dependabot[bot] in #2147
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #2139
• build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #2138
• build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #2140
• Fix Kubernetes IOC query Snowflake clause order by @rootverdict in #2148
• Update panther-analysis-tool to v1.8.0 by @panther-bot-automation in #2155
• v3.113.0 by @zaynahsmith-dasilva in #2157
• Auto-generated .versions.yml file by @panther-bot-automation in #2158

New Contributors

• @rootverdict made their first contribution in #2148

Full Changelog: v3.112.0...v3.113.0

What's Changed

🐛 Bug Fixes and Tunes

• Tune AWS.CloudTrail.IMDSCredentialExfiltration by @arielkr256 in #2117
• Fix empty app_name alert for OnePassword.Unusual.Client by @mustafa-intrusionops in #2129
• Tune Crowdstrike.RealTimeResponse.Session by @alessandrarizzo in #2133
• Databricks SQL Addition Auth0 Queries by @zaynahsmith-dasilva in #2119
• Databricks SQL Addition Notion Queries by @zaynahsmith-dasilva in #2123
• Databricks SQL Addition OnePassword Queries by @zaynahsmith-dasilva in #2124
• Databricks SQL Addition OTX Queries by @zaynahsmith-dasilva in #2125
• Databricks SQL Addition DropBox Queries by @zaynahsmith-dasilva in #2126
• Databricks SQL Addition Crowdstrike Queries by @zaynahsmith-dasilva in #2127
• Databricks SQL Addition GSuite Queries by @zaynahsmith-dasilva in #2128
• Databricks SQL Addition AWS Queries by @zaynahsmith-dasilva in #2130
• Databricks SQL Addition Kubernetes Queries by @zaynahsmith-dasilva in #2131
• Databricks SQL Addition Github Queries by @zaynahsmith-dasilva in #2121

🏡 Miscellaneous

• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2105
• build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #2120
• Add GTI/VirusTotal enrichment helpers by @arielkr256 in #2118
• Support parsing DatabricksQuery field by @rohantandon in #2122
• Update panther-analysis-tool to v1.7.0 by @panther-bot-automation in #2132
• Tune AWS GetSignInToken by @arielkr256 in #2134
• Prepare for release v3.112.0 by @alessandrarizzo in #2135
• Auto-generated .versions.yml file by @panther-bot-automation in #2136

New Contributors

• @rohantandon made their first contribution in #2122

Full Changelog: v3.111.0...v3.112.0

What's Changed

🐛 Bug Fixes and Tunes
Fix EKS anonymous API health check filter to cover all RFC 1918 by @flip-z in #2065
Fix field path bugs in Okta.Support.Reset and Slack app rules by @arielkr256 in #2092
AWS Root Activity Rule Dedup Tuning by @zaynahsmith-dasilva in #2097
Standardizing on 90 Day Baselines by @zaynahsmith-dasilva in #2099
🏡 Miscellaneous
Update panther-analysis-tool to v1.6.2 by @panther-bot-automation in #2076
Convert sequence correlation rules to group rules by @arielkr256 in #2096
prep for v3.110.0 by @arielkr256 in #2102
Auto-generated .versions.yml file by @panther-bot-automation in #2103
pip dependabot by @arielkr256 in #2104
dependency cooldown by @arielkr256 in #2111
disable correlation rules by default by @arielkr256 in #2114
v3.111.0 by @arielkr256 in #2115
Auto-generated .versions.yml file by @panther-bot-automation in #2116

New Contributors
@canagno123 made their first contribution in #2093
Full Changelog: v3.109.0...v3.110.0
Full Changelog: v3.110.0...v3.111.0

What's Changed

🌯 New Packs and Pack Expansion

• Graduate Anthropic.Activity rules & Standard.OTX.MaliciousIndicator out of experimental + create Anthropic pack by @alessandrarizzo in #2073

🐛 Bug Fixes and Tunes

• Fix FDR Passthrough Severity Function by @ben-githubs in #2056
• Fix Snowflake.UserCreated alert title for IF NOT EXISTS syntax by @zaynahsmith-dasilva in #2062
• Baseline Capping by @zaynahsmith-dasilva in #2066
• Fix Wiz Defend Passthrough severity function by @arielkr256 in #2068

🏡 Miscellaneous

• Main by @zaynahsmith-dasilva in #2064
• Add Crowdstrike AID device info lookup table by @arielkr256 in #2069
• Filter out common Panther queries for correlation rules and SQL enric… by @ben-githubs in #2070
• build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #2050
• Prepare for release v3.109.0 by @alessandrarizzo in #2074
• Auto-generated .versions.yml file by @panther-bot-automation in #2075

Full Changelog: v3.108.1...v3.109.0

What's Changed

🏡 Miscellaneous

• v3.108.0 by @zaynahsmith-dasilva in #2058
• Auto-generated .versions.yml file by @panther-bot-automation in #2059
• Fix release tag target and add version bump option by @maxrichie5 in #2063

Full Changelog: v3.108.0...v3.108.1

What's Changed

🕵️ New Detections

• [THREAT-689] Anthropic Compliance API Rules by @alessandrarizzo in #2053

🏡 Miscellaneous

• Prepare for release v3.107.0 by @arielkr256 in #2045
• Auto-generated .versions.yml file by @panther-bot-automation in #2046
• AI overhaul by @arielkr256 in #2049
• Replace PR review action with local pre-commit hooks and slash command by @alessandrarizzo in #2054

Full Changelog: v3.107.0...v3.108.0

What's Changed

🕵️ New Detections

• OTX pulse enrichment helpers and indicator-match rule by @arielkr256 in #2043

🌯 New Packs and Pack Expansion

• Promote Experimental rules to Stable by @alessandrarizzo in #2044

🐛 Bug Fixes and Tunes

• fix(azure): case-insensitive resource-ID parsing in panther_azureactivity_helpers by @wired33 in #2034
• [fix] Make Google drive rules app name specific by @alessandrarizzo in #2037
• [bug] ship missing helpers in kubernetes unified rules by @alessandrarizzo in #2038
• Update to MicrosoftGraph.SecurityAlertV2 schema by @arielkr256 in #2042

🏡 Miscellaneous

• Prepare for release v3.106.0 by @alessandrarizzo in #2035
• Auto-generated .versions.yml file by @panther-bot-automation in #2036

New Contributors

• @wired33 made their first contribution in #2034

Full Changelog: v3.106.0...v3.107.0

What's Changed

🕵️ New Detections

• [THREAT-353] AWS RDS Rules by @alessandrarizzo in #2014
• Correlation Rules Converted to use Unique Values by @zaynahsmith-dasilva in #2015
• [THREAT-197] AWS Credential Misuse Rules (STS, CloudTrail) by @alessandrarizzo in #2032

🗓️️ Scheduled Rules

• Convert Scheduled Rules to Real-Time Streaming Rules Using unique() by @zaynahsmith-dasilva in #2009

🏡 Miscellaneous

• v3.105.0 by @zaynahsmith-dasilva in #2027
• Auto-generated .versions.yml file by @panther-bot-automation in #2028
• build(deps-dev): bump cryptography from 46.0.5 to 46.0.7 by @dependabot[bot] in #2016
• build(deps): bump peterjgrainger/action-create-branch from 3.0.0 to 4.0.0 by @dependabot[bot] in #2017
• build(deps): bump aormsby/Fork-Sync-With-Upstream-action from 3.4.1 to 3.4.3 by @dependabot[bot] in #2019
• build(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in #2020
• build(deps): bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in #2022
• build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #2029
• build(deps): bump anthropics/claude-code-action from 1.0.75 to 1.0.97 by @dependabot[bot] in #2030
• SQL Okta AD Baseline Builders by @zaynahsmith-dasilva in #2033

Full Changelog: v3.105.0...v3.106.0

What's Changed

🕵️ New Detections

• Adding Pantherflow Baseline Builders by @zaynahsmith-dasilva in #2013

🌯 New Packs and Pack Expansion

• Remove experimental status from rules by @alessandrarizzo in #2012

🐛 Bug Fixes and Tunes

• Tune AWS.WAF.Managed.IPReputation by @alessandrarizzo in #2011

🏡 Miscellaneous

• prep for release v3.104.0 by @arielkr256 in #2007
• Auto-generated .versions.yml file by @panther-bot-automation in #2008
• Dependency Fix for Requests by @zaynahsmith-dasilva in #2023
• Fix invalid type hints in global helpers by @MichaelMVS in #2021
• Dependency Updates by @zaynahsmith-dasilva in #2024
• Fix Pipfile dev dependency conflicts with PAT 1.6.1 by @zaynahsmith-dasilva in #2025
• Update panther-analysis-tool to v1.6.1 by @panther-bot-automation in #2026

New Contributors

• @MichaelMVS made their first contribution in #2021

Full Changelog: v3.104.0...v3.105.0