Exposure Management (including XM for Business and XM Frontline Add-on) Changelog

LiselotteP · 2024-06-03T07:32:06+00:00

There was an error rendering this rich post.

This is the primary changelog for WithSecure™ Elements Exposure Management, covering all updates related to:

Exposure Management for Business
Exposure Management Frontline Add-on

It provides the latest enhancements, fixes, and feature updates for these components of the Exposure Management solution.

Note: This changelog does not include updates for Exposure Management for Cloud. For cloud-specific updates, please refer to the dedicated changelog here: Exposure Management for Cloud Changelog.

Find more posts tagged with

Changelog

Comments

Sandra

XM newsletter week 20

Attack path visualization

Added a link to primary finding in step details
Grouping of similar assets to tidy up the view

Exposure views filtering

Exposure views now support filtering by multiple values, e.g filters like "FindingSource Includes Identity, Network" are possible
Exposure multi-value filters can be repeated with different operations to support logics such as "Tags Include NIST KISA" "Tags Does not include HIPPA"

“MFA status” column in the Identities page

New tooltip has been added to clarify the meaning of different MFA statuses Identity can have
An adjustment to the MFA status logic has been made, when checking Entra ID Conditional Access policies. This might result in some of the Identities statuses changing from ‘Partially enabled’ to ‘Enabled’.

New “Account status” column in the Identities page

New column has been added to the Identities table to indicate if the Identity’s account is enabled or disabled. Column is hidden from the default view, and can be added to the view. New filter has been also added, enabling filtering by account status.

mortma

XM newsletter week 16

Luminen (Elements AI) enhanced recommendation descriptions are now globally available to all XM partners and customers.
- Visiting recommendation details page, AI generated description and title are shown
- With possibility of giving feedback by clicking on thumbs-up and thumbs-down icons at the bottom of the recommendation description
Recommendation algorithm improved to generate less "Inconclusive" recommendations
- Improvement especially more visible for the companies with mixture of asset types where one asset type dominates other asset types in terms of count
Minor bugfixes and security improvements

Sandra

XM newsletter week 11

We have released Exposure management with following changes:

Two new Identity findings are introduced for Entra ID tenants by analyzing the user’s role assignments with corresponding recommendation to review privileged roles and their permissions:
- Entra ID tenant has more than 5 global administrators
- Entra ID tenant has more than 10 privileged roles
Recommendation list page (Home => Exposure => Recommendation) has now a possibility to filter recommendations by status value. It is currenlly possible to filter only using one value. Multi-value filtering is coming. By default, list now filters recommendations having status Done.
Previously, in Elements attack path simulation, MITRE TTPs were linked to the MITRE website, while WithSecure extensions were not linked anywhere. With this update, WithSecure TTP extension IDs in the UI now link to https://ti.withsecure.com, providing direct access to detailed information.

Sandra

XM newsletter week 8

We have released Exposure management with following changes:

Executive summary report (beta version) now contains also company exposure risk as a visual grade with reference to how you are doing compared to other companies using WithSecure XM. Executive summary report is available in the Exposure dashboard page accessible via Home -> Exposure.

We have fixed an issue where not all recommendations were visible and some of the findings were not included in the visible recommendations. For the cases where recommendations were not included in the recommendation hierarchy, we are showing "inconclusive" as state. We advise to look inside those recommendations to see the finding specific remediation impact and relative remediation guidance.
Cloud findings which are not visible in the latest scan are now properly removed from Exposure management and their impact to the Cloud recommendation is re-calculated.
Several minor bug and performance improvements.

mortma

XM newsletter week 03

Demo role is generally available (for partners only). more details on partner portal
Executive summary pdf report is generally available. (beta version): A new link on Home → Exposure
Elevate to WithsSecure flow for recommendations improved : Elevations can be re-opened for up to 30 days after being closed
If a finding is a VM System Scan, a link to the actual vm scan page led into the finding was added to the Finding detail page
Linkage from Identities table (Environment → Identities (view findings link)) to exposure findings table (Environment → Exposure (Findings tab)) improved. Landing view is now shows only the findings for the selected Identity.
Home → Exposure (Highest impact recommendations table) now shows a label "Exploit exists" if there are known exploits to any of the findings in the recommendation, based on the threat intelligence data.
AttackPath details improved

mortma

XM newsletter week 51 🎅

Finding status management added: Similar to recommendations status management, user can manually impact on individual finding status. Only active findings are taken into account for risk score calculations. (active Finding = status not "Done" or "False Positive")
- Finding status can be set from Exposure → Findings page by selecting multiple findings
- or from Finding Detail page for a single finding
A new column "Scan subtype" added to "Findings in this recommendation" widget on Recommendation Details page. This column gives hint on what scan type has led into the creation of the finding. e.g "System Scan" for vulnerability findings and "Azure (cloud scan)" for Cloud findings can give more precise info about the scan.
- Note: This data is available for recent scans only. In case of old scans, a re-scan is required to populate it.
Improved harmonization of filters across various XM views.
Identity list view: Improved MFA status logic where MFA status was shown false-positively as green for some cases. Now more precise status appears on the UI.
- Note: As a result of this fix, users might notice more yellow colors on Identity list page.

mortma

XM newsletter week 48

Released a new widget on Home → Exposure Widget to show the Exposure Management coverage of a selected company from different angles.

Green color in each area indicates whether the company has completed WithSecure Exposure Management onboarding successfully and scans are running perfectly on that area.

Orange Color: Indicates that the company has the proper licenses to get onboarded to the Exposure management, but not all configuration or onboarding is complete. in this case, by clicking on the area, user will be taken to a relevant view where the configuration or onboarding can be completed.

Gray Color: Indicates that the company does not have required licenses to get onboarded on the area. In this case, please reach out to the sales staff for more info on how to obtain the relevant license.

mortma

XM newsletter Week 47

Identity audit logs when user modifies Identity properties such as importance and business context, are now available in Elements Audit Logs
Exposure audit logs when user does actions such as elevating a recommendation to WithSecure, are now available in Elements Audit Logs
Extended logic for checking identity’s MFA status. Correct MFA status is now shown on the Identity with traffic light colors depending on reported MFA status in O365, Portal and elsewhere by MicroSoft.
Identity lists pagination issue correction
Recommendation Status added to the Flyout on Finding details page when "view related recommendations" button is pressed

mortma

XM newsletter Week 45

Status of multiple Recommendations can be now set from Recommendation List page. Multiple Recommendation selection will activate the action panel. The status will be saved to the recommendations for further tracking. e.g The status appearing on Home → Exposure widget will show only active recommendations (active recommendation = status not "Done" or "False Positive")
"Findings in this recommendation" widget on Recommendation detail page has a new "last seen" column showing the time stamp when last time this finding has been seen. This column gives clearer idea about how fresh the scan results are.
Improved remediation impact score precision. This will help with more accurate distinguishment of recommendations and more enhanced prioritization of them when their remediation impact scores are close to each other.

mortma

XM newsletter week 44

New version released:

Recommendations List view now supports sorting on "Related attack paths" column to make it easier find the recommendations with AttackPaths attached to them
Recommendations List view populates "Related attack paths" much faster than beofre.
Several UI sorting bugfixes in Recommendation and Findings views
Cloud account removal now propagated to removal of all corresponding assets, findings and related recommendations

mortma

XM newsletter week 43

Status of a Recommendation can be set from Recommendation details page. The status is saved to the Recommendation for further tracking. e.g The status appearing on Home → Exposure widget.

in addition to Staus, Notes can be added to each recommendation e.g to give reason about why user has decided to set a specific status to a Recommendation

In this version Recommendations that are set as "Done" or "False Positive", will disappear from Home → Exposure → Highest Impact Recommendations

mortma

XM newsletter week 42

Added tags and affected-device columns to the Findings views for make them more self-explanatory
AttackPath visualizer more UX improvements
Several UX improvements and UI bug fixes including sorting bugs
Recommendation quality improvements via several scoring logic improvements

mortma

XM newsletter Week 41

We have released Exposure management with new improvements:

AttackPath visualizer tool updated with UX improvements.
New Recommendation score calculation is in place: Recommendations are now generated for only highly-enough risked assets. This may lead into less Recommendations provided compared to what had been recommended in the previous versions. This is considered as expected behavior while continuous improvements and tuning will be applied in the future releases to improve the quality of the recommendations.
Several minor bug and security fixes.