Windows - Privileged Network Shared Object Was Accessed: reduced noise, expanded coverage
Added monitoring for IPC$ share access alongside the existing ADMIN$/C$ coverage and added threshold.
SOAR forwarding reliability improvements
SOAR forwarding failures caused by a missing configuration or a session-key error are now correctly tagged as retryable errors so the Cyences - SOAR Forward Retry report picks them up, instead of being silently marked as skipped and never retried.
The command is now wrapped in top-level error handling so an unexpected exception no longer crashes the search; the failure is logged with a full traceback instead.
Improved Cyences - SOAR Forward Retry search to avoid reaching the limitation of subsearch.
Basic Network Scanning: destination IPs scoped to internal hosts
The alert now only considers scans against internal/private destination IPs, reducing false positives from scans against public/external destinations.
Simplified the severity calculation to be based on destination-port/destination-IP fan-out instead of blocked-traffic percentage.
Bug fixes
Fixed raw event data ingestion as notable events
This fix prevents raw events from being ingested into the cyences index.