v1.39.0

New Detections

🕵️ microsoft graph passthrough in #544
🕵️ detection for EC2 *Image* cloudtrail events relating to ATT&CK T1204 in #545
🕵️ detection for IAM Identity modifying the userProfile of another without setting the must reset password bit relating to ATT&CK T1550 in #548
🌯 update gsuite pack to include data model in #552

Bug Fixes

🐛 gsuite drive visibility title bug #543
🐛 guardduty context in #535
🐛 Potential typo prevents tests from passing in okta_password_accessed detection by @fr0mdual in #546
🐛 fix: get_val_from_list would raise an error if the comparison key was not in the input item of the list in #547 ( revealed by #546 )
🐛 fix: dedup aws_iam_user_key_created based on the userIdentity.arn to group by source identity in #549

Miscellaneous

🏠 fix: Default behavior of our python environment should be to use the Pipfile.lock specified versions in #541
🏠 feat: allow gsuite admins to provide an allow-list of applicationNames for when google is the IdP for a saml app in #542
🏠 docker support for windows environments in #538
🏠 fix: remove all references to ast.literal_eval in #551

Full Changelog: v1.38.1...v1.39.0