ElastiFlow v3.0.0 Release Notes
-
🆕 New Features
- 🚀 Dashboards have been rebuilt to leverage features added since the release of Kibana 6.x. This includes the addition of experimental dashboards which leverage the new Vega visualization.
- 🔨 The schema was refactored to minimize the volume of data stored and increase the efficiency of processing. The result is a reduction of storage requirements by 20-30%, and better throughput.
- IP reputation tagging has been added to assist in the identification of suspect network traffic.
- 👌 Improved support for application identification data has been added for Cisco NBAR2 and Fortinet.
- ➕ Added support for simultaneous collection over IPv4 and IPv6 on separate interfaces.
- 🔖 Versioning has been added for indices and index templates. This will make it possible in the future to create reindexing methods for the migration of historical data to newer versions.
- GeoIP and ASN lookups can now be enabled/disabled using an environment variable. Users who don't need these capabilities will be able to disable them, saving disk space and increasing processing efficiency.
- Index mappings were modified to more gracefully handle various vendor-specific flow field implementations.
🛠 Fixes
- 🛠 Fixed a regression related to the field type of various IPFIX date fields.