All Versions
87
Latest Version
Avg Release Cycle
29 days
Latest Release
235 days ago
Changelog History
Page 1
Changelog History
Page 1
-
v4.3.9 Changes
October 13, 2022Agent
๐ Fixed
- ๐ Fixed remote policy detection in SCA. (#15007)
- ๐ Fixed agent upgrade module settings parser to set a default CA file. (#15023)
โ Removed
- โ Removed obsolete Windows Audit SCA policy file. (#14497)
Other
๐ Changed
- โก๏ธ Updated external protobuf python dependency to 3.19.6. (#15067)
-
v4.3.8 Changes
September 19, 2022Manager
๐ Fixed
- ๐ Fixed wrong field assignation in Audit decoders (thanks to @pyama86). (#14752)
- ๐ท Prevented wazuh-remoted from cleaning the multigroup folder in worker nodes. (#14825)
- ๐ Fixed rule skipping in wazuh-analysisd when the option if_sid is invalid. (#14772)
Agent
๐ Changed
- โก๏ธ Updated root CA certificate in agents to validate WPK upgrades. (#14842)
๐ Fixed
- ๐ Fixed a path traversal flaw in Active Response affecting agents from v3.6.1 to v4.3.7 (reported by @guragainroshan0). (#14801)
-
v4.3.7 Changes
August 24, 2022Manager
โ Added
- โ Added cluster command to obtain custom ruleset files and their hash. (#14540)
๐ Fixed
- ๐ Fixed a bug in Analysisd that may make it crash when decoding regexes with more than 14 or-ed subpatterns. (#13956)
- ๐ Fixed a crash hazard in Vulnerability Detector when parsing OVAL feeds. (#14366)
- ๐ Fixed busy-looping in wazuh-maild when monitoring alerts.json. (#14436)
- ๐ Fixed a segmentation fault in wazuh-maild when parsing alerts exceeding the nesting limit. (#14417)
Agent
๐ Changed
- ๐ Improved Office365 integration module logs. (#13958)
๐ Fixed
- ๐ Fixed a code defect in the GitHub integration module reported by Coverity. (#14368)
- ๐ Fixed an undefined behavior in the agent unit tests. (#14518)
RESTful API
โ Added
- โ Added endpoint GET /cluster/ruleset/synchronization to check ruleset synchronization status in a cluster. (#14551)
๐ Changed
- ๐ Improved performance for MITRE API endpoints. (#14208)
Ruleset
โ Added
- โ Added SCA Policy for CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0. (#13806)
- โ Added SCA Policy for CIS Microsoft Windows 10 Enterprise Release 21H2 Benchmark v1.12.0. (#13879)
- โ Added SCA policy for Red Hat Enterprise Linux 9 (RHEL9). (#13843)
- โ Added SCA policy for CIS Microsoft Windows Server 2022 Benchmark 1.0.0. (#13899)
๐ Fixed
- ๐ Fixed rule regular expression bug on Ubuntu 20.04 Linux SCA policy control ID 19137. (#14513)
- ๐ Fixed AWS Amazon Linux SCA policy. Fixed bug when wazuh-agent tries to run the policy. (#14483)
- ๐ Fixed AWS Amazon Linux 2 SCA policy. Limit journalctl to kernel events and only since boot. (#13950)
- โ Added missing SCA files during Wazuh-manager installation. (#14482)
- ๐ Fixed OS detection in Ubuntu 20.04 LTS SCA policy. (#14678)
-
v4.3.6 Changes
July 20, 2022- โ Added support for Ubuntu 22 (Jammy) in Vulnerability Detector. (#14085)
- โ Addded support for Red Hat 9 in Vulnerability Detector. (#14117)
๐ Changed
- ๐ Improved the shared configuration file handling performance in wazuh-remoted. (#14111)
๐ Fixed
- ๐ Fixed potential memory leaks in Vulnerability Detector when parsing OVAL with no criteria. (#14098)
- ๐ Fixed a bug in Vulnerability Detector that skipped Windows 8.1 and Windows 8 agents. (#13957)
- ๐ Fixed a bug in wazuh-db that stored duplicate Syscollector package data. (#14061)
Agent
๐ Changed
- โก๏ธ Updated macOS codename list in Syscollector. (#13837)
- ๐ Improved GitHub and Office365 integrations log messages. (#14093)
๐ Fixed
- ๐ Fixed agent shutdown when syncing Syscollector data. (#13941)
- ๐ Fixed a bug in the agent installer that misdetected the wazuh username. (#14207)
- ๐ Fixed macOS vendor data retrieval in Syscollector. (#14100)
- ๐ Fixed a bug in the Syscollector data sync when the agent gets disconnected. (#14106)
- ๐ Fixed a crash in the Windows agent caused by the Syscollector SMBIOS parser for Windows agents. (#13980)
RESTful API
๐ Fixed
- ๐ป Return an exception when the user asks for agent inventory information where there is no database for it, such as never_connected agents. (#14152)
Ruleset
โ Added
- โ Added Ubuntu Linux 22.04 SCA Policy. (#13893)
- โ Added Apple macOS 12.0 Monterey SCA Policy. (#13905)
Other
๐ Changed
- ๐ฒ Disabled filebeat logging metrics. (#14121)
-
v4.3.5 Changes
June 29, 2022Manager
๐ Changed
- ๐ Improved the Vulnerability Detector's log when the agent's OS data is unavailable. (#13915)
๐ Fixed
- โฌ๏ธ The upgrade module's response message has been fixed not to include null values. (#13662)
- ๐ Fixed a string truncation warning log in wazuh-authd when enabling password authentication. (#13863)
- ๐ Fixed a memory leak in wazuh-analysisd when overwriting a rule multiple times. (#13587)
- Prevented wazuh-agentd and client-auth from performing enrollment if the agent fails to validate the manager's certificate. (#13907)
- ๐ Fixed manager's compilation when enabling GeoIP support. (#13694)
- ๐ Fixed a crash in wazuh-modulesd when getting stopped while downloading a Vulnerability Detector feed. (#13883)
Agent
๐ Changed
- ๐ฆ Extended package data support in Syscollector for modern RPM agents. (#13749)
- ๐ Improved verbosity of the GitHub module logs. (#13898)
๐ Fixed
- ๐ Fixed agent auto-restart on shared configuration changes when running on containerized environments. (#13606)
- ๐ Fixed an issue when attempting to run the DockerListener integration using Python 3.6 and having the Docker service stopped. (#13880)
RESTful API
๐ Fixed
- โก๏ธ Updated
tag
parameter ofGET /manager/logs
andGET /cluster/{node_id}/logs
endpoints to accept any string. (#13867)
Ruleset
๐ Fixed
- โ Solved Eventchannel testing and improved reporting capabilities of the runtest tool. (#13597)
- ๐ง Modified Amazon Linux 2 SCA policy to resolve a typo on control 1.1.22 and
EMPTY_LINE
conditions. (#13781) - ๐ง Modified Amazon Linux 2 SCA policy to resolve the rule and condition on control 1.5.2. (#13950)
โ Removed
- โ Removed deprecated MITRE tags in rules. (#13567)
Other
๐ Changed
- Fixed
test_agent_PUT_endpoints.tavern.yaml
API integration test failure in numbered branches. (#13811) - โฌ๏ธ Upgraded external click and clickclick python dependencies to 8.1.3 and 20.10.2 respectively. ([13790]([https://github.com/wazuh/wazuh/pull/13790))
-
v4.3.4 Changes
June 09, 2022Manager
๐ Changed
- Integratord now tries to read alerts indefinitely, instead of performing 3 attempts. (#13437)
- โ Adds a timeout for remote queries made by the Office 365, GitHub, and Agent Update modules. (#13626)
๐ Fixed
- ๐ Fixed bug in
agent_groups
CLI when removing agent groups. (#13621) - ๐ Fixed linux compilation errors with GCC 12. (#13459)
- ๐ Fixed a crash in wazuh-analysisd when overwriting a rule with a configured active response. (#13604)
- ๐ Fixed a crash in wazuh-db when it cannot open a database file. (#13666)
- ๐ Fixed the vulnerability feed parsing mechanism, now truncates excessively long values (This problem was detected during Ubuntu Bionic feed update). (#13566)
- ๐ Fixed a crash in wazuh-maild when parsing an alert with no full log and containing arrays of non-strings. #13679)
RESTful API
๐ Fixed
- โก๏ธ Updated default timeouts for
GET /mitre/software
andGET /mitre/techniques
to avoid timing out in slow environments. (#13550)
Ruleset
๐ Fixed
- ๐ Fixed the prematch criteria of
sshd-disconnect
decoder. (#13560)
-
v4.3.3 Changes
May 31, 2022 -
v4.3.2 Changes
May 30, 2022Manager
๐ Fixed
- ๐ Fixed a crash in Vuln Detector when scanning agents running on Windows. (#13616)
-
v4.3.1 Changes
May 18, 2022Manager
๐ Fixed
- ๐ Fixed a crash when overwrite rules are triggered. (#13439)
- ๐ Fixed a memory leak when loading overwrite rules. (#13439)
- ๐ Fixed the use of relationship labels in overwrite rules. (#13439)
- ๐ Fixed regex used to transform into datetime in the logtest framework function. (#13430)
RESTful API
๐ Fixed
- ๐ Fixed API response when using sort in Agent upgrade related endpoints. (#13178)
Ruleset
๐ Fixed
- ๐ Fixed rule 92656, added field condition win.eventdata.logonType equals 10 to avoid false positives. (#13409)
-
v4.3.0 Changes
May 05, 2022Manager
โ Added
- โ Added support for Arch Linux OS in Vulnerability Detector. Thanks to Aviel Warschawski (@avielw). (#8178)
- โ Added a log message in the
cluster.log
file to notify that wazuh-clusterd has been stopped. (#8749) - โ Added message with the PID of
wazuh-clusterd
process when launched in foreground mode. (#9077) - โ Added time calculation when extra information is requested to the
cluster_control
binary. (#10492) - โ Added a context variable to indicate origin module in socket communication messages. (#9209)
- โ Added unit tests for framework/core files to increase coverage. (#9733)
- โ Added a verbose mode in the wazuh-logtest tool. (#9204)
- โ Added Vulnerability Detector support for Amazon Linux. (#8830)
- Introduced new option
<force>
to set the behavior when Authd finds conflicts on agent enrollment requests. (#10693) - โ Added saniziters to the unit tests execution. (#9099)
- Vulnerability Detector introduces vulnerability inventory. (#8237)
- The manager will only deliver alerts when new vulnerabilities are detected in agents or when they stop applying.
- โ Added a mechanism to ensure the worker synchronization permissions is reset after a fixed period of time. (#11031)
- Included mechanism to create and handle PID files for each child process of the API and cluster. (#11799)
- โ Added support for Windows 11 in Vulnerability Detector. (#12446)
๐ Changed
- ๐ Changed the internal handling of agent keys in Remoted and Remoted to speed up key reloading. (#8083)
- ๐ The option
<server>
of the Syslog output now supports hostname resolution. (#7885) - The product's UNIX user and group have been renamed to "wazuh". (#7763)
- The MITRE database has been redesigned to provide full and searchable data. (#7865)
- The static fields related to FIM have been ported to dynamic fields in Analysisd. (7358)
- ๐ Changed all randomly generated IDs used for cluster tasks. Now,
uuid4
is used to ensure IDs are not repeated. (8351) - ๐ Improved sendsync error log to provide more details of the used parameters. (#8873)
- ๐ Changed
walk_dir
function to be iterative instead of recursive. (#9708) - ๐จ Refactored Integrity sync behavior so that new synchronizations do not start until extra-valid files are processed. (#10183)
- ๐ Changed cluster synchronization, now the content of the
etc/shared
folder is synchronized. (#10101) - ๐ Changed all XML file loads. Now,
defusedxml
library is used to avoid possible XML-based attacks. (8351) - ๐ Changed configuration validation from execq socket to com socket. (#8535)
- โก๏ธ Updated utils unittest to improve process_array function coverage. (#8392)
- ๐ Changed
request_slice
calculation to improve efficiency when accessing wazuh-db data. (#8885) - ๐ Improved the retrieval of information from
wazuh-db
so it reaches the optimum size in a single iteration. (#9273) - โก๏ธ Optimized the way framework uses context cached functions and added a note on context_cached docstring. (#9234)
- ๐ Improved framework regexes to be more specific and less vulnerable. (#9332)
- Unified framework exceptions for non-active agents. (#9423)
- ๐ Changed RBAC policies to case insensitive. (#9433)
- ๐จ Refactored framework stats module into SDK and core components to comply with Wazuh framework code standards. (#9548)
- โฌ๏ธ Changed the size of the agents chunks sent to the upgrade socket to make the upgrade endpoints faster. (#10309)
- ๐จ Refactored rootcheck and syscheck SDK code to make it clearer. (#9408)
- ๐ Adapted Azure-logs module to use Microsoft Graph API instead of Active Directory Graph API. (#9738)
- Analysisd now reconnects to Active Response if Remoted or Execd get restarted. (#8060)
- ๐ Agent key polling now supports cluster environments. (#10335)
- ๐ Extended support of Vulnerability Detector for Debian 11 (Bullseye). (#10357)
- ๐ Improved Remoted performance with an agent TCP connection sending queue. (#10326)
- ๐ Agent DB synchronization has been boosted by caching the last data checksum in Wazuh DB. (#9093)
- โ Logtest now scans new ruleset files when loading a new session. (#8892)
- CVE alerts by Vulnerability Detector now include the time of detection, severity, and score. (#8237)
- ๐ Fixed manager startup when
<database_output>
is enabled. (#10849) - ๐ Improved cluster performance using multiprocessing.
- Changed the cluster
local_integrity
task to run in a separate process to improve overall performance. (#10767) - The cluster communication with the database for agent information synchronization runs in a parallel separate process. (#10807)
- The cluster processing of the extra-valid files in the master node is carried out in a parallel separate process. (#10920)
- The cluster's file compression task in the master node is carried out in a parallel separate process. (#11328)
- Now the processing of Integrity files in worker nodes is carried out in a parallel separate process (#11364)
- Use cluster and API single processing when the wazuh user doesn't have permissions to access
/dev/shm
. (#11386)
- Changed the cluster
- ๐ Changed the Ubuntu OVAL feed URL to security-metadata.canonical.com. (#12491)
- Let Analysisd warn about missing rule dependencies instead of rejecting the ruleset. (#12652)
๐ Fixed
- ๐ Fixed a memory defect in Remoted when closing connection handles. (#8223)
- ๐ Fixed a timing problem in the manager that might prevent Analysisd from sending Active responses to agents. (#7625)
- ๐ Fixed a bug in Analysisd that did not apply field lookup in rules that overwrite other ones. (#8210)
- Prevented the manager from leaving dangling agent database files. (#8902)
- Corrected remediation message for error code 6004. (#8254)
- ๐ Fixed a bug when deleting non-existing users or roles in the security SDK. (#8157)
- ๐ Fixed a bug with
agent.conf
file permissions when creating an agent group. (#8418) - ๐ Fixed wrong exceptions with wdb pagination mechanism. (#8422)
- ๐ Fixed error when loading some rules with the
\
character. (#8747) - ๐ Changed
WazuhDBQuery
class to properly close socket connections and prevent file descriptor leaks. (#9216) - ๐ Fixed error in the api configuration when using the
agent_upgrade
script. (#10320) - ๐ Handle
JSONDecodeError
in Distributed API class methods. (#10341) - ๐ Fixed an issue with duplicated logs in Azure-logs module and applied several improvements to it. (#9738)
- ๐ Fixed the query parameter validation to allow usage of special chars in Azure module. (#10680)
- ๐ Fix a bug running wazuh-clusterd process when it was already running. (#8394)
- ๐ Allow cluster to send and receive messages with size higher than request_chunk. (#8732)
- ๐ Fixed a bug that caused
wazuh-clusterd
process to not delete its pidfile when running in foreground mode and it is stopped. (#9077) - ๐ Fixed race condition due to lack of atomicity in the cluster synchronization mechanism. (#10376)
- ๐ Fixed bug when displaying the dates of the cluster tasks that have not finished yet. Now
n/a
is displayed in these cases. (#10492) - ๐ Fixed missing field
value_type
in FIM alerts. (#9196) - ๐ Fixed a typo in the SSH Integrity Check script for Agentless. (#9292)
- ๐ Fixed multiple race conditions in Remoted. (#10421)
- ๐ The manager's agent database has been fixed to prevent dangling entries from removed agents. (#10390)
- ๐ Fixed the alerts generated by FIM when a lookup operation on an SID fails. (#9765)
- ๐ Fixed a bug that caused cluster agent-groups files to be synchronized multiple times unnecessarily. (#10866)
- ๐ Fixed an issue in Wazuh DB that compiled the SQL statements multiple times unnecessarily. (#10922)
- ๐ Fixed a crash in Analysisd when setting Active Response with agent_id = 0. (#10948)
- ๐ Fixed an uninitialized Blowfish encryption structure warning. (#11161)
- ๐ Fixed a memory overrun hazard in Vulnerability Detector. (#11262)
- ๐ Fixed a bug when using a limit parameter higher than the total number of objects in the wazuh-db queries. (#11282)
- Prevented a false positive for MySQL in Vulnerability Detector. (#11440)
- ๐ Fixed segmentation fault in Analysisd when setting the number of queues to zero. (#11448)
- ๐ Fixed false positives in Vulnerability Detector when scanning OVAl for Ubuntu Xenial and Bionic. (#11440)
- ๐ Fixed an argument injection hazard in the Pagerduty integration script. Reported by Jose Maria Zaragoza (@JoseMariaZ). (#11835)
- ๐ Fixed memory leaks in the feed parser at Vulnerability Detector. (#11863)
- Architecture data member from the RHEL 5 feed.
- RHSA items containing no CVEs.
- Unused RHSA data member when parsing Debian feeds.
- ๐ฆ Prevented Authd from exiting due to a pipe signal if Wazuh DB gets closed. (#12368)
- ๐ Fixed a buffer handling bug in Remoted that left the syslog TCP server stuck. (#12415)
- ๐ Fixed a memory leak in Vulnerability Detector when discarding kernel packages. (#12644)
- ๐ Fixed a memory leak at wazuh-logtest-legacy when matching a level-0 rule. (#12655)
- ๐ Fixed a bug in the Vulnerability Detector CPE helper that may lead to produce false positives about Firefox ESR. (#13067)
โ Removed
- ๐ The data reporting for Rootcheck scans in the agent_control tool has been deprecated. (#8399)
- โ Removed old framework functions used to calculate agent status. (#8846)
Agent
โ Added
- โ Added an option to allow the agent to refresh the connection to the manager. (#8016)
- ๐ Introduced a new module to collect audit logs from GitHub. (#8532)
- ๐ FIM now expands wildcarded paths in the configuration on Windows agents. (8461)
- FIM reloads wildcarded paths on full scans. (8754)
- โ Added new
path_suffix
option to AWS module configuration. (#8306) - โ Added new
discard_regex
option to AWS module configuration. (8331) - โ Added support for the S3 Server Access bucket type in AWS module. (#8482)
- โ Added support for Google Cloud Storage buckets using a new GCP module called
gcp-bucket
. (#9119) - โ Added support for VPC endpoints in AWS module. (#9420)
- โ Added support for GCS access logs in the GCP module. (#9279)
- โ Added an iam role session duration parameter to AWS module. (#10198)
- โ Added support for variables in SCA policies. (#8826)
- ๐ FIM now fills an audit rule file to support who-data although Audit is in immutable mode. (#7721)
- ๐ Introduced an integration to collect audit logs from Office365. (#8957)
- โ Added a new field
DisplayVersion
to Syscollector to help Vulnerability Detector match vulnerabilities for Windows. (#10168) - โ Added support for macOS agent upgrade via WPK. (#10148)
- โ Added Logcollector support for macOS logs (Unified Logging System). (#8632)
๐ Changed
- The agent now reports the version of the running AIX operating system to the manager. (#8381)
- ๐ Improved the reliability of the user ID parsing in FIM who-data mode on Linux. (#8604)
- ๐ Extended support of Logcollector for MySQL 4.7 logs. Thanks to @YoyaYOSHIDA. (#5047)
- Agents running on FreeBSD and OpenBSD now report their IP address. (#9887)
- โฌ๏ธ Reduced verbosity of FIM debugging logs. (#8202)
- The agent's IP resolution frequency has been limited to prevent high CPU load. (#9992)
- โก๏ธ Syscollector has been optimized to use lees memory. (#10236)
- โ Added support of ZscalerOS system information in the agent. (#10337)
- ๐ Syscollector has been extended to collect missing Microsoft product hotfixes. (#10259)
- โก๏ธ Updated the osquery integration to find the new osqueryd location as of version 5.0. (#10396)
- The internal FIM data handling has been simplified to find files by their path instead of their inode. (#9123)
- ๐ Reimplemented the WPK installer rollback on Windows. (#9764)
- ๐ Active responses for Windows agents now support native fields from Eventchannel. (#10208)
- ๐ Error logs by Logcollector when a file is missing have been changed to info logs. (#10651)
- ๐ The agent MSI installer for Windows now detects the platform version to install the default configuration. (#8724)
- ๐ Agent logs for inability to resolve the manager hostname now have info level. (#3659)
- โ Added ID number to connection enrollment logs. (#11276)
- ๐ Standardized the use of the
only_logs_after
parameter in the external integration modules. (#10838) - โก๏ธ Updated DockerListener integration shebang to python3 for Wazuh agents. (#12150)
- โก๏ธ Updated the Windows installer ico and png assets to the new logo. (#12779)
๐ Fixed
- ๐ Fixed a bug in FIM that did not allow monitoring new directories in real-time mode if the limit was reached at some point. (#8784)
- ๐ Fixed a bug in FIM that threw an error when a query to the internal database returned no data. (#8941)
- ๐ Fixed an error where the IP address was being returned along with the port for Amazon NLB service.(#8362)
- ๐ Fixed AWS module to properly handle the exception raised when processing a folder without logs. (#8372
- ๐ Fixed a bug with AWS module when pagination is needed in the bucket. (#8433)
- ๐ Fixed an error with the ipGeoLocation field in AWS Macie logs. (#8672)
- ๐ Changed an incorrect debug message in the GCloud integration module. (#10333)
- ๐ Data race conditions have been fixed in FIM. (#7848)
- ๐ Fixed wrong command line display in the Syscollector process report on Windows. (#10011)
- Prevented Modulesd from freezing if Analysisd or Agentd get stopped before it. (#10249)
- ๐ Fixed wrong keepalive message from the agent when file merged.mg is missing. (#10405)
- ๐ Fixed missing logs from the Windows agent when it's getting stopped. (#10381)
- ๐ Fixed missing packages reporting in Syscollector for macOS due to empty architecture data. (#10524)
- ๐ Fixed FIM on Linux to parse audit rules with multiple keys for who-data. (#7506)
- ๐ Fixed Windows 11 version collection in the agent. (#10639)
- ๐ Fixed missing Eventchannel location in Logcollector configuration reporting. (#10602)
- โก๏ธ Updated CloudWatch Logs integration to avoid crashing when AWS raises Throttling errors. (#10794)
- ๐ Fixed AWS modules' log file filtering when there are logs with and without a prefix mixed in a bucket. (#10718)
- ๐ Fixed a bug on the installation script that made upgrades not to update the code of the external integration modules. (#10884)
- ๐ Fixed issue with AWS integration module trying to parse manually created folders as if they were files. (#10921)
- ๐ Fixed installation errors in OS with no subversion. (#11086)
- ๐ Fixed a typo in an error log about enrollment SSL certificate. (#11115)
- ๐ Fixed unit tests for Windows agent when built on MinGW 10. (#11121)
- ๐ Fixed Windows agent compilation warnings. (#10942)
- ๐ Fixed the OS version reported by the agent on OpenSUSE Tumbleweed. (#11207)
- ๐ง Prevented Syscollector from truncating the open port inode numbers on Linux. (#11329)
- ๐ Fixed agent auto-restart on configuration changes when started via
wazuh-control
on a Systemd based Linux OS. (#11365) - ๐ Fixed a bug in the AWS module resulting in unnecessary API calls when trying to obtain the different Account IDs for the bucket. (#10952)
- ๐ Fixed Azure integration's configuration parsing to allow omitting optional parameters. (#11278)
- ๐ Fixed Azure Storage credentials validation bug. (#11296)
- ๐ Fixed the read of the hostname in the installation process for openSUSE. (#11455)
- ๐ Fixed the graceful shutdown when agent loses connection. (#11425)
- ๐ Fixed error "Unable to set server IP address" on the Windows agent. (#11736)
- ๐ Fixed reparse option in the AWS VPCFlow and Config integrations. (#11608)
- โ Removed unnecessary calls to the AWS API made by the VPCFlow and Config integration modules. (#11644)
- ๐ Fixed how the AWS Config module parses the dates used to request logs from AWS. (#12324)
- ๐ Let Logcollector audit format parse logs with a custom name_format. (#12676)
- ๐ Fixed Agent bootstrap issue that might lead to startup timeout when it cannot resolve a manager hostname. (#12704)
- ๐ Fixed a bug in the agent's leaky bucket throughput regulator that could leave it stuck if the time is advanced on Windows. (#13088)
โ Removed
- โ Removed oscap module files as it was already deprecated since v4.0.0. (#10900)
RESTful API
โ Added
- โ Added new
PUT /agents/reconnect
endpoint to force agents reconnection to the manager. (#7988) - โ Added
select
parameter to theGET /security/users
,GET /security/roles
,GET /security/rules
andGET /security/policies
endpoints. (#6761) - โ Added type and status filters to
GET /vulnerability/{agent_id}
endpoint. (#8100) - โ Added an option to configure SSL ciphers. (#7490)
- โ Added an option to configure the maximum response time of the API. (#8919)
- โ Added new
DELETE /rootcheck/{agent_id}
endpoint. (#8945) - Added new
GET /vulnerability/{agent_id}/last_scan
endpoint to check the latest vulnerability scan of an agent. (#9028) - โ Added new
cvss
andseverity
fields and filters toGET /vulnerability/{agent_id}
endpoint. (#9028) - โ Added an option to configure the maximum allowed API upload size. (#9100)
- โ Added new unit and integration tests for API models. (#9142)
- โ Added message with the PID of
wazuh-apid
process when launched in foreground mode. (#9077) - โ Added
external id
,source
andurl
to the MITRE endpoints responses. (#9144) - โ Added custom healthchecks for legacy agents in API integration tests, improving maintainability. (#9297)
- โ Added new unit tests for the API python module to increase coverage. (#9914)
- โ Added docker logs separately in API integration tests environment to get cleaner reports. (#10238)
- โ Added new
disconnection_time
field toGET /agents
response. (#10437) - โ Added new filters to agents upgrade endpoints. (#10457)
- โ Added new API endpoints to access all the MITRE information. (#8288)
- ๐ Show agent-info permissions flag when using cluster_control and in the
GET /cluster/healthcheck
API endpoint. (#10947) - ๐พ Save agents' ossec.log if an API integration test fails. (#11931)
- โ Added
POST /security/user/authenticate/run_as
endpoint to API bruteforce blocking system. (#12085) - โ Added new API endpoint to obtain summaries of agent vulnerabilities' inventory items. (#12638)
- โก๏ธ Added fields external_references, condition, title, published and updated to GET /vulnerability/{agent_id} API endpoint. (#12727)
- โ Added the possibility to include strings in brackets in values of the
q
parameter. (#13262)
๐ Changed
- ๐ง Renamed SSL protocol configuration parameter. (#7490)
- โก๏ธ Reviewed and updated API spec examples and JSON body examples. (#8827)
- ๐ Improved the performance of several API endpoints. This is specially appreciable in environments with a big number of agents.
- Improved
PUT /agents/group
endpoint. (#8937) - Improved
PUT /agents/restart
endpoint. (#8938) - Improved
DELETE /agents
endpoint. (#8950) - Improved
PUT /rootcheck
endpoint. (#8959) - Improved
PUT /syscheck
endpoint. (#8966) - Improved
DELETE /groups
endpoint and changed API response to be more consistent. (#9046)
- Improved
- ๐ Changed
DELETE /rootcheck
endpoint toDELETE /experimental/rootcheck
. (#8945) - โฌ๏ธ Reduced the time it takes for
wazuh-apid
process to check its configuration when using the-t
parameter. (#9012) - ๐ Fixed malfunction in the
sort
parameter of syscollector endpoints. (#9019) - ๐ Improved API integration tests stability when failing in entrypoint. (#9113)
- โ Made SCA API integration tests dynamic to validate responses coming from any agent version. (#9228)
- ๐จ Refactored and standardized all the date fields in the API responses to use ISO8601. (#9227)
- โ Removed
Server
header from API HTTP responses. (#9263) - ๐ Improved JWT implementation by replacing HS256 signing algorithm with RS256. (#9371)
- โ Removed limit of agents to upgrade using the API upgrade endpoints. (#10009)
- ๐ Changed Windows agents FIM responses to return permissions as JSON. (#10158)
- Adapted API endpoints to changes in
wazuh-authd
daemonforce
parameter. (#10389) - Deprecated
use_only_authd
API configuration option and related functionality.wazuh-authd
will always be required for creating and removing agents. (#10512) - ๐ Improved API validators and related unit tests. (#10745)
- ๐ Improved specific module healthchecks in API integration tests environment. (#10905)
- ๐ Changed thread pool executors for process pool executors to improve API availability. (#10916)
- ๐ Changed HTTPS options to use files instead of relative paths. (#11410)
๐ Fixed
- ๐ Fixed inconsistency in RBAC resources for
group:create
,decoders:update
, andrules:update
actions. (#8196) - ๐ Fixed the handling of an API error message occurring when Wazuh is started with a wrong
ossec.conf
. Now the execution continues and raises a warning. (8378) - ๐ Fixed a bug with
sort
parameter that caused a wrong response when sorting by several fields.(#8548) - ๐ Fixed the description of
force_time
parameter in the API spec reference. (#8597) - ๐ Fixed API incorrect path in remediation message when maximum number of requests per minute is reached. (#8537)
- ๐ Fixed agents' healthcheck error in the API integration test environment. (#9071)
- ๐ Fixed a bug with
wazuh-apid
process handling of pidfiles when running in foreground mode. (#9077) - ๐ Fixed a bug with RBAC
group_id
matching. (#9192) - โ Removed temporal development keys and values from
GET /cluster/healthcheck
response. (#9147) - ๐ Fixed several errors when filtering by dates. (#9227)
- ๐ Fixed limit in some endpoints like
PUT /agents/group/{group_id}/restart
and added a pagination method. (#9262) - ๐ Fixed bug with the
search
parameter resulting in invalid results. (#9320) - ๐ Fixed wrong values of
external_id
field in MITRE resources. (#9368) - ๐ Fixed how the API integration testing environment checks that
wazuh-apid
daemon is running before starting the tests. (#9399) - โ Add healthcheck to verify that
logcollector
stats are ready before starting the API integration test. (#9777) - ๐ Fixed API integration test healthcheck used in the
vulnerability
test cases. (#10159) - ๐ Fixed an error with
PUT /agents/node/{node_id}/restart
endpoint when no agents are present in selected node. (#10179) - ๐ Fixed RBAC experimental API integration tests expecting a 1760 code in implicit requests. (#10322)
- ๐ Fixed cluster race condition that caused API integration test to randomly fail. (#10289)
- ๐ Fixed
PUT /agents/node/{node_id}/restart
endpoint to exclude exception codes properly. (#10619) - ๐ Fixed
PUT /agents/group/{group_id}/restart
endpoint to exclude exception codes properly. (#10666) - ๐ Fixed agent endpoints
q
parameter to allow more operators when filtering by groups. (#10656) - ๐ Fixed API integration tests related to rule, decoder and task endpoints. (#10830)
- ๐ Improved exceptions handling when starting the Wazuh API service. (#11411)
- ๐ Fixed race condition while creating RBAC database. (#11598)
- ๐ Fixed API integration tests failures caused by race conditions. (#12102)
โ Removed
- โ Removed select parameter from GET /agents/stats/distinct endpoint. (#8599)
- โ Removed
GET /mitre
endpoint. (#8099) - ๐ง Deprecated the option to set log
path
in the configuration. (#11410)
Ruleset
โ Added
- โ Added Carbanak detection rules. (#11306)
- โ Added Cisco FTD rules and decoders. (#11309)
- โ Added decoders for AWS EKS service. (#11284)
- โ Added F5 BIG IP ruleset. (#11394)
- โ Added GCP VPC Storage, Firewall and Flow rules. (#11191)
- โ Added Gitlab v12 ruleset. (#11323)
- โ Added Microsoft Exchange Server rules and decoders. (#11289)
- โ Added Microsoft Windows persistence by using registry keys detection. (#11390)
- โ Added Oracle Database 12c rules and decoders. (#11274)
- โ Added rules for Carbanak step 1.A - User Execution: Malicious File. (#8476)
- โ Added rules for Carbanak step 2.A - Local Discovery. (#11212)
- โ Added rules for Carbanak step 2.B - Screen Capture. (#9075)
- โ Added rules for Carbanak step 5.B - Lateral Movement via SSH. (#9097)
- โ Added rules for Carbanak step 9.A - User Monitoring. (#11342)
- โ Added rules for Cloudflare WAF. (#11373)
- โ Added ruleset for ESET Remote console. (#11013)
- โ Added ruleset for GITHUB audit logs. (#8532)
- โ Added ruleset for Palo Alto v8.X - v10.X. (#11137)
- โ Added SCA policy for Amazon Linux 1. (#11431)
- โ Added SCA policy for Amazon Linux 2. (#11480)
- โ Added SCA policy for apple macOS 10.14 Mojave. (#7035)
- โ Added SCA policy for apple macOS 10.15 Catalina. (#7036)
- โ Added SCA policy for macOS Big Sur. (#11454)
- โ Added SCA policy for Microsoft IIS 10. (#11250)
- โ Added SCA policy for Microsoft SQL 2016. (#11249)
- โ Added SCA policy for Mongo Database 3.6. (#11247)
- โ Added SCA policy for NGINX. (#11248)
- โ Added SCA policy for Oracle Database 19c. (#11245)
- โ Added SCA policy for PostgreSQL 13. (#11154)
- โ Added SCA policy for SUSE Linux Enterprise Server 15. (#11223)
- โ Added SCA policy for Ubuntu 14. (#11432)
- โ Added SCA policy for Ubuntu 16. (#11452)
- โ Added SCA policy for Ubuntu 18. (#11453)
- โ Added SCA policy for Ubuntu 20. (#11430)
- โ Added SCA policy for. Solaris 11.4. (#11286)
- โ Added Sophos UTM Firewall ruleset. (#11122)
- โ Added Wazuh-api ruleset. (#11357)
๐ Changed
- โก๏ธ Updated audit rules. (#11016)
- โก๏ธ Updated AWS s3 ruleset. (#11177)
- โก๏ธ Updated Exim 4 decoder and rules to latest format. (#11344)
- โก๏ธ Updated MITRE DB with latest MITRE JSON specification. (#8738)
- Updated multiple rules to remove alert_by_email option. (#11255)
- โก๏ธ Updated NextCloud ruleset. (#11795)
- โก๏ธ Updated ProFTPD decoder. (#11232)
- โก๏ธ Updated RedHat Enterprise Linux 8 SCA up to version 1.0.1. (#11242)
- โก๏ธ Updated rules and decoders for FortiNet products. (#11100)
- โก๏ธ Updated SCA policy for CentOS 7. (#11429)
- โก๏ธ Updated SCA policy for CentOS 8. (#8751)
- โก๏ธ Updated SonicWall rules decoder. (#11263)
- โก๏ธ Updated SSHD ruleset. (#11388)
- ๐ From file 0580-win-security_rules.xml, rules with id 60198 and 60199 are moved to file 0585-win-application_rules.xml, with rule ids 61071 and 61072 respectively. (#8552)
๐ Fixed
- ๐ Fixed bad character on rules 60908 and 60884 - win-application rules. (#11117)
- ๐ Fixed Microsoft logs rules. (#11369)
- ๐ Fixed PHP rules for MITRE and groups. (#11405)
- ๐ Fixed rules id for Microsoft Windows Powershell. (#11214)
Other
๐ Changed
- โฌ๏ธ Upgraded external SQLite library dependency version to 3.36. (#10247)
- โฌ๏ธ Upgraded external BerkeleyDB library dependency version to 18.1.40. (#10247)
- โฌ๏ธ Upgraded external OpenSSL library dependency version to 1.1.1l. (#10247)
- โฌ๏ธ Upgraded external Google Test library dependency version to 1.11. (#10927)
- โฌ๏ธ Upgraded external Aiohttp library dependency version to 3.8.1. ([11436]([https://github.com/wazuh/wazuh/pull/11436))
- โฌ๏ธ Upgraded external Werkzeug library dependency version to 2.0.2. ([11436]([https://github.com/wazuh/wazuh/pull/11436))
- โฌ๏ธ Upgraded embedded Python version to 3.9.9. ([11436]([https://github.com/wazuh/wazuh/pull/11436))
๐ Fixed
- ๐ Fixed error detection in the CURL helper library. (#9168)
- ๐ Fixed external BerkeleyDB library support for GCC 11. (#10899)
- ๐ Fixed an installation error due to missing OS minor version on CentOS Stream. (#11086)
- ๐ Fixed an installation error due to missing command
hostname
on OpenSUSE Tumbleweed. (#11455)