CybercentreCanada/assemblyline v4.6.0.stable0

Release 4.6.0.0

on GitHub

BREAKING CHANGES: Updating to this version will require a reindexing of data for the system to be completely stable. We advise scheduling an outage for your existing deployment prior to performing an upgrade to 4.6. To reindex the data post-upgrade, you can run the index reindex command from the Assemblyline CLI (python -m assemblyline.run.cli)

Major Changes:

• Submission Profiles
  • This allows for simpler submission processes where only providing the profile name is necessary and adjusting the parameters is secondary
  • Users are allowed to configure each profile within the guidelines defined by the administrator
• API Key Management (#202)
  • This allows for an overview of all API keys created system-wide in a common management interface
  • This has the option of enforcing a rotation of API keys set by a configuration at the administrative-level
• Index Mappings (#331)
  • This will include changes such as changing fields from integers to longs to be able to store larger numerical values (ie. file size)
  • This also includes the addition of the wildcard field type which should make performing *term* a lot more faster

Additions

• technique.exploit tag has been added (#336)
• Expand on URL refang techniques
• Update internal ATT&CK and TLD data for platform

Bugfixes

• Ingestions that are deleted shouldn't return cached results (#335)
• Correct method for retrieving user roles via SAML authentication
• Fixes to Error Viewer
• Fixes related to Partial Results

Deprecations

• The following configurations are deprecated:
  • core.scaler.service_defaults.mounts.configmap & key
    • Alternative: Use resource_type: configmap and fill in the resource_name & resource_key fields to mount ConfigMaps
  • ui.ai
    • Alternative: ui.ai_backends
• The following submission parameters are deprecated:
  • ignore_dynamic_recursion_prevention
    • Alternative: ignore_recursion_prevention