Download the ISO
What's Changed
- Bump version from 3.3.0 to 3.4.0 by @TOoSmOotH in #16216
- /login is showing an nginx failure by @jertel in #16225
- fix location typo by @jertel in #16229
- filterEventFields by @coreyogburn in #16236
- Hotfix/3.3.0 by @TOoSmOotH in #16239
- Remove outdated HOTFIX version number by @TOoSmOotH in #16240
- stop Zeek gracefully preventing post-terminate logs by @m0duspwnens in #16242
- FIX: prevent so-sensor-clean runaway loop and concurrent instances by @m0duspwnens in #16243
- Fix/so minion install vars by @m0duspwnens in #16246
- FIX: suricata.fileinfo maps boolean gaps into long file.bytes.missing by @dougburks in #16249
- FIX: root-own /usr/sbin management scripts and the Salt default tree by @m0duspwnens in #16250
- Refactor for ESQL by @defensivedepth in #16247
- notification annotations by @jertel in #16251
- Isolate the Kratos admin API on a dedicated soauth docker network by @TOoSmOotH in #16221
- store in db by @jertel in #16252
- Fix config tree error from the docker.networks setting by @TOoSmOotH in #16253
- Fix user creation failing with a valid password by @TOoSmOotH in #16255
- upgrade whoislookup analyzer deps; notification annotations by @jertel in #16258
- FIX: Fleet scripts failing when endpoints-initial is missing by @reyesj2 in #16260
- Add openai_embeddings to the YAML configuration by @TOoSmOotH in #16262
- FIX: use /sbin/nologin for service accounts by @m0duspwnens in #16263
- Metric alarms and more NTF annotations by @jertel in #16264
- FIX: remove the docker socket from so-telegraf by @m0duspwnens in #16261
- resolve startup errors by @jertel in #16267
- Raise SOAI Sonnet default small context limit to 1M by @TOoSmOotH in #16266
- New Automation Fields by @coreyogburn in #16270
- review integration-defaults weird_integrations mappings, removed unus… by @reyesj2 in #16275
- support empty yaml files by @jertel in #16277
- Unified Automations by @coreyogburn in #16280
- upgrade docker 29.8.1 and containerd 2.3.6 by @m0duspwnens in #16286
- caseless for non-Defend sources by @defensivedepth in #16279
- EVTX Import cleanup by @defensivedepth in #16278
- Move Sigma pipelines into a managed directory by @defensivedepth in #16287
- Fix/auto apply state queue by @m0duspwnens in #16274
- Revert "Fix/auto apply state queue" by @m0duspwnens in #16297
- update tick interval desc by @jertel in #16300
- ES 9.4.8 by @reyesj2 in #16306
- new destination timeout annotation; fix fp by @jertel in #16310
- regenerate elastic agent installer by @reyesj2 in #16311
- Add allowExternalMarkdownImages SOC Setting by @mc-wright in #16312
- Map the AlertTriage and Notifier agents to a model by @TOoSmOotH in #16301
- Add Claude Haiku to the SOAI assistant models by @TOoSmOotH in #16315
- Initial Correlations support by @defensivedepth in #16269
- eval to use Suricata for metadata by @jertel in #16317
- remap enterprisesearch integration components by @reyesj2 in #16319
- combine default and availableModels added via pillar by @m0duspwnens in #16322
- Add a licensed Group By Assessment, Name alerts query by @TOoSmOotH in #16302
- Remove the Notifier agent mapping by @TOoSmOotH in #16323
- combine default and alerts queries added via pillar by @m0duspwnens in #16328
- Add readonly attribute to earliest alert time field by @TOoSmOotH in #16331
- Change readonly to readonlyUi in YAML configuration by @TOoSmOotH in #16332
- Automation Turn Timeout by @coreyogburn in #16333
- Refactor correlation template by @defensivedepth in #16335
- analyzer dep updates by @jertel in #16341
- Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir by @m0duspwnens in #16350
- fix false positive scan results by @jertel in #16351
- Add custom_bind_mounts to so-kafka and so-soc by @m0duspwnens in #16356
- Use the host CA trust store, with the grid CA, for all containers by @TOoSmOotH in #16357
- Remove unused elasticsearch.p12/sokeys keystore by @TOoSmOotH in #16354
- New Configurable Timeouts for Detection Engine Syncs by @coreyogburn in #16358
- switch analyzer deps to py 314 by @jertel in #16361
Full Changelog: 3.3.0-20260911...3.4.0-20261102