Changes
New Features
Improvements
- exprhelpers: LookupHost goes through the DNS cache (#4741) @twiesing
- metrics: add CAPI last pull timestamp and error counter (#4749) @NazarkinRoman
- add cscli bot subcommand (#4666) @blotus
- prometheus: add kind label to cs_alerts (#4742) @blotus
- lapi: make decisions stream page size configurable (#4733) @tommy-ng0
- Fix ValidateChallengeResponse (#4737) @buixor
- grok: only keep capture groups that can be accessed in evt.Parsed (#4736) @blotus
- grokky : preshot static strings (#4731) @buixor, @Copilot
- grokky : ParseInto (#4729) @buixor
- bot-detection: add new FlagSubmission() helper (#4727) @blotus
- appsec: add an optional category to the request score (#4715) @buixor
- apiserver: reload the TLS server certificate when its files change (#4709) @ohartwig
- fix image link (#4702) @buixor
- waf: add SkipProcessing() helper (#4667) @blotus
- [bot-detection] drop the URI from the cookie (#4656) @buixor
Bug Fixes
- waf: fix log spam when usin unix socket on freebsd (#4745) @blotus
- docker: read from now if container restarts (#4605) @blotus
- splunk-notification: add an option to configure InsecureSkipVerify (#4720) @blotus
- victorialogs: move the datasource to RestartableStreamer interface (#4738) @blotus
- metrics: remove series of deleted machines and bouncers (#4712) @somaz94
- postoverflow: run them in a goroutine to not block writers, enforce max in-flight alerts, and warn if queue is becoming too full (#4672) @blotus
- buckets: make a copy of all event maps before pouring the event to a bucket (#4481) @blotus
- fix(database): keep simulated decisions from suppressing real bans (#4679) @4erdenko, @blotus
- fix a nasty bug in transfrom where the effective uuid for a datasource (#4697) @sabban
- hubtest: add a tiebreaker based on the alert date to have a consistent order (#4699) @blotus
- challenge: optimize memory usage (#4674) @blotus
- syslog: copy buffer before handing it to the datasource (#4690) @blotus
- Expand env vars in online_api_credentials.yaml (#4677) @kushiemoon-dev
Chore / Deps
- waf: update to coraza 3.8.0 (#4724) @blotus, @buixor
- build(deps): bump the gomod group across 1 directory with 19 updates (#4730) @dependabot[bot]
- CI: skip more docker tests on windows (#4728) @blotus
- grok: embed grok library instead of having it as a dep (#4725) @blotus
- docker datasource: skip tests on windows (#4719) @blotus
- agents.md: keep comments to a reasonable level (#4716) @blotus
- build(deps): bump the github-actions group with 7 updates (#4693) @dependabot[bot]
- build(deps): bump the gomod group with 11 updates (#4694) @dependabot[bot]
- build(deps): bump github.com/go-openapi/validate from 0.26.5 to 1.0.0 (#4682) @dependabot[bot]
- build(deps): bump the gomod group with 19 updates (#4681) @dependabot[bot]
- build(deps): bump cryptography from 48.0.1 to 50.0.0 in /build/docker/test (#4591) @dependabot[bot]
- bump to go 1.27 (#4675) @blotus
- build(deps): bump the github-actions group across 1 directory with 3 updates (#4658) @dependabot[bot]
- build(deps): bump the gomod group across 1 directory with 21 updates (#4659) @dependabot[bot]
Geolite2 notice
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Installation
Take a look at the installation instructions.