For full documentation and setup guides, visit insightsplus.dev/docs.
Stability
- Fixed a remote denial of service. A single malformed syslog packet, such as one with an impossible timestamp, could crash the log receiver and lose the logs buffered at that moment. Malformed packets are now counted and dropped, and a failure while enriching a log keeps the log instead of discarding it. Reported and fixed by @OhJayGee (#110, PR #111).
- Bounded warning volume. Warnings caused by bad packets are now rate limited so a flood of garbage cannot fill the container log; suppressed counts are reported in the receiver heartbeat.
GeoIP
- Scheduled MaxMind updates work again. The update job never ran because its cron entry was missing the user field. Databases now refresh on Wednesdays and Saturdays at 07:00 container time. Reported and fixed by @jimstrang (#114, PR #115).
Enrichment
- Outbound IPv6 traffic is enriched correctly. GeoIP, ASN and threat data now apply to the remote destination instead of your own client's address, matching IPv4 behaviour. Reported and fixed by @Skalar06 (#134, PR #135).
Firewall Syslog Manager
- Policies without an id no longer fail silently. Some controllers return legacy rules that were not fully migrated to the zone-based firewall without an id. These rules stay visible and keep counting toward the zone matrix, their syslog toggle is disabled with an explanation, a notice above the table links to the troubleshooting guide, and invalid policy ids are rejected before reaching the controller. Reported by @OhJayGee (#112).
- Expanded log entries matched to such a rule now explain why logging cannot be toggled there, with a link to the docs.
- Bulk toggle results no longer lose their verification summary when many updates fail.
- The AI agent (MCP) syslog tool now correctly refuses auto-generated policies and policies without an id.
Documentation
- UniFi Network 10.x prerequisites. New guidance on enabling SIEM Server activity logging under Settings > Integrations > Syslog, which log categories to turn on, and what to do when packets arrive but nothing parses.
UI
- Links inside warning boxes are now readable in the light theme.
Dependencies
- cryptography updated to 48.0.1.