Changelog

v8.0.0

Breaking Changes

  • Full cluster restart required: Rolling upgrades from 7.x to 8.x are not supported. All nodes must be stopped and upgraded together.

  • JVM options location: The file /etc/logserver/jvm.options is now overwritten during upgrades. All custom JVM settings must be placed in /etc/logserver/jvm.options.d/. Heap size moved to /etc/logserver/jvm.options.d/heap-size.options, temporary directory to /etc/logserver/jvm.options.d/tmp-dir.options.

  • Service names: elasticsearch renamed to logserver, kibana to logserver-gui, logstash to logserver-probe. Old names still work with systemctl but journalctl requires the new names.

  • Index compatibility: Indices created on versions older than 7.4.0 must be reindexed or deleted before upgrading. The installer performs an automatic compatibility check.

  • Empowered AI: Forecast and Relationship Mining have been removed.

For detailed upgrade instructions, see Upgrade to Version 8.0.0.

Component Versions

Component

Version

OpenSearch

3.3.2

OpenSearch Dashboards

3.3.0

OpenJDK

21

Python

3.12

Node.js

20.20.2

Wazuh Manager

4.14.2

Wazuh Agent

4.14.2

Logstash-OSS

7.17.29

Beats-OSS

7.17.29

Skimmer

1.0.27

Curator

5.8.4

Cerebro

0.9.4

Upgrades

  • Energy Logserver database upgrade to 3.3.2 - faster engine (newer Lucene + query optimizations), better data compression, optimised for vectors

  • User interface upgrade to version 3.3.0

  • Complete SIEM Engine upgrade to version 4.14.2

  • Complete Network Probe upgrade to version 7.17.29

  • Complete Alerting upgrade to version 2.29.0

  • Support for Beats OSS Agents => 7.17.29

New Features

  • Empowered AI: AI Agent capable of operating on large datasets

  • Empowered AI: Introducing Chapters - datasets for AI Agents

  • Empowered AI: A new Knowledge tab has been added, allowing users to manage knowledge as chapters for AI

  • Empowered AI: Knowledge Chapters can now be created based on data from Discover

  • Empowered AI: Knowledge can now be uploaded as PDF files, creating additional chapters

  • Empowered AI: It is now possible to select multiple knowledge sources called chapters during conversations with the agent

  • Empowered AI: Support for vector storage and semantic search has been implemented

  • Empowered AI: The vectorization job now includes execution time estimation and document throughput tracking

  • Installation: Better support for offline / security zone installs, the installation process supports the –offline switch

  • Scheduler: Scheduled tasks are now audited and have their own history - for Archive, Sync, Index Management modules

Improvements

  • Alert: Ability to include alert fields directly from Discovery for Quick Alert feature

  • Empowered AI: Added an AI On-Prem as provider to the providers list

  • Empowered AI: Added a Run button in the Performance tab

  • Empowered AI: Added cluster statistics for the clustering use case

  • Empowered AI: Added the ability to dismiss notifications about issues with Empowered rule verification

  • Empowered AI: Removed Forecast and Relationship Mining from Empowered AI

  • Empowered AI: Tabs order updated to: Prompts, Knowledge, Providers

  • AI Assistant: AI will create Alert based on semantic meaning of logs

  • AI Assistant: Improved assistant access control: anyone can execute prompts, but only users with admin/intelligence roles can modify them

  • AI Assistant: Improved error handling and user-facing error messages

  • AI Assistant: Preloading prompts for logs

  • AI Assistant: Improved prompts: Explain log and Detect threat

  • AI Assistant: Prompt list sorting improved: editing a prompt no longer changes its position

  • Installation: License verification supports local files and REST API

  • Installation: License will be automatically loaded into product database state

  • Integrations: Improved error handling when activating integration

  • Integrations: Mikrotik integration updated

  • License-Service: Implemented round-robin for accessing many configured hosts (for license verification)

  • Network-Probe: Information about syntax errors directly while editing files

  • Network-Probe: Stopping the service from the GUI prevents the service from auto-starting after the machine reboot

  • Reports: Ability to filter export fields directly from Discovery for Quick Export feature

  • Reports: Graphical reports are now faster and lighter

  • Scheduler: Allows to configure the history period of running job

  • SIEM Engine: New outlook of generated reports

  • Sources Management: Improved presentation of data-sources in the Sources tab

Bug Fixes

  • Alert: Quick Alert - creating an alert incorrectly assigns it to the “Other” group and it is not visible on the Alert list

  • Archive: Restore now recreates metadata if missing

  • Audit: Auditing includes all actions from the Alert and Index-Management modules

  • Empowered AI: Fixed issues with agent performance for MSSP license

  • Index Management: proper handling of too short index_age warning

  • Installation: Improved user initialization process during installation

  • Installation: Support for different line breaks in the license .info file

  • License: In case of expired license added possibility to upload a new one using GUI

  • License: Corrected handling of .info files causes compatibility issues

  • License-Service: Corrected error about a busy port

  • Login: Ldap authenticator - no escaping of special characters in ldapSearch

  • Network-Probe: Corrected file permissions when editing from the GUI

  • Network-Probe: Corrected verification for creating intelligence group in %post

  • Network-Probe: Restored the ability to use the pipeline directive for non-MSSP modes

  • Scheduler: Corrected handling of keystore in logserver-gui

v7.9.0

New Features

  • Empowered AI: AI Assistant - Meet “Prem”, our language model assistant

  • Empowered AI: AI Assistant - work with Energy AI Provider or choose local LLM as AI on Prem

  • Installation: Support for distributions based on Red Hat Enterprise Linux (RHEL) version 9

  • Integrations: Barracuda integration with dedicated dashboard and SIEM alerts

  • Login: The ability to limit the number of users in roles/groups(RBAC) has been introduced

  • new plugin: CMDB! Get a list of all sources connected to SIEM

  • new plugin: CRUD! CRUD indexes can work as internal database with edit and update option. Easy way to enrich SIEM with custom records.

Improvements

  • Agents: Introduced version checking of connected agents

  • Agents: Support for additional configuration files for Integrations plugin

  • Alert: IoC blacklists - support for End of Life (How long an IoC remains useful varies and is dependent on factors including initial confidence level, fragility, and precision)

  • Alert: Visibility of UI elements related to the Alerts/Quick Alert based on user role

  • Empowered AI: Create own AI prompts using buttons available from Discover mode

  • Empowered AI: Simplified installation of Use Cases from the Empowered AI Store - added Advanced mode as an option

  • Index Management: Validation/User Notification: If a user sets the automatic data deletion period to less than 90 days, a warning will be displayed

  • Installation: The base repository is now sufficient for installation, the epel repository is no longer required

  • Integrations: Improved error handling when activating integration

  • Integrations: Unification of categories and names in Integrations and AI Store

  • Reports: Visibility of UI elements related to the Reports/Quick Report based on user role

  • Skimmer: Unification of field names in cluster monitoring metrics

  • Utils: configuration-backup.sh - added missing files: logserver.keystore & license files & empowered-ai configuration

  • Utils: logserver-password-util.sh - default passstore renamed to logserver.keystore

  • Utils: logserver-password-util.sh - improved error handling on missing files

  • Utils: logserver-password-util.sh - support for passwords with special character

Bug Fixes

  • Agents: Cleaning up unnecessary headers accumulating in the .agents index

  • Alert: Problem with discover_url in incidents tab

  • Empowered AI: AI Store - the option to select value for Rareness Threshold in advanced mode has been removed

  • Empowered AI: Anomaly multivariate results - the table does not reset after clicking reset/refresh

  • Empowered AI: API parameters escaping errors

  • Empowered AI: Build time frame and/or start date are set incorrectly by default

  • Empowered AI: Creating alert rules for text anomaly - a flat yaml file is not created with the rule

  • Empowered AI: Creating incidents from anomalies fix

  • Empowered AI: Deleting a rule forgets the page layout and search also sorting and filtering are cleared

  • Empowered AI: Logging of empowered-ai-realtime plugin in Network-Probe

  • Empowered AI: Logrotate configuration for the service (intelligence.log)

  • Empowered AI: Type error for limit_to_values field

  • Index Management: Default schedule cron pattern is incorrect in Rollover policy

  • Index Management: Incorrect handling of verify errors in Rollover policy and custom rules

  • Installation: Errors during installation due to the old cache version in sssd service

  • Integrations: Integration title instead of name in manifest files

  • Integrations: Prepareindex does not work in advanced mode

  • Login: Mapping for .reports and .agents has been added by default

  • Login: Role update for alerts and reports plugins

  • Network-Probe: Security fixes for dependencies: CVE-2025-6442 (webrick), CVE-2025-46727 (rack), CVE-2024-49761 (rexml)

  • Network-Probe: The API for verifying the status of all probes crashes when the registration documents in .networkprobes are malformed

  • Reports: Missing logo in .docx reports

  • Reports: Quick report does not take response from “pending” but from “running” state

  • Reports: The “origin” field in “schedulingData” blocks the creation of scheduled reports for dashboard export

  • SIEM Engine: GUI plugin overwrites the defaultIndex in the user config document

Older versions (v7.8.0 and below) - Click to expand

v7.8.0

New Features

  • Archive: support for retention policy

  • Empowered AI: Online AI Store - get new models from https://energylogserver.com/ai-store/

  • Empowered AI: Online AI Store - integrated into Empowered AI Model Library directly from the system

  • Empowered AI: Online AI Store - AI model is delivered along with Alert definition

  • Empowered AI: Online AI Store - first Use Cases available for Netflow traffic

  • Network-Probe: Ability to create new,custom pipeline from GUI

  • new Plugin Integrations! Ability to manage integrations from GUI

  • new SIEM visualization! Live Threat Globe Map

  • Reports: Data Export Wizard from Discover tab

Improvements

  • Alert: GUI - Default alert method set to NONE [create alert form]

  • Alert: GUI - Deleting multiple alerts at once

  • Alert: GUI - Enabled/disabled popup removed [create alert form]

  • Alert: GUI - Group/Category selection [create alert form]

  • Alert: GUI - No need to save alerts after creating/editing [create/edit alert form]

  • Alert: Performance - fix for Blacklist-IOC Alert Rule

  • Alert: Performance - size in query for aggregation in new_term rule

  • Alert: Playbooks - added pagination & collapse list

  • Empowered AI: Added a rule_name field to the results

  • Empowered AI: Allow aggregations only if they are smaller than the prediction time

  • Empowered AI: Time field taken from index pattern with the possibility of change + validation

  • Network-Probe: Improved misleading message when stopping/starting pipeline

  • Network-Probe: More filter plugins: added cybertrace, ldap, syslog filters

  • Network-Probe: status_refreshing_interval_seconds = 60s as default

  • Network-Probe: translog performance change - threshold_size:1mb, retention.age: 60s

  • Reports: better support for heavy overloaded systems

  • Reports: fully redesigned page for Data Export

  • Reports: saved_search support for Data Export

  • Reports: support for creating report for data without timestamp fields, like list of alerts

  • SIEM Engine: enriched application logs with username person who actively work in user interface

  • SIEM Engine: Documentation available on main screen as link to “Knowledge Base”

  • SIEM Engine: logserver_auth: performance boost - synchronous API replaced by asynchronous API

Bug Fixes

  • Alert: Manual Incident from Discover incorrectly saves discover_url field

  • Alert: no access to the discover_url from the alert by groups other than admin

  • Empowered AI: improvements for Anomaly Alerts in text

  • Empowered AI: Dark theme fix

  • Empowered AI: better doc_count support

  • Empowered AI: Error after opening a rule in a new window when it contains special characters

  • Empowered AI: Improved form for field mapping

  • Empowered AI: No mapping for last_modified field

  • Empowered AI: Sorting ai.anomaly_score and rules table

  • Index Management: Illegal_argument_exception fix

  • Index Management: Prepare_index exception fix

  • Network-Probe: Added support for invalid registration documents

  • Network-Probe: Fix installation of local .gem plugins

  • Network-Probe: Keystore create exception fix

  • Network-Probe: Registration ID should only be returned after the registration document has been successfully created

  • Reports: Index list download for Data Export

  • Reports: Timeout exception when generating Report export

  • Reports: URL in the data export contains an incorrect address/hostname in the sent email

  • SIEM Engine: Data table vis applies wrong filter when sorted

  • SIEM Engine: logserver_auth: hanging of http response when using synchronous client

  • SIEM Engine: patch for CVE-2025-2401 & CVE-2025-24016

  • Task Management: support for universal date format

v7.7.0

New Features

  • Alert: Wizard from Discover tab adds possibility to create alert rules

  • Empowered AI: import and export mechanism of rules

  • Empowered AI: rules as Use Cases with Categories!

  • Integrations: Stormshield integration with dedicated dashboard and SIEM alerts

  • OVA Appliance: base image is now Oracle Linux 8

  • Security: force safe cipher/SSL settings for all Energy Logserver components

Improvements

  • Login: system gain extra stability when running under a data flood state. SIEM will stop indexing before running out of free space. Administrator will be still able to log in and clear unnecessary data.

  • Alert: added warning that changing a rule name affects chain and logical rules

  • Archive: added debug logs that will be saved by default if a task has failed with any error

  • Archive: added verification of the number of restored documents

  • Archive: changed the default archives location to /usr/share/logserver-gui/data/archive/archives/ - breaking change

  • Archive: changed the way the files are recreated - added ‘Recreate missing files’ option [default: false] that verifies if all archived files exist in the archive folder path

  • Archive: extended the functionality of archive verification on demand - integrity is verified, as well as checksum

  • Archive: introduced archive.integrityCheck option [default: true] to verify the integrity of .zstd archive files at the end of the archivization task

  • Archive: optimized the preparation of the archivisation process by checking its document counts and .zstd file size instead of always calculating checksum

  • Empowered AI: ability to immediately stop building/scoring

  • Empowered AI: ability to view AI rule while building/scoring

  • Empowered AI: improvements in anomaly spread graph interactions

  • Empowered AI: information that Univariate works on aggregations

  • Installation: better support for multi-node environments

  • Integrations: updated translate{} syntax to new format

  • Integrations: redesigned welcome screen

  • Network-Probe: clear info about actions that network probe is performing such as enabling pipelines or editing files

  • Network-Probe: option to create label describing probe

  • Network-Probe: option to navigate to pipeline’s files directly from the details section

  • Network-Probe: option to remove installed probe directly from the GUI - probe will be stopped as well as its services

  • Network-Probe: template for .networkprobes index to ensure correct mapping in case of any issues

  • Network-Probe: warning if probe’s local time may be misconfigured

  • Network-Probe: warning when probe version does not match the Energy Logserver SIEM version

  • UBA/UEBA: new, sophisticated dashboards & documenation update

  • Skimmer: updated to v1.0.26

Bug Fixes

  • Alert: does not refresh aliases if roles for selected alerts are updated

  • Alert: fixed discover_url feature

  • Archive: fixed restoration of potentially corrupted archives - if any part of the file has been decompressed then an attempt will be made to upload its parts to the index

  • Archive: issue with not using last_archive_date from archives metadata

  • Empowered AI: progress bar bugfixes

  • Empowered AI: fixed rules get stuck in Scoring status and never end [intelligence-scheduler]

  • Network-Probe: fixed initialization process

  • Network-Probe: fixed not closing managed services when shutting down [SIEM mode]

  • Network-Probe: fixed time displayed in the pipeline details

  • Network-Probe: logging - redirected some messages to the debug, while emphasizing only the important ones

  • Network-Probe: management - in rare cases old documents from unregistered probes were corrupting the output of some APIs

  • Network-Probe: not checking pipelines statuses when logserver-probe service is not reachable

  • Network-Probe: suricata upgraded to v6.0.20

  • Network-Probe: verification if probe is currently active and available

  • Reports: issues with enabling/disabling scheduled reports

v7.6.0

New Features

  • Energy Logserver SIEM LITE - Initial step into Cyber Security

  • MSSP license provides transparent view to licensed sources

  • Sources Management: identify each source activity

  • UBA: SIEM module for tracking the nature of the user’s behaviour and its changes

  • UBA AI: predefinied AI rules to detect anomalies in user behavior

  • Login: Introducing a new user to manage the system’s graphical interface: admin (disables logserver account)

Improvements

  • Alert: cross-field-correlation in Logical alert method

  • Alert: improved time tolerance for run_once option

  • Alert: mapping change to be able to search by rule name in alert_error indices

  • Audit: new audit selection - now includes all plugins by default

  • Archive: improved error handling and task resuming

  • Cerebro: HSTS header support

  • Config: configuration-backup.sh includes agent keys and siem-engine config file

  • Config: logserver-password-util.sh: new password management tool changes system passwords easily

  • Empowered AI: create rule with Saved Search or index pattern with query dsl

  • Empowered AI: aggregation preview for univariate rule

  • Empowered AI: improved model encryption

  • Integrations: Dell Avamar added to default integrations

  • Login: status-page link added to top menu

  • Skimmer: output addresses support lists of nodes for fault tolerance

  • Skimmer: support for URI schemes in config file, i.e. http, https

  • Skimmer: migrated to libcurl

  • Skimmer: updated to v1.0.25

Bug Fixes

  • Alert: adding a note to an incident doesn’t work

  • Alert: long_term method does not work for objects

  • Cerebro: fix for permissions verification

  • Cerebro: limit on the used HEAP memory

  • Empowered AI: anomalies increase by zooming in on the graph

  • Empowered AI: cleared placeholder in text anomaly

  • Empowered AI: incorrect handling of state:storeInSessionStorage

  • Empowered AI: name change of the axis in the charts of univariate

  • Empowered AI: performance tab display error for large number of fields in multivariate

  • Empowered AI: rareness threshold does not fill in the scheduled model

  • SIEM Engine: incorrect verification when diskspace thresholds are not enabled

  • SIEM Engine: redirect loop after session expiration

  • SIEM Engine: the list of domains available for logging does not refresh after changing the authorization plugin settings

  • SIEM Engine: cluster does not start after disabling authorization plugin

  • SIEM Engine: filter error messages in AuthService

  • SIEM Engine: task of deleting old tokens now starts automatically

  • Network-Probe: pipeline details are now displayed correctly

  • Reports: banner with information about the expiring license or the diskspce visible on docx reports

  • Reports: fix for executing scheduled reports

  • Reports: visualization selection does not display all of them if there are more than 1000 of them

  • SIEM Engine: on_start inventories disabled by default

  • Task Management: show query duration

  • Task Management: show user matching similar query

v7.5.0

New Features

  • Empowered AI - anomaly detection in text message - rare words probability

  • Empowered AI - anomaly detection in numbers

  • Empowered AI - anomaly detection in multi dimention numbers

  • Empowered AI - Root Cause tracing based on knowledge model

  • Empowered AI - Relations Mining builds knowledge model

  • Empowered AI - unsupervised data clustering

  • Empowered AI - forecasting alerting method

  • Empowered AI - AI input for network probe

  • Empowered AI - realtime processing for AI rules

  • Empowered AI - Model Library - save, store and upload AI models

  • Empowered AI - Model Library - reuse and retraint saved models

  • Empowered AI - Text Anomaly default alerts

  • Empowered AI - create manual incident based on AI results

  • Empowered AI - easy create alerts tab from AI rules config

  • Empowered AI - progress bar for started rules

Bug Fixes

  • Alert: added custom arguments to Energy SOAR integration

  • Alert: added support for external_link to Energy SOAR integration

  • Alert: groups management

  • Alert: missing url in alert_text arguments of the Energy SOAR method

  • Archive: clearing issue with empty with non existing file metadata

  • Archive: scrolling in case of visible warnings

  • CMDB: data fetching at the plugin startup

  • Integrations: built-in templates now use wildcards

  • SIEM Engine: improved alias refresh synchronization

  • Network Probe: deleting config files and handling deleted files from disk

  • Network Probe: filtering of probe’s statuses has been fixed

  • Network Probe: fixed when probes’ services statuses were unavailable

  • Network Probe: layout improvements and readability refinements

  • Network Probe: updated log messages to be more comprehensible

  • Network Probe: fixed permissions problem with external services

  • Reports: improved handling of time fields

  • SIEM Engine: improved RBAC mapping existence verification for non-admin users

  • SIEM Engine: updated to v4.7.4 due cve [CVE-2023-42463, CVE-2024-32038]

  • Task Management: improved filtering tasks by their duration

v7.4.3

New Features

  • Query management: identify and stop long running query

  • Introducing Network-Probe as mandatory Input Layer

  • Archive: checksum verification on demand

  • Empowered-AI: default AI forecasting rules

  • License: GUI license upload with automatic distribution in cluster environment

  • Introducing “Status page”: showing health check in case of system problem without ability to log in

  • Free space warning on status and login page

  • Free space protection: Enabling Watermarks to keep system running in case of free space issue

  • Audit: enchancements to audit more GUI actions

Improvements

  • Alerts - Blacklist: wrong file name support

  • Alerts: Risk key can be set on non default field - SOAR integration

  • Alerts: secure und insecure webhook support

  • Archive: Date format change to epoch in milisec

  • Input layer uses Logserver-Probe-OSS 7.17.18

  • license-service: dedicated API

  • Skimmer: self monitoring of free space on cluster nodes

  • Skimmer: self monitoring of license API status

  • Support for Beats OSS Agents 7.17.18

Bug Fixes

  • Alerts: cannot select more than one index-pattern when creating/editing a rule

  • Alerts: empty role list when creating a rule without the admin role

  • Alerts: Energy SOAR method wrong WYSIWYG behavior

  • Alerts: errors when creating risks if any already exist

  • Alerts: Manual Incident: user without admin role cannot create an incident

  • Alerts: Manual Incident: user without admin role cannot see his incident

  • Alerts: notifications are not sent as a valid HTML email

  • Alerts: rule name change did not remove the old rule

  • Archive: partial restore

  • Archive: preparing data for archiving

  • Audit: exclusions on _nodes and _stats do not work

  • Audit: missing information about operations on users and roles

  • Audit: missing query content - if selected

  • Intelligence - view in discover: application not found

  • license-service: memory limitations

  • Login: AD login exception for users without mapped roles

  • Login: SSO login duplicate users

  • Reports: short link when creating docx report

  • SIEM Engine: Agent/Client updated to v4.5.4

  • SIEM Engine: permission denied after upgrade

  • status_page: missing branding

  • xlsx-import: fixing bug when writing more than 500 documents

v7.4.2

New Features

  • Introducing Empowered-AI - Your data science module

  • Empowered-AI: Forecasting usecase !

  • Alerts: NEW rule type for Forecasting : Difference Multi Pattern - matches the difference between two index patterns calculated in a unit of time.

  • Archive: repository validation (automatic scan of archive files and indices)

  • SQL query support: query Your data with SQL query with dedicated GUI console

  • Integrations: NEW Labyrinth - Deception-based threat detection

Improvements

  • Archive: cataloging for better retention: \(archivefolderpath/\)year/$month

  • Archive: sorting, pagination and filtering on task lists

  • Archive: support for huge repositories

  • Disaster Recovery: improvements during cluster initialization and recovery

  • Disaster Recovery: logs for damaged indexes have been enriched with index_id

  • Disaster Recovery: possibility of disabling the authorization plugin

  • GUI: improvements in updating the client (browser) cache after Update

  • license-service: possibility to change log_level & default log_level changed to WARN

  • Reports: accept only the unix cron format in recurring reports

  • Reports: clear descriptions for settings which deletes obsolete files

  • Reports: dedicated MIME type for docx reports

  • Reports: filenames created by recurring reports now based on creation date

  • Sync: improved logging and error handling

Bug Fixes

  • Archive: delete the results file when deleting a search task

  • Archive: missing .zstd files and .dec files are not deleted after decryption

  • Archive: unable to prepare data for selected indices fix

  • Audit: user and role actions were filtered from audit queue due to missing username

  • configuration-backup & support-tool: now supports all logserver versions

  • E-doc: e-doc user requires gui-access to query the GUI authorization for a token

  • GUI: wait until refreshAliases finishes at user login

  • install.sh: problem with symlink when installing only the data-node

  • Login: deprecated route to the default home plugin

  • Reports: enable/disable for recurring report was not shown in GUI

  • Reports: impossible to delete a recurring report without assigned file

  • Reports: incorrect capture of “data table” and “tag cloud” visualization

  • Reports: incorrect formatting of email messages and the “mail” command

  • Reports: selected time field was not saved in the “data export” report

  • Reports: temporary jpeg file not deleted after creating pdf report

  • Reports: tsvb-based visualizations are incorrectly captured in docx reports

  • Scheduler: “Archive task updated, but error occured when updating scheduler object. Please retry” fix

  • Sync: tasks cannot be deleted

  • Sync: unable to create/update profile

  • xlsx-import: invalid file extension validation

SIEM Plan

  • Alerts: NEW rule type: Difference Multi Pattern - matches the difference between two index patterns calculated in a unit of time.

  • Alerts: bugfix: alert index rollover causes service errors

  • Alerts: bugfix: sorting alert risk on incident tab did not work properly

  • Alerts: bugfix: problem with updating alert rules

  • Alerts: bugfix: Energy SOAR + metric_aggregation does not create artifacts

  • Alerts: bugfix: Run Once old history after updating alert rule

  • SIEM Engine: bugfix: duplicate index-pattern siem*

v7.4.1

New Features

  • Reports: DOCX support!

Improvements

  • Alert: multi-language support for alert rules

  • API: gui-access role is required to interact with the API

  • tlstool.sh: new ssl certificate management tool

Bug Fixes

  • Archive: support for “secure” and “insecure” mode (without valid certificates)

  • GUI: better-handled exceptions for custom plugins

  • GUI: defaultAppId directive has been restored

  • GUI: invalid directory for keystore

  • GUI: Module Access Control permission fix

  • GUI: users have aliases for different indexes after migration

  • Index Management: missing verification for “on save” action

  • Index Management: errors during rollover

  • Index Management: filtering using the “Enabled” column

  • Index Management: unable to update job after changing cron

  • Integrations: improved command for importing dashboards

  • Reports: custom logo moves the visualization on the dashboard

  • Reports: deleting reports (multi, single) does not refresh the list

  • Reports: enabling and disabling periodic reports by users

  • Reports: incorrect visualization titles are inserted when creating a Data Table report

  • Reports: long comment goes off the page when creating a PDF report

  • Reports: long title goes off the page when creating a PDF report

  • Reports: not translated statuses in the task list

  • Reports: problem with Tag Cloud visualization when creating PDF report

  • Reports: reports role paths to update, now require .reports

  • Scheduler: status table sorted by “start date” instead of “name”

  • Timeline/Timelion: regex not working due to an incorrectly built package

SIEM Plan

  • Alerts: bugfix: incorrect _id of the edited alert causes duplicates

  • Alerts: bugfix: unable to retrieve a list of risk key fields when updating a rule

  • SIEM Engine: better-handled exceptions in RBAC integration

  • CVE-2023-32002

  • CVE-2023-32006

  • CVE-2023-32559

  • CVE-2021-32014

  • CVE-2021-32012

  • CVE-2021-32013

  • CVE-2023-30533

  • CVE-2022-24785

  • CVE-2022-31129

  • CVE-2022-24785

  • CVE-2022-31129

  • CVE-2023-22467

  • CVE-2023-30533

  • CVE-2023-26115

v7.4.0

Upgrades

  • Complete database redefinition:

    • Segment replication

    • Searchable snapshots

    • Search backpressure feature can now cancel queries at the coordinator level

  • Complete user interface redefinition

  • Complete SIEM Engine redefinition:

    • New manager

    • New App

    • New Agent

  • Input layer uses Logserver-Probe-OSS 7.17.11

  • Support for Beats OSS Agents => 7.17.11

New Features

  • Logserver: RBAC integration with Wazuh Engine (users can map roles between systems)

Improvements

  • CMDB: Browser-based Time Zone

  • Improved error handling when reloading a license (logserver/license/reload)

  • Archive: deleting tasks with multiselect option

  • Unification and organization of Energy Logserver system APIs

  • Alert: WebHook: added support for nested fields in http post payload

  • Agents: built-in agents templates updated to 7.17.11

Bug Fixes

  • CMDB: incorrect parsing of values in the date filter

  • Archive: blank line in index list on restore

v7.3.0

New Features

  • Multi-Language Support

Improvements

  • Improved security by using response security headers

  • Network Probe: version lock prevents accidental updates

  • configuration-backup.sh activated by default

Bug Fixes

  • Reports: usage of “Include unmapped fields” cause “No data” when exporting csv

  • Agents: corrected manifest file for downloading agents

  • Archive: error while restoring encrypted archives

  • Cerebro: corrected auto-login after redirect

Integrations

  • VMware: Integration with dedicated dashboard and alerts

  • AWS: Integration with dedicated dashboard and alerts

  • Ruckus Networks: Integration with dedicated dashboard and alerts

  • Added Beats templates to beats integration

SIEM Plan

  • WatchGuard: Integration with dedicated dashboard and alerts

  • IDS Suricata: Integration with dedicated dashboard and alerts

  • Alerts: updated rule database with 90 new alert rules including new Windows Security Group

  • Alerts: bugfix: Jira integration

  • Alerts: bugfix: duplication of alarms in specific cases

  • Alerts: bugfix: top_count_keys doesn’t work properly with multiple query_keys

  • Alerts: bugfix: Broken Chain method TypeError

  • Alerts: bugfix: Exclude Fields for Logical/Chain body correlation

  • Alerts: NoLog rule for each alarm group

Network-Probe

  • Added support for sFlow - sfacctd service

  • Added IDS Suricata integration with dedicated dashboard and alerts

  • log4j - logserver-probe-input-tcp

Required post upgrade

  • Recreate bundles/cache: rm -rf /usr/share/logserver-gui/optimize/bundles/* && systemctl restart logserver-gui

v7.2.0

Breaking changes

  • Login: changed how gui access is granted for administrative users - access for any administrator has to be explicitly granted

  • Wiki portal renamed to E-Doc

New Features

  • CMDB: Infrastructure - create an inventory of all sources sending data to SIEM

  • CMDB: Relations - ability to create relation topology map based on sources inventory

  • Extended auditing support - each plugin can be enabled in GUI config to save its actions in the audit index

  • Syntax Assistant for Alerts, Agents, Index Management, Network Probe. Check YAML definition and structure

Improvements

  • Update process will not override /etc/sysconfig/logserver config

  • Clear GUI message for expired license

  • Agents: improved services information display for not running agents

  • Archive: optimization and improvements; added multi threaded processing and Task Retry support

  • Login: redesigned audit selection and exclusion settings GUI

  • Reports: tasks edit is now more robust and allows modification of advanced parameters

  • Reports: moved settings into new Config tab in the plugin from Config -> Settings

  • Alerts: loading new alarm Rule Set during update process [install.sh]

  • Beats: updated to v7.17.8

  • Skimmer: negotiate highest TLS1.3 version if possible

  • Skimmer: fixes regarding ssl connection

  • Skimmer: added logserver_ssl config option

  • Skimmer: added new metric: node_stats_fs_total_free_in_pct

  • Skimmer: updated to v1.0.22

  • Elasticdump updated to v6.79.4

Bug Fixes

  • Refreshing audit exclusions caused ELS node to freeze in rare cases

  • Update process on RedHat 7.9 could not be run caused by missing package

  • LDAP login: improved validation on username input

  • Table visualization: fix for “Count percenteges”, which was inacurate in some cases

  • Skimmer: sometimes did not start after installation

  • Agents: small GUI improvements

  • Alerts: long alert names presented outside the frame

  • Alerts: sorting alert risk on incident tab did not work properly

  • Intelligence: malware scanners would rise a false positive on one of the plugin dependencies

  • Reports: data export (csv) improvements on file integrity

  • Reports: a rare case of a race condition when removing temporary directories

  • E-Doc: improvements to https handling when using Logserver as a search engine

  • install.sh: installation process always uses LC_ALL=C

Integrations

  • Added new integrations: FireEye, Infoblox, ArcSight Common Event Format

SIEM Plan

  • Agents: SIEM agents updated to 3.13.6

  • Alerts: new notification methods: ServiceNow, WebHook, TheHive, Jira

  • Alerts: risk values on incident tab formated for clarity

  • Alerts: example description supplied with new values regarding escalate and recovery

  • Alerts: all alerts in a goup can be seen with a proper row selection

  • Alerts: creating risks is now supported on no time based indices

  • Alerts: long alert names presented outside of message frame

  • Alerts: on incident tab sorting by risk did not work properly

  • Alerts: added Ransomware Detection rules

Network-Probe

  • Increased tolerance for status/verification calls

Security related

  • axios - CVE-2021-3749

  • qs - CVE-2022-24999

  • express - CVE-2022-24999

  • moment - CVE-2022-24785

  • moment - CVE-2022-31129

  • minimist - CVE-2021-44906

  • char.js - CVE-2020-7746

  • async - CVE-2021-43138

  • minimist - CVE-2021-44906

  • requestretry - CVE-2022-0654

  • xmldom - CVE-2022-39353

  • underscore - CVE-2021-23358

  • flask-cors - CVE-2020-25032

  • logserver-gui - CVE-2022-23707

Required post upgrade

  • Recreate bundles/cache: rm -rf /usr/share/logserver-gui/optimize/bundles/* && systemctl restart logserver-gui

  • Wiki portal renamed to E-Doc: if data migration is required follow the steps of UPGRADE.md

v7.1.3

Security related

  • log4j updated to 2.19.0

  • kafka updated to 2.13-3.3.1 (log4j dependency removed)

  • logserver-probe: removed obsolete bundled jdk

v7.1.2

New Features

  • Energy SOAR: Redesigned and improved integration (Security Orchestration, Automation And Response)

  • Intelligence: Redesigned and improved Forecasting [experimental]

  • Masteragent: New feature: Configuration Templates

  • New plugin: CMDB - simple implementation of Configuration Management Database

Improvements

  • es2csv - Performance boost and Memory optimization

  • Reports: Support for large report files

  • Redirection of HTTPS connection to GUI enabled by default - 443 => 5601

  • Login: Home Page moved to Integrations Page

  • diagnostic-tool.sh - Added logserver-probe logs

  • Logserver: Global timeouts changed to 60s

  • Updated LICENSE in all components

  • Index Management: Prepare index has been moved from Config to Index-Management tab

  • Masteragent: Setting authorization with a client certificate by default

  • Masteragent: Possibility to fully disable the HTTP server on masteragent clients

Bug Fixes

  • Login: Fixed problems with sharing Short Links

  • Discover: Fixed problem with index-patterns name overlapping

  • Index Management: Fixed execution time for builin logtrail policies

  • Masteragent: Fixed error when getting installed services

Integrations

  • windows-ad: Fixed error in Ad Accounts dashboard

  • beats - Fixes in waf ruby filter

SIEM Plan

  • Vectra.AI: Integration with dedicated dashboard and alerts

  • MITRE added to SIEM Dashboard

  • Agents: SIEM agents updated to 3.13.4

  • Agents: Vulnerability detection & feeds enabled by default

  • Alert: Simplified discover_url feature

  • Alert: theHive project - Improved integration

  • Alert: Fixed exception for risk query

  • Alert: SIEM alert group changed to “Correlated”

  • Alert: Fixed problem with TypeError: deprecated_search()

  • Alert: Fixed logs problem after rotating the file

  • Alert: Fixed permission problem in Run Once mode

  • Alert: Fixed indentation in query_string

  • [bugfix] Added missing library to Qualys Quard venv

  • [bugfix] Added missing ports 1514udp-tcp/1515tcp to install.sh

Required post upgrade

  • Recreate bundles/cache: rm -rf /usr/share/logserver-gui/optimize/bundles/* && systemctl restart logserver-gui

  • (SIEM only) Update/ReImport SIEM Dashboard for MITRE

v7.1.1

New Features

  • Logserver Join support - API level query

Improvements

  • es2csv - Breakthrough (50%) performance boost

  • es2csv - Renamed to els2csv

  • diagnostic-tool.sh - Added logs encryption

  • diagnostic-tool.sh - Renamed to support-tool.sh

  • Skimmer: Indices_stats: run only on master node

  • Skimmer: Added two metrics: indices_stats_patterns and indices_stats_regex

  • Skimmer: Added cached info about nodes when poll errors out

  • Logtrail: Disabled ratelimit in rsyslog for logtrail source files

  • Logtrail: Parsing in pipeline for alert,logserver-gui,elasticearch,logserver-probe [added standardized log_level field]

  • Logtrail: Added default filter showing only errors [“NOT log_level: INFO”]

  • Index Management: Added built-in index policies for common actions

  • Discover: Default QueryLanguage changed to Lucene

  • Cerebro updated to v0.9.4

  • Curator updated to v5.8.4

  • Elasticdump updated to v6.79.4

  • Wiki.js updated to v2.5.274

Bug Fixes

  • Login: In case of unsuccessful login information about “redirection” is lost when using link sharing

  • Login: When logging using SSO auth, it doesn’t redirect when using link sharing

  • Login: Fixed “unable to parse url” when using link sharing

  • Login: Corrected Session expired message

  • Login: gui-access role added to role-mappings.yml

  • Login: When logging using SSO auth, sending the entered password as a default action

  • Skimmer: Index store value of _cat/shards in bytes

  • Skimmer: Disabled ssl handshake on logserver-probe api

  • Logtrail: Corrected syntax highlighting

  • Logtrail: Fixed filter selector on columns

  • Discover: Fixed timeout handling

  • Wiki: Removed gui-access group

  • Index Management: Wait for updates before refreshing the list

  • Index Management: Fixed id problem during custom update

Integrations

  • windows-ad/beats: fixed error in ruby{} filter

  • netflow - Fixes from 7.1.0

  • netflow - network_vis - Fixed incorrect filtering

  • netflow - network_vis - Added new option “skip null values”

  • syslog-mail - Fixes from 7.1.0

SIEM Plan

  • Added Log4j RCE attacks to Detection Rules [“Wazuh alert [HIGH] - rule group: custom - Log4j RCE”]

  • Alert: Fixed problem with modifying alertrulemethod

  • Alert: Fixed malfunction of Test Rule in case of “verify_certs: false” setting

  • Alert: Simplified Discover URL

  • Alert: Logtrail - Cluster Services Error Logs added to Cluster-Health group

Security related

  • http-proxy - CVE-2022-0155

  • xlsx - CVE-2021-32013

  • json-schema - CVE-2021-3918

  • lodash - CVE-2021-23337

  • json-schema - CVE-2021-3918

  • pdf-image - CVE-2020-8132

  • angular-chart.js - CVE-2020-7746

  • pyyaml - CVE-2020-14343

  • cryptography - CVE-2020-25659

  • aws-sdk - CVE-2020-28472

  • pyyaml - CVE-2020-14343

  • nodemailer - CVE-2020-7769

  • objection - CVE-2021-3766

  • socket.io - CVE-2020-28481

  • nodejs - CVE-2021-44531

v7.1.0

New Features

  • Added support for AlmaLinux and RockyLinux

  • Agents: Added local repository with GUI download links for agents installs

  • Archive: Added ‘Run now’ for scheduled archive tasks

  • Archive: Added option to enable/disable archive task

  • Archive: Added option to encrypt archived data

  • Audit: Added report of non-admin user actions in GUI

  • Logserver: Added field level security access control for documents

  • Logserver-GUI: Added support for Saved Query object in access management

  • Logserver-GUI: Added support for TLS v1.3

  • Logserver-GUI: Added new plugin Index Management - automate index retention and maintanance

  • Reports: Added new report type created from data table visualizations - allows creating a raport like table visualization including all records (pagination splitted into pages)

  • Reports: Added option to specify report task name which sets destination file name

Improvements

  • Security: log4j updated to address vulnerabilities: CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832, CVE-2021-4104

  • Added new directives for LDAP authenctication

  • Agents: Changed agent’s action name from drop to delete

  • Archive: Improvement and optimization of “resume” feature

  • Archive: Optimised archivization proces by saving data directly to zstd file

  • Archive: Multiple ‘Upload’ GUI improvements

  • Archive: Improved logs verbosity

  • Audit: Added template for audit index

  • Beats: Updated to v7.12.1

  • Curator: Added curator logs for rotation

  • Logserver: Extended timeout for starting service

  • Logserver: Updated engine to v7.5.2

  • install.sh: Improved update section for better handling of services restart

  • Logserver-GUI: Updated engine to v7.5.2

  • Logserver-GUI: Clean SSL info in logs

  • Logserver-GUI: Improved built-in roles

  • Logserver-GUI: Disabled telemetry

  • Logserver-GUI: Set Discover as a default app

  • Logserver-GUI: Optimized RPM

  • Logserver-GUI: Improved handling of unauthorized access in Discover

  • Logserver-GUI: small changes in UI - Improved Application RBAC, product version

  • Logserver-GUI: Added new logos

  • Logserver-GUI: Improved login screen, unauthorized access info

  • Logserver-GUI: Restricted access to specific apps

  • Logserver-GUI: Added option to configure default app

  • Logrotate: Added Skimmer

  • Logserver-Probe: Updated to v7.12.1

  • Network visualization: UI improvements

  • Object permission: Index pattern optimizations

  • Plugins: Moved Cluster Management inoto the right top menu, Scheduler and Sync moved to the Config

  • Reports: Added report’s time range info to raport details description

  • small_backup.sh: Added cerebro and alert configuration

  • Skimmer: Updated to v1.0.20

  • Skimmer: Added new metrics, pgpgin, pgpgout

  • Skimmer: Optimised duration_in_milis statistics

  • Skimmer: Added option to specify types

  • Skimmer: Added option to monitor disk usage

  • Wiki: Added support for nonstandard logserver-gui port

  • Wiki: Several optimizations for roles

  • Wiki: Changed default search engine to logserver

  • Wiki: Added support for own CAs

  • Wiki: Default authenticator improvements

  • XLSX Import: UI improvements

Bug Fixes

  • Archive: Fixed problems with task statuses

  • Archive: Fixed application crash when index name included special characters

  • Archive: Fixed ‘checksum mismatch’ bug

  • Archive: Fixed bug for showing unencrypted files as encrypted in upload section

  • Logserver: Fixed bug when changing role caused client crash

  • Elastfilter: Fixed “_msearch” and “_mget” requests

  • Elastfilter: Fixed bug when index pattern creation as an admin caused logserver-gui failure

  • Logserver-GUI: Fixed timeout handling

  • Logserver-GUI: Fixed a bug causing application crash when attempting to delete data without permission to it

  • Logserver-Probe: Fixed breaking geoip db when connection error occurred

  • Object permission: Fixed adding dashboard when all its related objects are already assigned

  • Reports: Added clearing .tmp files from corrupted csv exports

  • Reports: Fixed sending PDF instead of JPEG in scheduled reports

  • Reports: Fixed not working scheduled reports with domain selector enabled

  • Skimmer: Fixed expected cluster nodes calculation

  • Wiki: Added missing home page

  • Wiki: Added auto start of wiki service after installation

  • Wiki: Fixed logout behaviour

Integrations

  • Fixed labels in Skimmer dashboard

  • Fixed Audit dashboard fields

  • Updated Windows + AD dashboard and pipeline

  • Added Linux Mail dashboard and pipeline

  • Added Cisco ASA dashboard and pipeline

  • Added FortiGate dashboard and pipeline

  • Added Paloalto dashboard and pipeline

  • Added Oracle dashboard and pipeline

  • Added Waystream dashboard and pipeline

  • Added CEF dashboard and pipeline (CheckPoint, FireEye, Air-Watch, Infoblox, Flowmon, TrendMicro, CyberX, Juniper Networks)

  • Added monitoring of the alert module on Alert Dashboard

SIEM Plan

  • Updated SIEM dashboard

  • Updated QualysGuard integration

  • Updated Tenable.SC integration

  • Alert: Updated detection rules (370+)

  • Alert: Added Cluster-Health alert rules

  • Wazuh: Updated to v3.13.3

  • Wazuh: UI improvements

  • Alert: Improved groups management

  • Alert: Multiple UI/UX tweaks

  • Alert: Revised alerts’ descriptions and examples

  • Alert: Adding included fields when invert:true

  • Alert: Changed startup behaviour

  • Alert: Added field from ‘include’ to match_body

  • Alert: Optimised loading files with misp lists

  • Alert: Added option to set sourceRef in alert definition

  • Alert: Include & Exlcude in blacklist-ioc lists

  • Alert: Fixed several issue in chain and logical alerts

  • Alert: Fixed error when user tried to update alert from newly added group

  • Alert: Fixed top_count_keys not working with multiple query_key

  • Alert: Fixed bug when match in blacklist-ioc is breaking other rules

  • Alert: Fixed empty risk_key breaking alert rule

  • Alert: Fixed endless loop during scroll

Network-Probe

  • Added integration with license service

  • Changed plugin icon

  • Changed default settings

  • Changed logs mapping in logserver-probe

  • Optimised netflow template to be more efficient

  • Updated .service files

  • Updated Network-Probe dashboard

API Changes

  • Logserver: Updated API endpoints.

    • Following endpoints deprecated and update with:

      • /_auth/account -> /_logserver/accounts

      • /_license/reload -> /_logserver/license/reload

      • /_role-mapping/reload -> /_logserver/auth/reload

      • /user/updatePassword -> /_logserver/user/password

    • Following endpoint was removed and replaced with:

      • /_license -> /_logserver/license

Breaking changes

  • During the update, the “logserver-gui” role will be removed and replaced by “gui-access”, “gui-objects”, “report”. The three will automatically be assigned to all users that prior had the “logserver-gui” role. If you had a custom role that allowed users to log in to the GUI this WILL STOP WORKING and you will have to manually enable the access for users.

  • The above is also true for LDAP users. If role mapping has been set for role logserver-gui this will have to be manually updated to “gui-access” and if required “gui-objects” and “report” roles.

  • If any changes have been made to the “logserver-gui” role paths, those will be moved to “gui-objects”. GUI objects permissions also will be moved to “gui-objects” for “gui-access” cannot be used as a default role.

  • The “gui-access” is a read-only role and cannot be modified. By default, it will allow users to access all GUI apps; to constrain user access, assign user a role with limited apps permissions.

  • “small_backup.sh” script changed name to “configuration-backup.sh” - this might break existing cron jobs

  • SIEM plan is now a separate add-on package (requires an additional license)

  • Network-Probe is now a separate add-on package (requires an additional license)

  • (SIEM) Verify rpmsave files for alert and restore them if needed for following:

    • /opt/alert/config.yaml

    • /opt/alert/op5_auth_file.yml

    • /opt/alert/smtp_auth_file.yml

Required post upgrade

  • Role “wiki” has to be modified to contain only path: “.wiki” and all methods

v7.0.6

New Features

  • Alert: Added 5 alerts to detect SUNBURST attack

  • Incidents: Added the ability of transferring the calculated risk_value to be sent in any alarm method

  • Indidents: Added visibility of unassigned incidents based on user role - security-tenant role

  • install.sh: Added the ability to update with ./install.sh -u

Improvements

  • Object permission: Object filtering optimization

  • Reports: Date verification with scheduler enabled tasks

  • Reports: UI optimization

Bug Fixes

  • Agents: CVE-2020-28168

  • Alert: Fixes problem with Syslog notifications

  • Alert: Fixes problem with Test Rule functionality

  • Alert: CVE-2020-28168

  • Archive: CVE-2020-28168

  • Cerebro: CVE-2019-12384

  • Logserver-GUI-xlsx-import: CVE-2020-28168

  • Login: CVE-2020-28168

  • Reports: CVE-2020-28168

  • Reports: Fixes errors related to background tasks

  • Sync: CVE-2020-28168

v7.0.5

New Features

  • New plugin: Wiki - integration with wiki.js

  • Agents: Added index rotation using rollover function

  • Alert: Added counter with information about how many rules there are in a given group

  • Alert: Added index rotation using rollover function

  • Alert: First group will be expanded by default

  • Alert: New Alert method for Syslog added to GUI

  • Archive: Added compression level support - archive.compressionOptions [logserver-gui.yml]

  • Archive: Added mapping/template import support

  • Archive: Added number of matches in files

  • Archive: Added regexp and extended regexp support

  • Archive: Added size information of created archive on list of files for selection

  • Archive: Added support for archiving a selected field from the index

  • Archive: Added timestamp field for custom timeframe fields

  • Audit: Added index rotation using rollover function

  • Config: Added configuration possibility for Rollover (audit/alert/.agents indexes) in Settings tab

  • Object Permission: When deleting an object to a role in “object permission” now is possible to delete related objects at the same time

  • Reports: Ability to delete multiple tasks at once

  • Reports: Added details field for each task that includes information about: user, time range, query

  • Reports: Added Scheduler for “Data Export” tab

  • Reports: Fields to export are now alphabetical, searchable list

  • Reports: Scheduled tasks supports: enable, disable, delete

  • Reports: Scheduled tasks supports: Logo, Title, Comments, PDF/JPEG, CSV/HTML

  • Installation support for Centos7/8, RedHat7/8, Oracle Linux7/8, Scientific Linux 7, Centos Stream

  • iFrame embedding support: new directive login.isSameSite in logserver-gui.yml [“Strict” or “None”]

Improvements

  • Access management: Plugin Login for app management will show itself as Config

  • Alert: Added support for nested fields in blacklist-ioc alert type

  • Alert: Alert Dashboard rewritten to alert_status pattern - allows you to filter visible alarms per user

  • Alert: Cardinality - fix for _thread._local’ object has no attribute ‘alerts_sent’

  • Alert: Chain/Logical - few improvements for output content

  • Alert: Rule type example is hidden by default

  • Alert: RunOnce - improved results output

  • Alert: RunOnce - information that the process has finished

  • Alert: TestRule - improved error output

  • Archive: Added document sorting, which speeds up logserver response

  • Archive: API security -> only admin can use (previously only visual information)

  • Archive: Archiving process uses a direct connection, bypassing the elastfilter - proxy

  • Archive: Changed UTC time to local time

  • Archive: Information about problems with reading/writing to the archive directory

  • Archive: Optimized function for loading large files - improved loading time

  • Archive: Optimized saving method to a temporary flat file

  • Archive: Optimized scroll time which speeds up logserver response

  • Audit: Converted SEARCH _id: auditselection to GET _id: auditselection

  • Audit: Removed background task used for refresh audit settings

  • Beats: Updated to v6.8.14

  • Blacklist-IOC: Added Duplicates removal mechanism

  • Blacklist-IOC: Automatic configuration of repository access during installation [install.sh]

  • Cerebro: Updated to v0.9.3

  • Config: Character validation for usernames and roles - can consist only of letters a-z, A-Z, numbers 0-9 and characters _,-

  • Config: Deleting a user deletes his tokens/cookies immediately and causes logging out

  • Config: Securing the default administrator account against deletion

  • Config: Session timeout redirect into login screen from all modules

  • Config: Workaround for automatic filling of fields with passwords in modern browsers

  • Curator: Updated to v5.8.3 and added support for Python3 as default

  • ElasticDump: Updated to v6.65.3 and added support for backup all templates at once

  • Logserver: Removed default user “scheduler” with the admin role - is a thing of history

  • Logserver: Removed indices.query.bool.max_clause_count from default configuration - causes performance issues

  • Logserver: Role caching improvements

  • GEOIP: Automatic configuration of repository access during installation [install.sh]

  • Incidents: Switching to the Incidents tab creates pattern alert* if not exist

  • install.sh: Added workaround for cluster.max_shards_per_node=1000 bug

  • Logserver-GUI: Removed logserver-gui.autocomplete from default configuration - causes performance issues

  • License: Revision and update of license files in all system modules

  • Logserver-Probe: Updated logserver-probe-codec-sflow to v2.1.3

  • Logserver-Probe: Updated logserver-probe-input-beats to v6.1.0

  • Logserver-Probe: Updated to v6.8.14

  • Logtrail: Added default actionfile for curator - to clean logtrail indexes after 2 days

  • Network visualization: corrected legend and better colors

  • Reports: Added Switch button for filtering only scheduled tasks

  • Reports: Admin users should see all scheduled reports from every other user

  • Reports: Changed “Export Dashboard” to “Report Export”

  • Reports: Changed “Export Task Management” to “Data Export”

  • Reports: Crontab format validated before Submit in Scheduler

  • Reports: Default task list sorted by “start time”

  • Reports: Improved security by using kernel namespaces - dropped suid permissions for chrome_sandbox

  • Reports: Moved “Schedule Export Dashboard” to “Report Export” tab

  • Reports: Try catch for async getScheduler function

  • Skimmer: Added alerts: High_lag_on_Kafka_topic, High_node_CPU_usage, High_node_HEAP_usage, High_Flush_duration, High_Indexing_time

  • Skimmer: New metric - _cat/shards

  • Skimmer: New metric - _cat/tasks

  • Skimmer: Updated to v1.0.17

  • small_backup.sh: Added sync, archive, wiki support

  • small_backup.sh: Information about the completed operation is logged

  • Wazuh: Searching in the rule.description field

Bug Fixes

  • Access Management: Cosmetic issue in apps select box for default roles (like admin, alert, intelligence, logserver-gui etc.)

  • Alert: Category name did not appear on the “Risk” list

  • Alert: Description update for find_match alert type

  • Alert: Fixes bug where after renaming the alert it is not immediately visible on the list of alerts

  • Alert: Fixes bug where editing of alert, causes it returns to the Other group

  • Alert: Fixes incorrect function alertMethodData - problem with TestRule operation [itrs op5 alert-method]

  • Alert: Fixes problem with ‘[]’ in rule name

  • Alert: Fixes process status in Alert Status tab

  • Alert: In groups, if there is pagination, it is not possible to change the page - does not occur with the default group “Others”

  • Alert: Missing op5_url directive in /opt/alert/config.yaml [itrs op5 alert-method]

  • Alert: Missing smtp_auth_file directive in /opt/alert/config.yaml [itrs op5 alert-method]

  • Alert: Missing username directive in /opt/alert/config.yaml [itrs op5 alert-method]

  • Alert: Overwrite config files after updating, now it should create /opt/alert/config.yml.rpmnew

  • Archive: Fixes exception during connection problems to logserver

  • Archive: Missing symlink to runTask.js

  • Cerebro: Fixes problems with PID file after cerebro crash

  • Cerebro: Overwrite config files after updating, now it should create /opt/cerebro/conf/application.conf.rpmnew

  • Config: SSO login misreads application names entered in Access Management

  • Logserver: Fixes “No value present” message log when not using a radius auth [properties.yml]

  • Logserver: Fixes “nullPointerException” by adding default value for licenseFilePath [properties.yml]

  • Incidents: Fixes problem with vanishing status

  • install.sh: Opens the ports required by logserver-probe via firewall-cmd

  • install.sh: Set openjdk11 as the default JAVA for the operating system

  • Logserver-GUI: Fixes exception during connection problems to logserver - will stop restarting

  • Logserver-GUI: Fixes URL shortening when using Store URLs in session storage

  • Logtrail: Fixes missing logrotate definitions for Logtrail logfiles

  • Logtrail: Overwrite config files after updating, now it should create /usr/share/logserver-gui/plugins/logtrail/logtrail.json.rpmnew

  • Object Permission: Fixes permission verification error if the overwritten object’s title changes

  • Reports: Fixes Image Creation failed exception

  • Reports: Fixes permission problem for checkpass Reports API

  • Reports: Fixes problems with AD/Radius/LDAP users

  • Reports: Fixes problem with choosing the date for export

  • Reports: Fixes setting default index pattern for technical users when using https

  • Skimmer: Changed kafka.consumer_id to number in default mapping

  • Skimmer: Fixes in indices stats monitoring

  • Skimmer: Overwrite config files after updating, now it should create /opt/skimmer/skimmer.conf.rpmnew

v7.0.4

New Features

  • New plugin: Archive specified indices

  • Applications Access management based on roles

  • Dashboards: Possibility to play a sound on the dashboard

  • Tenable.SC: Integration with dedicated dashboard

  • QualysGuard: Integration with dedicated dashboard

  • Wazuh: added installation package

  • Beats: added to installation package

  • Central Agents Management (masteragent): Stop & start & restart for each registered agent

  • Central Agents Management (masteragent): Status of detected beats and master agent in each registered agent

  • Central Agents Management (masteragent): Tab with the list of agents can be grouped

  • Central Agents Management (masteragent): Autorolling documents from .agents index based on a Settings in Config tab

  • Alert: New Alert method for op5 Monitor added to GUI.

  • Alert: New Alert method for Slack added to GUI.

  • Alert: Name-change - the ability to rename an already created rule

  • Alert: Groups for different alert types

  • Alert: Possibility to modify all alarms in selected group

  • Alert: Calendar - calendar for managing notifications

  • Alert: Escalate - escalate alarm after specified time

  • Alert: TheHive integration

Improvements

  • Object Permission: When adding an object to a role in “object permission” now is possible to add related objects at the same time

  • Skimmer: New metric - increase of documents in a specific index

  • Skimmer: New metric - size of a specific index

  • Skimmer: New metric - expected datanodes

  • Skimmer: New metric - kafka offset in Kafka cluster

  • Installation script: The setup script validates the license

  • Installation script: Support for Centos 8

  • AD integration: Domain selector on login page

  • Incidents: New fieldsToSkipForVerify option for skipping false-positives

  • Alert: Added sorting of labels in comboxes

  • User Roles: Alphabetical, searchable list of roles

  • User Roles: List of users assigned to a given role

  • Audit: Cache for audit settings (performance)

  • Diagnostic-tool.sh: Added cerebro to audit files

  • Alert Chain/Logical: Few improvements

Bug Fixes

  • Role caching fix for working in multiple node setup.

  • Alert: Aggregation schedule time

  • Alert: Loading new_term fields

  • Alert: RecursionError: maximum recursion depth exceeded in comparison

  • Alert: Match_body.logserver-gui_discover_url malfunction in aggregation

  • Alert: Dashboard Recovery from Alert Status tab

  • Reports: Black bars after JPEG dashboard export

  • Reports: Problems with Scheduled reports

  • Logserver-auth: Forbidden - not authorized when querying an alias with a wildcard

  • Dashboards: Logserver_table is not present in 7.X, it has been replaced with basic table

  • Logserver-Probe: Mikrotik pipeline - failed to start pipeline

v7.0.3

New Features

  • Alert: new type - Chain - create alert from underlying rules triggered in defined order

  • Alert: new type - Logical - create alert from underlying rules triggered with defined logic (OR,AND,NOR)

  • Alert: correlate alerts for Chain and Logical types - alert is triggered only if each rule return same value (ip, username, process etc)

  • Alert: each triggered alert is indexed with uniqe alert_id - field added to default field schema

  • Alert: Processing Time visualization on Alert dashboard - easy to identify badly designed alerts

  • Alert: support for automatic search link generation

  • Input: added mikrotik parsing rules

  • Auditing : added IP address field for each action

  • Auditing : possibility to exclude values from auditing

  • Skimmer: indexing rate visualization

  • Skimmer: new metric: offset in Kafka topics

  • SKimmer: new metric: expected-datanodes

  • MasterAgent: added possibility for beats agents restart and the master agent itself (GUI)

Improvements

  • Search and sort support for User List in Config section

  • Copy/Sync: now supports “insecure” mode (operations without certificates)

  • Fix for “add sample data & web sample dashboard” from Home Page -> changes in default-base-template

  • Skimmer: service status check rewriteen to dbus api

  • Masteragent: possibility to exclude older SSL protocols

  • Masteragent: now supports Centos 8 and related distros

  • XLSX import: updated to 7.6.1

  • Logserver-Probe: masteragent pipeline shipped by default

  • Blacklist: Name field and Field names in the Fields column & Default field exclusions

  • Blacklist: runOnce is only killed on a fatal Alert failure

  • Blacklist: IOC excludes threats marked as false-positive

  • Incidents: new design for Preview

  • Incidents: Note - new feature, ability to add notes to incidents

  • Risks: possibility to add new custom value for risk, without the need to index that value

  • Alert: much better performance with multithread support - now default

  • Alert: Validation of email addresses in the Alerts plugin

  • Alert: “Difference” rule description include examples for alert recovery function

  • Logtrail: improved the beauty and readability of the plugin

  • Security: jquery updated to 3.5.1

  • Security: bootstrap updated to 4.5.0

  • The HELP button (in logserver-gui) now leads to the official product documentation

  • Centralization of previous alert code changes to single module

Bug Fixes

  • Individual special characters caused problems in user passwords

  • Bad permissions for scheduler of Copy/Sync module has been corrected

  • Wrong Alert status in the alert status tab

  • Skimmer: forcemerge caused under 0 values for cluster_stats_indices_docs_per_sec metric

  • diagnostic-tool.sh: wrong name for the archive in output

  • Reports: export to csv support STOP action

  • Reports: scroll errors in csv exports

  • Alert: .alertrules is not a required index for proper system operation

  • Alert: /opt/alerts/testrules is not a required directory for proper system operation

  • Alert: .riskcategories is not a required index for proper system operation

  • Malfunction in Session Timeout

  • Missing directives service_principal_name in bundled properties.yml

  • Blacklist: Removal of the doc type in blacklist template

  • Blacklist: Problem with “generate_logserver-gui_discover_url: true” directive

  • Alert: Overwriting an alert when trying to create a new alert with the same name

  • Reports: When exporting dashboards, PDF generates only one page or cuts the page

  • Wrong product logo when viewing dashboards in full screen mode

v7.0.2

New Features

  • Manual incident - creating manual incidents from the Discover section

  • New logserver-gui plugin - Sync/Copy between clusters

  • Alert: Analyze historical data with defined alert

  • Indicators of compromise (IoC) - providing blacklists based on Malware Information Sharing Platform (MISP)

  • Automatic update of MaxMind GeoIP Databases [asn, city, country]

  • Extended LDAP support

  • Cross cluster search

  • Diagnostic script to collect information about the environment, log files, configuration files - utils/diagnostic-tool.sh

  • New beat: op5beat - dedicated data shipper from op5 Monitor

Improvements

  • Added _license API for logserver (it replaces license path which is now deprecated and will stop working in future releases)

  • _license API now shows expiration_date and days_left

  • Visual indicator on Config tab for expiring license (for 30 days and less)

  • Creating a new user now requires reentering the passoword

  • Complexity check for password fields

  • Incidents can be supplemented with notes

  • Alert Spike: more detailed description of usage

  • ElasticDump added to base installation - /usr/share/logserver-gui/elasticdump

  • Alert plugin updated - frontend

  • Reimplemented session timeout for user activity

  • Skimmer: new metrics and dashboard for Cluster Monitoring

  • Wazuh config/keys added to small_backup.sh script

  • Logrotate definitions for Logtrail logfiles

  • Incidents can be sorted by Risk value

  • UTF-8 support for credentials

  • Wazuh: wrong document_type and timestamp field

Bug Fixes

  • Audit: Missing Audit entry for succesfull SSO login

  • Report: “stderr maxBuffer length exceeded” - export to csv

  • Report: “Too many scroll contexts” - export to csv

  • Intelligence: incorrect work in updated environments

  • Agents: fixed wrong document type

  • Logserver-GUI: “Add Data to Logserver-GUI” from Home Page

  • Incidents: the preview button uses the wrong index-pattern

  • Audit: Missing information about login errors of ad/ldap users

  • Netflow: fix for netflow v9

  • MasterAgent: none/certificade verification mode should work as intended

  • Incorrect CSS injections for dark theme

  • The role could not be removed in specific scenarios

v7.0.1

  • init

  • migrated features from branch 6 [ latest:6.1.8 ]

  • XLSX import [logserver-gui]

  • curator added to /usr/share/logserver-gui/curator

  • node_modules updated! [logserver-gui]

  • logserver upgraded to 7.3.2

  • logserver-gui upgraded to 7.3.2

  • dedicated icons for all logserver-gui modules

  • eui as default framework for login,raports

  • bugfix: alerts type description fix