Hotfix 2.15.6

Added

• [API_PARSER] [WAF_BARRACUDA] New API parser WAF_BARRACUDA

Fixed

• [API_PARSER] [HARFANGLAB] Handle independent saved timestamps for 'alerts' and 'threats' logs
• [API_PARSER] [PROOFPOINT_TRAP] Avoid errors on missing 'emails' field

Hotfix 2.15.5

Added

• [API_PARSER] [SIGNALSCIENCES_NGWAF] Add site_name key in logs
• [API_PARSER] [GATEWATCHER_ALERTS] New collector
• [API_PARSER] [CISCO_UMBRELLA] New collector

Fixed

• [API_PARSER] [VECTRA] Correctly allow to test the Collector before saving it
• [API_PARSER] [HARFANGLAB] Increase delay to 10 minutes to be sure to get all logs
• [AUTHENTICATION] [GUI] LDAP Users can now authenticate once activated

Hotfix 2.15.4

Changed

• [API_PARSER] [CYBEREASON] Update malops fetching
• [DEPENDENCIES] Python dependencies upgrade
  • gunicorn 21.2.0 -> 22.0.0
• [CLUSTER] [CONFIG] Reload all Rsyslog/Filebeat Listeners when updating the Redis cluster password

Fixed

• [FRONTEND] Missing redis fields in template infos
• [API_PARSER] [HARFANGLAB] Increase the limit of logs in request and reduce time range of requests
• [API_PARSER] [CSC_DOMAINMANAGER] Split logs with several records
• [API_PARSER] Correctly select custom parser certificate when set
• [REPUTATION_CTX] Ensure there are no duplicates left for GeoLite files in Mongodb
• [API_PARSER] [HARFANGLAB] Add threshold check to avoid infinite loop while getting more than >=10k logs on single execution
• [API_PARSER] [TRENDMICRO_VISIONONE] Avoid sporadic errors on collector's GUI test

Hotfix 2.15.3

Added

• [LOG_FORWARDER] [REDIS] Support for queues, sets, publish and streams modes for log insertion
• [LOGOMELASTICSEARCH] Handle log insertion errors returned by elasticsearch

Changed

• [DEPENDENCIES] Upgrade djongo and code for pymongo>=4
• [FRONTEND] [GUI] Improve binding information for Filebeat, Redis and Kafka listeners
• [CRON] Update Reputation Context DBs at 6:00am instead of 2:00am

Hotfix 2.15.1

Fixed

• [FRONTEND] TCP session were not received properly when LOG Frontend was set to TCP+UDP

Version 2.15.0

Added

• [FRONTEND] Redis stream support for input log
• [FRONTEND] Allow to simply use local Redis without worrying about parameters when creating a Redis Listener
• [REDIS] Password support for local redis
• [REDIS] New api function set_password and set_replica_of

Changed

• [CLUSTER] Evolve daemon's code to allow correctly handling tasks during service shutdowns
• [API] Increase API key length for new clusters from 16 to 32 characters
• [INSTALL] Improve and stabilize the Redis bootstrapping process
• [CONFIG] [API] Remove the object ID from the API: there is only one configuration object!
• [API_PARSER] [NOZOMI] Add missing 'Content-Type' and 'Accept' headers in requests

Fixed

• [FRONTEND] Allow skipping unresponsive nodes during HAProxy test_conf
• [REPUTATION] Changed predator references to barricade
• [REPUTATION_CTX] Ensure internally defined DBs cannot be modified
• [SYSTEM] [PKI] Fix wrong ca.key after cluster_join
• [API_PARSER] Connect automatically to redis matser
• [API_PARSER] [TRENDMICRO_VISIONONE] Correctly handle errors in log fetches
• [API_PARSER] [TRENDMICRO_VISIONONE] Avoid 429 errors by increasing default pagination
• [API_PARSER] [TRENDMICRO_VISIONONE] Delay log fetching by 5 minutes to be sure to get all logs
• [API_PARSER] [NOZOMI] Set a custom User-Agent to prevent request blacklisting from technology
• [HAPROXY] [LISTENERS] Put back a correct 60s server timeout for Rsyslog/Filebeat communication
• [HAPROXY] [CONFIGURATION] Prevent configuration failures when using packaged lua scripts

Hotfix 2.14.3

Fixed

• [REPUTATION] Changed predator references to barricade

Full Changelog: v2.14.2...v2.14.3

Version 2.14.2

Changed

• [API_PARSER] [VECTRA] Store current access token to avoid re-generating it every time
• [DEPENDENCIES] Python dependencies upgrade
  • aiohttp 3.9.1 -> 3.9.3
  • attrs 23.1.0 -> 23.2.0
  • beautifulsoup4 4.12.2 -> 4.12.3
  • boto3 1.33.2 -> 1.34.32
  • botocore 1.33.2 -> 1.34.32
  • bs4 0.0.1 -> removed
  • cryptography 41.0.7 -> 42.0.2
  • django 4.2.7 -> 4.2.9
  • djongo 1.3.6_2 -> 1.3.6.post3
  • frozenlist 1.4.0 -> 1.4.1
  • google-api-core 2.14.0 -> 2.16.1
  • google-api-python-client 2.108.0 -> 2.116.0
  • google-auth 2.23.4 -> 2.27.0
  • google-auth-httplib2 0.1.1 -> 0.2.0
  • googleapis-common-protos 1.61.0 -> 1.62.0
  • jinja2 3.1.2 -> 3.1.3
  • markupsafe 2.1.3 -> 2.1.4
  • maxminddb 2.5.1 -> 2.5.2
  • meraki 1.39.0 -> 1.42.0
  • netaddr 0.9.0 -> 0.10.1
  • pillow 10.1.0 -> 10.2.0
  • protobuf 4.25.1 -> 4.25.2
  • pyopenssl 23.3.0 -> 24.0.0
  • s3transfer 0.8.1 -> 0.10.0
  • typing-extensions 4.8.0 -> 4.9.0
  • yarl 1.9.3 -> 1.9.4
  • setuptools 69.0.2 -> 69.0.3

Fixed

• [API_PARSER] [CSC_DOMAINMANAGER] Correct missing import...
• [API_PARSER] [RETARUS] Fix update lock to prevent multiprocess
• [API_PARSER] [SENTINEL_ONE_MOBILE] Fix try..except raises
• [API_PARSER] [FORCEPOINT] Fix update lock to prevent multiprocess
• [API_PARSER] [FORCEPOINT] Use a safer alternative to XML decoding
• [WORKFLOW] Trigger build_conf on various changes
• [GUI] [NODES] Wrong state of mongo replica when a node is down
• [GUI] [NODES] Correctly print result when stepping down a Mongodb node
• [LOG_FORWARDER] Reload related frontends of type "file", "redis" or "kafka" without any node selected
• [CLUSTER_CREATE] Correctly reset Admin user during cluster creation
• [HAPROXY] Wrong backend timeout caused by the new intermediate backend
• [WORKFLOW] Correctly update Haproxy's old Frontend configuration when a different one is choosen on a Workflow

Version 2.14.0

Added

• [API_PARSER] [SIGNALSCIENCES_NGWAF] New collector
• [HAPROXY] [CONF] JWT verification through workflow
• [IDP] [LDAP] Allow to map custom IDP fields to LDAP attributes

Changed

• [DEPENDENCIES] Python dependencies upgrade
  • aiohttp 3.8.6 -> 3.9.1
  • boto3 1.28.68 -> 1.33.2
  • botocore 1.31.68 -> 1.33.2
  • cachetools 5.3.1 -> 5.3.2
  • certifi 2023.7.22 -> 2023.11.17
  • charset-normalizer 3.3.1 -> 3.3.2
  • cryptography 41.0.4 -> 41.0.7
  • django 4.2.6 -> 4.2.7
  • google-api-core 2.12.0 -> 2.14.0
  • google-api-python-client 2.104.0 -> 2.108.0
  • google-auth 2.23.3 -> 2.23.4
  • idna 3.4 -> 3.6
  • maxminddb 2.4.0 -> 2.5.1
  • meraki 1.38.0 -> 1.39.0
  • protobuf 4.24.4 -> 4.25.1
  • pyasn1 0.5.0 -> 0.5.1
  • pyopenssl 23.2.0 -> 23.3.0
  • python-ldap 3.4.3 -> 3.4.4
  • s3transfer 0.7.0 -> 0.8.1
  • urllib3 1.26.18 -> 1.26.18
  • werkzeug 3.0.0 -> 3.0.1
  • yarl 1.9.2 -> 1.9.3
  • setuptools added -> 69.0.2
• [FRONTEND] Deploy a listener on every node when listening_node is empty

Fixed

• [API_PARSER] [FORCEPOINT] Avoid duplicate processes when input takes long to process
• [CSC_DOMAINMANAGER] Fix missing json.dumps on logs list
• [PORTAL] [SELF_SERVICE] Correct wrong password change/logout links in self-service page
• [GUI] [WORKFLOW] Correctly print items' list when editing a Workflow
• [GUI] [FRONTEND] Correctly select a good ruleset for API collector but let user override the value
• [CONFIG] [SYSTEM] Correct issue preventing some certificates to be deleted from system
• [OPENID] [MODELS] Get correct URLs for OpenID IDPs
• [LDAP] Correctly get boolean values from LDAP replies
• [REPUTATION_CONTEXT] Add missing fixture for default GeoLite MMDBs download

Version 2.13.0

Added

• [FRONTEND] New last_update_time field
• [GUI] [WORKFLOW] CORS policy settings
• [HAPROXY] [CONF] CORS policy into config generation
• [API_PARSER] [HARFANGLAB] Fetch new endpoint for Threats logs
• [API_PARSER] [APEX] New parser
• [FRONTEND] [TCP] Add advanced option custom_tl_frame_delimiter for Rsyslog tcp frontends

Removed

• [FRONTEND] [TIMEOUTS] Incoherent "timeout connect" in Frontend attributes

Changed

• [HAPROXY] [CONF] Split Frontend and Workflow config to improve performance
• [HAPROXY] [CONF] Change test config names by uuids
• [PERFORMANCES] Avoid high overhead when loading Workflows by simplifying string representation

Fixed

• [GUI] [FRONTEND] Bug allowing the creation of an http or tcp frontend without a listener
• [LOG_FORWARDER] Rsyslog config generation error when '-' found in LOGOM name
• [LOG_FORWARDER] Frontends configs aren't refreshed when LOGOM used as parse failure
• [WORKFLOW] Re-allow multiple workflows on the same FQDN with sub-paths
• [HAPROXY] Ensure X-Forwarded-proto header is correctly set on Frontend configuration
• [API_PARSER] [NOZOMI] Set correct timestamp format for query limits