The Cyber Toolchain — issue -019, December 31, 2024
THE CYBER TOOLCHAIN
NO. -019
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED DECEMBER 31, 2024 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
ESP32 Marauder v1.1.0 adds Airtag and Flipper Zero BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. attack capabilities
└──▷ GET THIS VERSION
$ git clone --branch v1.1.0 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.1.0
Adds Airtag Sniff capability for detecting nearby Apple AirTags via Bluetooth Low Energy.
Adds Flipper Zero Sniff capability for interacting with Flipper Zero devices over BLE.
Adds Flipper Zero Spam capability to broadcast packets targeting Flipper Zero devices.
Adds List Airtag capability to enumerate detected Apple AirTags.
Adds Spoof Airtag capability to send spoofed advertising signals mimicking Apple AirTags.
A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.
Rayhunter v0.2.3 adds colorblind mode and removes a false-positive IMSIIMSIA unique 15-digit number that globally identifies a subscriber on a cellular network, stored on the SIM card. Cyber tools target or capture it to track devices or correlate identities across mobile networks. heuristic.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.3 https://github.com/EFForg/rayhunter.git
# already have the repo? check out this version:$ git checkout v0.2.3
Adds colorblind mode to improve accessibility in the Rayhunter UI
Removes the false positive IMSI heuristic from detection logic
The firmware for the HackRF+PortaPack H1/H2/H4/H4M.
Mayhem v2.1.0 adds I2C device manager, external module API, OOK brute-force app, exFAT support, and multiple new apps.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/portapack-mayhem/mayhem-firmware.git
# already have the repo? check out this version:$ git checkout v2.1.0
Introduces an I2c device manager for managing I2C peripherals.
Adds an External module api allowing third-party extensions.
Includes a new CVS Spam app for generating spam signals.
Adds the Ookbrute app for brute-forcing On-Off Keying signals.
Introduces an FM Radio ext app for FM radio functionality.
+2 moreshow less
Adds support for the exFAT file system on MicroSD cards.
Adds a Weather csv log feature to record weather data.
BloodHound v6.3.0 adds CoerceToTGT edge, a revamped Posture page, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support, graph label toggling, and more default Tier Zero nodes.
└──▷ GET THIS VERSION
$ git clone --branch v6.3.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v6.3.0
Adds new CoerceToTGT attack edge for modeling KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. TGT coercion paths in Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. graphs.
Enables the updated Posture page with a new date-range selector and supporting API implementation for tracking security posture over time.
Enables OIDC as a supported SSO provider type, including callback URI display in OIDC provider details.
Adds a PATCH endpoint to update existing SSO providers, plus UI support for editing SSO provider configurations.
Adds ability to download the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. signing certificate directly from the UI.
+4 moreshow less
Expands the default set of Tier Zero (T0) nodes for more comprehensive high-value asset coverage.
Adds toggle labels option to show or hide node/edge labels in the graph explorer.
Publishes OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specs for Add, Create, List, and Update SSO provider endpoints, and for the Posture and Findings APIs.
Sickle v3.1.0 adds 9 new shellcode stubs across Windows/Linux/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and an interactive ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. shell module.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:$ git checkout v3.1.0
└──▷ TRY IT
Generate a Linux AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. reflective ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. loader payload for in-memory execution over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
Mend SCA adds the --dev parameter to scan development dependencies for npm, Maven, Gradle, Go, Ruby and SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development..
Adds --dev parameter to enable scanning of development tools and dependencies
Supports npm, Maven, Gradle, Go, Ruby and SBT package managers for development dependency scans
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 24.11.2 adds CWE Number column to Code findings and renames existing columns.
Adds the CWE Number column to the Code findings table for direct CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. identifier visibility
Renames the Date column to Detected in the Code findings table
Renames the Type column to CWE Name in the Code findings table
3 details in Everything
2 more releases in this issue
· 2024-12-02 → 2024-12-16
Mend SAST 24.11.1 adds Code Findings API export and refined CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-20 detection for mail relay and memcache injection
Adds support for generating Code reports via the Platform API (API v3)
Splits CWE-20: Improper Input Validation into two new vulnerability types: CWE-20: Mail Relay and CWE-20: Memcache Injection Vulnerability
Adds detection of Stored Cross-site Scripting when tainted data is stored in React state
Updates the layout of the Code Findings table and the Code Finding Details panel to improve usability
Mend SAST v24.11.1 adds Platform API (v3) report generation, React XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection, and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-20 split.
Code reports can now be generated through the Platform API (API v3)
Mend.io now supports detection of Stored Cross-site Scripting if the tainted data is stored in React state
For the Python gen 2 detection engine, CWE-20: Improper Input Validation is split up into two new vulnerability types: CWE-20: Mail Relay and CWE-20: Memcache Injection Vulnerability. This change allows for a more fine-grained analysis
Checkov 3.2.345 adds sensitive param detection in CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., HTTP proxy support for Terraform scans, and a new Azure Cognitive Services detection.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.345 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.345
Adds CKV_AZURE_1234 detection rule that flags Azure Cognitive Services resources with unrestricted outbound network access
1 detail in Everything
5 more releases in this issue
· 2024-12-02 → 2024-12-31
Adds new CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. operator for resource ID generation in ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates
└──▷ GET THIS VERSION
$ git clone --branch 3.2.326 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.326
AFL++ v4.30c adds fast-resume, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. hooks, custom TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. mutator, and new afl-cc runtime/compile-time knobs.
└──▷ GET THIS VERSION
$ git clone --branch v4.30c https://github.com/AFLplusplus/AFLplusplus.git
# already have the repo? check out this version:$ git checkout v4.30c
└──▷ TRY IT
Resume a long fuzzing session without re-running calibration when the binary hasn't changed, saving time on large corpora.
$ afl-fuzz -i - -o /out -- ./target @@
Use the classic AFL forkserver for compatibility with symcc or nautilus instrumentation pipelines.
Compile a target with a lower optimization level to improve instrumentation coverage or debug reproducibility.
$ AFL_OPT_LEVEL=1 afl-cc -o target_fuzz target.c
Adds fastresume: when resuming with -i - or AFL_AUTORESUME=1 and the target binary is unchanged, AFL skips calibration by loading a saved dump (zlib-compressed if available); disable with AFL_NO_FASTRESUME=1.
Adds AFL_CUSTOM_MUTATOR_LATE_SEND=1 to invoke the custom send() function after the target has been restarted.
Adds optional hooking-bridge support in qemu_mode for new hook types (see qemu_mode/hooking_bridge).
Adds custom_send_tcp custom mutator for TCP-based fuzzing targets.
New afl-cc runtime variable AFL_OLD_FORKSERVER to use the classic AFL forkserver — useful with symcc, symqemu, nautilus, and similar tools when combined with AFL_LLVM_INSTRUMENT=CLASSIC.
+3 moreshow less
New afl-cc compile-time variable AFL_OPT_LEVEL to set a specific optimization level (default: 3).
Veracode Scan for VS Code v1.13.1 adds auto SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning and vulnerable library highlighting.
Adds auto SCA scanning option to automatically scan open-source libraries when a project opens or libraries change.
Highlights vulnerable libraries in the package manager file after an SCA scan for Maven, npm, or Yarn projects.
Veracode Scan for VS Code v1.12.0 adds option to skip vulnerable method analysis during SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans.
Veracode Scan for VS Code v1.12.0 adds an option to skip vulnerable method analysis during SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans.
Veracode adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 2023 training labs covering multiple APIs and runtimes.
Adds OWASP API Top 10 2023 labs training content to the Veracode platform
Adds four new lab scenarios: OWASP API 6 (Node), OWASP API 7 (.NET and Node), and OWASP API 10
Snyk Artifactory Gatekeeper Plugin 4.0.0 adds continuous mode and new repo types
Adds continuous mode to revoke access to packages if a new vulnerability is discovered
Adds support for Ruby Gems, Cocoapods, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. repositories
Adds support for Artifactory version 7.84 and above
Plans JavaScript CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. detection improvements in Snyk Code for January 15, 2025
Planned release January 15, 2025: adds detection for Cross-site Request Forgery findings using the express-csrf-protect library
Planned release January 15, 2025: adds detection of CSRF protections configured in a separate file from the main Express app setup
Planned release January 15, 2025: improves accuracy by restricting findings to cases where basic auth or cookie usage is detected
Early access for High-Context Inline Comments in Snyk PRs with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., priority score, and data flow.
In Early Access, opt-in High-Context Inline Comments embed SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings directly in supported GitHub and Bitbucket pull requests.
General availability of the GitHub Cloud App integration for Snyk
Adds GitHub Cloud App as a supported authentication method, using short-lived tokens instead of Personal Access Tokens (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) or OAuth.
Enables role-based, granular access control for the GitHub integration.
A preview Snyk Visual Studio upgrade adds auto-scanning, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., Delta Findings and Learn integration; release is planned for January 9
The special preview for Visual Studio 2022 (17.5+) includes auto-scanning, IaC support, Delta Findings and Snyk Learn integration.
The preview improves and standardizes the UI, aiming for parity with VS Code and JetBrains extensions; release is planned for January 9.
GitLab 17.7 adds Planner role, KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. support in Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., new access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. rotation UI, and group-level secret push protection via API.
Introduces the Planner user role for Agile planning tools like epics, roadmaps, and Kanban boards
Adds an instance-wide integration allowlist controlled by administrators to restrict which integrations can be enabled
New Vulnerability Management policy type with an Auto-resolve option for vulnerabilities no longer detected in scans
Enables rotation of personal, project, and group access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. directly in the UI instead of requiring the API
Adds a GraphQL query to track CI/CD component usage across projects within pipelines
+14 moreshow less
Provides small hosted runners on Linux Arm for all tiers on GitLab.com
Adds support for the Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. (KEV) Catalog in composition analysis via GraphQL
Expands the Advanced SAST code flow view to be available in the Vulnerability Report, Merge request security widget, Pipeline security report, and Merge request changes view
Adds /help command in GitLab Duo Chat to explore features
Resets auto_stop_in timer for environment.action: prepare and environment.action: access jobs starting in 18.0 (via prevent_blocking_non_deployment_jobs feature flag)
Adds full support for Kubernetes version 1.31
Allows setting namespace and Flux resource path directly from CI/CD job using environment.kubernetes.namespace and environment.kubernetes.flux_resource_path attributes
Includes group and project access tokens in the credentials inventory on GitLab.com
Sends token expiration email notifications 30 and 60 days before expiry (in addition to the existing 7-day notification)
Adds Unicode 15.1 emoji support
Allows setting a default text editor (rich text, plain text, or none) in user settings
Adds an optional description field for personal, project, group, and impersonation access tokens
Enables enabling secret push protection on all projects in a group via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and GraphQL API
Adds a new API endpoint to list enterprise users for Group Owners
Adds content_len field to crawl output for captured responses.
Introduces -td / -tech-detect flag to explicitly opt into technology detection (works with JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output).
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Technology detection is no longer enabled by default; existing workflows that relied on automatic tech detection must now pass -tech-detect explicitly.
nuclei v3.3.7 adds OS thread control via env var and a new flag to toggle global matchers
└──▷ GET THIS VERSION
$ git clone --branch v3.3.7 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.3.7
└──▷ TRY IT
Limit nuclei to 4 OS threads to reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. contention when running alongside other tools on a shared host.
New OS_MAX_THREADS_ENV environment variable lets you cap the number of OS threads the Go runtime can use, useful for tuning nuclei's resource footprint on constrained hosts.
New -enable-global-matchers flag gives explicit control over whether global matchers execute during a scan.
humble 1.44 adds 7 new insecure header checks, 21 enabled-header detections, and extended security response header coverage.
└──▷ GET THIS VERSION
$ git clone --branch 1.44 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:$ git checkout 1.44
Adds insecure check for Document-Policy header with no valid directives.
Adds insecure check for Activate-Storage-Access header with no valid directives.
Adds insecure check for Activate-Storage-Access header with incorrect values.
Adds insecure check for Accept-Patch as a potentially unsafe header.
Adds insecure checks for Content-Digest using no secure algorithms and unsafe algorithms.
+3 moreshow less
Adds insecure check for Content-DispositionContent-DispositionAn HTTP response header that tells a browser whether to display a file inline or treat it as a download attachment, and under what filename — letting cyber tools control how retrieved files are handled or trigger forced downloads. as a potentially unsafe header.
Adds detection of enabled security response headers, covering 21 new security-related headers.
Extends the set of security response HTTP headers checked during analysis.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.88.0 adds a Twilio API Key detector and a verification cache to speed up secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
└──▷ GET THIS VERSION
$ git clone --branch v3.88.0 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.88.0
4 more releases in this issue
· 2024-12-02 → 2024-12-20
GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user provisioning, secret pattern exclusions, GitHub forked repo checks, and Jira template selection.
Adds steps for SCIM integration enabling automatic user deprovisioning in GitGuardian based on Identity Provider changes
Adds steps to define secret pattern exclusion rules to hide secrets matching defined patterns from all or specific repositories
Adds steps to enable GitGuardian check runs on GitHub forked repositories for Business workspaces
Adds steps for a template selection dropdown when manually creating Jira Cloud issues via the integration
Sealed Secrets v0.27.3 adds key TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit./cutoff Helm options, configurable max retries, and instance labels on Prometheus metrics.
└──▷ GET THIS VERSION
$ git clone --branch v0.27.3 https://github.com/bitnami-labs/sealed-secrets.git
# already have the repo? check out this version:$ git checkout v0.27.3
Adds keyttl and keycutofftime options to the Helm chart for controlling sealing key lifecycle.
Adds configurable max retries for the controller.
Adds app.kubernetes.io/instance label to Prometheus metrics for better multi-instance observability.
New CircleCI context sync integration and SSH certificate issuance/signing endpoints for cyber tooling.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.99.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.99.0-postgres
feat(integrations): New CircleCI Context Sync
Infisical SSH (SSH Certificates) support with exposed API endpoints
CLI - SSH Capabilities including the addToAgent flag to load credentials into SSH Agent
3 details in Everything
└──▷ BREAKING ON UPGRADE
!PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. and KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. features are moved out of Secrets projects; if your workflow relied on PKI/KMS being in the default project scope, you will need to adjust your configuration or access patterns.
2 more releases in this issue
· 2024-12-06 → 2024-12-20
Infisical v0.98.0 adds k8s operator template support and an API endpoint to update integration auth
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.98.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.98.0-postgres
misc: add ssl setting for pg boss enables SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. configuration for the PgBoss worker pool
New PATCH /api/integrations/:id/auth endpoint (added via PR #2855) allows updating integration authentication credentials
Adds Google GCP KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. support for external encryption and copyable request IDs on server errors.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.97.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.97.0-postgres
└──▷ HOW TO FIND IT
Register Google GCP KMS as the encryption backend for a project.
📍1. Go to Project Settings › Encryption
2. Select Google GCP KMS from the Provider dropdown
3. Enter your GCP Service Account JSON and Key ID
When an API call fails, copy the request ID from the UI error toast to paste into support tickets.
📍1. Perform an action that results in a server error (e.g., invalid secret payload)
2. Look at the red error toast message
3. Click the Copy icon next to the Request ID field
Adds Google GCP KMS as a supported external KMS provider for encrypting secrets at rest
Add copyable request IDs to server-side error messages in the UI to aid troubleshooting
Gitleaks v8.22.0 replaces Go's regex engine with go-re2, delivering 2–4× faster secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
└──▷ GET THIS VERSION
$ git clone --branch v8.22.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.22.0
GitGuardian Self-Hosted 2024.12 adds Jira Data Center, GitLab instance integration, forked repo checks, secret pattern exclusions, and new worker metrics
Adds support for defining secret Secret pattern exclusion rules to hide secrets matching defined patterns from incidents.
Allows configuring an instance-level GitLab integration using a read-only admin token.
Enables GitGuardian check runs on GitHub forked repositories to improve code security coverage.
Workspace Managers can disable automatic repository monitoring in VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integrations to control perimeter expansion.
Adds 7 new secret detectors: X-API Key Secret, Azure Functions App Key Header, Azure Functions App Key Query Parameter, Jenkins API token, chpasswd Username Password, Nessus Agent Key, and Statsig Server Secret Key.
+2 moreshow less
Provides a Worker Tasks page in the Admin Area to monitor task activity and worker usage for scaling optimization.
Exposes new applicative metrics: gim_periodic_task_period_seconds, gim_periodic_task_not_run_for_seconds, gim_check_runs_long_running, gim_health_check_result_count, and gim_outdated_health_check_count.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The front.ingress Helm value has been renamed to ingress.
Nexus Repository 3.75.0 adds native PHP/Composer proxy support, Google Cloud KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. for GCS blob stores, and explicit Cargo auth control.
Adds native Proxy PHP/Composer repository support to Nexus Repository Pro, enabling storage and retrieval of Composer components alongside other dependencies.
Adds option to enable Google Cloud Key Management ServiceKey Management ServiceA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. (KMS) encryption for new Google Cloud Storage (GCS) blob stores by providing a KMS Key ID.
Adds Hide button to the Malware Warning banner to dismiss it during the current session.
Improves Cargo package browsing in the UI by extracting and displaying attributes (name, license, authors, vendor, description, version, homepage) from cargo.toml files.
Adds new checkbox Restrict repository content to authenticated users for Cargo proxy and group repositories that sets auth-required: true in /config.json responses.
LavaMoat ships git-safe-dependencies v0.1.0, a new tool for securing git-sourced Node.js dependencies.
└──▷ GET THIS VERSION
$ git clone --branch git-safe-dependencies-v0.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout git-safe-dependencies-v0.1.0
2 more releases in this issue
· 2024-12-05 → 2024-12-20
lavamoat-browserify 18.1.0 lets you override the module resolve implementation for custom dependency resolution.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-browserify-v18.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-browserify-v18.1.0
Supports overriding the resolve implementation, enabling custom module resolution logic in browserify builds.
LavaMoat Core 16.2.0 adds diff-friendly policy sorting and makes mergePolicy's second param explicitly optional.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.2.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.2.0
└──▷ USE IT
Merge a single policy without a second argument now that the param is explicitly optional.
javascript
import { mergePolicy } from 'lavamoat-core'
const merged = mergePolicy(existingPolicy)
Sorts LavaMoat policy files in a diff-friendly way so sort order remains stable even when a dependency's path changes, reducing noisy diffs on policy updates.
Adds a policy sorting CLI helper to migrate existing policy files to the new cleaner sort order.
Makes the second parameter of mergePolicy explicitly optional, simplifying single-policy merge calls.
syft v1.18.0 adds Rust audit binary relationships, configurable layer size, Dart arm/v7 support, and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. path normalization.
└──▷ GET THIS VERSION
$ git clone --branch v1.18.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.18.0
Adds dependency relationships for Rust audit binary packages in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Supports configuration of image layer size reporting in syft.
Supports Dart arm/v7 architecture for both Dart SDK 2.x and 3.x.
Converts SPDX absolute paths to relative paths in SPDX output.
it-depends v0.1.2 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output, Podman support, NPM aliased dependencies, and Go version comparison.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.2 https://github.com/trailofbits/it-depends.git
# already have the repo? check out this version:$ git checkout v0.1.2
Adds CycloneDX output format support.
Adds basic Podman support for container-based dependency analysis.
Spectra Assure Community adds support for generating and embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. GitHub-like package assessment badges.
Enables creation of GitHub-like badges with assessment of packages to embed in websites
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.61.0 adds support for editing application response headers.
BunkerWeb 1.6.0-beta adds HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. limits, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. encryption, DNS prefetch control, and CoreRuleset plugin support via new env vars
└──▷ GET THIS VERSION
$ git clone --branch 1.6.0-beta https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout 1.6.0-beta
└──▷ TRY IT
Enable DNS prefetch control by setting the environment variable
$ export X_DNS_PREFETCH_CONTROL=off
Encrypt TOTP secrets with a custom key to prevent data loss
$ export TOTP_SECRETS=my_custom_secret_key_here
Configure BunkerWeb to use specific Kubernetes namespaces for autoconf
$ export NAMESPACES=production,staging
Adds USE_MODSECURITY_CRS_PLUGINS and MODSECURITY_CRS_PLUGIN_URLS environment variables to automatically download and install Coreruleset plugins.
Adds the X-DNS-Prefetch-Control header functionality with the X_DNS_PREFETCH_CONTROL setting (default is off) to control DNS prefetching behavior.
Adds a new securitytxt plugin to manage the security.txt file from settings and serve it.
Adds the REVERSE_PROXY_PASS_REQUEST_BODY setting to control if the request body should be passed to the upstream server (default is yes).
Allows controlling job history size via the DATABASE_MAX_JOBS_RUNS setting (default is 10000), with future UI visibility.
+15 moreshow less
Adds HTTP/3 connections limiting via the HTTP3_CONNECTIONS_LIMIT setting (default is 100) in the limit plugin.
Adds a new templating feature to quickly override default values of settings and custom configurations, including UI steps for service configuration.
Allows setting a custom timezone for every service via the TZ environment variable, applying to logs and database date fields.
Enables running plugins jobs in async mode by setting the async key to true in the plugin job configuration (default is false).
Adds Let's Encrypt DNS challenges support.
Adds the REMOTE_PHP_PORT setting to control the port used by the remote PHP feature (default is 9000).
Updates the scheduler to use the BUNKERWEB_INSTANCES environment variable (replacing OVERRIDE_INSTANCES) for instance configuration.
Adds the NAMESPACES environment variable to the autoconf feature for setting namespaces to watch in multi-instance clusters.
Adds the USE_KUBERNETES_FQDN environment variable (default is yes) to use FQDNs instead of IPs for instance hostnames in Kubernetes.
Adds support for Fedora 41 and drops support for Fedora 40.
Refactors the UI to be more modular and easier to maintain.
Adds a remember me feature to the login page, keeping users logged in for 31 days.
Adds the TOTP_SECRETS setting to encrypt TOTP secrets in the database; recommends setting a custom value to prevent erasure on volume deletion.
Makes the 2FA feature more user-friendly and adds recovery codes for lost access.
Refactors UI log handling to read directly from /var/log/bunkerweb instead of using integration-specific logic.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!Fedora 40 is no longer supported; systems on Fedora 40 must migrate to Fedora 41 or another supported platform.
Frida 16.5.8 improves Fruity backend network performance and GIR generation.
Fruity: Multi-transfers boost data transfer efficiency
Fruity: Userspace NCM driver batching reduces packet loss in bursty situations
Fruity: Enable lwIP TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. timestamps and SACK to align with Linux IP stack defaults
Fruity: Bump lwIP TCP Maximum Segment Size (MSS) to 4036 for better TCP tunnel performance
Fruity: Account for frida-server bind() delay to improve connection establishment reliability
+4 moreshow less
Fruity: Improve USB device handling on non-macOS systems by avoiding unnecessary USB access when kernel NCM is available
Fruity: Improve TcpTunnelConnection teardown to ensure proper cleanup upon the remote end closing the connection
api: Generate a proper GObject Introspection Repository (GIR), including necessary types and omitting internal ones
CHIPSEC 1.13.8 adds SamplePart detection, statistical SMI enumeration, PCH 700-series support, and a live USB build system.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.8 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.8
Adds SamplePart control check to the debugenabled module to detect engineering/sample silicon.
Adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. sample-part detection to the sgx_check module.
Introduces statistical SMI enumeration using standard deviation for more reliable SMI discovery.
Adds live USB automatic build support via mkosi.
Adds PCH 700-series Device IDs (DIDs) to the PCH 600-series config, extending platform coverage.
+1 moreshow less
Adds a utility to decode test names and IDs from test output.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Python minimum requirement raised from 3.7 to 3.8; setups running Python 3.7 will no longer work.
EMBA v1.5.1 adds Rust binwalk as the initial extraction engine and enhances SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.1-rise-from-the-dead https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout v1.5.1-rise-from-the-dead
└──▷ TRY IT
Leverage the speed of the new Rust binwalk engine for initial firmware extraction during an analysis run.
$ ./emba -l ~/log -f ~/firmware
Integrates the rewritten Rust-based binwalk (v3) as the initial extractor in the extraction pipeline
Enhances the SBOM engine with a new JSON output format, dependency handling, untracked file inclusion, and optimized static version detection
Corellium 7.1.0 adds iOS 18.1.1/18.2 support, Android 15, dark mode UI, and new static analysis checks for network, crypto, storage, platform, and artifacts.
Adds History Page filtering options to improve navigation
ImHex v1.36.2 adds automatic content store updates after upgrades and a quicker way to close the command palette.
└──▷ GET THIS VERSION
$ git clone --branch v1.36.2 https://github.com/WerWolv/ImHex.git
# already have the repo? check out this version:$ git checkout v1.36.2
Automatically updates all content store downloads when ImHex itself is updated.
Enables closing the command palette by clicking on the menu bar.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!All customized keyboard shortcuts are force-reset to their defaults on upgrade to clear shortcut issues (a one-time reset; shortcuts can be re-customized afterwards).
2 more releases in this issue
· 2024-12-24 → 2024-12-28
Adds CloudResourceManager OrgPolicy support for organizational policy management
└──▷ GET THIS VERSION
$ git clone --branch 20241207 https://github.com/google/cloud-forensics-utils.git
# already have the repo? check out this version:$ git checkout 20241207
1 more release in this issue
· 2024-12-05 → 2024-12-10
Adds the get_project_metadata library function to retrieve GCP project details.
└──▷ GET THIS VERSION
$ git clone --branch 20241205 https://github.com/google/cloud-forensics-utils.git
# already have the repo? check out this version:$ git checkout 20241205
└──▷ USE IT
Retrieve details like creation time and labels for a specific Google Cloud project.
python
from cloud_forensics.utils import get_project_metadata
metadata = get_project_metadata('my-gcp-project-id')
Cortex Analyzers 3.4.2 adds Cluster25, Axur IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and ValidateObservable analyzers plus CrowdStrike custom user-agent support.
└──▷ GET THIS VERSION
$ git clone --branch 3.4.2 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.4.2
Adds Cluster25 (c25) Cortex analyzer for threat intelligence enrichment.
Adds Axur IOC analyzer for observable enrichment against Axur's threat intelligence.
Adds ValidateObservable analyzer to validate observables before processing.
Implements TheHive custom user-agent across CrowdStrike Falcon integrations.
4 details in Everything
2 more releases in this issue
· 2024-12-09 → 2024-12-26
Capa Analyzer gains auto-download of the latest capa binary; PhishTank analyzer adds proxy support.
└──▷ GET THIS VERSION
$ git clone --branch 3.4.1 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.4.1
Adds proxy support to phishtank_checkurl.py, enabling PhishTank URL checks through an HTTP proxy.
Capa Analyzer now auto-downloads the latest capa binary, removing the need to manually provision it.
cortex-analyzers 3.4.0 adds multiple analyzers and responders for CrowdStrike Falcon.
└──▷ GET THIS VERSION
$ git clone --branch 3.4.0 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.4.0
iLEAPP v2.0.2 adds PayByPhone parsing, Trusted Peers DB, call history temp merging, and new SQLite/file helper APIs
└──▷ GET THIS VERSION
$ git clone --branch v2.0.2 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v2.0.2
Adds new get_sqlite_db_records(path, query) function in ilapfuncs.py for streamlined SQLite querying across modules
Adds new get_file_path function in ilapfuncs.py for safer artifact file resolution
Adds PayByPhone module to parse parking payment app artifacts
Adds Trusted Peers Database module for parsing iCloud trust relationship data
Merges callHistoryTemp artifacts into the main callHistory module, surfacing temporary call history records alongside permanent ones
+3 moreshow less
Adds iOS-version-aware file detection to select the correct artifact file based on the device's iOS version
Improves kmlgen function with enhanced KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. generation capabilities for location artifact mapping
Adds admin scripts to audit and verify which modules parse SQLite databases
8 details in Everything
└──▷ BREAKING ON UPGRADE
!filesApps.py is renamed to filesApp.py — any external scripts or references pointing to filesApps.py will break.
Release 8.33 improves field efficiency by enabling direct EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. analysis via a new built-in viewer and enhancing system artifact parsing.
Malcontent v1.6.0 adds .deb/.rpm support, Java detection, BubbleTea TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., and fixes xz scanning
└──▷ GET THIS VERSION
$ git clone --branch v1.6.0 https://github.com/chainguard-dev/malcontent.git
# already have the repo? check out this version:$ git checkout v1.6.0
Add support for .deb and .rpm files — now scans RPM and Debian package archives directly.
Add new BubbleTea TUI renderer — provides an interactive terminal UI for scan progress and results.
Initial Java support (particularly credential stealers) — extends detection engine to identify Java-based malware patterns.
hollows_hunter v0.4.0 adds ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. listener mode via /etw flag and new PE-sieve CLI params
└──▷ GET THIS VERSION
$ git clone --branch v0.4.0 https://github.com/hasherezade/hollows_hunter.git
# already have the repo? check out this version:$ git checkout v0.4.0
/etw flag enables ETW listening mode in hollows_hunter (64-bit only)
HH_ETWProfile.ini controls which ETW event types are listened to
/rebase and /report flags added via updated CLI following PE-sieve changes
Cortex Analytics 2024.11.20 adds detection for Azure Service Principal creation, Azure application removal, Okta account unlock by admin, and potential Okta access limit brea
Adds new Medium Analytics BIOC: Suspicious Kubernetes pod token access
Adds new Low Analytics BIOCs: A process queried the ADFS database decryption key via LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Potential SCCM credential harvesting using WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. detected, Unusual Encrypting File System Remote call (EFSRPC) to domain controller
Adds new Informational Analytics BIOCs: Service Principal was created in Azure, Azure application removed, Azure group creation/deletion, Azure permission delegation granted, Data encryption was disabled, Member added to a Windows local security group, Okta account unlock by admin, Potential Okta access limit breach
Adds new Informational Analytics Alert: Okta account unlock
Prisma Cloud v24.12.1 adds Action Plans, Secrets asset search, AISPM AI benchmarks, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v4.0.1, and APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. APIs
Adds Action Plans feature to programmatically group multiple alerts related to a single affected asset into one actionable plan with prioritization, execution delegation, detailed visibility, and security fix efficiency using machine learning.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The aws-polly-voices API is deprecated; Prisma Cloud will no longer ingest metadata for this API, and the api.name attribute auto-completion will not include it.
Adds guest network NAT mode, power-related stats views in Central and AP6 UI, show status power CLI command, and reboot_reason.txt logging for Sophos Access Points.
└──▷ TRY IT
View current power and PSE status via CLI on an AP6.
$ show status power
Views power-related statistics and connected PSE information on the AP6 UI System Information page and via the show status power CLI command
Records the access point restart reason in the /tmp/reboot_reason.txt log file upon reboot
Sophos Central adds loopback detection, DoS protection, log settings, and pagination for Switch management
└──▷ HOW TO FIND IT
Enable automatic loopback detection to prevent network loops on managed switches.
📍Navigate to Switch management › Port Settings and enable Loopback detection.
Configure DoS protection rules for specific switch ports via Sophos Central.
📍Navigate to Switch management › Security and configure DoS settings.
Filter log messages by severity for RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. logs in the switch overview.
📍Navigate to Log settings and set the severity level for RAM logs.
Switch management > Port Settings now includes loopback detection to automatically shut down ports receiving packets from themselves.
Switch management > Security allows configuration of Denial-of-Service (DoS) protections against common attacks.
Switch management log settings enable configuration of severity levels for RAM and flash logs.
Pagination added to switch/site overview and Task queue with configurable page sizes (10, 25, or 50 items).
Sophos Firewall 20.0 MR3 adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. support and a new CLI command to clear missing heartbeat endpoint status.
Adds a new CLI command to remove the missing heartbeat status for endpoints based on the number of days their heartbeats have been missing, or by specifying individual endpoint names.
Enables FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 level 1 compliance mode using a certified cryptography library on XGS Series hardware appliances and cloud/virtual firewalls.
Aviatrix CoPilot 4.16.0 adds Hostname SmartGroup support, custom DNS resolution for non-HTTP/S, and auto right-sizing controls.
Adds Hostname resource type to SmartGroups so you can create SmartGroups based on hostnames instead of IP addresses.
Adds the DNS Server for Hostname Resolution card under Groups > Settings to select a custom DNS server or the Gateway's default for resolving SmartGroup hostnames in non-HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic.
Adds enable/disable toggle for the Auto Right-Sizing feature via Cloud Fabric > Scaling > Auto Right-Sizing > Auto Right-Sizing Settings dialog.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Security > Egress > Monitor is renamed to FQDN Monitor (Legacy).
OpenSnitch v1.6.7 adds connection detail display, custom event columns, and Qt plugin config via UI.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.7 https://github.com/evilsocket/opensnitch.git
# already have the repo? check out this version:$ git checkout v1.6.7
└──▷ HOW TO FIND IT
Inspect full connection metadata for a specific event in the firewall log.
📍In the Events tab, enable All details column to see complete connection info.
Fix pop-up crashes on Wayland by switching the Qt platform plugin via the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
📍Open Preferences -> UI tab and select xcb as the Qt platform plugin.
Adds the ability to display all details of connections in the GUI events view
Allows configuring which columns to display in the Events tab under Preferences -> UI
Enables configuring the Qt platform plugin from the GUI to resolve Wayland erratic behavior
$ git clone --branch 3.11.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.11.0
└──▷ TRY IT
Strip attachments from a message in a pipeline — useful for sanitizing inbound mail before archiving or forwarding.
$ rspamadm mime strip <path/to/message.eml>
Adds support for Elasticsearch 8 and OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. 2 in the Elasticsearch/OpenSearch plugin.
Adds index policy with log retention support to the Elasticsearch/OpenSearch plugin.
Adds LRU cache for last-filled ratelimit buckets, improving ratelimit performance at scale.
Adds utilities to manage ratelimit buckets directly.
Adds rspamadm mime strip command for removing attachments from messages.
+6 moreshow less
Adds new message anonymization capabilities.
Adds include/exclude logic for headers processing.
Adds lua.local.d folder and other new ways to extend Rspamd configuration.
Replaces fastutf with simdutf for broader architecture support and improved Unicode performance.
Skips extra RBLRBLA DNS-based blocklist of IP addresses known to send spam or host malicious traffic, maintained by various operators, used by cyber tools to reject or flag connections from listed sources at lookup speed. checks when the Received IP matches the From IP, reducing redundant lookups.
Multimap now uses only distinct text parts for content matching.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The Elasticsearch/OpenSearch plugin has a reworked configuration format — existing plugin configuration will break on upgrade.
Snort 3.6.1.0 adds fallback functionality for DNS, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., and POP inspectors with improved reload-config logging.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.1.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.6.1.0
Adds fallback functionality to the DNS inspector for graceful handling of unexpected traffic.
Adds fallback functionality to the SMTP inspector for invalid commands and responses.
Adds a wrong-bytes threshold to the POP splitter to trigger fallback behavior on malformed traffic.
Adds a re_eval flag to fileinfo in the file API, enabling re-evaluation of file inspection state.
Improves logging of reload_config arguments for better operational visibility during live config reloads.
5 details in Everything
1 more release in this issue
· 2024-12-05 → 2024-12-30
Snort3 3.6.0.0 adds a stdio connector, flow-end events, MIME hostname/URL enrichment, and resource-tuning logging.
└──▷ GET THIS VERSION
$ git clone --branch 3.6.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.6.0.0
Adds a standard I/O connector along with a connector API update, enabling new pipeline integration options.
Publishes flow end events, allowing downstream components and connectors to react to connection teardown.
Enriches HTTP with MIME traffic by adding hostname and URL fields to http_inspect and MIME inspection output.
Adds logging for resource tuning progress in the analyzer, making capacity-planning feedback visible at runtime.
Adds full path support when reading the list of Lua detectors in AppID.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The semicolon HTTP parameter delimiter has been removed from http_inspect; configurations or rules relying on semicolon-delimited http_param parsing will no longer work as before.
Zeek v7.1.0 adds PostgreSQL & StreamEvent analyzers, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster backend, and per-peer Broker backpressure controls.
└──▷ GET THIS VERSION
$ git clone --branch v7.1.0 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v7.1.0
└──▷ TRY IT
Disable the new PostgreSQL analyzer if it causes high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. in environments with heavy PostgreSQL traffic until it stabilizes.
Switch a cluster node to the experimental ZeroMQ backend and tune per-peer Broker buffer overflow policy for remaining Broker peers.
$ @load frameworks/cluster/backend/zeromq/connect
# Or, to keep Broker but tune backpressure:
redef Broker::peer_buffer_size = 4096;
redef Broker::peer_overflow_policy = "drop_oldest";
Adds a PostgreSQL protocol analyzer enabled by default, generating postgresql.log with associated events.
Adds a StreamEvent pseudo protocol analyzer that exposes raw TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream data to the scripting layer via the new stream_deliver() event.
Adds an experimental ZeroMQ-based cluster backend as a drop-in alternative to Broker publish-subscribe.
Adds new Cluster::publish(), Cluster::subscribe(), and Cluster::unsubscribe() functions that operate on whichever cluster backend is enabled.
Logs previously invisible IP connections using unknown IP protocols (e.g. not TCP/UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./ICMP) in conn.log with a new ip_proto column; optional ip_proto_name column available via policy script.
+16 moreshow less
Adds per-peer Broker I/O buffer management with configurable overflow policies (disconnect, drop_newest, drop_oldest) and new tunables peer_buffer_size, peer_overflow_policy, web_socket_buffer_size, and web_socket_overflow_policy.
Adds backpressure disconnect telemetry via the new zeek_broker_backpressure_disconnects_total labeled counter metric.
Adds StartTLS support to the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. analyzer, enabling SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection for connections negotiated via extended request/response.
Extends the LDAP analyzer to handle non-sealed GSS-API WRAP tokens.
Adds support for TKEY resource records (RFC 2390) to the DNS analyzer, with a new dns_TKEY event.
Adds a new DNS_unknown_opcode weird to report unrecognized DNS opcodes.
Extends the unknown_protocols() event and unknown_protocol.log to include the names of all packet analyzers used for processing.
Adds a mysql_user_change() event to the MySQL analyzer when a user changes mid-session via COM_USER_CHANGE.
Extends signature_match() and custom signature events with an optional end_of_match parameter indicating the end-of-match offset within data.
Adds a new InitPreExecution() plugin hook for ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. introspection after ZAM optimizations, executing before zeek_init() is enqueued.
Adds SQLite journal mode and synchronous mode configuration to the SQLite logger, including WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. mode support via LogSQLite::journal_mode.
Adds experimental support for pluggable cluster backends and pluggable serialization formats for events and log-writes.
Ships an experimental Spicy-based SSL/TLS analyzer (disabled by default), enabling full SSL/TLS parsing via --enable-spicy-ssl.
Exposes the majority of stats.log metrics through the Telemetry framework and Prometheus output.
Adds Log::flush_interval and Log::write_buffer_size options to control batching and flushing for local log writers.
FTP PASS command logging in ftp.log now honors FTP::default_capture_password, blanking passwords with <hidden>.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!The OpaqueVal::DoSerialize and OpaqueVal::DoUnserialize methods have been removed; plugins overriding them will fail to compile and must be updated to override OpaqueVal::DoSerializeData and OpaqueVal::DoUnserializeData instead.
!Internal broker and logging class methods now accept std::vector<threading::Value> instead of threading::Value**; plugins using these internal methods (not DoWrite()/HookLogWrite()) must be updated.
!Func::Name() is deprecated; use Func::GetName() instead.
Malcolm v24.12.0 adds a system testing framework, threat intel feed config options, and PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.-level NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. enrichment control.
└──▷ GET THIS VERSION
$ git clone --branch v24.12.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.12.0
└──▷ HOW TO FIND IT
Disable NetBox enrichment for a specific PCAP batch upload when you want raw traffic analysis without asset-context tagging.
📍In the Malcolm upload page, locate the NetBox enrichment toggle and disable it before submitting your current batch of PCAPs.
Adds configuration script options for pulling from threat intel feeds.
Adds an option on the upload page to disable NetBox enrichment for the currently-uploaded batch of PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic..
Exposes more of the Logstash API passthrough to the Malcolm API.
Improves the Indices, Ready, and Document Ingest Statistics APIs.
Prompts during configuration whether to enable capture statistics.
+4 moreshow less
Adds a simple readiness indicator to the upload page.
Adds additional EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. fields to the index template.
Launches malcolm-test, a Malcolm system testing framework.
Updates NetBox to v4.1.8 (major update from the v4.0.x series).
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.58.0 adds workspaceRelationship to scan responses, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4 support, and Private Packagist secrets detection.
└──▷ GET THIS VERSION
$ git clone --branch 0.58.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.58.0
Add workspaceRelationship to scan response JSON structure
Include CVSS v4 scores and vectors in scan results when available
Add built-in secrets detection rules for Private Packagist sources
Construct Go module dependencies directly in the parser for better accuracy
Inspektor Gadget v0.35.0 adds deadlock detection, a new fdpass gadget, WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. map APIs, and TID/exepath fields.
└──▷ GET THIS VERSION
$ git clone --branch v0.35.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.35.0
└──▷ TRY IT
Trace file-descriptor passing between processes (e.g. to audit privilege hand-off via SCM_RIGHTS).
$ ig run gadgets/fdpass
New fdpass gadget traces file-descriptor passing between processes.
New deadlock gadget detects deadlocks by finding cycles in mutex wait directed graphs, with PID-based filtering and dead-process handling.
Adds WASM API functions to create, close, and manipulate eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. maps from WASM gadgets.
Adds Unreference (formerly SetRequested) and AddTags methods to the WASM API for datasource and field accessor control.
Enhances version command output with JSON format support.
+4 moreshow less
Adds Thread ID (TID) field to execsnoop and open gadgets.
Adds exepath field to the trace_exec image-based gadget.
Expands exec argument capture to support up to 256 bytes per argument.
Monitoring tooling now uses an OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics exporter.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!JSON output for image-based gadgets now nests process-related fields (comm, pid, tid, uid, gid, pcomm, mntns_id) under a proc leaf node; consumers must update their unmarshaling logic. Built-in gadgets under pkg/gadgets/ are not affected.
cilium upgrade now supports --reset-then-reuse-values flag to control Helm value merging behavior
└──▷ GET THIS VERSION
$ git clone --branch v0.16.22 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.16.22
└──▷ USE IT
Explicitly retain existing Helm values during an upgrade without the new default reset behavior
shell
cilium upgrade --reset-then-reuse-values=false
Force a complete Helm value reset during an upgrade to ensure a clean slate
shell
cilium upgrade --reset-values
└──▷ BREAKING ON UPGRADE
!The default behavior for cilium upgrade has changed such that Helm values will be reset and then reused; previous behavior can only be restored by setting --reset-then-reuse-values=false or explicitly using --reuse-values/--reset-values.
1 more release in this issue
· 2024-12-06 → 2024-12-11
cilium-cli v0.16.21 adds kubectl impersonation flags, AWS AL2023 support, and a new ipcache lookup by label/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network..
└──▷ GET THIS VERSION
$ git clone --branch v0.16.21 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.16.21
Adds --as and --as-group flags for kubectl-style impersonation across cilium-cli commands.
Adds AWS AL2023 platform support for cilium-cli installs.
New CLI option to display ipcache information filtered by labels or CIDR.
Default Cilium version to install is now derived from cilium/charts source instead of being injected at compile time via -ldflags.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for running the Cilium KVStore in pod network is disabled; setups relying on this deprecated mode will break.
The cri-tools project provides command-line and validation tools for the Kubelet Container Runtime Interface (CRI).
crictl v1.32.0 adds TLS for exec/attach, parallel container/image removal, multi-container exec, namespace filtering, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./mem profiling flags.
└──▷ GET THIS VERSION
$ git clone --branch v1.32.0 https://github.com/kubernetes-sigs/cri-tools.git
# already have the repo? check out this version:$ git checkout v1.32.0
└──▷ TRY IT
Secure a streaming session to a container when the CRI runtime requires mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication.
Adds TLS support for crictl exec, portforward, and attach via --tls-ca, --tls-cert, --tls-key, and --tls-server-name flags.
Adds --profile-cpu and --profile-mem flags to crictl for on-demand CPU and memory profiling.
Enables crictl exec to run a single command across multiple containers simultaneously using new --image, --label, --last, --latest, --name, --pod, or --state filter flags.
Adds --quiet/-q, --ignore-error/-e, and --parallel/-x flags to crictl exec for quieter, fault-tolerant, parallel execution.
Adds --namespace flag to crictl ps and crictl inspect for filtering by pod namespace.
+4 moreshow less
Outputs container namespace in crictl ps table and verbose output.
Grype v0.86.0 adds missing package info to SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. reports and drops legacy DB schemas v1 & v2.
└──▷ GET THIS VERSION
$ git clone --branch v0.86.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.86.0
Adds missing package information fields to SARIF report output.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!DB v1 and v2 schemas are removed; any setup relying on these legacy database schema versions will break on upgrade.
Gatekeeper v3.18.0 promotes CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-based policies to GA, adds Config pod status, gator sync/expansion test support, and admission/audit stats logging.
└──▷ GET THIS VERSION
$ git clone --branch v3.18.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.18.0
└──▷ USE IT
Ensure your audit deployment generates CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and VAP/VAPBs after the new required generate operation is enforced.
CEL-based policies enforced through Gatekeeper (Validating Admission Policy) are now generally available.
Adds logStatsAdmission and logStatsAudit options to the Helm chart for admission and audit statistics logging.
Implements Config pod status reporting for visibility into Config resource health.
Adds generate operation to guard CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and VAP/VAPB generation, enabling explicit control over resource generation.
Supports expansion testing in gator verify, allowing policy expansion scenarios to be validated offline.
+3 moreshow less
Adds sync resource support to gator test commands via gator sync test.
Adds commonLabels support for Gatekeeper Deployments in the Helm chart.
Container images are now also published to ghcr.io in addition to existing registries.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The generate operation is now required to guard CRD and VAP/VAPB generation; existing singleton deployments (e.g. gatekeeper-audit) must add --operation=generate or CRD/VAP/VAPB resources will not be generated.
Introduces a restart watch action that restarts a container when watched files change, without rebuilding the image.
Introduces a sync+exec watch action that syncs files into a running container then executes a command, enabling hot-reload workflows without a full restart.
Automatically recreates containers when volume configuration changes, eliminating the need for manual intervention on volume updates.
Kata Containers 3.12.0 adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. builder images, kata-deploy multi-install support and containerd v3 config
└──▷ GET THIS VERSION
$ git clone --branch 3.12.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.12.0
qemu runtime upgrades to QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. 9.1.2
kata-deploy gains multi-install support for multiple Kata installations on one host
kata-deploy supports containerd configuration version 3 via drop-in files
Prowler 5.0 adds a full UI, APIs, SDKs, persistent storage, continuous monitoring, 1,000+ controls, and AI-driven check generation.
└──▷ GET THIS VERSION
$ git clone --branch 5.0.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.0.0
└──▷ TRY IT
Stand up the full Prowler platform locally — UI, API, and persistent storage — without any cloud dependency.
$ docker compose up -d
Run the CLI-only scanner as before using pipx, unchanged from prior versions.
$ pipx install prowler
New web UI component unifies scan results and enables drill-down into findings across AWS, Azure, GCP, and Kubernetes.
New REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. expose scan and findings data for programmatic use cases.
New SDKs enable seamless integration and automation of Prowler workflows.
Persistent storage for scan reports ensures findings are retained and always accessible.
Supports continuous monitoring mode alongside traditional one-time ad-hoc assessments.
+3 moreshow less
Expands detection and remediation library to over 1,000 security controls across AWS, Azure, Google Cloud, and Kubernetes.
AI-driven control creation automatically generates new detection checks and remediations.
Full platform now deployable on-premises via docker compose up -d, serving the UI at https://localhost:3000.
cloud-nuke v0.38.0 adds China region support, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure., ElastiCache Serverless, Grafana, and TGW Peering Attachment resources.
└──▷ GET THIS VERSION
$ git clone --branch v0.38.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.38.0
Adds support for AWS China region, enabling cloud-nuke to target China-region resources.
Adds EventBridge resource support for discovery and nuking of EventBridge resources.
Adds ElastiCache Serverless and Grafana as nukeable resource types.
Adds Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. Peering Attachment as a nukeable resource type.
Adds support for a cloud-nuke-excluded tag on VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. to protect them from being nuked.
Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.
Tetragon v1.3.0 adds IMA hashes in LSM events, CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. filters, ABI-aware syscall64 events, and new process-tree tracking flags.
└──▷ GET THIS VERSION
$ git clone --branch v1.3.0 https://github.com/cilium/tetragon.git
# already have the repo? check out this version:$ git checkout v1.3.0
└──▷ TRY IT
Inspect BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. map kernel memory usage broken down by tracing policy to identify high-overhead policies.
$ tetra tp list
Temporarily preserve legacy syscall64 size_arg output format while updating consumers to handle the new SyscallId ABI-aware format.
Adds IMA hash information to LSM events for file integrity visibility.
Adds support for associating pod information when nested cgroups are used.
Adds ABI information to syscall64 type events — output now uses a SyscallId object with id and abi fields to distinguish 64-bit and 32-bit syscalls unambiguously.
Adds support for tracing 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. (aarch32) syscalls.
Adds all operator support (including Mask) for the syscall64 tracing policy type.
+19 moreshow less
Adds BPF operations support in tracing policies (tracingpolicy).
Adds a Common Expression Language (CEL) filter for event export, including IP and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. helper functions.
Adds a regex filter type for parent process arguments.
Introduces the in_init_tree flag on process events indicating whether a process spawned from its container's init process tree.
Introduces a container_id export filter and an in_init_tree export filter.
Exposes BPF map kernel memory use per tracing policy via the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API and the tetragon_tracingpolicy_kernel_memory_bytes metric.
Adds an optional cluster_name field to GetEventsResponse in the protobuf API.
Adds tetragon_enforcer_missed_notifications_total metric for the enforcer.
Adds metrics for LRU data cache.
Adds overhead metrics for BPF programs.
Adds version information to build information metrics.
Adds tetra debug progs command for inspecting loaded BPF programs.
Adds BPF program type information to the API.
Allows multiple symbol instances in kprobe specs.
Enables matchBinary names to use process arguments as match criteria.
Adds policy filter support for the cgroup tracker (cgtracker).
Adds shortnames and category labels for Tetragon CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
Enables tetra bash autocompletion inside the Tetragon container image.
Adds an enabled switch in the Helm chart to control the gops server (now disabled by default).
24 details in Everything
└──▷ BREAKING ON UPGRADE
!The syscall64 type now outputs a SyscallId object ({"syscall_id":{"id":309,"abi":"x64"}}) instead of a bare size_arg; consumers parsing raw size_arg fields will break. Use --enable-compatibility-syscall64-size-type to preserve the old behavior temporarily (flag removed in v1.4).
!The tetragon_ratelimit_dropped_total metric is renamed to tetragon_export_ratelimit_events_dropped_total; any dashboards or alerts referencing the old name will stop receiving data.
!The --expose-kernel-addresses flag has been removed; agents using this flag will fail to start.
!The --pprof-addr flag has been removed; agents using this flag will fail to start.
!The --enable-process-ancestors flag has been removed; agents using this flag will fail to start.
!The behavior of --export-file-perm (and Helm value tetragon.exportFilePerm) changed: on log rotation Tetragon will now enforce the specified permissions on existing export files, whereas previously existing file permissions were preserved. Verify the existing export file permissions match the configured value (default 600) before upgrading.
MSTICPy v2.15.0 adds multi-dimensional outlier visualizations and federated auth improvements for M365D/Graph providers.
└──▷ GET THIS VERSION
$ git clone --branch v2.15.0 https://github.com/microsoft/msticpy.git
# already have the repo? check out this version:$ git checkout v2.15.0
└──▷ USE IT
Detect and visualize outliers across multiple numeric features — useful when hunting anomalies in multi-variate log telemetry without collapsing to a single score.
python
from msticpy.analysis.outliers import identify_outliers, plot_outlier_results
import numpy as np
data = np.random.rand(100, 7)
feature_columns = [f'feature{i}' for i in range(1, 8)]
clf, X_outliers, y_pred_outliers = identify_outliers(data, data, contamination=0.1, max_features=0.4)
plot_outlier_results(
clf,
data,
data,
X_outliers,
feature_columns=feature_columns,
plt_title="Isolation Forest Anomaly Detection for Multi Dimension Features"
)
Adds multi-dimensional plot support to analysis.outliers via plot_outlier_results, enabling visual interpretation of Isolation Forest anomaly detection across N-dimensional feature sets.
Improves federated authentication (delegated auth) support in the MDATP/Defender data provider, with cleaned-up code alongside the existing documentation.
MISP v2.5.4 flattens Analyst Data structures, adds analyst/event-report metrics, and expands tag collection support.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.4 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.4
Analyst Data objects (Notes, Opinions) are now flattened lists attached to their data layer instead of nested, improving API consistency across endpoints and views.
Adds new statistics metrics for analyst data and event reports.
Supports adding combinations of tag collection tags and other tags simultaneously on attributes.
The rest_client_baseurl setting is now CLI-only, restricting it from being configured via the web UI.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Security.disable_form_security setting has been removed; any configuration referencing it will silently lose that setting on upgrade.
!rest_client_baseurl is now CLI-only and can no longer be set through the web UI or REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. settings interface.
3 more releases in this issue
· 2024-12-17 → 2024-12-31
MISP v2.4.202 flattens Analyst Data structures, adds new metrics, and supports combined tag collection tagging.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.202 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.202
Analyst Data objects (Notes, Opinions) are now flattened lists attached to their data layer instead of nested, improving handling across endpoints and views.
Adds new metrics for analyst data and event reports in the Statistics section.
Supports adding combinations of tag collection tags and other tags simultaneously on attributes.
Adds a new setting to skip base URL coercion, enabling cleaner deployments of MISP under a subdirectory.
Adds Threatmon MISP Community to the community list.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!rest_client_baseurl is now CLI-only and can no longer be set via the web UI or API.
!Security.disable_form_security has been removed; any configuration referencing this setting will no longer be recognized.
MISP v2.5.3 adds protected-event feed exchange, instance-wide report variables, and a new arbitrary-data signing endpoint.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.3 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.3
└──▷ HOW TO FIND IT
Enable instance-wide report template variables so all analysts can reference shared context (e.g., CERT name, TLP defaults) in every event report without per-report duplication.
📍In the MISP console, go to Administration › Report Variables and create a new instance-wide variable (requires site administrator role).
Supports exchanging protected events via feeds.
Supports uploading protected events via the import MISP JSON functionality.
Adds a new endpoint to let the instance sign arbitrary data on demand, gated by a new role permission and ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting.
Introduces instance-wide template variables for reports, manageable only by site administrators but viewable and usable by all users.
Adds a CodeMirror editor placeholder plugin to display placeholders in the editor interface.
+4 moreshow less
Adds object count to instance statistics.
Adds UI and API export to display bound synchronization users in /users and /servers views.
Updates Redis serializer to default to JSON.
Restricts additional server settings to CLI-only for improved security.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The Redis serializer now defaults to JSON; existing installations should verify Redis serializer settings after upgrading.
MISP v2.4.201 adds protected-event feed exchange, instance-wide report variables, and a new data-signing endpoint.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.201 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.201
└──▷ HOW TO FIND IT
Create an instance-wide report template variable as a site admin so all users can reference it in event reports.
📍In the MISP UI, go to Administration › Report Variables and create a new instance-wide variable; it will be visible and usable by all users in event reports.
Supports exchanging protected events via feeds.
Supports uploading protected events via the import MISP JSON functionality.
Adds a new endpoint to let the instance sign arbitrary data on demand, gated by a new role permission and ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting.
Introduces instance-wide template variables for reports, manageable only by site administrators but viewable and usable by all users.
Adds object count to MISP instance statistics.
+2 moreshow less
Adds UI and API export to display bound synchronization users in /users and /servers views.
Adds a placeholder plugin to the CodeMirror editor interface.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The Redis serializer now defaults to JSON — existing installations should verify Redis serializer settings after upgrading.
Trend Vision One expands its automation capabilities by exposing public APIs for Container Security via the Automation Center, enabling programmable integration.
New outbound URLs added to Container Security firewall exceptions for global regions.
vcs-storage-<region>.xdr.trendmicro.com, upload.artifactscan.<region>.cloudone.trendmicro.com, and report.artifactscan.<region>.cloudone.trendmicro.com are new required outbound URLs for Container Security.
Legacy firewall rules ending in amazonaws.com and raw.githubusercontent.com are deprecated and should be removed.
Trend Vision One now generates PDF reports for true-positive Workbench cases with summaries, timelines, and recommendations
Companion can now generate PDF reports that include Workbench Insights summaries, threat activity timelines, actions taken, and recommendations to help security teams quickly understand and communicate investigation findings.
Workbench alerts now include MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. notifications.
Standard Endpoint Protection now includes new firewall exception rules for all regions.
Adds aurd-test2.activeupdate.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds support-connector-api.manage.trendmicro.com and support-connector-service.manage.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds supportconnectorpacks.manage.trendmicro.com to Standard Endpoint Protection firewall exceptions
Adds rpcollectedthings.blob.core.windows.net to Standard Endpoint Protection firewall exceptions
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Log Monitoring now supports AWS me-south-1 region.
Managed EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. partners can now request SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. phone support directly from the Huntress Portal via new incident report buttons
Adds a Request SOC Support button to the top right of all Managed EDR critical incident reports in the portal
Fibratus v2.3.0 adds an Eventlog alert sender, 10 new detection rules, richer process/thread/file filter fields, and a revamped YARA scanner.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.0 https://github.com/rabbitstack/fibratus.git
# already have the repo? check out this version:$ git checkout v2.3.0
Adds an Eventlog alert sender so rule detections can be forwarded directly to the Windows Event Log.
Augments process events and state with process creation flags for richer behavioural context.
Adds ps.creation_flags filter fields to write rules against process creation flag combinations.
Adds image.is_dotnet filter field to detect .NET image loads in filter expressions.
Adds teb parameter and thread.teb_address filter field to expose Thread Environment Block address in thread events.
+15 moreshow less
Adds additional file filter fields for finer-grained file event filtering.
Revamps the YARA scanner with restructured configuration.
New detection rule: AppDomain Manager injection via CLR search order hijacking.
New detection rule: .NET assembly loaded by an unmanaged process.
New detection rule: Potential injection via .NET debugging.
New detection rule: Hidden local account creation.
New detection rule: DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loaded via a callback function.
New detection rule: Process execution from a self-deleting binary.
New detection rule: Image load via NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. transaction.
New detection rule: DLL loaded via APC queue.
New detection rule: Hidden registry key creation.
New detection rule: Clear Eventlog.
Surfaces missing labels in the rules validation subcommand output.
Adds alert identifier to alert payloads.
Adds option to disable CLR metadata parsing.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!YARA configuration settings were restructured and some properties were removed — existing YARA config blocks must be updated to match the new layout.
Adds 12 new byte stream conversion operators to TQL2: write_csv, write_feather, write_json, write_lines, write_ndjson, write_parquet, write_pcap, write_ssv, write_tsv, write_xsv, write_yaml, and write_zeek_tsv.
Port of contexts to TQL2 with new module functions: context::enrich, context::list, context::create_lookup_table, context::create_bloom_filter, context::create_geoip, and context::update.
+15 moreshow less
New timeouts for TQL2 context updates via create_timeout, write_timeout, and read_timeout options.
Adds <list>.map(<capture>, <expression>) function to TQL2.
Adds <list>.where(<capture>, <predicate>) function to TQL2.
Adds record indexing with string expressions in TQL2.
Adds append, prepend, and concatenate functions for list manipulation in TQL2.
Adds split, split_regex, and join functions for string/list processing in TQL2.
Adds parse_time and format_time methods in TQL2.
Adds otherwise(<expr>, <expr>) function for null fallbacks in TQL2.
Adds encode_base64 and decode_base64 functions in TQL2.
Enables aggregation functions on lists in TQL2 (e.g., [1, 2, 3].sum()).
Adds --limit flag to the chart operator with a default of 10,000 events.
Adds encode_hex and decode_hex functions in TQL2.
Adds cacert, certfile, and keyfile options to the to_splunk operator for TLS configuration.
Porting of local, remote, and unordered operators to TQL2.
Adds zip function to merge two lists into records in TQL2.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!The functions ocsf_category_name, ocsf_category_uid, ocsf_class_name, and ocsf_class_uid are renamed to ocsf::category_name, ocsf::category_uid, ocsf::class_name, and ocsf::class_uid.
!The operators package_add, package_remove, packages, and show pipelines are renamed to package::add, package::remove, package::list, and pipeline::list.
!The cache operator options ttl and max_ttl are renamed to read_timeout and write_timeout.
!The tls_no_verify option for the to_splunk operator is renamed to skip_peer_verification.
!The ndjson option for the write_json operator is removed in favor of the new write_ndjson operator.
Splunk Security Content v4.44.0 adds 8 new analytics covering Microsoft Defender ATP, BitLockerToGo abuse, VaultCLI credential theft, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. activity, and RunMRU monitoring, plus 3 new threat stories.
└──▷ GET THIS VERSION
$ git clone --branch v4.44.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.44.0
New analytic: Microsoft Defender ATP Alerts — surfaces and summarizes alerts from Microsoft Defender Advanced Threat Protection.
New analytic: Microsoft Defender Incident Alerts — surfaces and summarizes Microsoft Defender O365 Incidents.
New analytics: Windows BitLockerToGo Process Execution and Windows BitLockerToGo with Network Activity — detect abuse of BitLockerToGo.exe by Lumma Stealer for registry manipulation, credential hunting, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
New analytic: Windows Credentials Access via VaultCli Module — flags suspicious use of VaultCLI.dll to extract credentials from the Windows Credential Vault, as seen in Meduza Stealer.
New analytics: Windows RDP File Execution and Windows RDPClient Connection Sequence Events — detect potentially suspicious Windows RDP activities.
+4 moreshow less
New analytic: Windows RunMRU Command Execution — monitors changes to the RunMRU registry key to catch malware-issued commands surfaced via the Windows Run dialog.
New Analytic Story: Lumma Stealer — groups detections covering Lumma Stealer TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind..
New Analytic Story: Meduza Stealer — groups detections covering Meduza Stealer TTPs.
New Analytic Story: PXA Stealer — groups detections covering PXA Stealer TTPs.
Sigma r2024-12-19 adds 12 new detection rules including CVE-2024-50623 (Cleo), Lummac Stealer, and QuickAssist abuse.
└──▷ GET THIS VERSION
$ git clone --branch r2024-12-19 https://github.com/SigmaHQ/sigma.git
# already have the repo? check out this version:$ git checkout r2024-12-19
New rule detects CVE-2024-50623 exploitation attempts against Cleo file-transfer products.
New rule detects Lummac Stealer activity via execution of More.com and Vbc.exe.
New rules detect QuickAssist abuse, covering both DNS queries and process execution.
New rule detects potential Right-to-Left Override (RTLO) file extension spoofing.
New rule detects suspicious Azure Front Door connections indicative of C2 or data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
+15 moreshow less
New rules cover AWS activity: key pair imports, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider deletions, RDS cluster modification/deletion, and new Lambda Function URL configurations.
New rule detects Setup16.EXE execution with a custom .lst file, a living-off-the-land technique.
New rule detects suspicious ShellExec_RunDLL calls via ordinal.
Updated DNS remote access rule adds coverage for getscreen.me.
Updated Linux file/directory discovery rule adds findmnt and mlocate binaries.
Updated Linux local account discovery adds less and emacs readers and /etc/pwd.db path.
Updated Linux password policy discovery adds /etc/pam.d/common-account, /etc/pam.d/common-auth, and /etc/pam.d/auth paths.
Updated Linux system user/owner discovery adds whoami, hostname, id, and last tools.
Updated Linux process discovery adds htop and atop.
Updated binary rename evasion rule adds ie4uinit.exe and msxsl.exe.
Sekoia Defend adds fullscreen MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Matrix visualization to detection rules page
databricks-agents SDK 0.13.0 allows specifying Databricks CLI profile and MLflow registry URI for deployment, adds secret-based auth to mlflow.evaluate()
Allows agents.deploy() and other APIs to honor the current active Databricks CLI profile and MLflow model registry URI by respecting DATABRICKS_CONFIG_PROFILE and MLFLOW_REGISTRY_URI environment variables.
Adds secret-based authentication support for clients in mlflow.evaluate().
External groups now labeled External and immutable by default in account console
External groups created via SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. are explicitly labeled as External
External groups can no longer be updated from the Databricks account console or workspace admin settings page by default
Adds Immutable external groups toggle in the account console preview page to allow updates to external group membership
3 details in Everything
└──▷ BREAKING ON UPGRADE
!External groups can no longer be updated from the Databricks account console or workspace admin settings page by default
vector_search function now accepts query_vector parameter for direct vector embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. inputs
vector_search AI Function supports query_text or query_vector parameters to search vector indexes
Meta Llama 3.3 is now available for Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. on provisioned throughput workloads
Databricks Jobs UI now displays streaming workload backlog metrics (seconds, bytes, records, files) for Spark Structured Streaming sources in Public Preview.
Unified login is now automatically enabled for accounts without SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.. It remains disabled only if the account had existing SSO configurations.
Mosaic AI Model Serving adds Meta Llama 3.3 70B Instruct with Function Calling support
Adds Meta-Llama-3.3-70B-Instruct to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. pay-per-token endpoints, replacing the deprecated Meta-Llama-3-70B-Instruct model.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The Meta-Llama-3.1-70B-Instruct model replaces Meta-Llama-3-70B-Instruct in Foundation Model APIs pay-per-token endpoints starting December 11, 2024.
Default maximum lifetime for Databricks personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. increased to 730 days
Google SecOps ATI adds Inbound IP Address Authentication rule set to identify inbound authentications to local infrastructure.
└──▷ HOW TO FIND IT
Monitor your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. dashboard for the new ATI rule set to detect inbound authentication attempts from external IPs.
📍In Google SecOps, go to Applied Threat Intelligence and view queries for Inbound IP Address Authentication.
2 more releases in this issue
· 2024-12-22 → 2024-12-27
New log parsers added for CrowdStrike, Azure AD, GitHub, GitLab, ServiceNow and other providers to Google SecOps Chronicle.
└──▷ HOW TO FIND IT
Ingest GitHub audit logs to monitor repository changes and user activity in Google SecOps.
📍Configure the Chronicle parser connector for Collect GitHub audit logs via the UI.
Monitor AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and Defender for Cloud alerts by enabling their respective log collectors.
📍Enable 'Collect Microsoft Defender for Cloud alert logs' and Collect Azure DevOps audit logs in the integration settings.
Collect network security events from Palo Alto Networks Prisma Cloud to correlate with endpoint telemetry.
📍Set up the 'Collect Palo Alto Prisma Cloud alert logs' parser configuration.
Adds support for ingesting CrowdStrike Detection logs
Adds Collect Microsoft Azure AD Audit logs capability
Adds Collect Microsoft Azure AD Context logs capability
Adds ability to ingest Chrome Enterprise Premium data
Adds support for Ansible AWX logs
+36 moreshow less
Adds Collect Atlassian Bitbucket logs support
Adds Collect Atlassian Jira logs support
Adds Collect Auth0 logs support
Adds Collect Azion firewall logs support
Adds Collect Azure DevOps audit logs support
Adds Collect GitHub audit logs support
Adds Collect GitLab logs support
Adds Collect Microsoft Defender for Cloud alert logs support
Adds Collect Microsoft Graph activity logs support
Adds Collect Microsoft Sentinel logs support
Adds Collect Twingate VPN logs support
Adds Collect Wordpress CMS logs support
Adds Collect CrowdStrike IOC logs support
Adds Collect Jenkins logs support
Adds Collect Wazuh logs support
Adds Collect OpenCanary logs support
Adds Collect Synology logs support
Adds Collect Palo Alto Networks IOC logs support
Adds Collect Fastly WAF logs support
Adds Collect MISP IOC logs support
Adds Collect ntopng logs support
Adds Collect Cloudflare logs support
Adds Collect Palo Alto Prisma Cloud alert logs support
Shuffle nightly adds auto-scaling, a redesigned App page, and automatic TLS cert mounting to workers.
└──▷ GET THIS VERSION
$ git clone --branch nightly-14122024 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout nightly-14122024
Adds auto-scale support for on-premises worker deployments.
Introduces a redesigned App page with updated modals for browsing and creating apps.
Mounts TLS certificates to each worker container automatically.
Updates docker-compose to use Docker Swarm mode by default.
Adds a synced app creation modal for streamlined app onboarding.
+1 moreshow less
Introduces a redesigned Workflow page UI.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The docker-compose configuration now uses Docker Swarm mode by default, which may break existing single-host Docker Compose deployments that are not configured for Swarm.
Stratus Red Team v2.20.0 adds two new AWS attack techniques for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. serial console abuse and STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. federation token persistence.
└──▷ GET THIS VERSION
$ git clone --branch v2.20.0 https://github.com/datadog/stratus-red-team.git
# already have the repo? check out this version:$ git checkout v2.20.0
└──▷ TRY IT
Detonate the EC2 serial console SSH key injection technique to test lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. detections in your AWS environment.
New attack technique: simulate lateral movement via EC2 Serial Console by pushing an SSH public key to multiple instances using SendSerialConsoleSSHPublicKey.
New attack technique: simulate persistence by generating temporary AWS credentials with GetFederationToken via STS federation.
December 2024 release adds Attack Surface Management connectors, Remediation Hub, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. vulnerability groupings, ServiceNow and GitLab CI/CD integrations, expanded custom co
Adds new Attack Surface Management (Surface Command) connectors for Cisco Umbrella DNS, Claroty xDome, Honeywell SCADAfence, SpecterOps BloodHound Enterprise, and Devo to the Rapid7 Extension Library
Introduces Remediation Hub in Response & Remediation to visualize top 25 remediation solutions and track risk reduction metrics
Adds vulnerability groupings in Application Security (InsightAppSec) to group findings by application and attack type for efficient triage
Integrates Application Security (InsightAppSec) with ServiceNow Xanadu for bidirectional data synchronization
Integrates Cloud Security (InsightCloudSec) with GitLab CI/CD pipelines to automate repository scans
+5 moreshow less
Enables combining multiple compliance packs into a single custom compliance pack in Cloud Security (InsightCloudSec)
Adds automatic triage for Rapid7 alerts using AI models in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR)
Adds automatic triage for CrowdStrike alerts using AI models in SIEM (InsightIDR)
Makes log lines clickable in SIEM (InsightIDR) Log Search to open a structured JSON panel view
Refreshes the Digital Risk Protection (Threat Command) home page visual design and navigation
Tenable One Dec 30 2024 adds Attack Path and Choke Point columns to Tenable Inventory pages
Adds Attack Path column on the Assets and Weaknesses pages in Tenable Inventory to provide clickable links to attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. details
Adds Choke Point column on the Assets page in Tenable Inventory to highlight choke point data with direct navigation capabilities
2 details in Everything
7 more releases in this issue
· 2024-12-02 → 2024-12-30
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. gains Last Metadata Change filter types and Azure Cloud Connector integration.
Adds before <date> and more than <x> days ago filter types to the Last Metadata Change column in the Tenable One Attack Surface Management console
Adds support for integrations with Azure to add assets from your Azure accounts via the Azure Cloud Connector
Tenable One Identity Exposure 3.84 adds flexibility to IoE allowlists and improves password policy correlation
The Permitted Object Owner allowlist in the Local Administrative Account Management Indicator of Exposure profile now accepts both SID and DistinguishedName formats.
Improved accuracy of correlation for the DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. Indicator of Attack in basic mode.
Tenable One OT Exposure 4.0.30 adds a Findings page, Asset Sources column, Overview Hubs, Honeywell policies and Tenable One software sync.
Adds a dedicated Findings page to view vulnerability instances across all assets with filtering and grouping options
Adds a new Sources column on the asset inventory and single asset pages to indicate detection methods such as Sensors, ERSPANERSPANA Cisco-originated GRE-based tunneling protocol that encapsulates mirrored network traffic and ships it across Layer 3 to a remote capture point, letting cyber tools analyze traffic from distant segments without local tap hardware., Local (ICP SPAN), Packet Capture, CSV Import, IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Connectors, and Active OT
Introduces new Overview Hubs in Tenable One OT Exposure and Tenable One OT Exposure EM for reviewing inventory and risks via interactive widgets
Adds HoneyForce Enable and Honey Force Disable policies to detect input forcing changes on Honeywell C300 assets
Enables synchronization of installed software details (name, version, install date) from Windows assets via WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. queries into Tenable One
Tenable Security Center 6.5.0 adds Vulnerability Intelligence, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./CVSSv4 filtering, Workspace ONE MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. integration, and ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. key support.
Adds Vulnerability Intelligence data (VPR, EPSS trends, notable events) to every CVE in the console for risk prioritization
Supports Web App Scanning sensors from Tenable Core + Tenable One and Docker images for scalable web application assessment
Enables filtering and reporting on findings using EPSS and CVSSv4 scores
Adds Workspace ONE MDM integration to collect mobile device information, replacing the AirWatch integration
Supports ECDSA SSH keys for remote repository synchronization in addition to existing key types
5 details in Everything
└──▷ BREAKING ON UPGRADE
!If you have more than 10,000 active IPs and upgrade from version 6.2.1 or earlier, you must update values in the Apache configuration file during the upgrade.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds asset origin attribution and integration with Tenable One VM for external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. context.
Asset Details page now includes an Origin field providing chronological information of attribution events.
New integration with Tenable One Vulnerability Management to provide continuous external attack surface monitoring and ingest data for host enrichment.
DefectDojo 2.41.4 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scoring to CSV imports, CGA vuln IDs, and None option for Active/Verified on import.
└──▷ GET THIS VERSION
$ git clone --branch 2.41.4 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.41.4
└──▷ TRY IT
Pass Active/Verified as None on reimport to leave those flags unchanged, matching UI behavior when no explicit state is desired.
DefectDojo 2.41.1 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. parameters to the generic parser, DTSA vuln ID support, and new JIRA/findings filters.
└──▷ GET THIS VERSION
$ git clone --branch 2.41.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.41.1
Adds epss_score, epss_percentile, and related epss_* parameters to the generic findings parser.
Adds DTSA as a supported vulnerability ID type in the vuln ID field.
New filter on the Findings list to show findings that have any JIRA issue (grouped or single).
Request review notifications now display usernames instead of generic identifiers.
API now disallows linking an already-linked JIRA issue to a second object.
+3 moreshow less
API now disallows multiple single-use notes on a single object.
Dashboard Reported Finding Severity by Month chart now aggregates by month instead of by day.
Removes the Settings SHA mechanism from settings.dist.py / local_settings.py.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The Settings SHA is removed from settings.dist.py / local_settings.py; any tooling or validation that relied on that hash will no longer work after upgrade.
Consolidates all Trivy Operator findings into a single JSON import.
Makes Trivy Operator Kubernetes vulnerability IDs consistent.
Adds new Mend Platform API 3.0 file types to the existing Mend parser.
Adds DSA, RLBA, RLSA, and TEMP vulnerability ID types.
+13 moreshow less
Supports newer Burp Enterprise report format.
Adds batch create-or-update capability for multiple DojoMeta objects via API.
New API endpoint to link an EngagementQuestionnaire's unanswered Answered_Survey to an Engagement.
New API support for updating the Jira epic on an Engagement.
Adds validator for DD_DEDUPLICATION_ALGORITHM_PER_PARSER and DD_HASHCODE_FIELDS_PER_SCANNER configuration values.
Displays reviewers on finding pages in the UI.
Adds audit log updates reflecting actual requested reviewers.
Allows sorting endpoints by ID in the UI.
Adds engagement-closed notification templates for MS Teams, Email, Alert, and Slack.
Reworks the Kubescape parser.
Refactors MobSF parser to support v4 reports.
Updates Prowler parser to support v4.5.0's renamed time_dt key (was event_time).
AnchoreCTL Policies parser gains additional severity checks from the description field.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!Helm chart drops support for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 3000 (cleanup(helm): Drop support for TCP/3000).
Vuls v0.28.0 adds Windows Server 2025 support, Ubuntu 24.10, a custom SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. port option, and RPM source-package tracking.
└──▷ GET THIS VERSION
$ git clone --branch v0.28.0 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.28.0
Adds --port/-P option to contrib/snmp2cpe for targeting SNMP devices on non-default ports.
Supports scanning Windows 11 24H2.
Supports scanning Windows Server 2025 and Windows Server 2022 23H2.
Adds Ubuntu 24.10 (Oracular) as a supported scan target.
Changes RPM query format to include sourcerpm, enabling source-package attribution in scan results.
+1 moreshow less
Skips SSH configuration validation when ssh-keyscan or ssh-keygen fails, improving scanner resilience.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The RPM scanner query format has changed to add sourcerpm; existing scan results or integrations parsing the raw RPM query output may receive differently structured data.
Brinqa 11.29.98 adds Jira Alert ticket pushing and immediate ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. application via Data Warehouse updates.
Adds support for pushing Alert tickets to Jira, allowing users to push tickets generated from alerts to Jira
1 detail in Everything
1 more release in this issue
· 2024-12-09 → 2024-12-18
Brinqa 11.28.73 adds Remediation owner, Targets, and Risk factor to CSV exports and fixes data models and UI performance.
Remediation owner, Targets, and Risk factor attributes in Finding are now included in the CSV export
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported in Brinqa Platform version 11.28 or later.
Edgescan adds AI summary views for license and asset blockers, plus scheduled export filters and pause schedules
Adds view to AI summary of licence information.
Adds view to AI summary of asset blockers information.
Added popup modal for ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. scheduling.
runZero 4.0.241205.0 adds Palo Alto ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. cache probing; Wiz integration now requires API URL
Scans now probe Palo Alto Networks firewalls for ARP cache information
Wiz integration configuration now requires an explicit API URL
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Wiz integration can no longer be configured without an API URL.
Sophos Mobile 2024.48 adds iOS device policy restrictions for call recording, app locking/hiding, email summarization, and RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. messaging support.
Adds Allow call recordings restriction to iOS device policies, enabling or disabling phone call recording and transcript viewing
Adds Allow locking apps restriction to iOS device policies, controlling availability of Require Face ID/Touch ID/Passcode lock commands in app quick actions
Adds Allow hiding apps restriction to iOS device policies, controlling availability of Hide + Require Face ID/Touch ID/Passcode commands in app quick actions
Adds Allow summarizing emails restriction to iOS device policies, disabling the Summarize command in Mail when turned off
Adds Allow RCS restriction to iOS device policies, enabling users to send messages via Rich Communication Services
Fleet 4.61.0 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. on login, Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. auto-migration, Linux encryption escrow expansion, and new Fleet-maintained app controls.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.61.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.61.0
└──▷ TRY IT
Enable automatic Windows MDM host migration on a Premium Fleet instance via the API.
Adds email verification (MFA) requirement on each login for Fleet users configured outside SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
Extends Linux disk-encryption key escrow support to Ubuntu 20.04.6.
Adds automatic install policy creation for Fleet-maintained apps.
Replaces Zoom Fleet-maintained app with Zoom for IT, which installs silently without opening windows.
Adds windows_migration_enabled setting (configurable via fleetctl, PATCH /api/latest/fleet/config, or UI) to enable automatic Windows MDM host migration (Premium).
+5 moreshow less
Adds without_vulnerability_details query parameter to the /api/latest/fleet/software/versions endpoint to truncate CVE details (Fleet Premium).
Allows /api/v1/fleet/software/fleet_maintained_apps to be called without a team ID to retrieve the full global list of maintained apps.
Allows APNS keys in unencrypted PKCS8 format, supporting migrations from other MDM solutions.
Improves label validation in live queries: passing a non-existent label now returns an error identifying the missing label(s), via both API and fleetctl query.
Improves performance of updating nano_enrollments.last_seen_at timestamps for Apple MDM devices by an order of magnitude under load.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The resend configuration profile API path changed from hosts/[hostid]/configuration_profiles/resend/{uuid} to hosts/{hostid}/configuration_profiles/{uuid}/resend.
!Live query label validation now returns an error (instead of silently ignoring them) when non-existent labels are passed via the API or fleetctl query.
1Password for Android 8.10.56 adds passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. verification improvements, username suggestion context, bottom notifications, and a Turn off Offer to save logins toggle.
Adds ability to turn off Offer to save logins in Settings > Autofill
Updates username suggestions to be based on the vault where a new item is created
Prioritizes recently used items in autofill suggestions
Adds ability to display notifications at the bottom of the screen
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Dec 2024 introduces a redesigned Contracts renewal workflow with notice deadlines, renewal windows, and calendar views.
Adds a Notice deadline calculation for contract renewals based on the end date minus the notice period
Introduces a configurable fallback notice period under Settings > Contracts in the UI
Adds a Renewal window feature that highlights contracts 90 days ± notice deadline on the Dashboard
Adds a two-step renewal processing workflow: indicating a decision (Renew / Terminate / Undecided) and marking as Complete
Adds a Renewals view list accessible from the Contracts list to track pending renewals
+1 moreshow less
Adds a Renewals calendar view accessible via the calendar icon in the Contracts list
Acsense Alerts GA introduces near-real-time notifications for major Okta events via Email, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (including Rapid7 and Datadog), or Slack channels.
Adds Alerts capability to set up notifications for major Okta events
Adds support for receiving alerts via Email integration
Adds support for receiving alerts via SIEM integrations including Rapid7 and Datadog
Adds support for routing all alerts to designated Slack channels
Adds oid support for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. user identification in Ory Kratos
Enables using the oid field from OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.id_token or the id field from the https://graph.microsoft.com/v1.0/me endpoint as a stable subject identifier for Microsoft users.
Enhanced Spend dashboard adds high-level insights like total discovered SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. spend, cost center monitoring, and prioritized optimization interventions.
Track high-level insights such as total discovered SaaS spend, potential cost savings, total paid apps, and average spend per user in the Spend dashboard
Monitor overall SaaS spend by category and cost center directly within the enhanced Spend dashboard
Prioritize cost optimization interventions based on app spend and potential savings impact using the updated Spend dashboard views
Stytch adds Programmatic Workspace Actions API and open beta Terraform provider for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. management
Adds Programmatic Workspace Actions through the Management API or Go SDK to create projects, configure SDK settings, manage public tokens and secrets, define RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. policies, set redirect URLs, and update email templates.
Launches open beta Stytch Terraform Provider for provisioning and automating Stytch projects via declarative Infrastructure-as-Code
2 details in Everything
2 more releases in this issue
· 2024-12-06 → 2024-12-20
Adds Email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. and Cross-Org Passwords as new B2B authentication methods.
Adds Email One-Time Passcodes (OTP) as a primary authentication method for B2B organizations, enabling verification of email ownership via one-time passcodes sent to the user's email.
Adds Cross-Organization Passwords support, allowing users to log in to all their organizations with a single shared password and supporting organization-specific logins and discovery flows. Enabling this requires a project with no active members who already have passwords.
Adds external_metadata field to DFP API and B2B pre-built UI components for React Native SDK
Adds external_metadata field to the Device Fingerprinting API's Fingerprint Lookup endpoint to associate user data with Stych fingerprints.
Enables searchable metadata in the DFP analytics Dashboard, allowing searches by external metadata fields.
Auto-populates the external_metadata field for DFP Protected Auth integrations via the Stytch SDK.
Adds a suite of B2B pre-built UI components (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., Passwords, Email Magic Links, OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip., Discovery) to the React Native SDK.
SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. no longer requires JumpCloud Go agent for unmanaged app discovery; browser extension is now sufficient.
1 more release in this issue
· 2024-12-09 → 2024-12-10
Adds CONN_MAX_AGE, CONN_HEALTH_CHECKS and DISABLE_SERVER_SIDE_CURSORS environment variables for PostgreSQL configuration in authentik
└──▷ GET THIS VERSION
$ git clone --branch version/2024.12.0 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2024.12.0
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
Acronis Cyber Protect 2024-12 adds AI onboarding assistant, Search Center inbox, M365/Google encrypted search, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. event hunting, RMM AD onboarding, and Cyber Files password
└──▷ HOW TO FIND IT
Proactively hunt for Indicators of Compromise (IoCs) across workloads using custom queries in Advanced XDR.
📍In the Advanced XDR console, use the Threat hunting with event search interface to run a query filtering by EDR endpoint attributes and save the result.
Onboard Windows devices at scale into Cyber Protect Cloud via Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. without manual configuration.
📍In Acronis RMM (Advanced Management), select Automatic onboarding via Active Directory, specify the domain controller with the protection agent, and choose the agent components and plans to apply.
Securely share sensitive files via Cyber Files Cloud using password-protected public links.
📍In Cyber Files Cloud, create a public link and configure Link access restrictions to Public with password protection, setting a specific password and expiration date.
Adds 'AI-assistant for onboarding in Acronis Cyber Protect Cloud' to provide partners with immediate product and sales guidance.
Introduces Communication Center (product inbox) as a persistent product inbox for updates and notifications without leaving the platform.
Enables search in Microsoft 365 and Google Workspace encrypted archives in cloud backup to locate content within encrypted archives.
Adds Protection dashboard providing partners with a real-time overview of customers’ DR sites throughout their lifecycle.
Introduces 'Threat hunting with event search (early access)' for Advanced XDR allowing MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. to run custom queries on event data, filter by EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./XDR attributes, and save/share queries.
+7 moreshow less
Allows viewing Microsoft quarantined emails in the Email Security console and supports auto-translation of chats with live agents via the AI-assistant.
Enables Automatic onboarding via Active Directory for Acronis RMM (Advanced Management) to onboard Windows devices at scale without manual preconfiguration.
Adds Customer tickets summary report in Acronis PSA (Advanced Automaton) to export customizable customer-facing reports with ticket, time, and SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. details.
Implements 'Partner onboarding improvements and default product configuration' including default products, tax rates, and billing settings in Acronis PSA.
Adds Advanced reboot configuration in Software Management for security updates and software deployment scenarios to minimize disruptions.
Introduces Password-protected public links for Cyber Files Cloud requiring recipients to enter a password to access shared files or folders.
Announces the end of support for /api/ams/REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints, replaced by a new public REST API.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!The /api/ams/ REST API is deprecated and will have no support commitment one year after the official announcement.
Adds k10tools image copy command to copy images to and from the local filesystem.
Adds ability to specify multiple platforms and/or remove attestation-manifests (SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.) when using k10tools image copy.
Adds support for Kubernetes 1.31.
Adds support for 64-bit Arm and Power architectures in addition to the already-supported x86_64 architecture.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!This release performs a catalog schema upgrade requiring at least 50% free space in the catalog-pv-claim PV; the catalog-pv-claim PVC size may need to be increased before upgrading.
1 more release in this issue
· 2024-12-02 → 2024-12-12
Kasten K10 7.5 adds CBT for Azure Managed Disks, GCS immutability, OpenShift Console Plugin, new DR CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., and SUSE Virtualization support.
└──▷ TRY IT
Trigger a KDR restore via the Kubernetes CLI after a disaster, using the new KastenDRRestore custom resource.
$ kubectl apply -f kastendrestore.yaml
Review DR readiness before a failover using the new KastenDRReview custom resource via the Kubernetes API.
$ kubectl get kastendrreview -n kasten-io
Adds ActionPodSpec and ActionPodSpecBinding custom resources for per-app or per-policy Kubernetes resource requests and limits on dynamically provisioned worker Pods.
Adds KastenDRReview and KastenDRRestore custom resources to enable KDR recovery via Kubernetes API or CLI.
Allows block mode exports of Harvester VM image volumes without requiring the k10.kasten.io/sc-supports-block-mode-exports=true annotation on the storage class.
Adds Dynamic Console Plugin for the OpenShift Web Console on OpenShift versions prior to 4.15.
Integrates with Microsoft Azure to enable Changed Block Tracking (CBT) for Azure Managed Disk volumes for efficient data exports.
+9 moreshow less
Integrates with Google Cloud Storage to enable immutability, protecting Kasten backups against ransomware or accidental deletion.
Introduces support for backup and restore of SUSE Virtualization (formerly Harvester) VMs.
Enables Kasten Multi-Cluster Manager and Veeam Backup & Replication Location Profiles in FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. mode on supported OpenShift clusters.
Supports restore of VirtualMachines referencing VirtualMachineInstanceTypes, VirtualMachinePreferences, or their cluster-scoped equivalents without additional transformation.
Adds support for backing up and restoring Multi-Cluster Manager configuration resources for primary and secondary clusters when Quick DR mode is enabled.
Adds support for Kubernetes 1.31.
Includes Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) as part of published images.
Delivers data mover optimizations reducing initial and incremental backup duration by up to 3x for volumes containing millions of files.
Adds Azure Federated Identity support for Azure Infrastructure Profiles, eliminating the need for long-lived credentials.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!Removed Helm values apigateway.serviceResolver, gateway.insecureDisableSSLVerify, gateway.exposeAdminPort, and service.gatewayAdminPort (deprecated since Kasten 7.0.10).
!Removed Helm values secrets.apiTlsCrt and secrets.apiTlsKey (deprecated since Kasten 7.0.8).
!Grafana is no longer installed as part of Veeam Kasten; the integrated Grafana instance will be removed on upgrade.
!The k10offline tool is replaced by the k10tools image; existing air-gapped workflows using k10offline must migrate to k10tools.
!The k10restore Helm chart is deprecated and will be removed in a future release.
!The original injectKanisterSidecar Helm parameters are deprecated in favor of injectGenericVolumeBackupSidecar; existing deployments must update their Helm or Operator configurations.
!Starting with v7.5.3, all installations default to Quick DR mode; installations on storage that cannot create or restore local snapshots must explicitly disable Quick DR mode via Helm values before upgrading.
!All users must re-login after upgrade due to an improved authentication cookie validation algorithm in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. mode.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. administrators can now set personal timezone preferences in the Managed Services Center profile.
Adds timezone setting to administrator profile in MSC for MSP, tenant, and read-only admins
Updates audit logs, entity timestamps, and monitor jobs to display in the administrator's chosen timezone
2 details in Everything
4 more releases in this issue
· 2024-12-14 → 2024-12-26
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. adds Power BI integration for dynamic tenant consumption reporting
Druva AWS Workloads adds Threat Hunting for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. air-gapped backups to detect IoCs.
Adds Threat Hunting capability for EC2 and EBS resources backed up via Airgap Backup
Enables Malware IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search within air-gapped backups to identify potential threats
Provides Infection Scope and Timelines insights in Threat Hunting results
Druva adds Threat Hunting for AWS Workloads (EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. Volume) backups to search malware IoCs.
Adds Threat Hunting capability for AWS Workloads (EC2 and EBS Volume) backed-up data to hunt for malware Indicators of Compromise (IoCs).
Enables defining scope of resources, adjusting scan depth, setting IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. parameters, and scheduling threat hunts proactively or on-demand.
Provides rich metadata in Threat Hunting results to aid investigation and incident response workflows.
Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.
Acronis Cyber Infrastructure 6.3 adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-2 S3 encryption, degraded-cluster Prometheus metrics, and an extended GET buckets API.
Extends the GET service ostor-buckets API to allow retrieving information about a single bucket or a list of buckets.
Adds a new Prometheus metric showing usable space after dropping the largest failure domain for every used service and storage policy, enabling degraded-cluster monitoring.
Configures the S3 service and all auxiliary services to use the NIST-certified FIPS 140-2 provider as the default data-in-transit encryption.
Adds Policy filter to SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Dashboard, AND/OR logic in Data Explorer filters, and Map (legacy) widget migration.
Adds a Policy filter for the SaaS Security Posture Dashboard allowing filtering by custom or predefined rules.
Adds Custom expression and New group filter options to Data Explorer with AND/OR logic support between filter groups.
2 details in Everything
3 more releases in this issue
· 2024-12-03 → 2024-12-12
Virtual Appliance 121.0.0 adds multi-port DPOP support, KMIP auth, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalives
Adds ability to configure a username and password for the KMIP server
DPOP now supports listening for traffic on multiple ports instead of a single port
Introduced the ability to increase TCP keepalives from the NS proxy to the web server for specific domains
Netskope Private Access Publisher v122 adds AliCloud OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. hosting and removes SSH RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. support.
New images hosted on Alicloud at npa-ova.oss-cn-shenzhen.aliyuncs.com/latest/ for OVA and VHDX formats
Removal of ssh-rsa configurations from sshd settings in Publisher images
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Publisher images remove the ssh-rsa related configurations from sshd configurations, which may break clients relying on SSH-RSA key exchange.
Netskope 122 adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs.REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. auth, Gemini/DeepSeek AI connectors, RBI isolation of 3rd party auth flows, and Box centralized ownership support.
Adds OAuth2 authentication support for the Netskope REST API service
Adds a dedicated app connector for DeepSeek to enforce real-time policies with mapped application activities
Adds Google Gemini API endpoint support through the Google Gemini app connector for Post activity detection
Enables isolation of 3rd party auth flows in Remote Browser Isitation (RBI) without requiring admins to add sidecar categories or cloud apps to isolate policies
Adds opt-in feature to ensure seamless and scalable API Data Protection in Box environments utilizing the centralized ownership model
+1 moreshow less
Adds ability to configure two token sets (authentication and encryption tokens) for Secure Enrollment with independent validity periods
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Netskope will no longer support classic Google Drive as forensic destinations; new customers cannot use Google Drive as forensic destination
Adds Lark IM/webhook integration, Redshift view definitions, and UI improvements
└──▷ GET THIS VERSION
$ git clone --branch 3.1.2 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.1.2
Supports IM and webhook integration for Lark
Display table and view definition for Redshift in SQL Editor
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The masking policy API v1/{instance}/{database}/policies/masking is removed; use v1/{instance}/{database}/metadata with the columnConfigs parameter instead.
1 more release in this issue
· 2024-12-05 → 2024-12-19
Bytebase 3.1.1 adds customizable homepage, Redis ClusterRedis ClusterA distributed mode of Redis, the open-source in-memory data store, that automatically shards data across multiple nodes and keeps it available if some nodes fail, giving cyber tools low-latency shared state at scale. node queries, and improved SQL Editor capabilities.
└──▷ GET THIS VERSION
$ git clone --branch 3.1.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.1.1
Customizable homepage with a user-defined shortcut list
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Instance roles are removed from Database messages; use GetInstance or ListInstanceRoles to get instance role information.
ZIA adds OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for outbound email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., Gmail support, new file types, ShareFile/Slack SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications., API pagination, and custom domain limits.
Adds sspmscan checkbox on ShareFile tenant onboarding to enable Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM)
Adds sspmscan checkbox on Slack tenant onboarding to enable Advanced SaaS Security Posture Management (SSPM)
Enables Optical Character Recognition (OCR) for Outbound Email DLP via the Administration > DLP Advanced Settings page
Adds Gmail as a selectable tenant type in Administration > Email Tenants for Outbound Email Data Loss Prevention
Adds support for Microsoft Excel Add-On (.xla), Open Document Files (.odt), Public Key File (.pub), and Binary Files (.bin) in File Type Control & DLP policies
+10 moreshow less
Adds Atlassian Label option when configuring Data at Rest Scanning DLP Policy rules for Confluence users
Adds new predefined DLP dictionaries: Addresses (Japan), First Names (Japan), Last Names ( Japan), Full Names (Japan)
Updates Driver's License (United States) DLP dictionary to support 2-letter state codes for all US states
Adds pageSize and page request parameters to the GET /pacFiles API endpoint for pagination support
Increases the number of custom domains allowed per domain profile from 32 to 1,024
Adds App Instance Level 1, 2, 3 and their Type columns and filters to Web Insights Logs (Analytics > Insights > Web Insights)
Adds a new Instance Discovery Report page under Analytics for monitoring GCP instance hierarchy logs
Adds Cloud Application column to Step 2 Request Review on the Site Review page
Adds toggle in Administration > Email Profiles > Domain Profiles to include subdomains in email domain profiles
Adds fileSize and documentType fields to the Incident Receiver JSON metadata file for Inline Web DLP violations
15 details in Everything
26 more releases in this issue
· 2024-12-02 → 2024-12-20
ZT800 ZTBC now supports SFP ports (copper/fiber) and GE1/GE2 WAN/LAN selection in gateway mode
Adds SFP port support (Finisar FCLF8522P2BTL copper, FTLF8519P3BNL SR fiber, FTLF1318P3BTL LR fiber) to the ZT800 Zero Trust Branch Device in gateway mode
Makes GE1 and GE2 hot-swappable ports selectable as WAN or LAN when using SFP modules
ZIA adds Platform filter on SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Posture page, Findings filters on 3rd-Party Governance Users page, expanded Sandbox file types, and manual control severity overrides.
Adds Platforms filter to the Posture page in Advanced SSPM
Expands Sandbox supported file types to include .msi, .bat, and .wsf
Adds ability to change control severity on the Posture page or Control Panel header in Advanced SSPM
ZPA adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. protection controls and per-profile language translation in isolation.
Adds Active Directory as an AppProtection Control option to enable inspection of KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. protocol traffic within application segments.
Adds a new Active Directory Dashboard page to view suspicious activity, errors, and violations for AD protection controls.
Enables admins to enable language translation via Google Translate per isolation profile, accessible via the isolation bar menu or right-click context menu.
ZPA adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Controls and Azure STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. RHEL9 App Connector support
Adds Active Directory as an option in the AppProtection control list for application segments, enabling inspection of KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. protocol traffic.
Adds a dedicated Active Directory Dashboard page to view suspicious activity, errors, and violations for Active Directory protection controls.
Adds a Red Hat Enterprise Linux 9 App Connector image on Microsoft Azure that enforces Security Technical Implementation Guide (STIG) compliance.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Passwords for STIG-hardened RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 App Connector images automatically expire after 60 days; if not disabled or changed, admin access becomes unavailable and the connector must be redeployed.
ZPA adds STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against.-hardened App Connector and PSE images on Nutanix/VMware and Cookie Persistence for isolation sessions.
Adds STIG-hardened Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images for Nutanix and VMware, with automatic password expiration after 95 days.
Enables Cookie Persistence in Isolation Profiles to automatically restore isolation session state upon timeout.
ZIA adds Gmail outbound DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for Slack/ShareFile, new API endpoints, and enhanced file type/DLP capabilities
Outbound Email DLP for Gmail allows enforcing DLP policies on emails sent to external domains via the ZIA Admin Portal.
Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) support for ShareFile tenants enables scanning via the SSPM Scan checkbox during onboarding.
Advanced SaaS Security Posture Management (SSPM) support for Slack tenants enables scanning via the SSPM Scan checkbox during onboarding.
New file types (.xla, .odt, .pub, .bin) are supported in File Type Control and DLP policies across Microsoft Office, Open Office Files, and Other Documents categories.
DLP now detects PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. using new predefined dictionaries: Addresses (Japan), First Names (Japan), Last Names (Japan), Full Names (Japan).
+26 moreshow less
DLP Driver's License (United States) dictionary adds support for 2-letter state codes as high confidence phrases.
Instance Discovery Report logs gain App Instance Level 1, 2, 3 columns and filters in Web Insights Logs.
Cloud Service API adds new endpoints for End User Notifications: GET /eun and PUT /eun.
Cloud Service API extends programmatic access with new categories of endpoints including Malware Protection Policy, Advanced Threat Protection Policy, DNS Control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, and more.
DNS Control policy rules are now manageable via API endpoints GET/POST/PUT/DELETE /firewallDnsRules.
IPS Control policy rules are now manageable via API endpoints GET/POST/PUT/DELETE /firewallIpsRules.
File Type Control rules are now manageable via API endpoints including GET/POST/PUT/DELETE /fileTypeRules and /fileTypeRules/{ruleId}.
Sandbox rules are now manageable via API endpoints GET/POST/PUT/DELETE /sandboxRules and /sandboxRules/{ruleId}.
Malware Protection policy configurations are accessible via endpoints such as GET/PUT /cyberThreatProtection/atpMalwareInspection and related.
Advanced Threat Protection policy configurations are accessible via endpoints such as GET/PUT /cyberThreatProtection/maliciousUrls and related.
Cloud NSS feeds are now manageable via API endpoints including GET/POST/PUT/DELETE /nssFeeds.
SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rules are now manageable via API endpoints GET/POST/PUT/DELETE /sslInspectionRules and /sslInspectionRules/{ruleId}.
Organization and subscription information is accessible via API endpoints GET /orgInformation, GET /orgInformation/lite, and GET /subscriptions.
Proxy gateway information is accessible via API endpoints GET /proxyGateways and GET /proxyGateways/lite.
Authentication settings are accessible/updated via API endpoints GET/GET /authSettings and PUT /authSettings.
Remote Assistance preferences are accessible/updated via API endpoints GET/PUT /remoteAssistance.
Advanced settings for URL Filtering and Cloud App Control are accessible/updated via API endpoints GET/PUT /advancedUrlFilterAndCloudAppSettings.
General advanced cloud configuration settings are accessible/updated via API endpoints GET/PUT /advancedSettings.
GET /pacFiles endpoint supports pagination with new pageSize and page request parameters.
Audit logs now include a new Trace ID for transactions associated with ZIA API requests made through Zscaler OneAPI.
Zscaler Incident Receiver JSON metadata now includes new fields: fileSize and documentType.
Zscaler Incident Receiver Inline Web DLP metadata now includes new fields: referrerUrl and department.
You can choose whether to include subdomains in email domain profiles via Administration > Email Profiles > Domain Profiles.
Custom bandwidth classes limit increased to 245 for Cloud Applications.
Custom domains allowed per domain profile increased from 32 to 1,024.
Site Review now displays the associated Cloud Application in the Cloud Application column on the Request Review page.
Client Connector 4.6 adds Legacy VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support, fail-open/close settings, health metrics, partner login overrides, and custom banners.
Adds support for VPN (for Legacy Apps) using Network Connectors and VPN Service Edges to create secure connections
Adds fail-open settings to the app profile that can override the global fail-open settings
Supports using a fail-close policy when Zscaler Client Connector is in Strict Enforcement mode and is in a fail-close state
Adds support for partner login settings on the app profile that can override global ZPA Partner Logins settings
Adds support for the collection of Health Metrics on devices to allow for diagnostics and proactively identify issues
+9 moreshow less
Adds the ability to automatically resize the Zscaler Client Connector window during authentication to fit the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. page
Adds the ability to display a custom notification to users who attempt to access the internet when in Strict Enforcement mode
Enhances CrowdStrike ZTA posture with two new device posture checks: CrowdStrike ZTA Device OS Score and CrowdStrike ZTA Sensor Setting Score
Adds the ability to create a custom banner with information about your organization and display it on the app
Supports Egress IP as a condition for trusted network criteria
Updates the forwarding profile settings to drop IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. packets from IPv6-only networks, and renames the Drop IPv6 Packets option that drops IPv6 packets in dual stack networks
Supports Dynamic ZIA Service Edge Assignment with ZIA Private Service Edges and ZIA Virtual Service Edges
Adds the ability to specify a registry key to locate the PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URL on forwarding profiles using the Enforce and None modes
Improves DNS request handling by adding the ability to prioritize domain exclusions over IP inclusions when determining whether a DNS request should bypass Z-Tunnel 2.0
14 details in Everything
└──▷ BREAKING ON UPGRADE
!The Drop IPv6 Packets option in forwarding profiles is renamed for dual stack networks, and the default behavior for dropping IPv6 packets from IPv6-only networks is now explicit.
ZDX Module 4.4 adds Health Metrics collection for proactive device diagnostics
Adds support for Health Metrics collection on devices to allow for diagnostics and to proactively identify issues.
Adds handling of Personally Identifiable Information (PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.) for new features.
Risk360 adds Identity Protection factor groups for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and Credential Exposure to the Compromise category.
Adds Active Directory factor group under Identity Protection in the Compromise category
Adds Entra ID factor group under Identity Protection in the Compromise category
Adds Credential Exposure factor group under Identity Protection in the Compromise category
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS DynamoDB support, new data posture policies for AWS/Azure/GCP, and improved alert graph features.
Adds NoSQL data store category to scan settings and supports scanning/classifying AWS DynamoDB tables
Adds new data posture policies for AWS S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., RDS; Azure VMs, SQL Server, Storage Accounts; and GCP Storage Buckets
Enhances alert graph with interactive CVE viewing, vulnerability search/filtering, file count per node, and direct links to Data Inventory
Adds Risk Level filter (Critical, High, Medium, Low) in Data Inventory and displays scanned data quantity per resource
Adds Not Included In operator for Access Level predicate and iLike/Not iLike operators for case-agnostic string comparison
+4 moreshow less
Adds support for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. context keys: aws:PrincipalTag/tag-key, aws:ResourceTag/tag-key, aws:PrincipalOrgID, aws:PrincipalArn in data posture policies
Adds discovery of API Gateways accessing primary resources via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles
Adds predicate relationships for DynamoDB: Can be accessed by and Access Level over Parent Resource
Integrates DSPM scan framework with Zscaler Cloud Connector for internet-bound traffic routing
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Last Scanned column renamed to Last Completed Scan in Data Inventory table
!Scan Status column renamed to Latest Scan Status in Data Inventory table
ZIA adds programmatic management for DNS/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection./File Type/Sandbox/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. policies and new API endpoints for EUNs, NSS feeds, and org info.
Adds GET /eun and PUT /eun endpoints to the Cloud Service API for retrieving and updating browser-based End User Notification (EUN) configurations
Adds GET /firewallDnsRules, POST /firewallDnsRules, GET /firewallDnsRules/{ruleId}, PUT /firewallDnsRules/{ruleId}, and DELETE /firewallDnsRules/{ruleId} endpoints to manage DNS Control policy rules programmatically
Adds GET /firewallIpsRules, POST /firewallIpsRules, GET /firewallIpsRules/{ruleId}, PUT /firewallIpsRules/{ruleId}, and DELETE /firewallIpsRules/{ruleId} endpoints to manage IPS Control policy rules programmatically
Adds GET /fileTypeRules, GET /fileTypeRules/lite, POST /fileTypeRules, GET /fileTypeRules/{ruleId}, PUT /fileTypeRules/{ruleId}, and DELETE /fileTypeRules/{ruleId} endpoints to manage File Type Control rules programmatically
Adds GET /sandboxRules, POST /sandboxRules, GET /sandboxRules/{ruleId}, PUT /sandboxRules/{ruleId}, and DELETE /sandboxRules/{ruleId} endpoints to manage Sandbox policy rules programmatically
+14 moreshow less
Adds GET /sslInspectionRules, POST /sslInspectionRules, GET /sslInspectionRules/{ruleId}, PUT /sslInspectionRules/{ruleId}, and DELETE /sslInspectionRules/{ruleId} endpoints to manage SSL Inspection rules programmatically
Adds GET /cyberThreatProtection/atpMalwareInspection, PUT /cyberThreatProtection/atpMalwareInspection, GET /cyberThreatProtection/atpMalwareProtocols, PUT /cyberThreatProtection/atpMalwareProtocols, GET /cyberThreatProtection/malwareSettings, PUT /cyberThreatProtection/malwareSettings, GET /cyberThreatProtection/malwarePolicy, and PUT /cyberThreatProtection/malwarePolicy endpoints to manage Malware Protection policy configurations
Adds GET /cyberThreatProtection/advancedThreatSettings, PUT /cyberThreatProtection/advancedThreatSettings, GET /cyberThreatProtection/maliciousUrls, PUT /cyberThreatProtection/maliciousUrls, GET /cyberThreatProtection/securityExceptions, and PUT /cyberThreatProtection/securityExceptions endpoints to manage Advanced Threat Protection policy configurations
Adds GET /advancedUrlFilterAndCloudAppSettings and PUT /advancedUrlFilterAndCloudAppSettings endpoints to update advanced settings for URL Filtering and Cloud App Control policies
Adds GET /advancedSettings and PUT /advancedSettings endpoints to manage cloud configuration advanced settings
Adds GET /nssFeeds, POST /nssFeeds, GET /nssFeeds/{feedId}, PUT /nssFeeds/{feedId}, DELETE /nssFeeds/{feedId}, GET /nssFeeds/feedOutputDefaults, GET /nssFeeds/testConnectivity/{feedId}, and POST /nssFeeds/validateFeedFormat endpoints to manage Cloud NSS feeds
Adds GET /orgInformation, GET /orgInformation/lite, and GET /subscriptions endpoints to retrieve organization details and subscription information
Adds GET /proxyGateways and GET /proxyGateways/lite endpoints to retrieve proxy gateway information
Adds GET /authSettings, GET /authSettings/lite, and PUT /authSettings endpoints to retrieve or update default authentication settings
Adds GET /remoteAssistance and PUT /remoteAssistance endpoints to update Remote Assistance preferences
Adds GET /cloudApplications/policy and GET /cloudApplications/sslPolicy endpoints to list cloud applications associated with various policies
Adds a new traceId field in the AuditLogEntryRequest model for the /auditlogEntryReport endpoint API
Adds Show Notification for ATP Blocks checkbox in the Action section of SSL Inspection rules to send End User Notifications for ATP blocks
Extends Tenant Profiles feature to the GitHub application, allowing access control for specific enterprise slugs
ZIA DNS Gateways now support customized URL paths for DNS over HTTP (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring.) servers.
Adds the ability to configure a custom URL path for DNS servers using DNS over HTTP (DoH) in DNS Gateways.
Zscaler Deception adds Generative AI decoys, Safe Processes to process tree checks, bulk blocklist creation, and deploy strategy UI enhancements.
Adds Safe Processes to Process Tree Check configuration, allowing safe programs to be excluded from event generation in decoy interactions.
Enables bulk blocklist creation on the Blocklists page (Deceive > Deceive Settings > Blocklist) for application across multiple Decoy Connectors.
Adds Generative AI decoys (Interactive and File-based) with specific application datasets (e.g., GenAI OpenWebUI, Apache AirflowApache AirflowAn open-source workflow orchestration platform maintained by the Apache Software Foundation that lets developers schedule, monitor, and chain tasks as directed acyclic graphs, making it useful for automating data pipelines.) and file datasets (e.g., Falcon-7b, GPT-2 Large).
Enhances Landmine Policies by updating Browser Lures, Session Lures, and File Decoys to support targeting Generative AI decoys.
Adds a Generative AI Network Personality feature for deploying Generative AI decoys via network decoys or deception strategies.
+4 moreshow less
Updates Deploy Strategy UI: default ZPA and Landmine toggles enabled by default for ZPA decoy types, auto-selection of all ZPA domains, copy icon for hostnames, new default naming convention <Strategy name> <Date and time>, and conditional Create Decoys button.
Adds Gen AI Malicious Input Prompt ThreatParse rule to detect and categorize malicious prompts against Generative AI decoys using Deception AI enrichment.
Adds static dataset for Ivanti Virtual Traffic Manager (vTM) application.
Supports selecting specific Threat Intelligence (TI) or network decoys as target decoys in the Target Decoys drop-down when configuring credential file decoys via landmine policies.
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS DynamoDB support, NoSQL scan settings, new data posture policies for AWS/Azure/GCP, and case-insensitive query operators.
Adds support for AWS DynamoDB as a data store with dedicated scan setting category
Adds NoSQL category in scan settings to enable scanning and classification of DynamoDB tables
Adds new data posture policies for S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., RDS, Azure VMs/SQL/Storage, GCP buckets, and Lambda access patterns covering malware, sensitive data, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. gaps, and public exposure risks
Adds iLike (i%) and Not iLike (!i%) case-agnostic operators for string comparison in investigation and policy queries
Adds ⊈ (Not Included In) operator for the Access Level predicate to exclude specific access levels in policy queries
+13 moreshow less
Adds new DynamoDB relationship predicates: Can be accessed by and Access Level over Parent Resource for querying DynamoDB resources
Adds aws:PrincipalTag/tag-key, aws:ResourceTag/tag-key, aws:PrincipalOrgID, and aws:PrincipalArn context keys support in IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies for access control analysis
Adds discovery of API Gateways that have access to the primary resource via an IAM role
Adds interactive CVE viewing, vulnerability search/filter, file count nodes, and Data Inventory links in the Alert Graph
Adds Risk Level Filter (Critical/High/Medium/Low) and Last Completed Scan column renames in the Data Inventory page
Adds view for publicly exposed files/folders with anonymous access verification in the Data Inventory
Adds data inventory tile showing total data scanned per resource and specific entity access levels
Adds Cloud Service Provider name appended to resource types (e.g., AWS EC Instance, Azure SQL Server) in the Data Inventory
Adds timestamped error messages in scan results for troubleshooting
Adds Insights Report dashboard tiles summarizing alerts by threat category and severity across AWS, Azure, GCP
Integrates DSPM with Zscaler Cloud Connector to route outbound internet traffic through Zscaler Cloud Connector without public IPs
Allows configuring scan scope to run DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines only on relevant file types to reduce false positives
Adds visibility into reasons for failed third-party integrations to aid troubleshooting
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The Last Scanned column in the Data Inventory table has been renamed to Last Completed Scan.
!The Scan Status column in the Data Inventory table has been renamed to Latest Scan Status.
ZIA adds App Inventory filters, Integration status icons, and SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. compliance mapping
Adds a filter to the App Inventory page in 3rd-Party App Governance to view results from the inventory, 3rd-Party App Governance catalog, or both.
Adds pending and error icons to the Integrations banner in 3rd-Party App Governance to indicate tenant processing status and errors.
Adds a Compliance page in Advanced SSPM to view control mapping for frameworks like GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. and NIST.
ZPA adds version check and automated upgrade enforcement for App Connectors and PSE.
Adds Minimum Version Control for App Connectors and ZPA Private Service Edges to enforce version checks and automated upgrades during initial connection.
ZPA adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. controls for App Protection and allows sharing FQDNs across multiple application segments.
AppProtection now supports Active Directory controls, enabling AD-based policies for protected applications
Application segments can now use the same Application (FQDN) for multiple segments
Zscaler Workflow Automation adds user attribute obfuscation, incident severity column, and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Azure validation button.
Adds user attribute obfuscation settings in the Privacy and Security section of Account Settings to mask PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. in incidents
Adds a Severity column to the Incidents table
Adds a Validate button on the add Zscaler DLP Azure Integration page to verify configuration before saving
Adds Files section with Policy column on Incident Details page for Source DLP type Email incidents
Adds Module and Resource filters to the Audit Logs page
App Connector 24.650.5 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. controls for AppProtection, generic subdomain inspection improvements, and RPM packages for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 7/8/9.
Improves AppProtection inspection for subdomains when they include a generic domain
Updates App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x
Termius 2024 introduces Vault management, Helium Autocomplete, biometric keys on Windows, and extensive theme/key exchange support.
Adds Vault management for team users to set permissions right in the app (v9.6.1)
Adds Autocomplete Helium input field for low-latency command entry (v9.10.0)
Adds ability to convert text into shell commands with AI via Down Arrow key press (v9.9.0)
Adds ability to duplicate port forwarding rules (v9.8.5)
Adds Vault Filter to select a single vault or all vaults with one click (v9.4.1)
+5 moreshow less
Adds biometric key support on Windows via Windows Hello APIs (v8.11.0)
Adds horizontal tabs for navigation between Vault, SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel., and connections (v9.0.0)
Introduces the command palette feature with shortcuts CTRL+K/CMD+K, CTRL+J/CMD+J, and CTRL+T/CMD+T (v9.0.0)
Adds support for diffie-hellman-group16-sha512 and diffie-hellman-group18-sha512 key exchange methods (v8.12.1)
Adds support for rsa-sha2-256-cert-v01@openssh.com and rsa-sha2-512-cert-v01@openssh.com host key types (v8.12.1)
10 details in Everything
2 more releases in this issue
· 2024-12-05 → 2024-12-20
vopono 0.10.11 adds AzireVPN WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. port forwarding, key replacement on sync, and a new --silent flag
└──▷ GET THIS VERSION
$ git clone --branch 0.10.11 https://github.com/jamesmcm/vopono.git
# already have the repo? check out this version:$ git checkout 0.10.11
Adds WireGuard port forwarding support for AzireVPN.
Supports replacing keys for an existing device when syncing with AzireVPN via vopono sync.
New --silent flag silences all application output.
Teleport v17.1.1 adds PostgreSQL Web UI access, granular SSH port forwarding controls, and VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. multi-port support.
└──▷ GET THIS VERSION
$ git clone --branch v17.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.1.1
└──▷ USE IT
Allow remote port forwarding for admins while denying local port forwarding using the new granular role option.
Connect to a PostgreSQL database instance managed by Teleport directly in the browser.
📍Steps: In the Teleport web UI, navigate to the cluster's Resources › Databases view and select the target PostgreSQL database. Click Connect and use the embedded psql-style interface to run queries.
Adds ssh_port_forwarding role option to control local and remote port forwarding independently
Adds PostgreSQL database access directly from the Teleport web UI with psql-style interface
Adds Hosted email plugin (Mailgun or generic SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure.) setup via Web UI for Access Request notifications
Adds AWS Identity Center integration to Access Requests, allowing requests for permission set access
Adds Graphical Role Editor in the Teleport web UI as an alternative to raw YAML editing
+1 moreshow less
Exposes /.well-known/jwks-okta public endpoint for Okta API services type App
6 details in Everything
9 more releases in this issue
· 2024-12-02 → 2024-12-20
Teleport v16.4.10 adds hardware key support in Connect and auto-update control for client tools
└──▷ GET THIS VERSION
$ git clone --branch v16.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.10
Adds hardware_keys support in Teleport Connect for FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it./WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. authentication.
Controls {tctl,tsh} client tool auto-updates via cluster configuration.
Teleport v17.0.3 adds searchable session playback, in-cluster join audience flexibility, and new enterprise controls for device lists and access request reasons.
└──▷ GET THIS VERSION
$ git clone --branch v17.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.0.3
Session recording playback in the web UI is now searchable
Add ability to configure resource labels in teleport-cluster's operator sub-chart
Kubernetes in-cluster joining now also accepts tokens whose audience is the Teleport cluster name (before it only allowed the default Kubernetes audience). Kubernetes JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. joining is unchanged and still requires tokens with the cluster name in the audience.
Users can now see a list of their enrolled devices on their Account page
Added support for requiring reason for Access Requests (with a new role.spec.allow.request.reason.mode setting)
SPIRE v1.11.1 adds SPRIG template functions, configurable JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. cache, and a configurable JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. issuer in the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Discovery Provider.
└──▷ GET THIS VERSION
$ git clone --branch v1.11.1 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.11.1
└──▷ USE IT
Override the JWT issuer in the OIDC Discovery Provider to match your organisation's public domain instead of the default.
hcl
jwt_issuer = "https://oidc.example.com"
Adds SPRIG library functions to the Go text/template engine available in SPIRE plugins, expanding templating power for plugin authors.
Makes the JWT-SVID cache in the SPIRE agent configurable, giving operators control over cache sizing and behaviour.
Enables a configurable JWT issuer (jwt_issuer) in the OIDC Discovery Provider, allowing operators to override the default issuer claim.
Aembit Edge Components now support RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8 and 9 with SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root.
Physical security tests now accept direct evidence uploads; refreshes Frameworks page progress tracking.
└──▷ HOW TO FIND IT
Verify physical security implementation by uploading specific evidence files to a test.
📍In the Secureframe console, navigate to Physical Security › Tests › [Test Name] and use the Upload Evidence action to attach supporting documents.
Monitor evidence freshness for physical security tests using the new column and visual indicators.
📍In the Secureframe console, go to Physical Security › Tests and check the Last Upload At column; look for color-coded tags to identify stale evidence requiring refresh.
Visualize how many controls overlap with a new framework on the Frameworks page.
📍In the Secureframe console, go to Frameworks and view the reinstated progress bar showing control overlaps for faster adoption planning.
Upgrades physical security tests to upload-based verification for direct evidence submission
Adds Last Upload At column and color-coded tags to identify stale physical security test evidence
Reinstates framework overlap progress bar on the refreshed Frameworks page
Drata adds Twilio, OpenAI, Ansible, and Netlify connections for automated access reviews.
Adds Twilio, OpenAI, Ansible, and Netlify as available integrations for user access reviews.
Updates Jira offboarding automation in-app messaging to handle No Jira tickets found and No matching former personnel scenarios with clearer guidance.
Ensures AI and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. training completion dates in the Personnel Drawer and PDF Reports are verified, accurately labeled, and consistent with Security Training checks.
3 details in Everything
2 more releases in this issue
· 2024-12-06 → 2024-12-20
Trust Vault audit log now captures admin actions and document downloads; improved clickwrap attachment consistency.
Audit log now captures admin actions (accepting or declining requests) and logged-in user actions (document downloads) in Trust Vault
Document download metric on the Trust Vault Dashboard now counts every download event rather than unique users
Clickwrap attachment behavior updated to ensure users remain associated with the specific NDA version they initially accepted when modified via inline editor
Scrut adds send reminder buttons and bulk actions for security campaigns, automated onboarding welcome emails, and empty checklist support with a No tasks assigned filter
Adds a Send Reminder button to the campaign detail page for active campaigns, showing the count of incomplete employees in the resulting modal
Enables bulk selection of employees on a security campaign's employee list page to send reminder emails at scale
Adds a toggle in notification settings to automatically send welcome emails with assigned tasks to new employees upon onboarding
Allows creation of empty checklists and adds a No tasks assigned filter on the employee list/detail pages for visibility
Scrut adds detection of CrowdStrike Falcon Antivirus status on employee devices via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or agent.
Adds support for detecting CrowdStrike Falcon Antivirus installation status on employee devices
Enables tracking of antivirus compliance through MDM solutions or the Scrut agent
For IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. customers without HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records., automatically triggers offboarding and skips initially importing already-deprovisioned or deleted employees.
For customers without HRIS alongside their IDP integration, automatically initiates offboarding when an employee account is deleted, suspended or de-provisioned in the IDP.
For those customers, the first sync of a new IDP integration skips employees already de-provisioned or deleted.
CISO Assistant v2.0.3 updates EBIOS Risk Manager roles and permissions.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.3
7 more releases in this issue
· 2024-12-02 → 2024-12-30
CISO Assistant v2.0 adds impact/economy/stakeholder radars for EBIOS RMEBIOS RMA French risk-management method published by ANSSI for analysing cyber threats and selecting countermeasures; tools use it to structure risk assessments that satisfy French and EU regulatory expectations. studies, a priority review matrix, and an audit table progress tracker.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.0.0
Adds impact graph visualization for EBIOS RM risk scenarios
Adds ebios stakeholders radar to visualize stakeholder perspectives in EBIOS RM studies
Adds 'eco radar ebios study' to display ecological impact within the EBIOS framework
Adds priority review matrix (PRO feature) for assessing and prioritizing risks
Adds audit table progress indicator to track compliance audit completion status
+6 moreshow less
Integrates new breadcrumbs with command palette for improved UI navigation
Adds ability to disable EBIOS RM steps
Adds support for CA 733 in risk assessment PDF exports
Adds mapping from Adobe CCF v5 to ISO 27001: 2022
Enables internationalization of CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. functions with French translation support
Applies RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to global settings management
Adds strategic scenario modeling and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. column to user view in CISO Assistant v1.9.31
└──▷ GET THIS VERSION
$ git clone --branch v1.9.31 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.31
Add explicit strategic scenarios for risk analysis
Display name and ref_id columns in attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. model table
CISO Assistant v1.9.29 adds keyboard shortcuts for Edit views and simplified audit action plans.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.29 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.29
Adds more keyboard shortcuts for Edit mode in detail views including flash and table modes
Simplifies the audit action plan interface to improve usability
v1.9.28 introduces multi-parent asset support for disaster recovery objectives, CNIL data security guides, Cmd+K command palette, and enhanced table mode UX.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.28 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.28
└──▷ HOW TO FIND IT
Open the command palette for quick navigation without using a mouse.
📍Press Cmd+K (or Ctrl+K) to open the interface.
Adds support for multiple parent assets in disaster recovery objectives
Adds ANSSI hygiene guide content, Word export format, and dependency loading enhancements
└──▷ GET THIS VERSION
$ git clone --branch v1.9.22 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.22
detailed ANSSI hygiene guide available in the knowledge base
Exports to Microsoft Word (word export) as a new report format
Imports dependencies and updates them automatically on load
CISO Assistant v1.9.19 adds applied control duplication and priority fields to policies and action plans.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.19 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.19
└──▷ HOW TO FIND IT
Duplicate an existing applied control to quickly set up similar controls without manual re-entry.
📍In the Cyber Tool's UI, navigate to Applied Controls and use the duplicate action on an existing entry.
Sort policies by urgency in the main list view to prioritize remediation efforts.
📍Click the priority column header in the Policies list view.
Manage action plans by viewing and sorting them by priority level.
📍View the Action Plan model tables where the new priority field is now available for each entry.
CISO Assistant v1.9.18 adds SAMA framework support, CLI risk assessment import, and extra metrics.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.18 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.18
Adds sama frameworks to the available compliance catalog
Adds LOG_STORE_BASEPATH config key to support the new S3_CUSTOMLOG_STORE type for arbitrary S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage providers
Adds support for passing requests through to AWS SageMaker models as a new provider
vArmor v0.6.0 adds BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. violation auditing, Prometheus/Grafana metrics integration, and unprivileged container execution.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.0 https://github.com/bytedance/varmor.git
# already have the repo? check out this version:$ git checkout v0.6.0
Adds monitoring metrics with support for integration with Prometheus and Grafana
Supports enforcing access control on socket creation for BPF enforcer
Unify the audit event format of AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. and BPF enforcers, and save the audit events into /var/log/varmor/violations.log
Garak scans language models and applications for vulnerabilities including prompt injection and data leakage.
New probes (ANSI takeover, past tense), RestGenerator skip codes, config updates, hf chat support
└──▷ GET THIS VERSION
$ git clone --branch v0.10.1 https://github.com/NVIDIA/garak.git
# already have the repo? check out this version:$ git checkout v0.10.1
Adds probe: ansi_takeover for ANSI terminal takeover testing
Adds probe: past_tense_vulnerability for past tense vulnerability probing
Promotes generator: openai_compatible to a first-class generator
Allows adjustable per-probe tags based on payload selection
Reinforces trust_remote_code=False for generators by default
+1 moreshow less
Adds ability to specify HTTP codes to skip generation for RestGenerator
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Generators now default to trust_remote_code=False, which may change behavior for some Hugging Face models if they require remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..
gh pr merge adds --delete-branch support for merge queues; gh attestation verify gains --bundle-from-oci flag and policy print
└──▷ GET THIS VERSION
$ git clone --branch v2.64.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.64.0
└──▷ TRY IT
Verify an attestation by fetching the bundle directly from an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry instead of OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. metadata
mdbtools v1.0.1 adds index/primary key output to SQLite schema export and floating-point type conversion via ODBCODBCA standard API, maintained by Microsoft, for connecting applications to relational databases regardless of vendor. Cyber tools use it to query databases without writing engine-specific code. SQLGetData.
└──▷ GET THIS VERSION
$ git clone --branch v1.0.1 https://github.com/mdbtools/mdbtools.git
# already have the repo? check out this version:$ git checkout v1.0.1
Adds index and primary key output to the SQLite schema writer backend.
Adds ODBC SQLGetData support for converting floating-point types.
Ghostty 1.0.1 adds default config generation, bitmap font support, and confirm-close-surface keybind action
└──▷ USE IT
Style the GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code. window title bar with custom colors.
Add MD5-authenticated eBGP peering over Direct CNI circuits for Magic WAN and Transit via dashboard
Adds MD5 authentication support for eBGP sessions established between customer devices and the Magic routing table when connected via a Direct Cloudflare Network Interconnect (CNI) on-ramp.
Enables dynamic route exchange by establishing an eBGP session between local network devices and the Magic WAN / Magic Transit service over Direct CNI circuits.
Adds cloudflare_snippet and cloudflare_snippet_rules Terraform resources to manage Snippets via IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.
Adds the cloudflare_snippet Terraform resource to deploy and update Snippet code as infrastructure-as-code
Adds the cloudflare_snippet_rules Terraform resource to define rules that trigger Snippets based on expressions
THE CYBER TOOLCHAIN