The Cyber Toolchain — issue -021, October 31, 2024
THE CYBER TOOLCHAIN
NO. -021
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED OCTOBER 31, 2024 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
$ git clone --branch v1.6.9 https://github.com/projectdiscovery/httpx.git
# already have the repo? check out this version:$ git checkout v1.6.9
└──▷ TRY IT
Trace the full connection to a target (TLS handshake, redirects, timings) and emit structured JSON for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.
$ httpx -u example.com -trace-j
Adds -fd/-filter-duplicates flag to deduplicate near-identical HTTP responses, retaining only the first unique response
Adds -trace flag to log the complete HTTP connection lifecycle for a target
Adds -sid/-screenshot-idle flag to configure idle wait time before capturing a screenshot when using -screenshot
Adds -tid/-team-id flag to upload scan results to a specific team in the ProjectDiscovery Cloud Platform dashboard
Adds initial automatic page-type classifier to categorize crawled pages
+1 moreshow less
Supports providing PDCP authentication credentials via config file
Bruce 1.6 adds BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. Rubber Ducky/Keyboard modes, CC1101 auto-scan, CH9329 BadUSB on StickCs/Core, NRF24 spectrum analysis, file sharing, and JS menu
└──▷ GET THIS VERSION
$ git clone --branch 1.6 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.6
Adds BLE Rubber Ducky emulation mode (Bad BLE)
Adds BLE Keyboard mode to use the device as a HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. keyboard
Enables automatic frequency scanning for CC1101 RF modules
Extends BadUSB capability to StickCs and Core devices via CH9329
Adds command to check the device's own MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet.
+4 moreshow less
Adds 2.4GHz Spectrum analysis capability (2.40 to 2.48 GHz)
Adds 2.4GHz Jammer capability
Adds a JS interpreter menu item for running scripts
Enables file sharing between Bruce devices over BLE
A fast, intuitive USB 2.0 protocol analysis application for use with Cynthion.
Packetry v0.3.0 adds USB device support (iCE40iCE40A family of low-power FPGAs made by Lattice Semiconductor, favored by cyber tools for its fully open-source synthesis toolchain, making it easy to deploy custom hardware logic without proprietary software.-usbtrace), new capture views, and a backend API.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.0 https://github.com/greatscottgadgets/packetry.git
# already have the repo? check out this version:$ git checkout v0.3.0
Adds backend API for USB capture devices
Adds transaction-level and packet-level views of capture
evil-winrm 3.6 adds --user-agent, new ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. bypasses, and AMSI refactor.
└──▷ GET THIS VERSION
$ git clone --branch 3.6 https://github.com/Hackplayers/evil-winrm.git
# already have the repo? check out this version:$ git checkout 3.6
Adds --user-agent option to control the HTTP User-Agent header
NetExec v1.3.0 adds NFS protocol support, SCCM LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. recon, coerce_plus, BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. dumping, and 8 new modules.
└──▷ GET THIS VERSION
$ git clone --branch v1.3.0 https://github.com/Pennyw0rth/NetExec.git
# already have the repo? check out this version:$ git checkout v1.3.0
└──▷ TRY IT
Enumerate NFS shares and their access privileges on a target host after authenticating.
$ nxc nfs <target> --shares
New NFS protocol support: detect NFS servers, enumerate shares and privileges, recursive file enumeration with UID detection, and upload/download files.
New SCCM LDAP reconnaissance: enumerate SCCM Site-Servers, Sites, Management Points, and associated users, computers, and groups (with recursive group search).
New coerce_plusSMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. module: combines DFSCoerce, PetitPotam, PrinterBug, ShadowCoerce, and MSEven coercion techniques into a single module.
New BitLocker SMB/WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. module to retrieve BitLocker recovery information.
New security-questions module queries Windows local user security questions, which may contain plaintext passwords.
+14 moreshow less
New hyperv-host LDAP module to look up the hostname of a Hyper-V host.
New smbghost scanning module to detect CVE-2020-0796 (SMBGhost) vulnerability.
New network interfaces module to retrieve network interface information from remote hosts.
New SMB module to collect PowerShell command history for all users on a target.
Adds SMB file-write check to test write access on shares.
Adds EnumAV detection for Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. and Trellix EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. in the enum_av module.
Identifies Pre-Created Computer Accounts via LDAP and saves a ccache for each vulnerable account.
Displays a distinct Guest-privileges label when authentication succeeds via a guest account.
Adds domain name output to --users when enumerating via SAMR.
Improves OS detection accuracy.
Improves schtask_as module with options for custom task name, file, and location.
Adds wcc module checks for additional Windows Defender configuration items.
Increases plaintext and hash login speeds.
Adds NXCDB support for CTRL-D to exit the interactive database shell.
BloodHound v6.1.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider registration and scheduled analysis runs.
└──▷ GET THIS VERSION
$ git clone --branch v6.1.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v6.1.0
New OIDC Provider endpoint and API registration support, enabling external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration.
New Scheduled Analysis feature, allowing graph analysis to be triggered automatically on a schedule.
Updated impact table for the Butterfly attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. view.
KICS v2.1.3 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. information to SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. reports and updates query metadata for multiple platforms.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.3 https://github.com/Checkmarx/kics.git
# already have the repo? check out this version:$ git checkout v2.1.3
Adds CWE information field to SARIF report output generated by the scanner
Updates Nifcloud query metadata and functionality in the scanning engine
Checkov 3.2.275 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. definition context to improve Azure resource scanning depth
└──▷ GET THIS VERSION
$ git clone --branch 3.2.275 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.275
Adds arm definition context support, enabling deeper inspection of ARM template structures.
1 detail in Everything
3 more releases in this issue
· 2024-10-01 → 2024-10-30
Checkov 3.2.270 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. graph edges and custom policy support
└──▷ GET THIS VERSION
$ git clone --branch 3.2.270 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.270
└──▷ TRY IT
Scan an ARM template to visualize resource dependencies and validate against custom policies.
Mend SCA 24.10.1: SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Import GA lets users upload files to create or update projects.
2 more releases in this issue
· 2024-10-13 → 2024-10-20
SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Import reaches GA, enabling project creation and updates via upload.
SBOM Import feature is generally available to upload SBOM files for creating new projects or updating existing ones in the Mend AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. Platform.
Adds a Direct/Transitive parameter to the Dependency column in Security -> Dependencies -> Libraries, Security -> Dependencies -> Findings, and Compliance -> SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. -> OOS List tables
Veracode CLI v2.35.0 introduces capability to package source code for projects without a package manager, ensuring complete code inclusion for Python, JavaScript, and PHP.
7 more releases in this issue
· 2024-10-09 → 2024-10-24
Veracode Scan for Visual Studio v0.3.0 adds Software Composition Analysis (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.) scans to find open-source library vulnerabilities and review license risks.
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 24.9.2 adds Invicti integration and ASP.NET multi-core processing
Adds the ability to integrate Mend Code results into Invicti for a holistic view of SAST and DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings.
Enables multi-core processing for ASP.NET code analysis, improving performance.
Adjusts accuracy for Java CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-79 (XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session.), CWE-497 (Sensitive System Information), CWE-918 (SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.) and C# CWE-78 (Command Injection), CWE-89 (SQL Injection), CWE-918 (SSRF).
Mend SAST 24.9.2 adds Invicti DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. integration and ASP.NET multi-core processing
Adds integration of Mend Code results into Invicti for holistic SAST and DAST views
Enables multi-core processing for ASP.NET code analysis to improve performance
GitLab 17.5 adds Duo Quick Chat, self-hosted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for code suggestions, GraphQL export of AI events, enhanced branch rules, and more.
Adds Duo Quick Chat, an in-editor AI chat interface that provides real-time assistance on the lines being edited without leaving the code context.
Enables self-hosted large language modelslarge language modelsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for GitLab Duo Code Suggestions by configuring models hosted on-premise or in a private cloud, currently supporting open-source Mistral models on vLLM or AWS Bedrock.
Adds export of raw code suggestion usage events via the GraphQL API to allow deeper analysis of acceptance rates by dimensions such as suggestion size, language, and user.
Enables conversation with GitLab Duo Chat about a specific merge request directly from the MR interface for reviewers and authors.
Adds direct editing of branch rules (protections, approval rules, status checks) in the consolidated branch settings view.
+19 moreshow less
Introduces Tenant Overview page in Switchboard for GitLab Dedicated instances to view instance version, URL, and maintenance windows.
Makes Secret Push Protection generally available for Ultimate customers, with diff-only scanning for CLI pushes and experimental support for excluding paths or values to reduce false positives.
Brings Credentials Inventory to top-level group Owners on GitLab.com for viewing and revoking personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and SSH keys across the group.
Adds a component filter to the Dependency List view to quickly isolate specific dependency components and assess open risks.
Introduces glab cluster agent bootstrap CLI command to simplify installing the Kubernetes agent on top of an existing Flux installation.
Allows GitLab to initiate the connection to the Kubernetes cluster for the agent, enabling use behind firewalled GitLab installations where the cluster cannot reach GitLab directly.
Enables streaming of real-time Kubernetes resource events in the dashboard instead of static listing.
Adds ability to suspend or resume Flux reconciliation directly from the GitLab UI dashboard.
Provides an improved user management summary for administrators showing pending approvals, users without 2FA, and administrators.
Extends security policy scope to include groups/subgroups for targeted enforcement.
Allows Group Owners on GitLab.com to disable password authentication for enterprise users, enforcing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or token-based auth.
Brings Access compliance center view-only capabilities to projects, not just top-level groups.
Adds a guided migration workflow and warning banner to help move from deprecated compliance pipelines to pipeline execution policies.
Allows viewing group, subgroup, and project associations for a token via the API.
Implements selective SAML single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enforcement, allowing non-SAML identities to access groups with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enabled unless explicitly enforced.
Adds keyset pagination to the Container Registry tags endpoint /id/registry/repositories/:repository_id/tags for self-managed instances.
Introduces support for protected npm packages in GitLab.com Package Registry to prevent accidental modification or deletion by specified users.
Adds Ruby support to GitLab Advanced SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for cross-file, cross-function scanning.
Updates Advanced SAST detection rules to identify additional Java path traversal, Java command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell., and JavaScript path traversal vulnerabilities.
24 details in Everything
└──▷ BREAKING ON UPGRADE
!GitLab chart includes nginx-controller v1.11.2 which requires an RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. rule to access endpointslices.
Release details a training update for Snyk IDE users, highlighting the Net new issues vs all Issues filter and DeepCode AI Fix capabilities via new courseware.
5 more releases in this issue
· 2024-10-17 → 2024-10-31
DeepCode AI Fix for the IDE graduates to GA with broader language support and improved quality.
DeepCode AI Fix expands language coverage from one to eight: JavaScript, TypeScript, Java and Python are GA, while the remaining languages have limited support.
Snyk CLI v1.1294.0 adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema.SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation support.
Plans opt-in Early Access Delta Findings for VS Code and JetBrains from October 23, showing newly introduced issues
From October 23, Early Access Delta Findings is planned for VS Code and JetBrains, disabled by default; an IDE setting enables comparison of current findings against a base branch using a local Git repository.
Openlayer adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. support and a test diagnosis page with error visibility and filtering
Enables SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication for workspaces via major identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
Adds List view on the test diagnosis page to scan skipped/errored tests and filter by type.
Shows an overview at the top of the test diagnosis page with total results per status and recent issues.
Makes sections in the test diagnosis page collapsible.
Supports Azure OpenAI as an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. evaluator.
+3 moreshow less
Adds Ragas metrics (faithfulness, answer correctness) to Evals.
Updates cost table for OpenAI models in Observability.
Lists pipeline names in notifications for new inference pipelines.
Dependency Track 4.12.0 adds tag-based project filtering and bulk tagging REST endpoints to its cyber tooling
└──▷ GET THIS VERSION
$ git clone --branch 4.12.0 https://github.com/DependencyTrack/dependency-track.git
# already have the repo? check out this version:$ git checkout 4.12.0
Add support for authors field in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. BOMs
Support ingestion of CycloneDX v1.6 BOMs
Raise baseline Java version to 21
Migrate from Swagger v2 to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. v3 specification
Add isLatest project flag and allow policies to be limited to latest version only
+13 moreshow less
Add REST endpoint for tag retrieval (GET /api/v1/tag)
Add REST endpoints for bulk tagging & un-tagging of projects (POST /api/v1/projects/tags, DELETE /api/v1/projects/tags)
Add REST endpoint for tag deletion (DELETE /api/v1/tag/{uuid})
Add REST endpoints to tag and untag policies in bulk (POST /api/v1/policies/tags, DELETE /api/v1/policies/tags)
Enable string de-duplication JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. option by default
Disable H2 database shutdown hook
Add support for configurable system-wide default locale
Support customizable welcome message on the login page
Support configuration of teams for portfolio ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. when creating a project
Add active field to Project Versions in API responses
Add option to test notification publisher via UI/API
Add Notification for BOM_VALIDATION_FAILED events
Enhance badge API to require authorization
18 details in Everything
└──▷ BREAKING ON UPGRADE
!The minimum supported Java version is now 21; older versions will fail to start.
!The /api/v1/tag/{policyUuid} endpoint is deprecated in favor of /api/v1/tag/policy/{uuid}.
!Badge API calls now require authorization; unauthenticated requests will fail.
Native Code Alert now scans multiple ecosystems beyond npm, including prebuilt binaries.
Expands the Native Code alert to detect prebuilt binaries and ecosystem-specific files across various programming languages, rather than just binding.gyp files in npm packages.
$ git clone --branch v1.15.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.15.0
Supports hierarchical config file merging and named config profiles for managing multiple scan configurations.
Enables the cargo-auditable-binary-cataloger for scanning files and directories (previously container-only).
Detects older MariaDB versions via an improved binary classifier.
Discovers dpkg status files at additional glob paths for broader Debian package detection.
Emits dependency relationships for Java packages in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.
5 details in Everything
1 more release in this issue
· 2024-10-07 → 2024-10-28
Syft v1.14.0 adds known-unknowns reporting to SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and expands distro detection for HAProxy, Redis, Node, and Ruby.
└──▷ GET THIS VERSION
$ git clone --branch v1.14.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.14.0
Reports known unknowns (unidentified components) directly in the output SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for greater visibility into coverage gaps.
Identifies bash.preinst as a cataloged artifact.
Supports HAProxy release-candidate and older version identifiers.
Supports Redis on arm/v5, arm/v7, and 386 architectures across versions 7.2, 7.4, and 8.0.
Supports identification of older Node.js versions.
+1 moreshow less
Supports rubylang/ruby dev, rc, and preview version identifiers.
Adds native support for the Rust / Cargo format (Pro only), enabling hosted, proxy, and group repositories with Cargo's sparse protocol for versions 1.68+.
Introduces a Malware Warning Banner in the Nexus Repository UI to alert administrators and users when open-source malware components are detected in repositories.
Enables administrators to rotate the encryption key used for reversible storage of sensitive data (e.g., passwords) via the re-encryption feature.
Adds a new index on parent_id to improve getByDisplayPath query performance, running on startup.
Chalk v0.4.13 adds new environment variable keys for exit codes, cloud vendor detection, failed metadata collection, partial traceroute IPs, and Dockerfile paths.
└──▷ GET THIS VERSION
$ git clone --branch v0.4.13 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:$ git checkout v0.4.13
└──▷ USE IT
Check the exit code of a previous docker build operation via environment variables.
shell
echo "Build exit code: $_OP_EXIT_CODE"
Inspect which metadata keys failed to collect and why during a scan.
shell
echo "${FAILED_KEYS}" | jq .
Verify the Dockerfile path relative to the repository root for VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integration.
shell
echo "$DOCKERFILE_PATH_WITHIN_VCTL"
Adds _OP_EXIT_CODE key to report the exit code of external commands like chalk docker build
Adds _OP_CLOUD_SYS_VENDOR key for reporting sys vendor file content used to identify cloud provider
Adds FAILED_KEYS and _OP_FAILED_KEYS metadata keys containing collected error details (code, message, description) for keys that could not be collected
Adds _NETWORK_PARTIAL_TRACEROUTE_IPS to collect local network subnet IPs in docker network-namespaced containers
Adds DOCKERFILE_PATH_WITHIN_VCTL key reporting the Dockerfile path relative to the VCS project root
lavamoat-core now exports endowmentsToolkit from the package root for easier direct access.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.1.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.1.0
└──▷ USE IT
Access endowmentsToolkit directly from the package root instead of hunting for an internal module path.
javascript
import { endowmentsToolkit } from 'lavamoat-core'
Exports endowmentsToolkit directly from the lavamoat-core root, removing the need to import from a deep internal path.
1 detail in Everything
1 more release in this issue2 more releases in this issue · 2024-10-11
allow-scripts v3.3.0 lets you configure which lifecycle events are loaded via loadAllPackageConfigurations.
└──▷ GET THIS VERSION
$ git clone --branch allow-scripts-v3.3.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout allow-scripts-v3.3.0
Supports configuring lifecycleEvents when calling loadAllPackageConfigurations, giving programmatic control over which npm lifecycle hooks are evaluated.
$ git clone --branch webpack-v0.7.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.7.0-beta.0
Changes how inlining of SES lockdown is configured in the webpack plugin.
Adds support for the thisAsExports webpack runtime requirement, broadening compatibility with CommonJS modules that rely on this as their exports object.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The way inlining lockdown is configured has changed — existing plugin configuration for lockdown inlining will need to be updated to match the new interface.
Enablement API adds ddos_protection support and a mode parameter
Adds the mode parameter to the configuration endpoint's request body to control DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. Protection settings.
Adds ddos_protection as a supported product within the product enablement API.
Adds rpcThreadCount config option to control thread pool size in Fastly NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. for Java 2.6.0.
Added rpcThreadCount configuration option for directly specifying the number of threads the module will use.
CLI v10.15.0 adds NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. product support via go-fastly 9.11.0 dependency
Adds NGWAFNGWAFA next-generation web application firewall that inspects HTTP traffic at the application layer, using behavioral analysis and contextual rules rather than pure signature matching to block attacks like SQLi and XSS. product enablement support
Gitleaks v8.21.2 adds Octopus Deploy, 1Password, and new GitLab token rules plus curl header detection.
└──▷ GET THIS VERSION
$ git clone --branch v8.21.2 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.21.2
Adds detection rule for Octopus Deploy API keys.
Adds detection rules for new GitLab token formats.
Adds detection rule for 1Password tokens.
Adds curl header rule to catch secrets passed via HTTP headers.
Expands AWS access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. rule with entropy checks and an allowlist.
+5 moreshow less
Tunes generic-api-key rule with additional entropy filtering and keyword exclusions to reduce false positives.
Updates global allowlist to suppress common false-positive paths and patterns.
Adds automatic ignoring of jQuery and Swagger-UI static assets to reduce noise in web projects.
Bumps Okta token entropy threshold to 4 for higher-confidence detections.
Adds identifier left-side matching to broaden secret context detection.
10 details in Everything
4 more releases in this issue
· 2024-10-03 → 2024-10-28
Gitleaks v8.21.0 adds multiple allowlists per rule and a new Azure AD client secret detector.
└──▷ GET THIS VERSION
$ git clone --branch v8.21.0 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.21.0
└──▷ USE IT
Suppress different categories of false positives independently within a single rule by defining multiple named allowlists.
toml
# In your gitleaks.toml
[[rules]]
id = "my-rule"
description = "Example rule with multiple allowlists"
regex = '''some-secret-pattern'''
[[rules.allowlists]]
description = "Allow test files"
paths = ['''tests/.*''']
[[rules.allowlists]]
description = "Allow known placeholder values"
regexes = ['''placeholder-value''']
Supports defining multiple allowlists per rule, enabling finer-grained suppression logic within a single rule definition.
Adds detection for Azure AD client secrets.
Matches gitleaks.toml config file anywhere in the directory tree, not just the repo root.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Findings previously suppressed via .gitleaksignore may reappear: gitleaks now records the correct commit SHA where a secret was introduced instead of the merge commit SHA, so existing ignore-list entries keyed to merge commit SHAs will no longer match.
Gitleaks v8.20.1 adds PrivateAI, Cohere, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. config password rules plus global allowlist placeholder regexes.
└──▷ GET THIS VERSION
$ git clone --branch v8.20.1 https://github.com/gitleaks/gitleaks.git
# already have the repo? check out this version:$ git checkout v8.20.1
Adds PrivateAI secret detection rule to catch PrivateAI API keys in repos.
Adds Cohere secret detection rule to identify Cohere API keys.
Adds NuGet config password rule to detect credentials in NuGet configuration files.
Supports placeholder regexes in the global allowlist, enabling broad suppression of known-safe patterns across all rules.
Secretlint v8.5.0 adds enableIDScanRule option for AWS secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..
└──▷ GET THIS VERSION
$ git clone --branch v8.5.0 https://github.com/secretlint/secretlint.git
# already have the repo? check out this version:$ git checkout v8.5.0
Adds enableIDScanRule config key to .secretlintrc.json (or equivalent) for the AWS plugin to control ID scanning behavior
GitGuardian adds GitHub custom properties override for check runs and bulk historical scan management with instance filtering.
Adds gh_custom_properties support to leverage GitHub's custom properties for overriding GitGuardian global configuration of check runs at repository and organization levels
Introduces Bulk Historical Scans Management page with a new filter for instances (e.g., production/staging) to track and filter historical scans
2 details in Everything
2 more releases in this issue
· 2024-10-07 → 2024-10-21
Adds SAP HANA dynamic secrets support and custom CA for the K8 operator.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.91.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.91.0-postgres
└──▷ USE IT
Add a custom CA to the Kubernetes operator configuration.
Infisical CLI v0.31.4 adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. support for organization selection.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.31.4 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.31.4
v0.90.1 introduces org-level MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement and allows approvers to bypass secret change requests.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.90.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.90.1-postgres
feat: moved mfa to org level
feat: allow approvers to bypass secret change requests
Infisical v0.90.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group-to-org-role mapping, Github app auth integration, and secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. whitelist configuration.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.90.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.90.0-postgres
SCIM Group to Organization Role Mapping allows synchronizing SCIM groups directly to Infisical organization roles
Github app auth enables GitHub integration via the native GitHub App authentication flow
secret scanning whitelist configuration provides a new mechanism to define secrets that should be ignored during scanning
Adds EU cloud region support, server-based expandSecretReferences, and JSON args for get secrets
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.31.2 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.31.2
Adds cloudEU support for deploying Infisical to a European Union region.
Switches expandSecretReferences from client-side to server-based expansion, extending the same capability to templates.
Adds secret_path field to the template output and accepts optional arguments passed as JSON to the get secrets command.
Infisical v0.89.0 adds queue-based Envkey imports, ghost user creation, and secret path to templates.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.89.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.89.0-postgres
Adds Process Envkey import in queue to background Envkey migration tasks
Adds auto ghost user creation for accounts without associated users
Adds secret path field to template configurations
Allows optional additional arguments when using the secret path template feature
Adds RPM binary support, opt-in audit log partitioning, default org membership role setting, and multi-select UI component
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.88.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.88.0-postgres
Adds rpm binary for Linux installations
Makes audit log database partitioning opt-in via configuration
Adds a Multi-Select component to improve adding users to projects
Infisical v0.87.0 introduces KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. MVP, Databricks integration, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. for dynamic secrets, and Terraform import support.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.87.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.87.0-postgres
KMS MVP now available for server-side encryption of secrets in the overview
Databricks integration allows syncing secrets to Databricks workspaces
LDAP support added for generating dynamic secrets via LDAP backend
New Terraform import prerequisite checks and API improvements for terraform import workflows
Data Region Select UI control for choosing data residency regions
+1 moreshow less
Users can now replace existing authentication methods (e.g. switching SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. providers)
TruffleHog v3.82.9 adds SaladCloud and Box detectors, GitHub comment time-filtering, and CLI feature flags
└──▷ GET THIS VERSION
$ git clone --branch v3.82.9 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.82.9
New SaladCloud API Key detector identifies leaked SaladCloud credentials in scanned sources.
New Box detector identifies leaked Box API credentials in scanned sources.
Adds GitHub comments timeframe filtering to scope secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to a specific time window.
Exposes feature flags as CLI arguments for runtime capability control.
GitGuardian Self-Hosted 2024.10.0 adds VS Code extension, occurrence grouping, filepath exclusions, and new detection engines.
ggshield is now available as a VS Code extension that scans files on save and displays highlighted secrets in the IDE
New grouping mode in Honeytoken Self-Hosted groups secret occurrences per secret x source for separate incident management
Filepath exclusions can now be scoped to specific repositories via configuration to reduce irrelevant incidents
Certificate-based authentication with CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. support added alongside multi-authentication for service access
New long-ods and long-ods-io worker types available in Embedded cluster for productivity tools and I/O tasks
+1 moreshow less
Secrets detection engine upgraded to version 2.122.1 adding Atlassian Access Token, Bitbucket Access Token, and Mistral AI API Key detectors
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Users must upgrade KOTS to version 1.117.3 or later before upgrading GitGuardian
!Removed resources limits for Postgres and Redis on the Embedded cluster installation require manual review of previous configurations
Caido v0.43.0 expands the plugin SDK with file, filter, match-replace, and replay APIs plus backend HTTP fetch support.
└──▷ GET THIS VERSION
$ git clone --branch v0.43.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.43.0
Adds FilesSDK to plugins: list, create, update, and delete files from the frontend.
Adds FilterSDK to plugins: full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for filter presets.
Adds HTTPHistorySDK and SearchSDK to plugins: get and set HTTPQL queries programmatically.
Adds MatchReplaceSDK to plugins: full CRUD for match & replace rules and collections.
Adds ReplaySDK to plugins: create/delete/list tabs, list collections, and list/rename sessions.
+3 moreshow less
Adds sdk.events.onProjectChange backend event: trigger plugin logic whenever the active project changes.
Adds sdk.requests.matches backend API: test whether a given request/response satisfies an HTTPQL query.
Adds fetch from caido:http in backend plugins: enables plugins to make outbound HTTP requests server-side.
8 details in Everything
1 more release in this issue
· 2024-10-08 → 2024-10-29
Caido v0.42.0 adds SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxy support, workflow branching improvements, and expanded SDK APIs.
└──▷ GET THIS VERSION
$ git clone --branch v0.42.0 https://github.com/caido/caido.git
# already have the repo? check out this version:$ git checkout v0.42.0
Adds SOCKS proxy support, enabling traffic redirection through one or more SOCKS proxies with per-destination routing rules.
Supports multiple simultaneous proxy configurations, letting testers assign specific traffic to different proxies based on target.
The Matches HTTPQL workflow node now has native true/false execution branches, eliminating the need for a separate if/else node.
Workflow node editor sidebar now surfaces which inputs are required vs. optional and blocks invalid references.
Adds a crypto module to the backend/workflow SDK implementing a subset of the Node.js crypto API.
+4 moreshow less
Adds RequestSpec.parse() to the SDK, allowing creation of a RequestSpec directly from a raw HTTP request string.
Adds sdk.replay.createSession API to programmatically create replay sessions.
Adds sdk.replaySession.getCollections API to retrieve the list of replay collections.
Adds Editor.getEditorView to the frontend SDK, exposing the internal CodeMirror EditorView for deep editor customization.
Katana v1.1.1 adds no-clobber output protection, per-host field directory control, htmx endpoint extraction, and auto form-filling for select/textarea.
└──▷ GET THIS VERSION
$ git clone --branch v1.1.1 https://github.com/projectdiscovery/katana.git
# already have the repo? check out this version:$ git checkout v1.1.1
└──▷ TRY IT
Prevent katana from overwriting an existing output file when re-running a crawl on the same target.
Adds -ncb/-no-clobber flag to prevent overwriting existing output files during a crawl.
Adds -sfd/-store-field-dir flag to save per-host fields to a custom directory instead of the default location.
Adds a response parser that extracts endpoints from htmx attributes, broadening JavaScript-heavy app coverage.
Adds automatic form filling for <select> and <textarea> elements to improve crawl depth on forms.
Expands JavaScript library fingerprint coverage to improve endpoint parsing across more frameworks.
+1 moreshow less
Chrome launcher now prioritizes the path specified with -scp over system default Chrome paths in headless mode.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Passive crawling flags -ps/-passive and -pss/-passive-source are removed from katana; the capability has been spun out into the separate urlfinder project.
iLEAPP v1.19.5 adds Apple Watch sleep data, Identity Lookup Service, Withings Health Mate, Oops app, and Brave Browser artifact support.
└──▷ GET THIS VERSION
$ git clone --branch v1.19.5 https://github.com/abrignoni/iLEAPP.git
# already have the repo? check out this version:$ git checkout v1.19.5
New WatchSleepData.py module extracts Apple Watch sleep data artifacts.
New Identity Lookup Service artifact parser added for iOS forensic analysis.
New mobileInstallb.py module for mobile installation artifact parsing.
Adds support for the Withings Health Mate app artifacts.
Adds support for Brave Browser by including its artifact locations in Chrome artifact parsing.
+7 moreshow less
New Oops: Make New Friends app artifact parser added.
Updated TikTok parser now includes replied/referenced artifact extraction.
Updated ChatGPT artifact parser with expanded coverage.
Updated Burner app artifact parser.
Adds Close logs button in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. after processing completes.
HTML report now displays the loaded profile.
Windows binaries now include version metadata via file_version_info.txt.
Timesketch 20241009 adds DFIQ analyzer support, query-string filtering in Visualizations, and CLI sketch archive/export commands.
└──▷ GET THIS VERSION
$ git clone --branch 20241009 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20241009
└──▷ HOW TO FIND IT
Scope a Visualization to a specific subset of events without leaving the Visualizations panel.
📍In the Timesketch UI, open a sketch, navigate to Visualizations, and enter a query string in the filter box to restrict the visualized events to matching results.
Adds query-string filtering to Visualizations, enabling scoped visual analysis directly within a sketch.
New CLI commands to export, archive, and unarchive a sketch for offline storage or transfer.
Adds --skip-create-user option to the deployment tooling for non-interactive/automated deployments.
Enables passing auto-run analyzers parameter when uploading via the importer library.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrading to this version requires a database migration — run the upgrade procedure at https://timesketch.org/guides/admin/upgrade/ before starting the new instance.
Volatility 3 v2.8.0 adds 15 new plugins including hollow process, process ghosting, and netfilter detection.
└──▷ GET THIS VERSION
$ git clone --branch v2.8.0 https://github.com/volatilityfoundation/volatility3.git
# already have the repo? check out this version:$ git checkout v2.8.0
└──▷ TRY IT
Detect process ghosting — a technique that evades AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. by deleting the executable before process creation — during incident response.
$ vol -f <memory.dump> windows.processghosting
Find hidden processes by cross-referencing multiple process enumeration sources, surfacing rootkit-concealed entries.
$ vol -f <memory.dump> windows.psxview
Inspect Linux netfilter hooks to detect kernel-level packet interception or rootkit hooks on a Linux memory image.
$ vol -f <memory.dump> linux.netfilter
New vmscan plugin for memory scan analysis.
New linux.netfilter plugin to inspect Linux netfilter hooks.
New windows.hollowprocesses plugin to detect process hollowing.
New windows.kpcrs plugin to enumerate Kernel Processor Control Regions.
New windows.pedump plugin to dump PE images from memory.
+13 moreshow less
New windows.processghosting plugin to detect process ghosting attacks.
New windows.psxview plugin for cross-view process listing to find hidden processes.
New windows.registry.getcellroutine plugin to inspect registry cell routines.
New windows.shimcachemem plugin to extract shim cache artifacts from memory.
New windows.suspicious_threads plugin to identify suspicious thread activity.
New windows.svcdiff plugin to compare service listings and detect discrepancies.
New windows.svclist plugin to enumerate Windows services.
New windows.threads plugin to list process threads.
New windows.timers plugin to enumerate kernel timers.
New windows.unloadedmodules plugin to list previously unloaded kernel modules.
Adds timeliner support to the userassist plugin.
Expands windows.callbacks plugin to support additional callback types.
Adds argcomplete support for shell tab-completion of Volatility commands.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!Volatility 3 now requires Python >= 3.7.3; environments running older Python versions will break on upgrade.
Adds --with-bash-completion configure flag to enable bash completion for dcfldd
└──▷ GET THIS VERSION
$ git clone --branch v1.9.2 https://github.com/resurrecting-open-source-projects/dcfldd.git
# already have the repo? check out this version:$ git checkout v1.9.2
└──▷ TRY IT
Enable bash tab-completion for dcfldd commands and flags when building from source.
$ ./configure --with-bash-completion && make
Added --with-bash-completion configure switch to enable bash completion
Enabled asserts by default during build (can be disabled with --disable-assert)
UAC v3.0.0 adds zip/none output formats, cloud transfers, per-file hashing, verbosity control, and dozens of new artifact collectors.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.0 https://github.com/tclahr/uac.git
# already have the repo? check out this version:$ git checkout v3.0.0
└──▷ TRY IT
Collect a triage image as a password-protected zip with a descriptive filename — useful when transferring evidence to cloud storage with at-rest encryption.
Hash every collected file to produce a chain-of-custody hash manifest alongside the archive.
$ uac -p ir_triage -H--output-format zip /evidence/case42
Run modifier artifacts (e.g., unmounting PID-hijacking filesystems to expose hidden processes) during a live Linux investigation.
$ uac -p ir_triage --enable-modifiers--output-format zip /evidence/case42
New --enable-modifiers flag lets UAC run artifacts that intentionally change system state (e.g., unmounting filesystems to reveal hidden processes).
New none output format copies collected data directly to an output directory without archiving or compression.
New zip output format archives and compresses collected data; supports password-protected zip files via --output-password.
New -o/--output-base-name option lets analysts set a custom, variable-formatted output filename.
Custom profiles, artifact files, and config files can now be supplied by full path, outside their respective default directories, using -c/--config.
+23 moreshow less
New remote transfer support for Amazon, Google, and IBM cloud storage; falls back to wget when curl is unavailable.
New -v/--verbose flag increases verbosity level and displays all executed commands.
New -H/--hash-collected flag hashes all collected files and saves results to a hash file.
New --validate-profile option validates profile files before collection runs.
UAC now uses the built-in astrings function to extract strings from binaries when the strings command is unavailable.
Stderr from executed commands is now recorded in uac.log.
New global max_depth configuration option in uac.conf limits directory tree search depth globally.
New artifact modifier property ensures an artifact only runs when --enable-modifiers is active.
New artifact condition property skips collection unless a specified condition evaluates to true.
New eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs collection via bpftool on Linux (live_response/system/bpftool.yaml).
New collection of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. network details from /proc/net on Linux.
New collection of btrfs mountpoints, subvolumes, and snapshots on Linux.
New collection of kernel tainted-state messages from dmesg on Linux.
New collection of FreeBSD jail information via jls (live_response/containers/jls.yaml).
New collection of Solaris extended accounting configuration and last-executed commands.
New collection of udev rule files on Linux.
New collection of system accounting files for FreeBSD, NetBSD, OpenBSD, and Solaris.
New collection of OpenBSD kernel relink log, device-lookup database, locate database, and security backup files.
New collection of WhatsApp Desktop files on macOS.
New collection of git-related persistence files on Linux and macOS.
Statically linked zip binary now bundled for Linux/ESXi (arm, arm64, i386, x86_64) and FreeBSD/NetScaler (i386, x86_64).
--artifacts list [OPERATING_SYSTEM] now filters displayed artifacts to a specific OS.
AVML updated to v0.14.0.
28 details in Everything
└──▷ BREAKING ON UPGRADE
!--date-range-start is renamed to --start-date; scripts using the old flag will break.
!--date-range-end is renamed to --end-date; scripts using the old flag will break.
!--validate-artifacts-file is renamed to --validate-artifact; scripts using the old flag will break.
!--s3-presigned-url is renamed to --aws-s3-presigned-url; scripts using the old flag will break.
!--s3-presigned-url-log-file is renamed to --aws-s3-presigned-url-log-file; scripts using the old flag will break.
!--ibm-cos-url, --ibm-cos-url-log-file, and --ibm-cloud-api-key are removed; IBM cloud transfers must now use --s3-provider, --s3-region, --s3-bucket, and --s3-token.
!The output_directory property is now mandatory for command, find, hash, and stat collectors; existing artifact YAML files omitting it will fail.
!The file_type artifact property is now an array; artifact YAML files using a scalar value will break.
!The permissions artifact property is now an array; artifact YAML files using a scalar value will break.
!Android is no longer a supported operating system target; use --operating-system linux to continue collecting from Android devices.
!files/logs/additional_logs.yaml is renamed to files/logs/advanced_log_search.yaml; references to the old filename will break.
!live_response/system/sys_modules.yaml is removed; use kernel_modules.yaml instead.
capa v7.4.0 adds IDA v9.0 idalib backend, auto-detection of third-party tools, and 14 new detection rules.
└──▷ GET THIS VERSION
$ git clone --branch v7.4.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v7.4.0
Adds IDA Pro v9.0 backend support via idalib, enabling capa analysis directly through the IDA library interface.
Auto-detects Binary Ninja installations using XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Desktop Entries, allowing the standalone executable to locate and use the Binary Ninja backend without manual configuration.
Adds 14 new detection rules covering .NET COM/UI automation, SysWhispers2 syscall list population, NMM-Protect packer, firewall policy access via INetFwPolicy2/INetFwRule, process filename retrieval, async I/O completion, and registry RecentDocs key access.
Improves navigation in capa Explorer Web.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Python 3.8 and 3.9 support is dropped after this release; users on those versions must upgrade Python before the next capa version.
Radare2 5.9.6 adds Dalvik disassembler, m68k assembler, Capstone6 arch support, new search commands, crypto ops, and shell improvements.
└──▷ GET THIS VERSION
$ git clone --branch 5.9.6 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 5.9.6
New Dalvik disassembler contributed by NowSecure for Android bytecode analysis.
Assembler support added for m68k architecture.
Capstone6 support for PowerPC, MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware., and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..
New /xn command to search for repeated byte patterns.
New /xv[s] command to search for value arrays.
+29 moreshow less
New /V value range support added to rafind2.
New ano command to manage function annotations.
Adds poE and poD crypto commands.
Adds ed25519 private key search capability.
Adds CRC search to magic.
New test command with -s, -f, -x, and -d flags.
New @@f alias for @@c:afla to iterate over functions in inverse recursive order.
New f-0x, f-?, and related flag removal commands.
Adds io.mapinc config variable for IO map control.
Adds scr.prompt.prj config to display project name in the prompt.
New dark theme: gruvbox.
Exposes scr.color via R2_COLOR environment variable.
Adds -e cmd.exit option to run commands before leaving r2.
New -A and -H shell commands.
Detects Dart ELFs and supports fixed x27 as global pointer reference on Dart binaries.
Detects VisionOS binaries.
Support for jump table constructions for ARM64 (Swift binaries).
Support tail addresses in pdua...
Implements pfb bitfield printing improvements in C, ASCII art, and oneliner formats.
Horizontal scrolling with Ctrl+wheel in graph and visual modes.
Makes -p/-P project commands available directly from the r2 shell.
Generic pseudo disassembly for non-supported architectures.
Adds scr.css and scr.css.prefix config options for HTML output customization.
Initial implementation of HTTP sessions.
xmm registers added for FreeBSD debugger.
FPU registers st0–st7 and mm0–mm7 added for FreeBSD debugger.
Hardware breakpoints (hwbp) used by default on mac-x64.
Renames bin.demangle.libs to bin.demangle.pfxlib for clarity.
Summarized variable listing enabled by default (asm.var.summary=4).
34 details in Everything
└──▷ BREAKING ON UPGRADE
!The ia command is replaced by iA; ia is deprecated.
!bin.demangle.libs is renamed to bin.demangle.pfxlib.
!r2pm -HH is removed; use r2pm -H (without argument) instead.
EMBA v1.5.0-SBOMdorado adds broad SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support for RPM, DEB, PIP, npm, and other package managers via binary analysis
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0-SBOMdorado https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout v1.5.0-SBOMdorado
Adds support for extracting SBOM data from Linux distribution identification, RPM packages, Debian packages, OpenWRT packages, Python PIP/requirements/poetry/wheel, FreeBSD pkg, Java archives, Alpine APK, Rust cargo.lock, Ruby gem, and npm JavaScript packages
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!Switches from docker-compose to docker compose which may break scripts relying on the old binary name
binwalk v3.1.0 rewrites the tool in Rust, adding LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations., NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices., BTRFS, WinCE, and Autel firmware support with Windows compilation.
└──▷ GET THIS VERSION
$ git clone --branch v3.1.0 https://github.com/ReFirmLabs/binwalk.git
# already have the repo? check out this version:$ git checkout v3.1.0
Complete rewrite in Rust delivers significantly faster scanning with far fewer false positives.
Adds LUKS header detection for identifying encrypted disk volumes in firmware images.
Adds NTFS filesystem signature detection and extraction support.
Adds APFS filesystem signature detection and extraction support.
Adds BTRFS filesystem signature detection and extraction support.
+7 moreshow less
Adds WinCE image signature detection support.
Adds detection and extraction support for Autel-encoded drone firmware.
Cortex Analytics adds SSH brute force alert and new cloud identity BIOCs
Adds SSH brute force attempt informational analytics alert to detect credential stuffing via SSH.
Adds 2 new Medium Analytics BIOCs: Cloud snapshot of a database or storage instance was publicly shared and Uncommon DLL-sideloading from a logical CD-ROM (ISO) device.
Adds 17 new Informational Analytics BIOCs covering Azure identity events, cloud storage configuration changes, OneDrive activity, and rare RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets./AppleScript execution.
Adds --podman-socket argument to the Linux Container Defender installation script to specify a custom Podman runtime socket path
Adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksum visibility for Defender images in Console Manage > System > Utilities
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Defenders from versions previous to v30.00 (such as v22.12) will be disconnected from the Console; failure to upgrade Defenders below version v30.00 results in disconnection.
!Upgrading from any v31.00 release requires an intermediate upgrade to v32.00 before upgrading to v33.00.
Prisma Access 5.2 adds wildcard FQDN support for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector policies to simplify management
Adds wildcard FQDN support to ZTNA Connector security policies, allowing a single policy to apply automatically to all discovered applications matching the pattern
Removes protocol restrictions (previously limited to HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.) for wildcard FQDN-based ZTNA Connector policies
Prisma Cloud adds Podman Defender support, SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksum verification, Copilot AI interface, satellite-based network exposure detection, and new application-centric securi
Support for deploying Defenders on Podman containers with --install-podman flag and optional --podman-socket argument for custom runtime paths
SHA-256 checksum validation for Defender image downloads via the Show Checksum button in Manage > System > Utilities
Prisma Cloud Copilot AI chat interface for risk prioritization, vulnerability management, and support case creation in stack version 24.10.1
Satellite-based Kubernetes Service Exposure detection correlating K8s Services with VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. network info via the new Satellite operator
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The format of external_asset_id for aws-ecr-image resources changes, deleting existing resources and resolving Open alerts to Closed.
!VPC peering connection ingestion is restricted to the requester account only, removing resources from the accepter account.
!Private AMIs owned by other accounts are no longer ingested unless actively used by EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances in the current account.
!gcloud-cloud-function-v1 API is deprecated and metadata ingestion stops; saved searches or policies based on it must be deleted manually.
!Resource Explorer endpoints GET/resource, POST /resource/timeline, and POST /resource/raw are deprecated and replaced by POST /uai/v1/asset.
PAN-OS 11.1 adds tunnel bandwidth as a default SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. link performance measure.
Adds bandwidth measurement to the SD-WAN tunnel and physical interface view for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. clusters.
Prisma Access 5.2 enables Explicit Proxy integration with ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector for high-capacity private app access.
Adds Explicit Proxy integration with ZTNA Connector to support ZTNA Connectors with a capacity of up to 10 Gbps for Prisma Browser and Agent Proxy traffic
Enables ZTNA Connector support for Cloud Identity Engine (CIE) to allow automatic discovery of private applications
Adds support for ZTNA Connector retrieval of private applications in overlapping networks
Prisma Access 5.2 adds native end-to-end IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for Mobile Users, Remote Networks, and Service Connections.
Enables Mobile Users with IPv6-only endpoints to establish connections via GlobalProtect using IPv6
PAN-OS 11.2 adds Prisma Access hub support for SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. enabled cellular interfaces (4G/5G)
Prisma Access 5.2 raises ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector limits to 10k apps/tenant and 1k apps/connector group.
Increases ZTNA application target limit per tenant from previous constraints to 10,000
Increases application limit per connector group to 1,000
Sophos DNS Protection v2024.42 adds ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. support and quick-access link
Adds EDNSEDNSAn extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. Client Subnet (ECS) support to serve DNS queries based on geographic location for certain Sophos domains.
Adds a quick-access link for DNS Protection under Product setup in Sophos Central dashboard.
Malcolm v24.10.1 adds a readiness API, websocket.log support, Amazon Linux 2023 builds, and a new JA4SSH packet-count config key.
└──▷ GET THIS VERSION
$ git clone --branch v24.10.1 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.10.1
└──▷ USE IT
Tune JA4SSH fingerprint logging granularity by setting how many SSH packets trigger a log entry.
ini
ZEEK_JA4SSH_PACKET_COUNT=500
Adds ZEEK_JA4SSH_PACKET_COUNT (default 200) to ./config/zeek.env and control_vars.conf to control the logging interval packet count for ja4ssh.log SSH traffic fingerprinting.
Adds a readiness API at https://cisagov.github.io/Malcolm/docs/api-ready.html to determine if various Malcolm services are ready.
Adds support for parsing and indexing websocket.log from Zeek.
Updates AWS AMI build scripts and demo setup scripts to use Amazon Linux 2023 instead of Amazon Linux 2.
4 details in Everything
1 more release in this issue
· 2024-10-09 → 2024-10-24
Malcolm v24.10.0 adds Zeek HTTP header field parsing and raises the OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. field limit to 6000.
└──▷ GET THIS VERSION
$ git clone --branch v24.10.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.10.0
Enables Zeek parsing of HTTP server and client header names, exposed as zeek.http.client_header_names and zeek.http.server_header_names fields.
Raises the maximum field limit in OpenSearch index templates from 5000 to 6000.
Security Onion 2.4.110 adds Barracuda/Imperva integrations, Elastic Defend filter management, PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier.OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. support, and custom IDH skins.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.110-20241004 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.110-20241004
Adds Barracuda and Imperva log source integrations.
Adds initial support for managing Elastic Defend Filters through Security Onion.
Adds PKCE OIDC authentication support.
Enables automatic upgrades of Elastic integrations when new versions are available.
Enables Suricata for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. on Standalone installs.
Enables STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. hardening for Security Onion desktop installs.
nfdump v1.7.5 adds NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. output, JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. processing, TorLookup integration, Nokia enterprise support and parallel filtering
└──▷ GET THIS VERSION
$ git clone --branch v1.7.5 https://github.com/phaag/nfdump.git
# already have the repo? check out this version:$ git checkout v1.7.5
Add ndjson output format for nfdump reports
Add JA4 (ja4) processing to network flow analysis
Add support for NOKIA enterprise in the netflow collector/parser
Improve performance with parallel filtering and parallel processing of reading, filtering and data
Snort 3.5.0.0 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. PDU inspector, FTP event pub/sub, asymmetric-flow flushing, and richer extractor fields.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.5.0.0
New tcp_pdu inspector provides simple length-based flushing for TCP streams.
Adds stream_tcp flush on asymmetric flows in IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. mode when queued bytes exceed a configured threshold.
Adds FTP request and response events via pub_sub, enabling downstream consumers to react to FTP activity.
Extractor gains support for body length, info_code/msg, filename, and proxied fields.
Extracts and sets hostname for file processing in file_api and http_inspect.
+5 moreshow less
Adds filename extraction for FTP file processing in ftp_telnet.
IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. engine now ignores protocol when service supersedes ports, broadening rule matching.
JavaScript normalizer (js_norm) now processes complex nested PDF objects.
Stream layer rechecks flow eligibility when a session times out, improving accuracy of flow tracking.
Connector interface updated in framework and managers, with connector initialization moved out of SideChannel.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The --dump-rule-databases flag has been removed from snort and search_engine.
!Requires libdaq v3.0.17 (bumped from the previous dependency version); older libdaq installs will be incompatible.
!The MPSE API has changed (minor version bumped); plugins or external code depending on the MPSE API must be recompiled.
1 more release in this issue
· 2024-10-20 → 2024-10-23
Snort 3.4 adds body length extraction, hostname setting in HTTP inspect, and new TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. PDU inspector
└──▷ GET THIS VERSION
$ git clone --branch 3.4.0.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.4.0.0
Adds body_length, info_code/msg, filename, and proxied fields to extractor output
Enables http_inspect to set the hostname field during file processing for better context
Introduces a new TCP PDU inspector that implements simple length-based flushing logic
New self-service options in Abnormal Email Productivity for configuring passive/active modes and user safelist/blocklist permissions
Enables configuration of Email Productivity into Passive mode (specifying an AD or Google Group) or Active mode (enabling all users with exclusion lists)
Grants or revokes end-users the ability to create graymail safelists or blocklists via self-service
2 details in Everything
2 more releases in this issue
· 2024-10-21 → 2024-10-31
Abnormal RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. adds User Management permissions to custom roles for finer-grained user provisioning control.
Adds User Management section with new permissions for custom roles in Abnormal RBAC
Enables portal administrators to grant user management privileges to non-admin custom role users
Introduces json_include_message_property config option to emit a clean message field in JSON output without date or priority.
Introduces append_output configuration to extend alert output formatting.
Adds JSON schema validation for both rule files and Falco config files, catching misconfigurations at startup.
+4 moreshow less
Adds --config-schema CLI action to print the full Falco configuration JSON schema.
Enables setting nested config keys via CLI with -o key={object} syntax for object-type config values.
Adds container_engines configuration block in falco.yaml to explicitly control which container engines Falco monitors.
Allows all Falco systemd services to be referenced via the consistent alias falco.service.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The tags label in falco_metrics is split into multiple tag_-prefixed labels; existing Prometheus queries or dashboards filtering on tags will break.
!Prometheus metrics falco_metrics now use full names for configs and rules files labels instead of short names; label matchers using short names will no longer match.
!Prometheus metrics n_evts_cpu and n_drops_cpu are rearranged to follow Prometheus best practices; existing queries using their previous naming/label structure will break.
!The deprecated CLI options -t, -T, and -D are removed; any scripts or systemd unit files using these flags will fail to start Falco.
aya-ebpf-bindings adds powerpc64 and s390x architecture support
└──▷ GET THIS VERSION
$ git clone --branch aya-ebpf-bindings-v0.1.1 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-ebpf-bindings-v0.1.1
aya-ebpf-cty v0.2.2 adds powerpc64 and s390x architecture support
└──▷ GET THIS VERSION
$ git clone --branch aya-ebpf-cty-v0.2.2 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-ebpf-cty-v0.2.2
$ git clone --branch aya-ebpf-macros-v0.1.1 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-ebpf-macros-v0.1.1
└──▷ USE IT
Use the correct context type for a kretprobe handler to satisfy the new compile-time enforcement.
!Programs using #[kprobe] or #[uprobe] with a RetProbeContext argument, or #[kretprobe] / #[uretprobe] with a ProbeContext argument, will now fail to compile — the correct context type must be used.
aya-ebpf v0.1.1 adds memmove, RetProbeContext, powerpc64/s390x support, and a set_reply accessor for SockOpsContext.
└──▷ GET THIS VERSION
$ git clone --branch aya-ebpf-v0.1.1 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-ebpf-v0.1.1
└──▷ USE IT
Access the return value in a kretprobe program using the new RetProbeContext instead of ProbeContext.
rust
use aya_ebpf::programs::RetProbeContext;
#[kretprobe]
pub fn my_kretprobe(ctx: RetProbeContext) -> u32 {
let retval = ctx.ret();
// process return value
0
}
Adds set_reply accessor to SockOpsContext for writing reply data in sock_ops programs.
Moves ret out of ProbeContext into a new RetProbeContext (in retprobe.rs), so kretprobe programs access return values via RetProbeContext and kprobe programs access arguments via ProbeContext.
Adds architecture support for powerpc64 and s390x targets.
Implements memmove as a compiler built-in, preventing eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. load failures caused by missing symbol when the compiler emits this function.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!PerfEventArray::with_max_entries has been removed; callers must remove this API usage since max_entries must be set by the loader to the number of online CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware..
aya-obj v0.2.0 adds powerpc64/s390x support, richer MapInfo/ProgramInfo APIs, and u32-to-enum type conversions
└──▷ GET THIS VERSION
$ git clone --branch aya-obj-v0.2.0 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-obj-v0.2.0
Adds map_type() on MapInfo returning new MapType enum instead of a raw integer, with Option<NonZero*> for fields that cannot be zero, and feature-probe-backed name_as_str() via bpf_name()
Adds program_type() on ProgramInfo returning new ProgramType enum, Option<NonZero*> for non-zero fields, prog_info_map_ids() probe for map_ids() field, prog_info_gpl_compatible() probe for gpl_compatible() field, and feature-probe-backed name_as_str()
Adds u32-to-enum conversions for program type, link type, and attach type, plus new InvalidTypeBinding<T> error replacing InvalidMapTypeError in TryFrom for bpf_map_type
Adds support for powerpc64 and s390x architectures
Renames Bpf to Ebpf and BpfLoader to EbpfLoader (old names kept as deprecated type aliases)
5 details in Everything
└──▷ BREAKING ON UPGRADE
!BpfRelocationError is renamed to EbpfRelocationError — code referencing BpfRelocationError by name will break.
!BpfSectionKind is renamed to EbpfSectionKind — code referencing BpfSectionKind by name will break.
aya-log v0.2.1 adds EbpfLogger, IP address logging, and re-attach support for already-running eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs
└──▷ GET THIS VERSION
$ git clone --branch aya-log-v0.2.1 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-log-v0.2.1
Renames BpfLogger to EbpfLogger (with deprecated BpfLogger alias for backward compatibility).
Renames Bpf to Ebpf and BpfLoader to EbpfLoader (with deprecated aliases preserved).
Adds support for logging core::net::Ipv4Addr and core::net::Ipv6Addr types in eBPF programs, including WriteTuBuf implementation, Ipv4Formatter/Ipv6Formatter support, DisplayHint::Ip support, and [u8; 4] formatting for Ipv4Addr::octets.
Enables re-attaching to and reading logs from previously created/already-running eBPF programs (e.g. pinned programs or XDPXDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. programs attached to a network interface).
4 details in Everything
└──▷ BREAKING ON UPGRADE
!BpfLogger is renamed to EbpfLogger; the old name is still available as a deprecated alias but will be removed in a future release.
!Bpf is renamed to Ebpf and BpfLoader is renamed to EbpfLoader; old names are preserved as deprecated aliases but will be removed in a future release.
aya-log-common v0.1.15 adds logging support for core::net::Ipv4Addr and core::net::Ipv6Addr in eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs.
└──▷ GET THIS VERSION
$ git clone --branch aya-log-common-v0.1.15 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-log-common-v0.1.15
└──▷ USE IT
Log a core::net::Ipv4Addr directly from an eBPF program now that the type is supported by aya-log.
rust
use core::net::Ipv4Addr;
let addr = Ipv4Addr::new(192, 168, 1, 1);
info!(&ctx, "source IP: {:i}", addr);
Adds WriteToBuf implementation for core::net::Ipv4Addr and core::net::Ipv6Addr, enabling these types to be logged directly from eBPF programs via Ipv4Formatter, Ipv6Formatter, and DisplayHint::Ip.
Adds formatting support for [u8; 4] to handle Ipv4Addr::octets in eBPF log output.
aya v0.13.0 adds TCX multi-program attachment, BPF_ENABLE_STATS, debug-file symbol lookup, and renames Bpf to Ebpf
└──▷ GET THIS VERSION
$ git clone --branch aya-v0.13.0 https://github.com/aya-rs/aya.git
# already have the repo? check out this version:$ git checkout aya-v0.13.0
Adds TCXBPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. link support via the new LinkOrder type, enabling multi-program attachment at a TC hook with caller-controlled ordering relative to other programs.
Adds BPF_ENABLE_STATS syscall function to enable eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. runtime stats tracking for benchmarking purposes.
Adds run_time_ns and run_cnt field accessors to ProgramInfo, exposing per-program execution statistics.
Adds prog_info_map_ids() and prog_info_gpl_compatible() feature probes, surfacing map_ids() and gpl_compatible() fields on ProgramInfo.
Adds program_type() returning a new ProgramType enum and map_type() returning a new MapType enum on the respective info structs, replacing raw integer returns.
+4 moreshow less
Adds InvalidTypeBinding<T> error type for invalid u32-to-enum conversions for program, link, and attach types.
Adds symbol lookup in associated debug files (via .gnu_debuglink section) for uprobe/uretprobe attachment, falling back from the original binary when a symbol is not found.
Renames Bpf to Ebpf and BpfLoader to EbpfLoader; old names remain as deprecated type aliases via BpfError alias and companions.
Switches SockOps programs to use FdLink for attachment.
cilium-cli v0.16.19 improves clustermesh multi-context connections and adds BGPv2 CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. collection to sysdump
└──▷ GET THIS VERSION
$ git clone --branch v0.16.19 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.16.19
Improves --destination-context option for clustermesh connect to support connecting multiple remote contexts in one operation.
Collects BGPv2 CRD resources automatically during sysdump captures.
Skips Kubernetes client creation when --client is specified in the version command, enabling faster offline version checks.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
kube-bench v0.9.0 adds GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. 1.6 CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark, overhauled K3s scans, and expanded EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. kubelet config coverage.
└──▷ GET THIS VERSION
$ git clone --branch v0.9.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.9.0
Adds GKE 1.6 CIS benchmark support for GCP environments.
Overhauls K3s scan checks for improved accuracy and coverage.
Extends the default kubelet config file list to cover AWS EKS nodes.
Inspektor Gadget v0.33.0 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RTT profiling, mutex tracing, block I/O top, headless gadget execution, and a -f config flag.
└──▷ GET THIS VERSION
$ git clone --branch v0.33.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.33.0
└──▷ TRY IT
Load gadget runtime configuration from a file instead of passing many flags inline.
$ ig run <gadget-image> -f config.yaml
New profile_tcprtt gadget profiles TCP round-trip times per connection.
New trace_mutex gadget traces mutex lock/unlock events in running processes.
New top_blockio gadget shows top block I/O activity, similar to existing top gadgets.
Ports trace_fsslower to image-based gadget format for consistent deployment.
Introduces GadgetInstanceManager to run gadgets headless (without a terminal/UI).
+8 moreshow less
Adds -f flag to specify gadget runtime configuration from a file.
Adds inspect subcommand to the image command for examining gadget images.
Adds --fields flag to CLI operator for adding or removing output fields at runtime.
Outputs full file path in top_file gadget instead of a bare filename.
Adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. verifier debug output when a faulty eBPF gadget fails to load.
Adds new fields to fsnotify data source for richer filesystem event data.
Adds WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. support for parameters handling and runtime config setting.
Supports setting OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. annotations at runtime via the OCI handler operator.
Clair v4.8.0 adds CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale./VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. updater, CPE2.3 matching, iterator-based DB updates, and clairctl admin pre-migration
└──▷ GET THIS VERSION
$ git clone --branch v4.8.0 https://github.com/quay/clair.git
# already have the repo? check out this version:$ git checkout v4.8.0
└──▷ TRY IT
Run pre-migration cleanup manually before the automatic database migration removes old OVAL data
$ clairctl -D admin pre v4.8.0
Implement custom updaters using the new iterator interfaces to reduce memory consumption during database updates
go
func (u *MyUpdater) UpdateVulnerabilitiesIter(ctx context.Context, iter Iterator) error {
// Use iter instead of returning a slice
}
Adds csaf/vex updaters for Red Hat security data, replacing the deprecated RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. OVAL v2 updaters
Adds IgnoreUnpatched config key to the RHEL matcher (moved from updater)
Extends Updater interface with UpdateVulnerabilitiesIter method and EnrichmentUpdater with UpdateEnrichmentsIter for iterator-based database updates
Adds NIST IR 7696 CPE2.3 Name Matching support for CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. pattern matching
Adds clairctl -D admin pre v4.8.0 subcommand to manually clean deprecated OVAL vulnerabilities
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecated updaters that rely on Red Hat OVAL v2 security data are removed in favor of CSAF/VEX data; a database migration deletes existing OVAL-originated vulnerabilities
Kata Containers 3.10 adds CDI device support, VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space.-DAN networking, virtio-scsi hotplugging, and confidential sealed secrets as volumes.
└──▷ GET THIS VERSION
$ git clone --branch 3.10.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.10.0
tools.kata-webhook now allows specifying the runtime class via a configMap
Introduces Container Device Interface (CDI) support in runtime-rs
Adds Dynamic Attached Network (DAN) support for VFIO network devices in the Go kata-runtime
Adds network device hotplugging capability to qemu-rs
Supports Confidential Sealed Secrets as a volume mount
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Drop of ACRN platform support by the acrn hypervisor component
Docker Compose v2.30.0 adds service hooks, a new generate alpha command, export command, CDI device support, and bind-recursive mounts.
└──▷ GET THIS VERSION
$ git clone --branch v2.30.0 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.30.0
└──▷ TRY IT
Generate a Compose configuration from an existing setup using the new alpha command.
$ docker compose generate
Reference an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Compose artifact directly with the -f flag alongside a local override file.
$ docker compose -f oci://registry.example.com/myapp:latest -f compose.override.yml up
Introduces service hooks, enabling lifecycle hook actions tied to service events.
Adds docker compose generate as an alpha command for generating Compose configuration.
Adds docker compose export command to export service container filesystems.
Supports CDI (Container Device Interface) device requests via the devices key in Compose files.
Supports bind volume option recursive for recursive bind mounts.
+1 moreshow less
Allows the -f flag to be used with OCI Compose artifacts when specifying Compose files.
eksctl v0.192.0 adds support for EKS accelerated AMIs based on AL2023.
└──▷ GET THIS VERSION
$ git clone --branch v0.192.0 https://github.com/weaveworks/eksctl.git
# already have the repo? check out this version:$ git checkout v0.192.0
Supports EKS accelerated AMIs based on AL2023 for GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference./accelerated node groups.
ESET PROTECT 5.5 adds Incidents section, macOS 15 support, and new LiveGrid policies.
Adds a new Incidents dashboard section with a list of automatically created incidents and their details.
Adds overall impact of vulnerable applications display in the ESET Vulnerability & Patch Management dashboard and Vulnerabilities section.
Adds ability to easily enable ESET Inspect and ESET MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. via the ESET Solutions section.
Adds new set of policies for automatic enablement of ESET LiveGrid on all supported platforms (Windows, macOS, Linux and Android).
Adds Worst functionality problem column in the Computers section.
+4 moreshow less
Adds new pre-defined protection statuses for better End-of-Life-related filtering in Dynamic Groups.
Adds ability to unlock offline mobile devices.
Adds support for macOS 15 (Sequoia) in Management Agent.
Adds support for Amazon Linux 2023 in Management Agent.
Trend Vision One Container Security now supports CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark scanning for Red Hat OpenShift clusters.
19 more releases in this issue
· 2024-10-01 → 2024-10-31
Trend Vision One automatically recovers false positive emails from Exchange Online and Gmail trash folders.
Cloud Email and Collaboration Protection extends capabilities to identify false positives detected by Advanced Spam Protection, Web Reputation, and Correlated Intelligence
Adds ability to re-create access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for Dropbox and Google Drive service accounts in Cloud Email and Collaboration Protection.
Provides an option for administrators to re-create access tokens for the Dropbox and Google Drive service accounts when the current tokens become invalid or you want to refresh the existing token.
Trend Vision One adds four predefined Correlated Intelligence conditions for Cloud Email and Collaboration Protection.
Adds Reply-To domain activity as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds Reply-To address activity as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds URL domain registration age in email as a predefined condition for defining custom detection signals in Correlated Intelligence
Adds 'sender address for anomaly detection in the customer’s environment' as a predefined condition for defining custom detection signals in Correlated Intelligence
Trend Vision One Service Gateway v3.0.14 adds Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. (QCOW2) deployment support and persistent routing.
Adds support for deploying the Service Gateway virtual appliance on the Nutanix AHV (QCOW2) platform
Ensures additional route configurations remain persistent after a Service Gateway reboot or upgrade
New dedicated entitlements tab in Cloud Security Posture for centralized cloud identity visibility and prioritized risk remediation
Adds a dedicated entitlements tab in Cloud Security Posture to give users centralized visibility into cloud identities and related risks.
Enables focused remediation efforts based on prioritized risks, including risky identity types, identity misconfigurations, and potential attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
Trend Vision One adds cluster-managed policy creation via Kubernetes API for Container Security.
Enables direct interaction with the Kubernetes API to create and manage Container Security cluster-managed policies within Kubernetes clusters
Integrates Container Security policy deployment into GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflows
Trend Vision One updates Case Management and Workbench to support SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. group assignments for alert and case owners respectively.
Adds support for assigning SAML groups as alert owners in Case Management
Adds support for assigning IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-only SAML groups as case owners in Workbench
Huntress allows editing of existing incident reports to consolidate updates into a single notification.
Incident report content (details, status, severity, remediation guidance) can now be edited and reflected in a single report instead of triggering new reports for each change.
Custom tags on dedicated compute are now propagated to serverless queries and recorded in system.billing.usage
Custom tags assigned to a dedicated compute instance are now automatically propagated to any query that is forwarded to serverless compute for data filtering, enabling accurate cost attribution.
The cost attribution data from these propagated queries is now recorded in the system.billing.usage table.
2 details in Everything
10 more releases in this issue
· 2024-10-02 → 2024-10-31
Allows configuring server-side encryption algorithms for AWS S3 external locations in Unity Catalog.
Adds support to specify the SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. algorithm (SSE-S3 or SSE-KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.) when configuring an external location for AWS S3
Enables access to S3 buckets that require server-side encryption via new external location configuration
Adds support for specifying JSON schemas in Mosaic AI Model Serving chat model responses.
Adds JSON schema specification capability to Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. in Mosaic AI Model Serving.
AI Functions powered by Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves. are now available in EU regions (eu-west-1 and eu-central-1).
Sekoia.io introduces a new API version for its MISP feed to update and remove indicators instead of pushing duplicates.
Adds a brand new API to consume Sekoia Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) into MISP
Enables updating existing objects and their properties in the MISP feed
Enables removing expired indicators from the MISP feed
Organizes MISP events by source in the new feed integration
4 details in Everything
7 more releases in this issue
· 2024-10-02 → 2024-10-29
New EDR agent ID field on Host assets to enable EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-targeted playbook actions
Adds EDR agent ID field to Host assets, populated from ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.agent.id and agent.type fields
Sekoia.io adds Intake v2 for data source management, Meta-Playbooks for multi-community automation, and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Agent ID support.
Adds Intake v2 to the UI for enhanced data source management and easier integration setup
Adds Meta-Playbooks capability to manage automation across multiple communities simultaneously
Adds EDR Agent ID field access to enable quicker incident response workflows
Improves visualization of event, alert, and case queries in Enhanced Dashboards
Sekoia.io adds six new data integrations and automations for SentinelOne, WithSecure, and Sophos
Adds Pradeo MTD integration for endpoint telemetry ingestion
Adds Google Cloud Load Balancing integration for network security logs
Adds 1Password EPM integration for applicative event collection
Adds Clavister NGFW integration for firewall log ingestion
Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. generic integration for standardized log parsing
+6 moreshow less
Adds Gatewatcher AionIQ V103 integration for network security events
Adds SentinelOne EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. automation actions: initiate scan, Update Threat Incident, Create Threat Note, and Create Iocs
Wazuh Manager adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. package support, API enables dual-stack IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. listening, and Agent supports macOS 15
└──▷ GET THIS VERSION
$ git clone --branch v4.9.1 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.9.1
Adds ARM packages support for the Wazuh Manager component
Enables the RESTful API to listen on both IPV4 and IPV6 stacks simultaneously
Tenzir v4.21.0 adds Azure Blob Storage connector and precise parsing with schema flags
Adds the azure-blob-storage connector for reading from and writing to Azure Blob Storage via URI.
Adds --schema and --selector flags to CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure., CSV, GELFGELFA structured log format created by Graylog that carries JSON payloads over UDP, TCP, or HTTP, giving cyber tools a compact, schema-aware alternative to syslog for shipping log data to centralised collectors., JSON, KV, LEEF, Suricata, Syslog, XSV, YAML, and Zeek JSON parsers for schema-constrained parsing.
Adds the --null flag to the lines parser to handle null-delimited input.
Adds support for bytes inputs in the buffer operator.
Adds metrics tcp to show per-connection TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. metrics including reads, writes, and bytes transmitted.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The JSON parser's --precise option is deprecated; precise mode is now the default. Use --merge to retain previous imprecise behavior.
!The JSON parser's --no-infer option has been renamed to --schema-only; the old name is deprecated and will be removed in the future.
!Tenzir’s internal wire format bitz is now incompatible with bitz from Tenzir Node v4.20 and older.
!The unused --snapshot option has been removed from the lookup operator.
pySigma v0.11.17 adds regex conversion for string patterns, an interpret_special option for ReplaceStringTransformation, and broader special-character support.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.17 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v0.11.17
└──▷ USE IT
Apply a string replacement in a pipeline transformation while preserving wildcard/special token semantics from the original Sigma string.
Splunk Security Content v4.42.0 adds 10 new detections covering Splunk product vulnerabilities and PowerShell Web Access exploitation.
└──▷ GET THIS VERSION
$ git clone --branch v4.42.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.42.0
Adds detection for Splunk KVStore being disabled via CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. to enable maintenance mode.
Adds detection for image file disclosure through PDF exports in Classic Dashboard.
Adds detection for low-privileged searches running as nobody via SplunkDeploymentServerConfig App.
Adds two detections for persistent XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. attacks — via props.conf and via scheduled views.
Adds detection for remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. through arbitrary file writes to the Windows system root.
+5 moreshow less
Adds detection for sensitive information disclosure in Splunk SG for low-privileged users.
Adds detection for sensitive information disclosure in DEBUG logging channels.
Adds Windows IIS Server PSWA Console Access to detect unauthorized PowerShell Web Access console sessions via IIS logs.
Adds Windows Identify PowerShell Web Access IIS Pool to detect creation and anomalies in PSWA IIS application pool configurations.
Updates the CISA AA24-241A analytic story with new PSWA-focused detections targeting privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., and remote code execution in Windows environments.
Adds Kunai export format, available via restSearch, for use with Linux endpoint monitoring via the Kunai OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. tool.
New workflow triggers for event report saving and proposal saving.
New version comparison tool that warns users of new major MISP releases and indicates up-to-date status on their current branch.
Improvements to the workflow editor and individual workflow modules.
4 details in Everything
2 more releases in this issue
· 2024-10-04 → 2024-10-18
MISP 2.5.0 adds PHP 8.1+ support, Supervisor-based workers, and a new Ubuntu 24.04 install/upgrade script.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.0 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.0
└──▷ TRY IT
Perform a fresh native MISP 2.5 installation on Ubuntu 24.04 with sane defaults.
$ bash INSTALL/INSTALL.ubuntu2404.sh
Upgrade an existing Ubuntu MISP 2.4 installation to 2.5 after first upgrading the OS to Ubuntu 24.04.
$ bash INSTALL/UPGRADE.ubuntu2404.sh
Adds PHP 8.1+ support via an updated CakePHP fork, enabling MISP to run on a modern, non-EOL PHP runtime.
Switches default worker engine to Supervisor-based implementation for new installs and upgrades, replacing the CakeResque-based engine with a more reliable and lightweight alternative.
Introduces new native installation and upgrade scripts targeting Ubuntu 24.04 (INSTALL.ubuntu2404.sh and UPGRADE.ubuntu2404.sh).
Supports Docker-based installation and upgrade to MISP 2.5 via the updated MISP-docker project.
Replaces legacy dependencies with modern PHP 8.x-compatible alternatives across the core platform.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Upgrading via the built-in MISP UI or API update function will NOT trigger the 2.4→2.5 minor version upgrade; the upgrade process is manual and requires running the provided upgrade script.
!Ubuntu installations must be upgraded to Ubuntu 24.04 before running the UPGRADE script.
!Switching to the Supervisor worker engine drops support for scheduled tasks (previously available in CakeResque).
!RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. and non-Ubuntu distributions are not yet supported for 2.5; those installations should remain on 2.4 until installation guides are available.
OpenCTI 6.3.7 adds dynamic configurable required fields via settings and lets security admins revoke user tokens
└──▷ GET THIS VERSION
$ git clone --branch 6.3.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.3.7
└──▷ HOW TO FIND IT
Configure which fields are mandatory for custom entities via the customization settings panel.
📍Navigate to Settings › Customization › Required Fields and add the new dynamic rules.
Adds support for dynamic configurable required fields via the settings customization interface, allowing organizations to tailor form validation rules without code changes.
Updates the YARA rule validation engine by replacing the plyara dependency with yara-python, improving support for text string escape sequences.
2 details in Everything
2 more releases in this issue
· 2024-10-04 → 2024-10-29
OpenCTI 6.3.5 adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. email attribute mapping and improves retention policy deletion speed
└──▷ GET THIS VERSION
$ git clone --branch 6.3.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.3.5
[Backend] Add SAML option to get email from attribute
Cloudmersive Cloud Virus API v9-6-5 introduces chunked transfer encoding support for the Basic File Scan API, enabling efficient processing of large files.
ThreatStream OnPrem 5.8 adds Red Hat 8.10 support, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. connection command, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. Notes, and advanced search fields.
source_locations and target_locations intelligence fields added to Advanced Search and Filtering
New command to establish a connection between ThreatStream OnPrem and ThreatStream TAXII server
Added support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 Notes in Analyze > Observables
Polyswarm sandbox service added for malware detonation
Can Audit permission control setting added to User Admin tab in Settings
5 details in Everything
6 more releases in this issue
· 2024-10-08 → 2024-10-28
ThreatStream adds the ability to create multiple MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profiles with independent security coverage.
MITRE ATT&CK Profiles — Allows creating and managing multiple distinct profiles in ThreatStream
Multiple MITRE ATT&CK Profile support — Enables mapping different security coverage representations per profile
Lookyloo v1.26.1 adds pagination by capture timestamp, new TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. index, and optional JS disable during capture.
└──▷ GET THIS VERSION
$ git clone --branch v1.26.1 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.26.1
Adds new index for Top Level Domains (TLDs) to improve lookup speed
Allows paginating search results based on capture timestamp using the new index backend
$ git clone --branch 2.1.12 https://github.com/yeti-platform/yeti.git
# already have the repo? check out this version:$ git checkout 2.1.12
yetitask CLI subcommand group for managing internal tasks directly from the terminal.
S3 bucket integration for export input/output via AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_S3_EXPORT_BUCKET, AWS_S3_IMPORT_BUCKET. Set these environment variables or in yeti.conf.
Dynamic schema loading for YETI objects and indicators — no restart needed after adding custom types.
YetiPackage JSON structure to create multiple correlated Yeti objects (Indicators, Observables, etc.) in one operation.
Stateless authentication model. Replaces the previous session-based or JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. cookie auth with token-based validation.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Templates have been moved from the database to the filesystem; existing templates must be exported as Jinja files before upgrading.
MSTICPy v2.14.0 adds declarative user session config, nested-dict DataFrame expansion, and HTTP 429 retry control.
└──▷ GET THIS VERSION
$ git clone --branch v2.14.0 https://github.com/microsoft/msticpy.git
# already have the repo? check out this version:$ git checkout v2.14.0
└──▷ USE IT
Bootstrap a notebook's full provider stack from a YAML file instead of writing repetitive connect calls — useful in automation or shared notebook templates.
python
import msticpy as mp
mp.init_notebook()
mp.load_user_session("my_config.yaml", verbose=True)
# qry_prov_sent, qry_prov_md, mssentinel now available as variables
Flatten a column of nested JSON/dicts (e.g. raw API responses) into analysis-ready tabular columns and rows in one call.
Adds mp.load_user_session() to declaratively initialize and connect multiple data providers and components from a YAML file, publishing them directly into the notebook namespace.
Adds mp_pivot.dict_to_dataframe(col=...) pandas extension method to recursively expand nested dictionaries and lists in a DataFrame column into multiple columns and rows.
Adds a max-retry parameter to prevent HTTP 429 (rate-limit) errors during query execution.
Supports Maxmind GeoIPLite's new AccountID-based download authentication mechanism via msticpyconfig.yaml.
Feedly adds font/text customization to Automated Newsletters, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. country exports, and Vice Spider AI card.
Automated Newsletters now support text customization including font styles, sizing, color-coding, alignment, highlighting, headers, quotes, and bullet points.
Cribl Stream 4.9 adds ClickHouse/Dynatrace OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. destinations, Security Lake source, cross-region worker groups, dead-lettering, and API workspace creds.
Adds support for the ClickHouse destination to write data directly into ClickHouse clusters
Adds support for the Dynatrace HTTP (logs only) and Dynatrace OpenTelemetry Protocol (OTLP) destinations
Adds the Amazon Security Lake Source which supports receiving Amazon Simple Queue Service (SQS) data from Amazon Security Lake event subscriptions
Allows creating Cribl-managed Worker Groups in different AWS regions within Cribl.Cloud, independent of the Organization Leader's region
Adds new KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. limit settings on the Leader Node to control API process resource usage
+5 moreshow less
Enables creation of API credentials for individual Workspaces in Cribl.Cloud to manage access programmatically
Introduces a dead-lettering feature for Filesystem-based Destinations to store failed files and configure retry limits
Adds Always On and Backpressure persistent queue modes for Destinations to control disk write behavior during backpressure
Adds a Disk space protection setting for Filesystem-based Destinations to block or drop events when free disk space is low
Allows disabling the Script Collector across the entire deployment via the Cribl command-line interface
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for CentOS 7 on the Cribl Stream Leader and Worker Nodes is deprecated
NodeZero adds MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Azure credential injection via Device Code Flow, Tripwires webhooks for Sentinel/Splunk, and new AWS/Azure attack content.
Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. device authorization grant (Device Code Flow) to inject MFA-protected Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. credentials during an Entra ID Pentest
Adds webhook configurations on the Settings page for Tripwires data export to Microsoft Sentinel and Splunk Cloud
Tripwires is now available for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Client and Sub-Client accounts with improvements to alerting and notifications UX
Adds capability to pilfer secrets, certificates, and keys from Azure KeyVault
Adds AWS Privilege Escalation Detection for three new weaknesses: Pass Role and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Run Instances (H3-2024-45), Pass Role and CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. Create Stack (H3-2024-43), and Pass Role, Lambda Create Function, and Lambda Invoke (H3-2024-44)
Stratus Red Team v2.19.0 adds an Azure attack technique for VM access via Bastion shareable links.
└──▷ GET THIS VERSION
$ git clone --branch v2.19.0 https://github.com/datadog/stratus-red-team.git
# already have the repo? check out this version:$ git checkout v2.19.0
└──▷ TRY IT
Detonate the new Azure Bastion shareable link technique to test detection of unauthorized VM lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. via Bastion.
Tenable One adds Exposure Signals module and extends Lumin, Inventory, and Attack Path with cloud security capabilities.
Adds the Exposure Signals module within Tenable Inventory for prioritization, including a library of pre-built signals, custom signal creation via query capabilities, AI explainability, and drill-down to Inventory view or Asset Details pages
Updates Lumin Exposure View to include Cloud Security data in Global and Tenable-provided exposure cards
Expands Tenable Inventory with Cloud asset support (excluding EntraID/OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.), a Cloud Security quick filter, 3 new Tenable queries, 2 new Exposure Insights, and new cloud asset properties for searching/tagging
Extends Attack Path to include cloud assets, internet-based attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., hybrid corporate-to-cloud attack paths, and policy-based privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. paths
4 details in Everything
9 more releases in this issue
· 2024-10-01 → 2024-10-30
Tenable One Identity Exposure 3.81 adds IOE reasons for Credential Guard, Point and Print, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. signing; customizes dormant account days; excludes MSOL accounts; UPN/SID allo
Dormant Accounts Indicator of Exposure now supports a customizable number of days to determine dormancy based on lastLogonTimestamp.
Root Objects Permissions Allowing DCSync-Like Attacks IOE adds a Keep MSOL_* accounts option (default disabled) to exclude these accounts from deviations.
Protected Users Group Not Used Indicator of Exposure Allowed Users option now accepts User Principal Name (UPN), SID, and sAMAccountName in addition to Distinguished Name.
New CVE tab filters for asset-present vulnerabilities and per-CVE asset views; Linux agent continuous assessment scanning in early access.
Adds a checkbox on the CVEs tab to filter for only the vulnerabilities present on your assets
Adds a dropdown in any row of the CVEs tab to view assets containing that vulnerability
(Early Access) Enables continuous assessment scanning for Linux hosts via Agent Profiles, controlled by Enable Continuous Assessment module and Baseline scan frequency
Tenable ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. gains rule deletion attribution and source copying via API
Adds target_inventory_id parameter to the create source API endpoint to copy sources across inventories
Enables soft deletion of Automation Rules for better attribution capabilities
Adds an Exposure Response Summary page in the Tenable MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. Portal for high-level child container vulnerability overview.
Tenable One adds redesigned sidebar navigation with renamed items and direct shortcuts for Assets, Findings, Solutions, Reports, Remediation, Sensors, and Exports.
Renames My Dashboards to Dashboards in the left sidebar
Adds Vulnerability Intelligence entry to review vulnerabilities from Tenable's database against environment findings
Adds Exposure Response entry to create and manage projects addressing vulnerabilities
Moves Assets view to top-level sidebar item (previously under Explore)
Moves Findings view to top-level sidebar item (previously under Explore)
+6 moreshow less
Adds Solutions entry for reviewing Tenable-recommended vulnerability solutions (moved from Act)
Adds Sensors entry with shortcut to Settings > Sensors for managing cloud and linked Nessus sensors
Moves Reports view to top-level sidebar item (moved from Act)
Adds Exports entry with shortcut to Settings > Exports for managing scheduled exports
Moves Remediation view to top-level sidebar item (moved from Act)
Marks Container Security Legacy as End of Life on September 30, 2024
Attack Path dashboard renamed, filter relabeled to Data Source with OT and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. integration
Adds support for Tenable One OT Exposure and Tenable One Attack Surface Management as data sources in the Top Attack Path Matrix
Renames the Attack Path Matrix view to Top Attack Path Matrix and restricts paths to those leading to critical assets
Renames the UI filter labeled Target Filter to Data Source to reflect its broader scope
Edgescan adds an in-platform license utilization modal and PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. attestation email notifications.
Added licence utilization modal to the assets page for viewing licences and expiry breakdowns without exporting a report
Added new permission to support licence utilization summary
Added email notification when PCI attestation information is missing
3 details in Everything
1 more release in this issue
· 2024-10-03 → 2024-10-10
Adds ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. scheduled export capability and fixes licence auto-renewal logic
DefectDojo 2.39.3 adds RXSA VULNERABILITY_URL setting to settings.dist.py and local_settings.py.
└──▷ GET THIS VERSION
$ git clone --branch 2.39.3 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.39.3
Adds VULNERABILITY_URL setting for RXSA integrations
Supports OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. Parser with robustified parsing logic
2 details in Everything
3 more releases in this issue
· 2024-10-07 → 2024-10-28
DefectDojo 2.39.2 adds file_path to SonarQube findings, a no-enforcement SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. config option, and ELSA errata support.
└──▷ GET THIS VERSION
$ git clone --branch 2.39.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.39.2
└──▷ HOW TO FIND IT
Configure an SLA policy that tracks findings without enforcing SLA deadlines — useful for informational or low-priority finding types.
📍In the console, go to Configuration › SLA Configuration and create a new SLA Config with enforcement disabled.
Adds file_path field to SonarQube findings for more precise vulnerability location tracking.
New SLA Config option that does not enforce SLA, allowing teams to track findings without triggering SLA violations.
DefectDojo 2.39.0 adds webhook notifications, 5 new parsers, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching./Impact enhancements, and risk exception audit notes.
└──▷ GET THIS VERSION
$ git clone --branch 2.39.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.39.0
└──▷ HOW TO FIND IT
Enable outbound webhook notifications so your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or chat tool receives DefectDojo events in real time.
📍In the console, go to Settings › Notifications and add a new Webhook entry with your endpoint URL and the events to subscribe to.
Adds webhook support for notifications, enabling outbound HTTP callbacks on DefectDojo events.
New parser: Qualys Hacker Guardian for importing Qualys HackerGuardian scan results.
New parser: Threat Composer for ingesting AWS Threat Composer threat model outputs.
New parser: Legitify for analyzing GitHub/GitLab security posture findings.
New parser: KrakenD audit results via the krakend audit parser.
+15 moreshow less
Adds HackerOne Bug Bounty Program report support to the existing HackerOne parser.
Adds Invicti scanner support through the Netsparker parser.
Extends the Wiz parser with SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning and Fortify legacy format support.
Adds EPSS score data to the Aqua parser output.
Adds Impact field parsing to the AWS SecurityHub ASFF parser.
Adds vulnerability ID enrichment to the ssh-audit parser.
Adds AlmaLinux advisory links to vulnerability records.
Risk Exceptions: automatically adds/removes audit notes on findings when they enter or leave a risk exception.
User management: adds an admin toggle to require password on new user creation.
Dynamic parsing: adds a flag to indicate when a parser introduces new test types.
Lists global-role members within Product and Product Type member views.
Makes Product Type clickable from the Product detail page.
Adds GitLab-specific permission support.
Semgrep parser gains support for new severity levels.
Prefetch API: adds Swagger documentation for models that support prefetching.
Vuls v0.27.0 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 scoring, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. CVE source, VulnCheck KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data, and Azure Trivy content type.
└──▷ GET THIS VERSION
$ git clone --branch v0.27.0 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.27.0
Supports CVSS v4.0 scores from NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and Trivy sources.
Adds MITRE as a new CVE content source via go-cve-dictionary.
Adds VulnCheck KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data to the vulnerability model.
Adds new trivy:azure CVE content type for Azure-specific Trivy findings.
Skips TDC vs. non-TDC package comparisons in SUSE OVAL detection to reduce false positives.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Alpine detection now uses source packages instead of binary packages (fix!(alpine): use source package for detection) — existing Alpine scan results may change on upgrade.
!VulnCheck KEV fields are added to the models (feat!(models): add vulncheck kev) — downstream consumers parsing Vuls output JSON may need to handle the new fields.
ssh-audit v3.3.0 adds post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchanges, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. DHEat support, new built-in policies, and LANcom device recognition.
└──▷ GET THIS VERSION
$ git clone --branch v3.3.0 https://github.com/jtesta/ssh-audit.git
# already have the repo? check out this version:$ git checkout v3.3.0
└──▷ TRY IT
Scan a list of hosts on a non-standard port, letting individual entries override the default — useful for bulk audits of a mixed fleet.
$ ssh-audit -T targets.txt -p 222
Adds built-in policies for Ubuntu 24.04 LTS server & client, OpenSSH 9.8, and OpenSSH 9.9.
Adds IPv6 support for DHEat and connection rate tests.
Adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port information to JSON output from policy scans.
Adds LANcom LCOS server recognition and Ed448 key extraction.
Reports ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. and DSS fingerprints when running in verbose mode.
+3 moreshow less
Adds support for post-quantum key exchanges mlkem768x25519-sha256 and sntrup761x25519-sha512.
When scanning multiple targets with -T/--targets, the -p/--port option now sets the default port for all hosts that don't specify one explicitly.
Updated built-in policies for Amazon Linux 2023, Debian 12, Rocky Linux 9, and Ubuntu 22.04 to improve host key efficiency and quantum-attack cipher resistance.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!CVE information based on server/client version numbers has been removed entirely from output.
runZero 4.0.241015.0 adds NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. integration, asset refingerprinting, and dashboard metric recalculation.
Integrates with NetBox for asset data synchronization
Adds ability to refingerprint an individual asset from the asset details page using the latest fingerprint database
Adds Recalculate dashboard metrics option in the dashboard menu
runZero 4.0.241010.0 enables SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with missing name fields and locks disabled project settings
SSO login now succeeds when the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. returns a blank or missing first or last name field.
Intruder adds subdomain/related domain discovery, Cloudflare/Sentinel/Okta integrations, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. context, and balanced scan mode.
Adds Subdomain and Related Domain discovery on the Enterprise plan
Adds Cloudflare integration to discover and protect more assets
Adds Microsoft Sentinel integration for risk detection, investigation, and remediation
Adds Okta SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication support
Adds EPSS score, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vector, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. list data to issue context
Apple VPP apps automatically update on User Enrollment devices
└──▷ HOW TO FIND IT
Enable seamless app updates for corporate-owned BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. (User Enrollment) fleets without manual intervention.
📍In the console, go to Devices › iOS/iPadOS › Apple VPP setup and ensure Automatically update iOS VPP apps is enabled.
1 more release in this issue
· 2024-10-07 → 2024-10-21
Sophos Mobile 2024.39 adds macOS profile import and drops Android 8 / iOS 14 support
Adds ability to import Apple configuration profiles from Apple Configurator or other sources for installation on Macs via the UI.
Drops support for Android 8, requiring a migration away from this deprecated OS version for device enrollment.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Removal of support for Android 8, iOS/iPadOS 14, macOS 10.15 (Catalina), and Zimbra mail server means devices on these platforms can no longer be managed.
Retrieve details of a specific Fleet-maintained app to inspect its metadata before deploying.
$ curl -X GET https://<fleet-server>/api/latest/fleet/software/fleet_maintained_apps/<app_id> \
-H 'Authorization: Bearer <token>'
Configure a policy automation to run a remediation script on failure, directly from the Fleet UI.
📍In the Fleet console, go to Policies, select or create a policy, open the Automations section, and enable Run script — choosing the remediation script to execute when hosts fail the policy.
Adds built-in label for Fedora Linux, enabling automatic categorization of Fedora hosts.
Enables triggering a script run automatically on policy failure, with a corresponding activity feed event.
Adds POST /software/fleet_maintained_apps endpoint for adding Fleet-maintained apps via API.
Adds GET /software/fleet_maintained_apps/{app_id} endpoint to retrieve details of a specific Fleet-maintained app.
Adds API endpoint to list team-available Fleet-maintained apps.
+6 moreshow less
Adds UI for managing Fleet-maintained apps directly in the Fleet console.
Adds support for uploading RPM packages as software installers.
Adds upload progress bar to the software uploads UI.
Adds battery status (including health definitions based on cycle counts and max capacity) to Windows host details.
Improves performance for host details and Fleet Desktop in environments with high volumes of live queries.
Updates add software modal to separate pages in Fleet UI for a clearer workflow.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Migrations will fail if a pre-existing Fedora Linux label exists — delete the existing label before upgrading.
!GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. script and software installer relative paths are now always relative to the file they're in; existing YAML files that relied on the previous inconsistent behavior (e.g. script paths in no-team.yml being relative to default.yaml one directory up) will break and must be updated.
Adds 1Password Developer sidebar view and OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support in LastPass importer
Adds Show 1Password Developer in Sidebar setting under Settings > Developer to enable the new Developer experience in the sidebar
New Developer Experience sidebar entry and OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support in LastPass importer; Touch ID unlock for Safari extension
Adds a Developer entry to the sidebar with Settings > Developer config key Show 1Password in the sidebar to enable access to developer credential tools
Adds OneLogin as a supported SSO provider in the LastPass importer
Enables Touch ID unlock for the 1Password extension in Safari
1Password for Windows 8.10.50 adds Developer sidebar, SSH passphrase auto-fill, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. self-update
Adds the Developer experience to the sidebar under Settings > Developer with a Show 1Password in the sidebar toggle to discover and configure developer credential tools
Automatically includes the passphrase when exporting or copying an SSH key with a passphrase in the SSH Key item
Adds self-update support to the Windows ARM version of 1Password
1Password for iOS 8.10.50 adds one-time code sign-in on iOS 18, QR device setup, SSH key export, and MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. settings support
Adds the ability to sign in to websites and apps using a one-time code from 1Password on iOS 18
Enables setting up another device using a QR code instead of a manual setup code, with a confirmation screen for unauthorized devices
Allows exporting encrypted SSH keys on 1Password for iOS and Android, including automatic inclusion of the passphrase with the item
Adds support for additional general, privacy, and security settings to mobile device managementmobile device managementMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. (MDM)
Provides an iOS 18+ dark icon option for the 1Password app
Adds QR code sign-in on new Android devices and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement for Autofill.
Sign in on a new device by scanning a QR code from an already-signed-in mobile device
Verify your 1Password account with two-factor authentication when using Autofill
1Password SDKS 0.1.2 adds tag management, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. resolution via secrets.resolve, and Python SDK publishing.
Adds support for creating, getting, and editing tags within 1Password items.
Adds secrets.resolve function to fetch one-time password (TOTP) codes using secret references.
Simplifies item creation by making vault ID, item category, and item title the only required fields; optional values like details no longer need explicit None assignment in ItemCreateParams.
Publishes the Python SDK to PyPI with package name onepassword-sdk.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager October 2024 adds Kanban access requests, email actions, and separate approval tasks
Adds an Access Request report viewable as a list or Kanban board for cross-app request management
Adds an Access request widget on the Dashboard summarizing open request status
Enables direct Approve or Decline actions from buttons in email notifications sent to approvers
Adds automatic passphrase injection for exported SSH keys and expanded MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. settings
When you export or copy an SSH key with a passphrase, the passphrase is now automatically included with the SSH Key item
Added support for additional general, privacy, and security settings to mobile device managementmobile device managementMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. (MDM)
1Password for Windows Beta 8.10.50-8 adds SSH key export passphrase inclusion and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. self-update.
Exports or copies of SSH keys with passphrases now automatically include the passphrase with the SSH Key item.
JumpCloud MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. adds iOS/iPadOS 18+ BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. enrollment via ADUE and Apple Intelligence restriction policies.
Adds support for Account-Driven User Enrollment (ADUE) for iOS/iPadOS 18+ BYOD devices.
Adds two new MDM policies to control access to Apple Intelligence features on iOS/iPadOS and macOS.
Adds full support for Android 15 devices in the MDM platform.
JumpCloud Go session management in User Portal; Remote Assist ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. binaries for Apple Silicon
Adds a new section in User Portal > Security > Multi-Factor Authentication to manage JumpCloud Go sessions on user devices
Drops separate manual architecture selection for Remote Assist; the installer now automatically selects the appropriate binary (ARM64 or x86_64)
New SaaS ManagementSaaS ManagementA category of software that tracks, governs, and optimises an organisation's portfolio of SaaS subscriptions, covering spend, access, and licence utilisation from a single control plane. capability allows tracking usage and enforcing access policies via a new browser extension and policy settings.
Workspace API Keys now support Time-to-Live (TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.) settings for automatic expiration
4 more releases in this issue
· 2024-10-11 → 2024-10-29
The Ory Console now exposes configuration options for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.-based authentication flows.
Ory Identities now supports PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. social sign-in flows automatically.
New SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.-based authentication capability for Ory Kratos users.
Adds External SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Connections for multi-org sharing and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. custom scopes, attribute mapping to trusted_metadata, and auto token refresh
Adds External SSO Connections enabling a single SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDC connection to authenticate across multiple organizations
Adds custom OIDC scopes configurable per connection or through query parameters.
Adds attribute mapping for OIDC connections to propagate values into the member's trusted_metadata field
Adds automatic refresh of OIDC access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.
4 details in Everything
1 more release in this issue
· 2024-10-11 → 2024-10-25
Stytch dashboard now supports SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login for all accounts with self-serve configuration via Workspace Settings.
Adds SSO login to stytch.com for all account tiers, including Free, allowing developers to log in via SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..
Topaz v0.32.31 introduces automated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for release artifacts, targeting specific operating systems and architectures.
└──▷ GET THIS VERSION
$ git clone --branch v0.32.31 https://github.com/aserto-dev/topaz.git
# already have the repo? check out this version:$ git checkout v0.32.31
Adds sbom generation capability to the build/release process, scoped by GOOS and GOARCH environment variables.
Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.
New EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Public API for mass incident management, macOS 15 Sequoia support, and Distributor billing report endpoints.
Adds the POST /reports endpoint to trigger stored usage reports for Distributor billing automation
Adds GET /api/2/reports/<id>/stored and GET /api/2/reports/<id>/stored/<report_id> endpoints to download customer usage data regardless of Support access settings
Adds EDR Public API mass incident management capabilities for partners with Advanced Security + EDR licenses
Adds support for macOS 15 Sequoia workloads, including backup, security, and File Sync and Share
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The /api/ams/REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. is deprecated and will be removed after a one-year notice period, requiring migration to the new public REST API.
Veeam Kasten is a Kubernetes-native platform for backing up, restoring, and migrating containerized applications and their persistent data.
Kasten K10 7.0.13 adds Azure Disk CBT incremental export and read-only location profiles for import/restore.
Adds incremental block mode export with changed block tracking (CBT) for Azure Disk volumes provisioned using the disk.csi.azure.comCSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. driver.
Adds support for read-only location profiles for import and restore operations, enabling tighter control over data access and security.
2 details in Everything
2 more releases in this issue
· 2024-10-03 → 2024-10-31
Kasten K10 7.0.10 adds custom pod labels/annotations to k10restore chart and granular worker pod resource controls.
Adds podLabels and podAnnotations Helm flags to the k10restore chart to attach custom labels and annotations to pods created during Veeam Kasten Disaster Recovery.
Adds granular resource requests/limits configuration for k10 worker pods.
Multiple policies that select the same applications now perform separate, policy-associated actions when run simultaneously.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Admins gain granular control to enable Long-Term Retention per customer via Managed Services Center.
Adds an option in Managed Services Center (MSC) to enable Long-Term Retention (LTR) for Hybrid Workloads customers.
Allows MSP Admins to determine which Enterprise and Elite customers can leverage LTR storage capabilities.
2 details in Everything
8 more releases in this issue
· 2024-10-07 → 2024-10-30
New SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and Endpoint discovery reports added to Managed Services Center for MSPsMSPsA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs..
Adds SharePoint Site Discovery Report, Groups Discovery Report, and Teams Discovery Report to Managed Services Center
Adds Endpoints, Microsoft 365, and Google Workspace Preserved Users Datasources Report to Managed Services Center
Enhances Hybrid Workloads alert emails to include customer's Account Name in the subject line
Druva Enterprise Workloads v7.0.3 adds auto-configuration tag removal handling and supports Nutanix AOS 6.7/6.8 with new guest OSes.
Enables automatic backup disablement and alert notification when auto-configuration rules remove tags from VMware VMs
Adds support for Nutanix AOS 6.7 and 6.8 for AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. data protection
Adds guest OS support for Windows Server 2022, Ubuntu 22.04, and RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.8 on Nutanix AHV
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Discontinued support for Nutanix AOS versions 5.5 to 6.4; upgrade required to use supported versions.
Druva inSync GovCloud adds Smart Backup for SharePoint, RESTore APIs, eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. client v2.0.7, and AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. admin provisioning
Introduces Smart Backup for Microsoft 365 that utilizes an advanced site change detection algorithm to selectively back up SharePoint Online sites, requiring a mandatory backup interval settable from 2 days to quarterly (90 days, default 7 days).
Adds new restore APIs for SharePoint Site Collections, SharePoint Site Restore Points, SharePoint Sites, filtered users, protected cloud apps, OneDrive/Exchange Online restore points, and OneDrive/Exchange Online restoration.
Adds Administrator Management functionality using AD/LDAP integration with a new version of the AD/LDAP Connector.
Updates eDiscovery Download Client to v2.0.7 for Cloud data governance tasks.
Enhances file violations list APIs with new parameters: File Name, Policy Violation, Sensitive Data Found, UserName, Datasource, Violation Reported On, Resolved On, Resolution Details, and Additional Comment.
+3 moreshow less
Adds support for backup and restore of Microsoft Teams Shared Channels as Shared Channels (including granular restores).
Enables Enterprise Key Management for Google Workspace allowing use of AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves.-generated keys for encryption.
Introduces Last Sync Time display in the User Provisioning tab for Google Directory sync status.
Threat Hunting now accepts SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. and MD5 file hashes alongside SHA1
Adds support for inputting SHA-256 and MD5 file hashes in Threat Hunting queries (in addition to existing SHA1 support)
Adds automatic best-effort resolution of SHA1 from provided SHA-256 or MD5 hashes during threat hunting
Adds Oracle Home, Oracle Base, Other Server Parameters, and Restore Location input fields in the Management Console for custom parameters during Oracle SP File redirected restore
Phoenix backup store now supports Ubuntu 22 via OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. package for Oracle database backup and restore
Protection capability enabled in the Ohio storage region (disaster recovery service not available)
Analytics page gains Consumption Insights tab with granular Credits, Storage, and Backup Sets details
Cost Allocation and Credit Limits information integrated into the Analytics page from Billing module
Druva Enterprise Workloads adds custom SP file parameters for Oracle redirected restore and Ubuntu 22 support for Phoenix Backup Store
Adds support for custom Oracle Home, Oracle Base, Other Server Parameters, and Restore Location values during Oracle SP File redirection in the Management Console
Extends Phoenix Backup Store platform support to include Ubuntu 22 via OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. package
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Discontinued support for Ubuntu 18 Linux operating system edition; proxies must be upgraded to a supported version
Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.
Acronis Cyber Infrastructure 6.2.1-66 adds support for multiple iSCSI targets per node.
SPIRE v1.11.0 adds forced rotation/revocation, a new EJBCA UpstreamAuthority plugin, and config-file variable support.
└──▷ GET THIS VERSION
$ git clone --branch v1.11.0 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.11.0
└──▷ USE IT
Control the size of the now-always-on SPIRE Agent LRU identity cache to tune memory usage for your workload density.
hcl
# In the SPIRE Agent config file
agent {
x509_svid_cache_max_size = 1000
}
Adds forced rotation and revocation support for SVIDs.
New EJBCA UpstreamAuthority plugin for SPIRE Server enables issuing SVIDs via an EJBCA CA.
Supports variables in templates within the SPIRE config file.
Supports configuration validation RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. on all built-in plugins.
Improves CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory usage for concurrent Kubernetes Workload attestation.
+2 moreshow less
Enables CGroups v2 support in Kubernetes and Docker workload attestors by default.
SPIRE Agent LRU identity cache is now always enabled, with size controllable via x509_svid_cache_max_size.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The deprecated -ttl flag has been removed from the SPIRE Server entry create and entry update commands; commands using -ttl will break.
!Official support for MySQL 5.X has been dropped; no explicit testing will be performed against this version.
!The SPIRE Agent LRU identity cache is now unconditionally enabled; any configuration that previously disabled it will no longer have that effect.
Adds real-time DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. controls for MS Teams Approval/Praise apps and secure enrollment enforcement options.
Adds activity detection and DLP support for real-time control of Approval and Praise apps in Microsoft Teams
Adds the new Enforce feature and web UI Enforce Token(s) option to manage secure enrollment token policies
Okta SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. categorization now excludes Single Sign-On (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) apps from 3rd Party Apps category
3 details in Everything
1 more release in this issue
· 2024-10-03 → 2024-10-17
Netskope R120 adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Alternate User ID, FTP real-time policy with DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., UCI REST reset API, and GPT-4o ChatGPT Attach activity.
Adds Alternate User ID field to Private Apps SAML Reverse Proxy configuration for identity mapping.
Enables Real-Time Policy for FTP (Firewall Application) with DLP Profiles and file size constraints (controlled GA).
Updates Transaction Event Format-4 with 35 new fields in Identity, Device, Threat Protection, and Connection categories (beta).
Adds Attach activity detection for ChatGPT connector via GPT-4o LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support to monitor files attached from Google Drive or Microsoft OneDrive.
Adds eight GenAI-specific Cloud Confidence Index (CCI) attributes for informational tracking of enterprise data usage and AI regulation compliance.
+16 moreshow less
Allows resetting User Confidence Index (UCI) value to 1000 via the new UCI Reset REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint.
Expands Netskope Reporting platform with interactive visualizations, centralized schedule management, improved sharing, and expanded template library (New Experience).
Adds Box as a forensic destination for Next Gen Forensics.
Displays Microsoft Purview Information Protection sensitivity labels on the Inventory side panel for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps.
Enables downloading multiple quarantine and legal hold files as a compressed .zip from the Incidents page Next Gen tab.
Extends inventory side panel data to Box, Dropbox, Egnyte, Google Drive, Salesforce (Sharing & Links), and Microsoft 365 OneDrive/SharePoint/Salesforce (File Versions).
Allows scheduling PDF reports for storage apps via PDF REPORT > Schedule in the Advanced Analytics Dashboard.
Supports CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GitHub 1.0 Benchmark compliance standard in SaaS Security Posture Management (SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.).
Makes SaaS Security Posture Management and SSPM Compliance dashboards generally available in the Netskope Advanced Analytics Library.
Adds support for RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and SSH access via Browser Access without requiring the Netskope Client.
Enables Forward to proxy action for all SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. bypassed traffic to next hop proxies (controlled GA).
Separates Custom categories, URL Lists, and URL Lookup into distinct sections in the Web profiles UI.
Increases concurrent isolated browser tab limits in Remote Browser Isolation (RBI) to remove predefined thresholds, binding only on resource consumption limits.
Adds an AI Assistant to the SQL Editor that can generate SQL from natural language prompts, explain queries, and identify potential issues
Supports 1-click rollback for SQL Server DML change tasks
Enables gh-ost online schema changes for MariaDB databases
Introduces new SQL review rules requiring MAX_EXECUTION_TIME for MySQL, MAX_STATEMENT_TIME for MariaDB, and specific ALGORITHM and LOCK options for online DDL in MySQL/MariaDB, plus table/column comment checks for PostgreSQL/Oracle
Adds a rule to disallow mixing statements within the same DDL or DML task during SQL review
5 details in Everything
└──▷ BREAKING ON UPGRADE
!CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. parsed expressions no longer include unused sourceInfo, which impacts the structure of responses from /v1/cel/batchDeparse, /v1/cel/batchParse, and all IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy endpoints (/v1/workspaces/*:getIamPolicy, /v1/workspaces/*:setIamPolicy, /v1/projects/{project}:getIamPolicy, /v1/projects/{project}:setIamPolicy).
!The group_email parameter is now mandatory when calling POST /v1/groups to create a new group.
1 more release in this issue
· 2024-10-10 → 2024-10-24
Custom End User Notification messages available for inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on macOS
└──▷ HOW TO FIND IT
Configure a custom alert to appear in the Zscaler Client Connector tray when a user triggers a DLP rule.
📍Administration › End User Notifications › Client Connector
Zscaler Client Connector 3.8 for iOS adds ZDX support, per-app VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., and skip.authByTunnel config
Adds authByTunnel=1 config parameter to enable passwordless enrollment for ZIA-only and ZIA + ZPA users via the Portal IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
Adds External Device ID value in Device Details screen
Adds support for wildcard (*) ZPA application segments
Includes support for Digital Experience (ZDX) on iOS devices
Supports per app VPN access for Zscaler Private Access (ZPA) apps along with Enterprise VPN for Zscaler Internet Access (ZIA) on iOS devices
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Requires Tunnel SDK 3.8 (previously 3.7); by default, Tunnel SDK 1.9 is enabled and must be changed by contacting Zscaler Support to enable SDK 3.8
Zscaler Client Connector 3.7 adds ZDX for Federal cloud, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. dropping in Forwarding Profiles, OS Version posture type, and secondary DNS fallback.
Adds OS Version device posture type for assigning specific entitlements to devices based on posture.
Supports separate one-time passwords (OTPs) for the logout and uninstall functions in Zscaler Client Connector.
Adds the ability for Zscaler Client Connector to fall back to a secondary DNS.
Includes the ability to drop IPv6 traffic when configuring Forwarding Profiles for Zscaler Client Connector.
Adds Digital Experience (ZDX) support for the Federal cloud.
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware predicates, EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. scan caching, region-scoped onboarding, and new data posture policies for AWS/Azure/GCP
Adds Has Malware, Malware Name, Malware Category, and Detection Accuracy Level predicates to investigation queries and custom policies.
Adds scanner cache for EBS volumes attached to multiple EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances or Auto Scaling groups to reduce scan cost and improve performance.
Adds region selection during onboarding of AWS Organizations, Microsoft Entra Tenants, and GCP Organizations to limit scanner instance deployment.
Adds Resource Property Predicate supporting the And operator for multiple attributes in a metadata array.
Adds three new AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role resource types: IAM Role, IAM Unmanaged Role, and IAM External Role.
ZIA adds Advanced SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. capabilities, Endpoint Data Scan Report, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file management API, and new isolation analytics filters.
Adds GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, and DELETE /pacFiles/{pacId} endpoints to manage Zscaler-hosted PAC files via Cloud Service API.
Adds the Endpoint Data Scan Report for visibility into sensitive data stored locally on connected endpoints, with drill-down by user.
Adds Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) features including 3rd-Party App Governance and configuration drift management.
Adds Policy Reason as a new Web Insights filter for Isolation Policy in ZIA Analytics.
Adds a new widget for Policy Reason in Browser Isolation Consumption Reports within ZIA Analytics.
ZPA Private Service Edge 24.566.2 adds Business Continuity support and refined Client-to-Client connection promotion.
Adds Business Continuity support to ZPA Private Service Edge, enabling resilient connectivity during outages.
Enhances Private Service Edge logic to promote only Client-to-Client connections when overlapping Client Hostname Validation and application segments are configured.
ZDX adds alert rule templates for Zscaler Hosted Probes and new filters in Data Explorer
Adds the ability to create alert rule templates on the Templates page to prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. criteria for Zscaler Hosted probes
Adds additional filters and group options in Data Explorer configuration
Workflow Automation now allows post-closure incident actions and configurable approvers in specific workflow templates.
Adds Assign DLP Admin, Assign to Me, Assign Priority, Notify User, and Label actions for resolved incidents via the Incidents page Actions drop-down
Enables selection of an approver from the Approver Name drop-down when creating workflows using the Auto Escalate, Auto Notify User and Escalate, or Auto Notify User and Concurrently Escalate templates
ZIA adds Confirm action for Inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., granular AI/ML controls, and EUN localization.
Adds Confirm action to Inline Web DLP policy rules to allow users to justify or cancel transactions
Extends granular control actions in the Add AI & ML Rule window for Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway
Adds localization support (Chinese Traditional, French, German, Japanese, Spanish) for Endpoint DLP end user notification messages
ZIA adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference.-based Turbo Mode for Isolation and granular AI/ML app controls
Adds Turbo Mode for Isolation to enable GPU-accelerated rendering in isolation profiles
Extends granular action controls to Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway applications
ZPA adds Turbo Mode for Isolation to leverage GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. rendering and reduce bandwidth
Adds Turbo Mode for Isolation feature that uses the user's GPU to capture and replay rendering instructions instead of pixel streaming.
Enables enabling Turbo Mode for Isolation per isolation profile in ZPA.
Authentication Service now mandates immediate MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enrollment, supports OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. step-up authentication via ACR claims, and allows access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. revocation for API client
Removes the option to skip MFA enrollment for a default grace period, requiring admins to enroll immediately upon first login
Adds support for Step-Up Authentication over OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect with external IdPs, allowing configuration of authentication levels and mapping them to ACR claims
Enables revoking access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. assigned to API clients accessing Zscaler service API resources
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The option to skip MFA enrollment for a default grace period is no longer available, requiring admins to enroll immediately upon first login
Zscaler Client Connector for VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. adds port and protocol forwarding support in v1.4.0.5
ZIA adds localized End User Notifications for Endpoint and Inline Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., DLP rule support for LibreOffice/Edge print jobs, and ATP blocking notifications.
Adds localized (Chinese Traditional, French, German, Japanese, Spanish) end user notification messages for Endpoint DLP policy enforcement
Adds a Confirm action to Inline Web DLP policy rules, allowing users to justify or cancel blocked transactions with a localized confirmation message
Extends Endpoint DLP policy rule application to print jobs in LibreOffice, Chrome, and Microsoft Edge
ZIA adds SSN inclusion/exclusion attributes to API, HTTP GET query param DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection, Slack file restore, non-delimited Unicode DLP, IR health checks, and .zipx/.ost suppo
includeSsnNumbers and ssnNumbers API attributes for the predefined DLP Social Security Numbers (US) dictionary on zscalertwo.net and zscalerthree.net to include or exclude specific SSNs.
UI toggle to enable HTTP GET query parameter inspection in DLP rules, available from the DLP page drop-down menu for URL categories.
Checkbox option to enable Non-delimited Unicode phrase matching when adding custom DLP dictionaries.
New health status JSON file (<systmld>_<iphash>_ir_health_status_timestamp.json) produced by the Zscaler Incident Receiver, running every 5 minutes by default.
Adds Settings UI/API for Topology, NTP, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript., and syslog hostname configuration.
The Settings menu replaces Topology Name and adds controls for NTP hosts, CORS embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. allowed hosts, and the syslog hostname.
Tagging API now supports generalized queries to find object types by tag, enabling the new Clientpack capability.
Self-tuning on boot or reboot adjusts concurrency based on available cores to improve performance on small instances such as AWS t3.nano.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Topology Name menu item is removed; Topology and Controller name are now accessed via the new Settings section.
Teleport v15.4.21 adds teleport_roles_total metric, TELEPORT_DEVICE_AUTO_ENROLL_DISABLED env var, custom SQS consumer settings, Firestore backend customization, tctl --with-secrets flag, and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. session listing fix
└──▷ GET THIS VERSION
$ git clone --branch v15.4.21 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.21
Teleport v16.4.3 adds Workload ID JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. SVID support, tctl AccessMonitoringRule commands, and tctl tokens ls --with-secrets flag.
└──▷ GET THIS VERSION
$ git clone --branch v16.4.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.4.3
└──▷ TRY IT
List join tokens with their actual secret values for automation or auditing purposes.
$ tctl tokens ls --with-secrets
Retrieve details of an AccessMonitoringRule resource using the tctl CLI for programmatic management.
$ tctl get AccessMonitoringRule --name=<rule_name>
Add --with-secrets flag to tctl tokens ls command to include secret join token values in output
Adds AccessMonitoringRule resource listing and retrieval capabilities to the tctl CLI
Enable Teleport Workload ID to issue JWT SVIDs via the Workload API for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. federation compatibility
Add sshAgent.addKeysToAgent config option in Teleport Connect to control local SSH agent interaction
Add ssh.forwardAgent config option in Teleport Connect to control SSH agent forwarding behavior
+1 moreshow less
Extend Teleport Discovery Service to support resource discovery across all projects accessible by the service account
Teleport v14.3.32 adds session termination controls and enforces device_trust.mode for OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees./Enterprise pairs
└──▷ GET THIS VERSION
$ git clone --branch v14.3.32 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v14.3.32
Session participants now see available controls to terminate or leave the session
Enforces a global device_trust.mode=required on OSS processes paired with an Enterprise Auth server
2 details in Everything
└──▷ BREAKING ON UPGRADE
!OSS processes paired with an Enterprise Auth server now require device_trust.mode=required, otherwise they will be rejected
Drata adds Vendor SOC2SOC2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. AI Summary with side-by-side view and CMMC control mapping.
Adds Vendor SOC2 AI Summary feature to highlight key elements, exceptions, and management responses for vendor reports
Adds Side-by-Side View to display uploaded SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. 2 reports alongside AI-generated summaries in one screen
Adds CMMC Control Mapping with 110 controls mapped to 195 requirements and 23 policy templates
Panorays Q3’24 adds DORA generator, Portfolios, Activity Center, Dark Web updates, and task management
└──▷ HOW TO FIND IT
Generate and send a DORA compliance report directly to Supervisory Authorities.
📍In Panorays, navigate to the DORA File Generator module and use the built-in templates to export the Register of Information.
Segment third parties by criticality and location for risk-based management.
📍In Panorars, use the Portfolios feature to group vendors based on criteria like geolocations and company departments.
Export supplier activity logs for auditing purposes.
📍In the Activity Center, filter logs by supplier and use the export function to download the data for reporting.
DORA File Generator module enables generation of a complete DORA Register of Information report for Supervisory Authorities using built-in questionnaire templates to automate Excel coding values.
Portfolios feature allows organization of third parties into distinct groups based on criteria such as criticality, sensitivity, geolocations, and company departments.
Activity Center provides a consolidated view of logs to track supplier activities with filtering and export capabilities for reporting.
Dark Web Enhancements add Source Type and Site details for third-party mentions, leveraging Cyber Threat Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) to categorize information and send alerts.
Task Management: General Tasks allows opening customized tasks for internal teams or third parties from a centralized place to streamline follow-ups.
+2 moreshow less
Business Snapshot: Certifications Improvements incorporate public certifications into the Bottom Line risk rating of third-party cyber assessments, subject to manual expert review.
Internal Questionnaires Report adds visibility of questionnaire status via a widget in Live Dashboards or an executive summary PDF report.
CISO Assistant v1.9.6 adds an Assets graph view and dynamic label support
└──▷ GET THIS VERSION
$ git clone --branch v1.9.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.6
└──▷ HOW TO FIND IT
Visualize asset dependencies and relationships within the platform.
📍In the console, navigate to the Assets section and select Assets graph from the view options.
Assign new attributes to an asset without pre-defining a static label schema.
📍Open an asset's details panel and use the dynamic input field to add a label on the fly.
Adds Assets graph as a new visualization for asset relationships.
Enables adding labels dynamically to assets via UI controls.
2 details in Everything
5 more releases in this issue
· 2024-10-04 → 2024-10-31
Adds Graph explorer beta for mapping crosswalks, plus a Helm chart and the Clausier de sécurité
└──▷ GET THIS VERSION
$ git clone --branch v1.9.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.5
└──▷ TRY IT
Deploy CISO Assistant to Kubernetes using the official Helm chart introduced in this release.
$ git clone --branch v1.9.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.4
└──▷ HOW TO FIND IT
Check your current seat count and license expiry date directly in the status section.
📍Navigate to the dashboard status area to view seats and expiry date fields.
Add add seats and expiry date in status to display subscription lifecycle details
Enable Upload backend logs as artifacts for audit trail persistence
CISO Assistant v1.9.3 adds a global analyst user group for permission management.
└──▷ GET THIS VERSION
$ git clone --branch v1.9.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.3
$ git clone --branch v1.9.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.9.0
Implements hard limits on user seats (CA-470) to control maximum active users
Introduces an Experimental Insights feature in the UI for data visibility
Supports viewing CMMC framework questions within the application interface
Adds library content type filter and fixes domain tree display in requirement assessments.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.11 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.8.11
Enterprise Gateway 1.8.0 adds Bedrock Converse API, Vertex Imagen, Stable Diffusion v2, Pydantic SDK structured outputsstructured outputsForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed., Lambda provider, and prompt cache pricing.
Bedrock chat completions now use the Converse API instead of /chat/completions, enabling tool calls and vision for supported models while removing manual chat templating logic.
Adds Vertex Imagen image generation support via the Gateway.
Adds support for Stable Image Ultra, Core, 3.0, and 3.5 models through stability-ai and bedrock providers, handling internal API signature transformations between v1 and v2.
Adds Pydantic SDK integration for structured outputs in GoogleAI and VertexAI providers by dereferencing JSON schemas to ensure Google compatibility.
Adds support for prompt caching pricing calculations for OpenAI and AzureOpenAI models that require it.
+1 moreshow less
Adds lambda provider with support for chat completions and completions endpoints.
Giskard tests and evaluates LLM applications for performance, bias, and security issues.
Adds conversation_correctness detector for evaluating LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. conversation flows.
└──▷ GET THIS VERSION
$ git clone --branch v2.15.2 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:$ git checkout v2.15.2
└──▷ USE IT
Evaluate the correctness of responses in an AI conversation chain using the new detector.
python
from giskard import Dataset, Model
from giskard.detectors import conversation_correctness
dataset = Dataset(df, ...
model = Model(...)
detector = conversation_correctness()
results = detector.run(dataset, model)
VS Code 1.94 adds Explorer search, Source Control Graph filters, Python test coverage, and Copilot in the Native REPL.
└──▷ GET THIS VERSION
$ git clone --branch 1.94.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.94.0
Adds improved Find control in the Explorer view for quickly locating files.
Adds more filtering options and interactivity to the Source Control Graph.
Supports running Python tests with coverage and displays rich results inline in the editor.
Faster startup via migration to ES ModulesES ModulesThe official JavaScript module system, standardized by TC39, that lets files import and export values using `import`/`export` syntax; tools adopt it for native browser compatibility and static analysis of dependencies. (ESM).
Enables per-extension account preference, letting users specify which account an extension should use.
+3 moreshow less
Adds Copilot inline chat and code completions inside the Python Native REPL.
Supports drag-and-drop files and IntelliSense-driven context attachment in Copilot chat for more relevant responses.
Adds automated test framework setup assistance to help configure a test environment for a workspace.
Adds an attribution field to Challenges for crediting challenge authors or sources.
Displays brackets in the Admin Panel and on user/team listing and profile pages.
Adds dark mode to the core-beta theme.
Enables overriding ECharts scoreboard and score-graph behavior via window.scoreboardChartOptions, window.teamScoreGraphChartOptions, and window.userScoreGraphChartOptions window objects.
Adds type and extra arguments to Assets.js() with defer defaulting to False.
+1 moreshow less
Updates the scoreboard score graph to reflect the currently active bracket.
kustomize v5.5.0 adds --helm-debug flag for enhanced Helm chart debugging
└──▷ GET THIS VERSION
$ git clone --branch kustomize/v5.5.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout kustomize/v5.5.0
└──▷ TRY IT
Troubleshoot a Helm chart inflated via kustomize by enabling verbose Helm debug output during the build.
kustomize api/v0.18.0 adds --helm-debug flag and drops Starlark support
└──▷ GET THIS VERSION
$ git clone --branch api/v0.18.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout api/v0.18.0
└──▷ TRY IT
Surface verbose Helm renderer output when diagnosing chart rendering failures inside a kustomization.
kyaml v0.18.0 adds Helm debug flag, inline list conversion control, and smarter Namespace sorting.
└──▷ GET THIS VERSION
$ git clone --branch kyaml/v0.18.0 https://github.com/kubernetes-sigs/kustomize.git
# already have the repo? check out this version:$ git checkout kyaml/v0.18.0
└──▷ TRY IT
Troubleshoot Helm chart rendering failures by enabling verbose Helm output during a kustomize build.
Adds --helm-debug flag to expose enhanced Helm debugging output during kustomize builds.
Adds annotation to control inline list conversion behavior in Kustomize resources.
Sorts built-in Namespace kind before CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. with the same name for more predictable apply ordering.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Starlark support for KRM functions has been removed; any pipeline relying on starlark-based krm functions will break on upgrade.
hardened_malloc v13 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. hardware memory tagging (MTE) support
└──▷ GET THIS VERSION
$ git clone --branch 13 https://github.com/GrapheneOS/hardened_malloc.git
# already have the repo? check out this version:$ git checkout 13
SysReptor 2024.79 adds granular file storage settings, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. trusted types, and markdown editor enhancements.
└──▷ GET THIS VERSION
$ git clone --branch 2024.79 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2024.79
Adds more granular file storage settings for finer control over where and how files are stored.
Adds trusted types configuration to Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. for stronger XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. mitigations.
New markdown editor toolbar button to reference findings directly from the editor.
Markdown editor now shows a markdown snippet in image preview dialogs for quick copy-paste embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG..
$ git clone --branch 3.4.0 https://github.com/openssl/openssl.git
# already have the repo? check out this version:$ git checkout 3.4.0
Added JITTER random seed source using a statically linked jitterentropy library.
Adds encapsulation and decapsulation operations to the pkeyutl command.
Added XOF DIGEST API with EVP_xof() helper and updated context size macros for SHAKE digests.
Added support for directly fetched composite signature algorithms (e.g. RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it.-SHA2-256) in EVP signing APIs.
Added FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. indicators to allow logging of unapproved algorithms via OSSL_INDICATOR_set_callback() in the FIPS provider.
+7 moreshow less
Added -not_before and -not_after options to req, x509x509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols., and ca commands for explicit certificate date setting.
Added CMP support for retrieving certificate request templates (-template) and CRLs (-crlcert, -oldcrl, -crlout, -crlform>, -rsp_crl).
Added TLS integrity-only cipher suites TLS_SHA256_SHA256 and TLS_SHA384_SHA384 (RFC 9150).
Added support for multiple X.509v3 extensions including issuedOnBehalfOf, auditIdentity, and others.
Added Attribute Certificate (RFC 5755) support via public API.
Added enable-pie configuration option to build Position Independent Executables.
Redesigned Windows OPENSSLDIR/ENGINESDIR/MODULESDIR to use registry keys at run time.
12 details in Everything
└──▷ BREAKING ON UPGRADE
!RSA encryption using PKCS1 padding is no longer approved in the FIPS provider.
!SSL_SESSION_get_time(), SSL_SESSION_set_time(), and SSL_CTX_flush_sessions() are deprecated in favor of their _ex() replacements.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Cloudflare Workflows is now available in open beta for free and paid Workers plans, providing a programming model for reliable, long-running tasks triggered by events.
└──▷ USE IT
Scaffold a new long-running workflow project using the official starter template
Cloudflare introduces SSH with Access for Infrastructure, enabling short-lived certificates and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for servers.
Enables fine-grained policy authoring for SSH access control, including specific ports, protocols, and SSH users.
Provides infrastructure access monitoring via Access and SSH command logs.
THE CYBER TOOLCHAIN
NO. -021