The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
BloodHound v5.14.0 expands OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec coverage, adds AIACA nodes in CA chains, and improves Saved Cypher with description fields.
└──▷ GET THIS VERSION
$ git clone --branch v5.14.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v5.14.0
Adds AIACA nodes to the certificate authority chain graph, improving PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visibility.
Adds a description field to Saved Cypher queries for better organization and documentation.
Expands OpenAPI spec to cover auth/user, grapher, cypher, search, data, analysis, and group entity endpoints.
Adds UI permission gating for asset group edits, restricting modifications to authorized users.
Adds audit log entries for failed auth token deletion events.
+3 moreshow less
Adds support for Entra devices with unsupported operating systems as graph nodes.
Adds default query result limits to all graph queries to improve stability at scale.
BloodHound v5.13.0 adds dark mode, hybrid path analysis, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. group shortcutting, and live datapipe status exposure.
└──▷ GET THIS VERSION
$ git clone --branch v5.13.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v5.13.0
Adds dark mode UI theme across the application, including updated Copy menu palette support.
Introduces hybrid path edge post-processing and edge panels for cross-environment attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis.
Adds DCSync group shortcutting to accelerate DCSync-related attack path calculations.
Exposes live datapipe status via the tool API, enabling real-time ingest pipeline monitoring.
Returns partial failure details when ingesting zip files, so practitioners can see which entries failed without losing the whole ingest.
+4 moreshow less
Displays server version on the profile page.
Supports negative numbers in Cypher queries.
Expands OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. (OAPI) spec coverage to include entity path endpoints for User, Computer, Domain, GPO, OU, Base, Azure, and Meta entities.
ligolo-ng v0.7.2-alpha switches agent/proxy serialization from gob to msgpack
└──▷ GET THIS VERSION
$ git clone --branch v0.7.2-alpha https://github.com/nicocha30/ligolo-ng.git
# already have the repo? check out this version:$ git checkout v0.7.2-alpha
└──▷ BREAKING ON UPGRADE
!Wire protocol changed from gob to msgpack — existing proxy and agent binaries from prior versions are no longer compatible and must both be upgraded together
0 more releases in this issue1 more release in this issue · 2024-08-04 → 2024-08-25
ligolo-ng v0.7-alpha adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. tunneling, automatic tunnel recovery, and a new autoroute command.
└──▷ GET THIS VERSION
$ git clone --branch v0.7-alpha https://github.com/nicocha30/ligolo-ng.git
# already have the repo? check out this version:$ git checkout v0.7-alpha
└──▷ TRY IT
Set up all required interfaces and routes automatically instead of running separate interface/route commands.
$ ligolo-ng proxy> autoroute
Adds WebSocket protocol support for tunneling, including HTTP-proxy support.
New automatic tunnel and listener recovery on network loss — sessions resume without manual intervention.
New autoroute command that automatically creates tunnel interfaces and routes in one step.
sickle-pdk v2.0.2 adds Windows registry key support and detects all bad characters from a single input flag.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.2 https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:$ git checkout v2.0.2
└──▷ TRY IT
Identify all common bad characters in one pass rather than running the tool multiple times.
$ sickle -b"\x00\x0a\x0d"
Supports specifying all bad characters on a single input argument (e.g. -b"\x00\x0a\x0d") instead of requiring separate passes.
Adds a Windows registry key entry for easier invocation on Windows hosts.
Re-focuses supported architecture targets to x86, x64, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware..
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Sickle subdirectory has been renamed to sickle (lowercase), which may break paths, scripts, or imports that reference the old casing.
!module() classes have been renamed to FormatModule() classes, which will break any custom modules or plugins that subclass or reference the old class name.
Empire v5.11.2 adds ThreadlessInject, Invoke-BSOD modules and ticketdumper; this minor release is a bug-fix only patch.
└──▷ GET THIS VERSION
$ git clone --branch v5.11.2 https://github.com/BC-SECURITY/Empire.git
# already have the repo? check out this version:$ git checkout v5.11.2
Adds ThreadlessInject module for in-memory process injection without allocating executable memory pages.
Adds Invoke-BSOD module to trigger a Blue Screen of Death on compromised hosts.
Adds ticketdumper IronPython module for extracting KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. tickets from memory.
pwntools 4.13.0 adds Windows process support, ELF.stripped/ELF.debuginfo properties, process.env_add, ssh.env_add, gdb.server_timeout, and ssh.libs.flatten.
└──▷ GET THIS VERSION
$ git clone --branch 4.13.0 https://github.com/Gallopsled/pwntools.git
# already have the repo? check out this version:$ git checkout 4.13.0
└──▷ TRY IT
Detect the binary and libc automatically when generating a new template.
$ $ pwn template --binary ./challenge.elf
pwn template now automatically detects the challenge binary and libc files.
Adds ELF.stripped and ELF.debuginfo properties to query ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. metadata.
Adds support for starting processes on Windows via process().
checksec output now includes x86 CET status.
Adds the env_add argument to process() to merge environments instead of replacing them.
+3 moreshow less
Adds the env_add argument to ssh() to merge remote environments.
Adds a flatten argument to ssh.libs to control library resolution output.
Adds a timeout argument to gdb.server to configure the gdbserver connection wait time.
Instaloader v4.13 adds a max_count parameter to download_profiles for capping how many profiles are downloaded.
└──▷ GET THIS VERSION
$ git clone --branch v4.13 https://github.com/instaloader/instaloader.git
# already have the repo? check out this version:$ git checkout v4.13
└──▷ BREAKING ON UPGRADE
!Post.owner_profile may now return a different user than the one being downloaded for posts shared by multiple users; use {target} in the filename pattern to ensure filenames reflect the downloading profile.
cloudlist v1.0.9 adds AWS assume role, GCP ADC fallback, and expands asset coverage across EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., Lambda, GCP functions, and more via the -s flag.
└──▷ GET THIS VERSION
$ git clone --branch v1.0.9 https://github.com/projectdiscovery/cloudlist.git
# already have the repo? check out this version:$ git checkout v1.0.9
Adds --aws-assume-role support to the AWS provider for pulling assets from cross/multiple accounts
Expands AWS provider asset fetches to include cloudfront, ecs, eks, elb, elbv2, lambda, lightsail, and apigateway services
Expands GCP provider asset fetches to include bucket, function, and run services
Adds the -s / -service CLI flag to filter or fetch assets by service name (comma-separated)
Enables GCP provider to fallback to Application Default Credentials (ADC) when gcp_service_account_key is not set
Predatory ESP32 firmware for M5Stack, Cardputer and LilyGo devices.
Bruce 1.4.2 adds BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. and NRF24 jammer support via CC1101 GPIOs
└──▷ GET THIS VERSION
$ git clone --branch 1.4.2 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.4.2
2 more releases in this issue
· 2024-08-12 → 2024-08-25
A fast, intuitive USB 2.0 protocol analysis application for use with Cynthion.
Packetry v0.2.0 adds packetry-cli wrapper, Linux AppImage build, and detail pane
└──▷ GET THIS VERSION
$ git clone --branch v0.2.0 https://github.com/greatscottgadgets/packetry.git
# already have the repo? check out this version:$ git checkout v0.2.0
└──▷ TRY IT
Run Packetry commands via CLI on Windows using the new wrapper.
$ packetry-cli <args>
Install the portable Linux desktop build as a single executable binary.
$ ./packetry.AppImage
View expanded packet information in the new detail pane of the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
📍Use the detail pane view in the UI
Add packetry-cli wrapper program, enabling command-line options on Windows.
A portable multi-tool for pentesters and geeks; this is its official firmware.
Flipper Zero 0.105 adds LFRFID GProxII and SubGhz Dickert MAHS protocol support
└──▷ GET THIS VERSION
$ git clone --branch 0.105.0 https://github.com/flipperdevices/flipperzero-firmware.git
# already have the repo? check out this version:$ git checkout 0.105.0
Adds lfrfid GProxII protocol support for low-frequency RFID emulation and reading.
Adds SubGhz support for the Dickert MAHS garage door remote control protocol.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!This update resets your PIN code; you must set it up again in Settings -> Desktop.
Flipper Zero Unleashed Firmware, an unlocked alternative firmware.
Unleashed Firmware unlshd-077 adds Dickert MAHS SubGHz protocol support and LFRFID GProxII compatibility
└──▷ GET THIS VERSION
$ git clone --branch unlshd-077 https://github.com/DarkFlippers/unleashed-firmware.git
# already have the repo? check out this version:$ git checkout unlshd-077
Adds Dickert MAHS garage door remote control protocol support for SubGHz transmission
Adds lfrfid GProxII support for 125kHz RFID reading and writing
Feature-rich, stable and customizable Flipper Zero firmware.
Momentum Firmware mntm-006 adds Key Copier app, Solight TE44 Sub-GHzSub-GHzRadio frequencies below 1 GHz (typically 300–900 MHz) used by IoT devices, key fobs, garage doors, and industrial sensors; cyber tools target this band to capture, replay, or analyze those wireless signals. support, GProxII RFID and iButton ID writing.
└──▷ GET THIS VERSION
$ git clone --branch mntm-006 https://github.com/Next-Flip/Momentum-Firmware.git
# already have the repo? check out this version:$ git checkout mntm-006
Adds Key Copier app for copying keys (by @zinongli)
Enables Music to Sub-GHz Radio transmission via the Sub-GHz app (by @jamisonderek)
Adds recognition of Solight TE44 weather station in Sub-GHz receiver (#183 by @m7i-org)
Adds support for Dickert MAHS garage door protocol in Sub-GHz transmissions (by @OevreFlataeker)
Adds manual Dolphin XP mode setting in MNTM Settings (by @Willy-JL)
+6 moreshow less
Shows free flash amount in internal storage info under Settings (by @Willy-JL)
Enables loading of BT, Desktop, Dolphin, Expansion, Notification, Region, Momentum Settings, Asset Packs, FindMy Flipper, NameSpoof, RGB Backlight, Power, and SubGHz configs on SD card insert (by @gsurkov, @Willy-JL)
Re-enables FURI_TRACE for improved crash debugging with source code paths (by @Willy-JL)
Adds GProxII RFID reader support in OFW (by @BarTenderNZ)
Enables ID writing for iButton devices in OFW (by @Astrrra)
Adds a new NumberInput GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. component that only accepts full numbers (by @leedave)
11 details in Everything
└──▷ BREAKING ON UPGRADE
!LFS / LittleFS Internal Storage is removed; all configuration must now be stored on the SD card
!Desktop settings require reconfiguration (PIN code, auto lock, show clock) due to storage restructuring
!CFG_PATH() and .config/ folder are removed; INT_PATH() now points to .int/ on the SD card
Checkov 3.2.234 adds SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scanning support on Windows.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.234 https://github.com/bridgecrewio/checkov.git
# already have the repo? check out this version:$ git checkout 3.2.234
Snyk IDE plugins add OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. auth support and severity annotations across VS Code, JetBrains, Eclipse, and VS.
Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication across the listed Snyk IDE releases: VS Code v2.18.1, JetBrains v2.9.0, Eclipse 2.0.2 and Visual Studio 1.1.63; the Visual Studio release supports VS 2022 only.
1 detail in Everything
5 more releases in this issue
· 2024-08-06 → 2024-08-29
Snyk CLI v1.1293.0 adds snyk config environment, default OAuth, pnpm Early Access, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.+ enhancements.
Introduces snyk config environment subcommand to set the API endpoint
Enables OAuth authentication by default for local users starting from v1.1293.0
Adds support for license issues in sbom test output for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats
Improves snyk container sbom accuracy by including application dependencies that could previously be omitted, alongside operating-system dependencies.
Displays successful rule hits alongside failed rules in IaC+ test results
+1 moreshow less
Enables Early Access testing and monitoring of pnpm projects via Snyk Preview
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Starting with CLI v1.1293.0, local-user authentication defaults to OAuth.
Snyk introduces Workspaces GA, rolling out as default for new organizations.
Announces General Availability of Workspaces to improve SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration accuracy and reliability
Rolls out ability to manage Workspaces at both the Snyk Organization and Snyk Group level
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Workspaces will be enabled by default for new Snyk Organizations, and existing Organizations will gradually transition; deferral requests must be submitted by September 20, 2024.
Mend SAST 24.7.2 introduces asynchronous scan processing with a new Processing state and optimized import handling for JavaScript/TypeScript.
Introduces Processing as a new SAST scan status to indicate asynchronous result processing
Enforces API validation requiring scan status to be neither Running nor Processing before querying findings
Adds graceful resource monitoring to fail scans before they run out of resources, ensuring partial results are available
Improves import handling efficiency in the new engine generation for Java, C#, and JavaScript/TypeScript to reduce scan times
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Querying SAST findings via an API now requires verifying that scan status is neither Running nor Processing; queries during these states may fail or return incomplete data.
GitLab 17.3 adds root cause analysis for failed jobs, multiple compliance frameworks, and new Kubernetes and security capabilities
Adds general availability of root cause analysis for troubleshooting failed CI/CD jobs using AI-powered log analysis.
Adds ability to run a health check for GitLab Duo setup in the Admin area's GitLab Duo page as a beta feature.
Adds Delete pod action directly from the Kubernetes dashboard UI within GitLab.
Adds connect command generation via the Kubernetes dashboard or agent list for terminal access to clusters.
Enables resolving SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. vulnerabilities with AI code suggestions and opening a merge request directly from the CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. support list.
+30 moreshow less
Allows applying multiple compliance frameworks to a single project, removing the previous one-framework limit.
Adds Code Suggestions acceptance rate and GitLab Duo seats assigned and used metrics to the Value Streams Dashboard AI Impact analytics.
Supports Raspberry Pi OS 12 packages for GitLab Self-Managed installations.
Adds Index the instance setting in advanced search configuration to perform full initial indexing or re-indexing with functional parity to the gitlab:elastic:index rake task.
Adds use_inherited_settings parameter to the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. of all integrations to toggle inheritance via API.
Exposes group and project webhook event history (past 7 days) via the REST API.
Enables searching for group settings via the command palette using > mode on a group page.
Adds granular control to enable or disable code suggestions for specific programming languages in VS Code.
Allows configuring custom HTTP agent options, including client certificates and CAs, directly in JetBrains IDE settings.
Adds repository maintenance option in project settings to remove blobs by object ID list and redact text (replaced with ***REMOVED***).
Introduces audit events: cluster_agent_created, cluster_agent_create_failed, cluster_agent_deleted, and cluster_agent_delete_failed.
Adds full support for Kubernetes version 1.30.
Allows configuring HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. authentication with SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. signature in the X-Gitlab-Signature header for merge request external status checks.
Enables filtering the Member list by role in group or project settings.
Allows viewing custom role permissions in the right drawer of the Members page for any user.
Extends LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. group link support to custom roles for permission mapping.
Adds Read Runners permission type available for creating custom roles.
Adds ability to disable or re-enable instance personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. via the Admin UI.
Supports adding Bluesky did:plc identifier to user profiles.
Preserves subdomain cookies on sign out, preventing cross-service sign-outs on sibling subdomains.
Enhances AI Impact analytics with sparklines trend visualization in data tables.
Allows connecting merge requests to tasks using closing patterns and auto-closing the task upon MR merge.
Enables setting parent items for OKRs and tasks directly from child records.
Adds report abuse functionality for tasks, objectives, and key results via the Actions menu.
Allows resolving threads in tasks, objectives, and key results.
Adds MR first reviewer assigned stage event to Value Stream Analytics for Cycle Time Reduction tracking.
Adds Rust support for Dependency and License Scanning via Cargo.lock file type and cargo CI/CD template.
Displays SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. ingestion validation errors in the project-level Vulnerability Report, Dependency List, and Pipeline Security tabs.
Adds SECURE_ENABLE_LOCAL_CONFIGURATION CI/CD variable (default true) to enforce shared rulesets by disabling local configuration preference in SAST, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., and Secret Detection.
Adds filtering jobs by job name in the pipeline view.
New VRM features include Application Risk Heatmap, Universal Connector 1.0, GitLab Repository support, and custom compliance mappings.
Application Security Heatmap provides an at-a-glance view of risk for all applications with drill-down capability to assets, issues, solutions, and score trending.
Universal Connector 1.0 enables ingestion of assets and findings from any data source via a straightforward API setup.
GitLab Repository Connector adds support for scanning files and logs to identify IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. configuration files and inventory image hashes, mapping runtime ACR/ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images to version control.
GitLab Ultimate connector integration automatically creates issues from Container and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings without additional setup.
Veracode Connector now supports a new asset type for application profiles, displaying SAST, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. issues in Asset and Issue tables.
VRM allows filtering the Issues table by user-defined custom compliance standards.
Enables filtering the Issues table by custom compliance standards defined by the organization
Adds out-of-the-box support for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS 1.4, CIS AWS 1.5, CIS AWS 2.0, and NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. Rev 5
Veracode Scan for JetBrains 1.3.1 improves autofix filtering and macOS Rider integration
Veracode Fix restricts suggested fixes to flaws with supported CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. IDs
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
Trufflehog v3.81.10 adds result cleaning customization and targeted scan filtration skipping.
└──▷ GET THIS VERSION
$ git clone --branch v3.81.10 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.81.10
Adds the ability to customize results cleaning via a smuggled interface in pull #3235
Introduces the ability to skip filtration for targeted scans in pull #3243
2 details in Everything
6 more releases in this issue
· 2024-08-02 → 2024-08-29
TruffleHog v3.81.7 promotes the analyze subcommand into the main TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. and unhides it for general use.
└──▷ GET THIS VERSION
$ git clone --branch v3.81.7 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.81.7
└──▷ TRY IT
Run the interactive TUI to analyze a found credential's permissions and scope directly from the main menu.
$ trufflehog analyze
Adds analyze option to the main TUI menu, making credential analysis discoverable without knowing the hidden subcommand.
Unhides the analyze subcommand so it appears in help output and is officially supported.
TruffleHog v3.81.6 adds a TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. for credential analysis and improves fine-grained GitHub token support.
└──▷ GET THIS VERSION
$ git clone --branch v3.81.6 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.81.6
Adds a terminal UI (TUI) for the analyze command, giving interactive visibility into credential analysis results.
Improves fine-grained GitHub personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. support in analysis.
Separates SID from token input in the Twilio analyzer for more precise credential analysis.
infisical-cli v0.28.7 adds --watch flag to infisical run for live secret updates and hot reload settings.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.28.7 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.28.7
Adds hot-reload.enabled and hot-reload.interval configuration keys under settings to control automatic reloading behavior
1 detail in Everything
8 more releases in this issue
· 2024-08-06 → 2024-08-29
$ git clone --branch infisical/v0.81.2-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.81.2-postgres
Adds Certificate Extension Server Trust (EST) protocol support for automated certificate enrollment.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.81.1-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.81.1-postgres
Adds support for the Certificate EST protocol, including simpleenroll, simplereenroll, and cacerts operations
Azure DevOps integration, role/project selection on invite, and email notifications for secret change requests.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.81.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.81.0-postgres
Adds azure-devops as a supported service integration for automated secret provisioning
Enables selecting specific roles and projects when inviting members to an organization via the UI or API
Adds new email notifications triggered on secret change requests, configurable per environment or project
Infisical v0.80 introduces certificate templates and group-level support for access requests.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.80.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.80.0-postgres
infisical-cli/v0.28.5 adds tag support for secret operations and simplifies auth by removing local workspace file requirement.
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.28.5 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.28.5
feat: added tag support for secret operation in cli
misc: made local workspace file not required if using auth token
Adds tag-based filtering for the secret API and improves migration performance via chunked inserts.
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.79.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.79.0-postgres
Secret migration switched to chunking based batch insert
infisical-cli v0.28.0 adds --vault-password-file for automated vault integration
└──▷ GET THIS VERSION
$ git clone --branch infisical-cli/v0.28.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical-cli/v0.28.0
└──▷ USE IT
Automate non-interactive authentication in CI/CD by passing the keyring password via a secret-managed file.
Infisical v0.78.0 introduces secrets engine v2, external KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. support, persistent file vault passphrase, and auto-deletion on integration removal
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.78.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.78.0-postgres
secrets engine v2 is now available, providing a new backend for secret storage and retrieval
Supports external kms providers to manage encryption keys outside the platform
The CLI now supports a persistent file vault passphrase via the new file vault mechanism
GitGuardian August 14 2024 adds saved views, custom remediation messages, and a new team leader API field
Adds is_team_leader boolean in the /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations API endpoints to replace the deprecated team_permissions field for designating team owners.
Adds Saved Views feature allowing admins to save frequently used filters as named views for quicker access in the dashboard.
Adds custom remediation message support in ggshield for pre-commit, pre-push, or pre-receive stages to provide developers with internal guidance.
Adds Health Check capability in the GitGuardian dashboard letting managers manually start checks for failed items immediately.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The team_permissions field is deprecated and replaced by the is_team_leader field in the /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations API endpoints.
GitGuardian Self-Hosted 2024.8.0 adds saved views, CAC/PIV auth, Helm updateStrategy config and API feedback_list
Adds updateStrategy configuration key to Helm values for customizing rolling upgrade strategy
Adds feedback_list field to secret incidents' API payload to expose user feedback via /v1/incidents
Supports CAC or PIV card certificate-based authentication (new architecture only)
Adds Saved views in the UI to save and quick-access frequently used filters for secrets
Adds progress estimation and comprehensive scan status details (size, duration, start/end dates, commits, branches, queue) for historical scans
+3 moreshow less
Allows manual triggering of Health Checks from the GitGuardian dashboard
Enables skipping initial historical scan when installing a new GitLab Community Edition integration
Adds is_team_leader boolean attribute in API endpoints /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations to designate team owners
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The team_permissions field has been deprecated and replaced by the is_team_leader field in API endpoints /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations
juice-shop v17.1.0 adds Node.js 22 support and guided tutorials for Admin Section and Reflected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. challenges.
└──▷ GET THIS VERSION
$ git clone --branch v17.1.0 https://github.com/juice-shop/juice-shop.git
# already have the repo? check out this version:$ git checkout v17.1.0
Adds support for Node.js 22.x runtime.
New guided tutorial script for the Admin Section () challenge.
New guided tutorial script for the Reflected XSS () challenge.
Improved DevTools-open detection in the hacking instructor tutorial helper.
Wapiti 3.2.0 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. injection detection, Swagger scanning, JSON payload injection, and cookie flag.
└──▷ GET THIS VERSION
$ git clone --branch 3.2.0 https://github.com/wapiti-scanner/wapiti.git
# already have the repo? check out this version:$ git checkout 3.2.0
└──▷ USE IT
Pass specific session cookies during a crawl without manual injection.
Detect LDAP injection vulnerabilities using the new module.
shell
wapiti --url https://target.com -m ldap
Scan an API by providing its Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. definition file.
Fastly adds INSECURE-AUTH anomaly signal to detect insecure auth methods like JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. None algorithm
Fastly adds Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Starter Package configuration to the control panel
Introduces dedicated instructions for configuring the new Next-Gen WAF starter package in documentation
Adds API endpoints to enable and configure Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. (ngwaf) via the product enablement API.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for HAProxy 1.4.2 adds RHEL9 support
Fastly CLI v10.13.0 adds TLS key path param, debug mode, timestamps, npm distribution, quiet JSON modeJSON modeForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed., and keepalive config.
Adds --key-path parameter to tls-custom private-key create command for specifying a private key file location
Adds debug-mode that wraps all network requests with verbose logging
Adds --timestamps flag to logtail command for timestamped output
Distributes CLI binaries via npm module for easier installation
Enables quiet mode automatically when the --json flag is supplied to suppress non-JSON output
+1 moreshow less
Supports configuring connection keepalive parameters for network requests
Fastly VCLVCLVarnish Configuration Language, a domain-specific language used to configure the Varnish HTTP cache, letting tools control request routing, caching rules, and traffic manipulation with low-latency precision. adds numbered group references ({N}) for regsub pattern matching.
Adds support for regsub named/numbered groups using {N} syntax (values 1-19) in the pattern argument
Removes deprecated tls.client.cert_verify_result and tls.client.raw_certificate_b64, requiring use of tls.client.certificate.is_verified
2 details in Everything
└──▷ BREAKING ON UPGRADE
!tls.client.cert_verify_result has been removed; use tls.client.certificate.is_verified instead.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. for NGINX 1.1.9 adds support for newer NGINX versions (1.27.x) and platforms including Alpine Linux 3.21.
Wallarm Node 5.0 shifts to Go with new diagnostic script path and consolidated logging.
Wallarm Node re-engineered from Ruby to Go for improved performance and scalability
Postanalytics CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage reduced from 0.5 to 0.1 cores
Logs consolidated into single file wcli-out.log
Diagnostic script moved to /opt/wallarm/collect-info.sh
cosign v2.4.0 adds Sigstore bundle format support for blob signing/verification and a new trust root file mechanism.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.0 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.4.0
Adds Sigstore specification-compliant bundle format support to verify-blob and verify-blob-attestation.
Adds protobuf bundle format support to sign-blob and attest-blob.
Adds support for recording creation timestamp in cosign attest.
Integrates a conformance test suite to verify signing and verification behavior.
Nightly cosign container builds now served from GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. instead of GCR.
+1 moreshow less
Includes SCT verification failure details in error messages.
Nexus Repository 3.71.0 defaults to H2 database, adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Docker support and new HTTP Config REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.
Sets H2 as the default embedded database for all new installations, including OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.
Enables rolling upgrades for High Availability (HA) deployments in preparation for 3.72.0
Adds OCI Distribution Spec 1.0/1.0.1 compliance for Docker repositories
Exposes a new HTTP Configuration REST API to retrieve, update, and reset HTTP settings
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Requires migration to H2 or external PostgreSQL database; Java 8/11 and OrientDB are no longer supported for upgrades
!Requires upgrade to Java 17 for all installations of version 3.71.0 and later
Improves Java cataloging with better multi-level parent POM resolution, DependencyManagement support, and cycle detection.
Updates PackageSupplier to type Organization for JAR files in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.
Improves main artifact name retrieval accuracy for multi-JAR packages.
Socket introduces Low Noise, Default, and Higher Noise default security policies with new alert types (Block, Warn, Monitor, Ignore).
Adds three customizable default security policy profiles: Low Noise (traditional SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.), Default, and Higher Noise to reduce alert noise and manage false positives.
Enables four new alert types: Block, Warn, Monitor, and Ignore for granular control over CI/CD flow and dashboard visibility.
Allows users to lock in specific settings during the transition period (August 14-28, 2024) before new defaults automatically take effect on August 28.
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
Apiiro adds Secure Code Warrior integration for just-in-time secure code training within AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. workflows.
1 more release in this issue
· 2024-08-15 → 2024-08-19
lavamoat-core v16 adds a global store with attenuation support and consistent negative policy override handling for builtins.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.0.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.0.0
Adds a global store with attenuation support, enabling attenuated access to global references across LavaMoat compartments.
Makes makeMinimalViewOfRef usage in builtin attenuation consistent with globals for negative policy overrides, now implemented in endowmentsToolkit for reuse by the webpack plugin.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Node.js v16 is no longer supported by lavamoat-core (and lavamoat-browserify, lavamoat-node, lavamoat-perf, lavamoat-tofu, lavamoat-webpack).
2 more releases in this issue3 more releases in this issue · 2024-08-16
LavaMoat v18 drops Node.js v16 support and adds compatibility for Node.js ^22.5.1 across all packages.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-browserify-v18.0.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-browserify-v18.0.0
Adds support for Node.js ^22.5.1 in the node, browserify, and perf components
Removes support for Node.js v16 from all workspace packages (core, node, browserify, perf, tofu, webpack)
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The tool no longer runs on Node.js v16; upgrades to v18.0.0 will fail or crash on that version.
allow-scripts v3.2.0 exports new policy-loading APIs and exposes canonical name maps for programmatic use.
└──▷ GET THIS VERSION
$ git clone --branch allow-scripts-v3.2.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout allow-scripts-v3.2.0
└──▷ USE IT
Audit CI for any packages missing an allow-scripts policy entry without running the CLI directly.
LavaMoat webpack plugin gains builtin attenuation by policy and a global store with attenuation support.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v0.5.0-beta.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v0.5.0-beta.0
Adds a global store with attenuation support, enabling fine-grained control over shared global state across packages.
Adds built-in module support in the webpack plugin options and build-time policy generation.
Adds built-in module support in the webpack runtime, allowing builtins to be tracked and controlled at runtime.
Enables attenuation of Node.js built-in modules via LavaMoat policy in webpack bundles.
Supports Node.js ^22.5.1 for the webpack plugin.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Node.js v16 is no longer supported by lavamoat-webpack (or lavamoat-core, lavamoat-browserify, lavamoat-node, lavamoat-perf, or lavamoat-tofu); upgrading requires Node.js v18 or later.
capa v7.2.0 adds a web-based results explorer, DRAKVUF sandbox support, and per-function/process filtering
└──▷ GET THIS VERSION
$ git clone --branch v7.2.0 https://github.com/mandiant/capa.git
# already have the repo? check out this version:$ git checkout v7.2.0
└──▷ HOW TO FIND IT
Inspect a saved capa JSON result interactively without installing anything.
📍Open https://mandiant.github.io/capa/explorer/# in a browser and drag-and-drop your capa result JSON file.
New web-based UI (capa explorer web) lets analysts inspect capa result JSON documents interactively in a browser — online at mandiant.github.io/capa/explorer or offline via a standalone HTML page — with filtering, sorting, and capability detail views.
New DRAKVUF sandbox feature extractor: pass a drakmon.log file to capa to extract capabilities from dynamic sandbox traces.
New CLI option to filter capa analysis to specific functions or processes, reducing scope and noise in large binaries.
Five new detection rules added: OneDrive file upload, Base64 decode via VBMI lookup table, BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. socket attachment on Linux, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. text-section hook removal, and Linux file deletion.
Radare2 5.9.4 adds UXN/UF2/s390x/STM8 support, Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. crypto, jump table analysis, project history, and dozens of new commands.
└──▷ GET THIS VERSION
$ git clone --branch 5.9.4 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 5.9.4
└──▷ TRY IT
Search for assembly patterns using glob matching to catch instruction families in one pass.
$ r2 -c '/ad mov eax, *' <binary>
Adds initial support for the UXN virtual machine architecture.
Adds initial support for the UF2 file format in the IO layer.
Adds initial support for native debugger on Linux/s390x.
Adds initial support for STM8 pseudo-decompilation.
Adds initial support for MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. jump tables via anal.jmp.tbl.
+41 moreshow less
Adds initial support for Ed25519 signature verification in the crypto layer.
Adds anal.flagends option to stop function analysis when flags are encountered.
Adds anal.emu option to run aaef/aef emulation passes inside aaa/af.
Adds anal.fixed.* settings (including anal.fixed.arch and anal.fixed.bits) to lock architecture and bits during analysis.
Adds iclc command to list classes from binary info.
Exposes ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. hash algorithm via rahash2 -a elf.
Adds ig command to guess binary size.
Supports resizing the BSS section with rabin2 -O.
Implements prj.history to save and load per-project command history.
Adds fD command to filter and mangle flag names.
Adds !! for session history and !. for history save in the shell.
Adds -D as an alias for iD in the shell.
Adds JSON support to the iD command.
Adds rax2 -q for quiet output when printing hexdumps.
Adds r2.cmd2[j] APIs for r2js scripting.
Adds initial support for base64-encoded r2js scripts.
Adds R2_PAPI_SCRIPT environment variable for custom r2papi testing.
Adds r_base32 encode/decode APIs.
Adds RBin.attr(str2bits) for binary attribute parsing.
Implements RBinPlugin commands in the new ABI via the i: interface.
Adds dir.sourcebase newabi setting and faster bin.dbginfo on macOS.
Adds magic file detection for Flutter binaries.
Supports glob matching in /ad (search for assembly patterns).
Adds Csp meta type for Pascal strings.
Adds phl/phL as aliases for Lh.
Adds ?iu command for a one-liner custom UI.
Adds Bit Registers panel in visual mode.
Implements menu separators, project and analysis options in panels.
Adds sfence.vma instruction support for RISC-V disassembly.
Adds SMI (small integer) anal hints support in disasm via ahi.
Adds double type support in RTable.
Supports multiline RCons.message() output.
Adds curl POST support in the socket layer.
Adds r2r -H flag and honors R2R_JOBS environment variable as a replacement for -j.
Adds initial implementation of r2pipe2.
Adds il2cpp metadata importer as an r2js script.
Adds Visual Studio MAP file parser script.
Creates sections for dyldcache stub islands.
Adds iP and :iF commands to dsc for authenticated pointer and cache info.
Makes anal.vinfun false by default, reducing noise in variable analysis.
Renames ib as ooi.
46 details in Everything
└──▷ BREAKING ON UPGRADE
!The ib command is renamed to ooi; scripts using ib will break.
!iSm is no longer a valid command (was previously accepted but did nothing).
!ihh and iHH aliases are removed.
!anal.vinfun default changed to false; setups relying on the previous default true behaviour will see different variable analysis output.
!radiff2 -A now runs aa instead of aaa; workflows relying on full aaa analysis via -A will need to adjust.
EMBA v1.4.2 introduces a new S18 module for capa analysis with ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. support.
└──▷ GET THIS VERSION
$ git clone --branch 1.4.2-Summertime https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout 1.4.2-Summertime
└──▷ HOW TO FIND IT
Run EMBA on a firmware image with the new capa module enabled via the scan profile.
Adds the S18_capa_checker.sh module to analyze executable files using capa and map findings to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques
Capstone 5.0.2 adds AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. meta-programming macros to ease the ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. name-change transition.
└──▷ GET THIS VERSION
$ git clone --branch 5.0.2 https://github.com/aquynh/capstone.git
# already have the repo? check out this version:$ git checkout 5.0.2
└──▷ BREAKING ON UPGRADE
!The constant value of CS_OP_MEM is reverted to its v5.0.1 value — code that relied on the value introduced between 5.0.1 and 5.0.2 must be updated.
Supports Sigma V2 |exists: modifier for field-existence checks in detection rules.
Supports Sigma V2 |cased: modifier for explicit case-sensitive matching.
Adds name lookup support for Sigma correlation rules.
Low-memory mode is now on by default; -s flag is repurposed as --sort-events to explicitly sort events before output (high memory).
+6 moreshow less
Sigma correlation reference rules no longer emit alerts by default; add generate: true to a rule to re-enable output.
Data fields in JSON output are now indexed (e.g., Data[3]) instead of emitted as a flat array, improving downstream parsing.
Aggregation rule alerts now include Channel and EventID even when multiple results are present.
JSON timeline outputs {} instead of "-" for empty Details fields, improving machine-parsability.
Updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tags to Sigma V2 format (e.g., defense_evasion → defense-evasion).
Config files in the config folder are now embedded in the binary, reducing file count for live analysis and Velociraptor deployments.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The -s, --low-memory-mode flag is renamed to -s, --sort-events; existing scripts or workflows that passed -s to enable low-memory mode will now instead enable high-memory event sorting.
!-R, --remove-duplicate-data and -X, --remove-duplicate-detections now require -s, --sort-events to be explicitly set; they no longer work without it.
!JSON timeline output for empty Details fields changes from "-" to {}; parsers that expected the string "-" will break.
!JSON Data field output changes from an array ("Data": [...]) to indexed keys ("Data[3]", "Data[4]", …); any downstream parser relying on the array format will break.
!MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tags are reformatted to Sigma V2 style (e.g., defense_evasion → defense-evasion); tooling that matches on the underscore format will no longer match.
!The set-default-profile command requires the config directory to be present on disk; it cannot run from the embedded-config binary alone.
Turbinia adds API endpoints and CLI commands for logs, evidence, output downloads, and new report views.
└──▷ GET THIS VERSION
$ git clone --branch 20240820 https://github.com/google/turbinia.git
# already have the repo? check out this version:$ git checkout 20240820
Adds API endpoint download.output to retrieve task artifacts
Adds request.report markdown functionality to the API server config
Adds config.download functionality to the API server config
Adds new commands to support the latest API endpoints (logs, evidence, download)
Adds request report view in the Web UI
+2 moreshow less
Adds task report endpoint and corresponding UI changes
Updates OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec to reflect new capabilities
Cortex Analytics adds new detections for KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access., SPN enumeration, and internal login password spray.
Possible Kerberoasting attack Medium Analytics Alert is now available
Abnormal Communication to a Rare Domain Informational Analytics BIOCs is now available
DLP sensitive data exposed to external users Informational Analytics BIOCs is now available
Cortex Analytics 2024.07.24 adds new BIOCs and updates detection logic for cloud, Kubernetes, and identity threats
Added Collection error High Analytics BIOC to detect collection failures.
Added Correlation rule error Medium Analytics BIOC.
Added Error in event forwarding Medium Analytics BIOC.
Added 'A rare FTP user has been detected on an existing FTP server' Low Analytics BIOC.
Added Cloud email service activity Low Analytics BIOC.
+12 moreshow less
Added Rare DLP rule match by user Informational Analytics BIOC.
Improved logic for Copy a process memory file High Analytics BIOC.
Improved logic for 'Execution of the Hydra Linux password brute-force tool' Medium Analytics BIOC.
Improved logic for Kubernetes vulnerability scanning tool usage Medium Analytics BIOC.
Improved logic for 'Recurring rare domain access from an unsigned process' Medium Analytics BIOC.
Improved logic for 'Windows LOLBIN executable connected to a rare external host' Medium Analytics BIOC.
Improved logic for 18 Low Analytics BIOCs including An uncommon service was started and Masquerading as the Linux crond process.
Improved logic for Impossible traveler - SSO and Impossible traveler - VPN alerts.
Improved logic for 31 Informational Analytics BIOCs covering Kubernetes pod creation, PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. modification, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration.
Improved logic for 4 Informational Analytics Alerts including Kubernetes enumeration activity.
Decreased severity of 'A process modified an SSH authorized_keys file' to Informational.
Changed metadata for 'Discovery of misconfigured certificate templates using LDAP' Medium Analytics BIOC.
Prisma Cloud introduces DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores./AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. GA, MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions., Code-to-Cloud tracing, AI queries, and RQL AWS key fields
Data Security Posture Management and AI Security Posture Management modules are now generally available for subscription via the console.
New Managed Security Service Provider capability allows administering large customer groups from a single console with dynamic tenant creation, industry segmentation, and credit reallocation.
Code to Cloud Tracing for Vulnerabilities traces runtime container image vulnerabilities back to their root cause in build (package manager files, Dockerfiles, base images).
Vulnerabilities Dashboard gains Account Group and Cloud Account filters, a Vulnerable Assets widget, and toggling View By between CVE and Asset views.
AI Assisted Queries toggle enables semantic searchsemantic searchSearching by meaning rather than requiring the same words. It commonly compares vector representations to find related content, even when the wording differs. in the query launcher, interpreting natural language like public facing to return relevant saved searches.
+6 moreshow less
New RQL fields for AWS Access Key discovery: source.cloud.accesskey.lastused.days and source.cloud.accesskey.activekeys.
Custom Build Policies support a new AI and Machine Learning category in both YAML (Code Editor) and Visual Editor templates.
Resource Classes filter is available under Application Security > Inventory > IaC Resources, with supported values including Compute, Storage, Network, Identity & Security, Database, AI and Machine Learning, Analytics, Code, and Others.
Blocklist Resource Control allows defining granular resource controls to block specific Terraform resource types in custom build policies.
New compliance benchmarks added: SEBI CSCRF, SCF 2024.2, NIST SP 800-171 Revision 3, and CIS Controls v8.1.
Get Vulnerabilities by RQL API accepts a new View query parameter (values: CVE, Asset) to control vulnerability detail grouping.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Multiselect is disabled for the Alert Rule Name filter on the Alerts > Overview page; only one rule name can be selected in API requests via POST/alerts/policy.
!User-generated reports are now restricted to System Administrators and users with the same role due to RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. implementation.
!Create/Update Policy permissions are split into Policy and Manage Policy Compliance Mapping; new custom permission groups must explicitly select both to assign compliance mappings.
!azure-timeseriesinsights-environments and azure-datacatalog-catalog APIs are deprecated and no longer ingested; saved searches or policies based on these keys will be resolved as Policy_Deleted.
New Informational BIOC for rare DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rule matches and improved logic across 51 existing BIOCs and alerts.
Rare DLP rule match by user is added as a new Informational Analytics BIOC to detect data loss events triggered by specific DLP policies rather than generic content matches.
bettercap v2.33.0 adds NDP ban/router-lifetime controls, new scripting functions, a graph module, and updated MAC vendor data.
└──▷ GET THIS VERSION
$ git clone --branch v2.33.0 https://github.com/bettercap/bettercap.git
# already have the repo? check out this version:$ git checkout v2.33.0
└──▷ TRY IT
Set a custom router lifetime in NDP spoofing to poison IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. default gateway entries for a controlled duration.
Above v2.7 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. and RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. protocol detection to its network threat-visibility toolkit.
└──▷ GET THIS VERSION
$ git clone --branch v2.7 https://github.com/caster0x00/Above.git
# already have the repo? check out this version:$ git checkout v2.7
Adds SNMP and RADIUS protocol support for network threat detection.
Separates VLAN search into a dedicated function for improved modularity.
Rewrites host discovery via Passive ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. for enhanced reliability.
Wireshark 4.4 adds profile switching by filter, LZ4 compression support, and custom column expressions.
automatic profile switching allows Wireshark to associate a display filter with a configuration profile to automatically switch profiles when opening matching capture files
Capture files can now be saved with LZ4 compression using the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. or command-line tools, enabling fast random access for large captures
Custom columns in the GUI and custom output fields via tshark -e support valid field expressions including arithmetic, slices, logical tests, and display filter functions
Edit > Copy > Display filter as pcap filter now converts display filters to pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. filters when a corresponding equivalent exists for each field
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Support for Lua 5.1 and 5.2 has been removed; installers now ship with Lua 5.4.6 only
!The tvb_get_guintX and tvb_get_gintX API functions have been renamed to tvb_get_uintX and tvb_get_intX respectively
Security Onion 2.4.100 adds AI-powered alert summaries, mandatory OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. enforcement, and Tenable.io integration.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.100-20240829 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.100-20240829
Adds AI-generated summaries for alerts via new ai summaries capability in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared..
New setting to require OTP (one-time password) for user authentication.
Adds Tenable.io integration for ingesting vulnerability data.
Adds SSH warning to the soup upgrade tool to alert administrators before proceeding.
Adds support for new appliance RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. controllers.
$ git clone --branch 3.3.3.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.3.3.0
Adds outstanding packets counter to the DAQ layer for real-time queue depth visibility.
Adds flow hash key to the extractor for richer flow correlation in extracted output.
Adds peg counts for gzip, known-not-supported, and unknown encodings in http_inspect.
Logs normalized URI in extra data from http_inspect for improved alerting context.
Separates main-thread PCRE counts from packet-thread stats in IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. options for more accurate per-thread profiling.
Malcolm v24.08.0 adds public IP pseudo-segments, easier NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. plugin support, a reworked Windows Event dashboard, and Zeek v7.0.0.
└──▷ GET THIS VERSION
$ git clone --branch v24.08.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v24.08.0
Adds netbox tag to any logs passed into the netbox_enrich.rb script in the Logstash enrichment pipeline for easier filtering and identification.
Adds public pseudo-segments for public IP addresses to improve network segmentation visibility.
Allows users to more easily add NetBox plugins, and runs the netbox-initializers plugin on startup even during a NetBox database backup preload.
ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. installer now prompts users to format other drives for artifact storage rather than doing it automatically.
Upgrades Zeek to v7.0.0.
+4 moreshow less
Upgrades Arkime to v5.4.0.
Upgrades OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. and OpenSearch Dashboards to v2.16.0.
Upgrades capa to v7.2.0.
Specifies resource requests for some containers needed for Kubernetes deployments.
Inspektor Gadget v0.31.0 promotes image-based gadgets to GA, adds new trace/top gadgets, TLS support, config file, and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics.
└──▷ GET THIS VERSION
$ git clone --branch v0.31.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.31.0
└──▷ TRY IT
Trace bind() syscalls across all pods in a namespace to detect unexpected port listeners.
$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_bind:latest -n my-namespace
Audit seccomp policy violations across containers to identify syscalls being blocked.
$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/audit_seccomp:latest -n my-namespace
Promotes image-based gadgets to general availability (no longer experimental).
Adds trace_bind gadget for tracing bind system calls.
Adds audit_seccomp gadget for auditing seccomp policy violations.
Adds top_tcp as an image-based gadget for monitoring top TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections.
Ports trace_dns to image-based gadget.
+16 moreshow less
Adds OpenTelemetry metrics operator (otel-metrics) for image-based gadgets.
Adds support for profiler gadgets in the image-based gadget framework.
Introduces map iterators for image-based gadgets, enabling top_file to use them instead of legacy toppers.
Adds TLS support for ig/gadgetctlgRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. connections.
Adds configuration file support for ig and ig-k8s.
Adds --allowed-gadgets global parameter, replacing the previous --allowed-digests and --allowed-registries flags.
Adds option to restrict image-based gadget execution to specific registries.
Adds support for specifying multiple public keys for gadget verification.
Enriches trace_exec output with current working directory (cwd) field.
Adds pcomm (parent process command) field to relevant gadgets.
Adds retcode field to trace_tcpconnect output.
Adds Docker runtime image digest enrichment for running containers.
Adds process metadata enricher to container-collection.
Makes UidGidResolver available in image-based gadgets.
Improves insecure registry support.
Adds combiner operator for merging data across datasources.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!The --allowed-digests and --allowed-registries flags are replaced by --allowed-gadgets; existing invocations using those flags will break.
The cri-tools project provides command-line and validation tools for the Kubelet Container Runtime Interface (CRI).
crictl v1.31.0 adds pull timeouts, JSON schema introspection, runtime config updates, and Ctrl-C interruptibility across commands.
└──▷ GET THIS VERSION
$ git clone --branch v1.31.0 https://github.com/kubernetes-sigs/cri-tools.git
# already have the repo? check out this version:$ git checkout v1.31.0
└──▷ TRY IT
Cap how long a slow registry pull can block container creation in automated pipelines.
$ crictl run --pull-timeout 60s container-config.json pod-config.json
Adds --pull-timeout flag to crictl create, run, and pull commands to cap image pull duration.
Adds crictl [create,runp,run,pull] jsonschema subcommands to display the pod and/or container config JSON schema.
Adds crictl logs --reopen/-r flag to reopen container log files.
Adds crictl update-runtime-config subcommand to update the runtime configuration.
Adds filtering flags to crictl inspect, inspectp, and inspecti; with no filter, commands now inspect all containers, pods, or images.
+4 moreshow less
Supports pulling OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. object mounts on container creation when crictl create or crictl run is invoked with --with-pull.
Makes container, sandbox, and image commands interruptible via Ctrl-C.
Supports Fine-grained SupplementalGroups control (KEP-3619).
Outputs JSON, YAML, and go-template slices correctly for crictl inspect, inspectp, and images.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The --timeout/-t flag for crictl run is renamed to --cancel-timeout/-T.
Mend Container 24.8.1-1 adds stdlib Go detection and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. deps.json analysis.
Adds detection of vulnerabilities in the Golang stdlib package
Enhances NuGet detection to analyze packages defined in deps.json
2 details in Everything
1 more release in this issue
· 2024-08-11 → 2024-08-27
Mend Container 24.7.2 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning in CLI, C# reachability, and UI-based finding suppression.
Introducing Infrastructure-as-Code (IaC) scanning, available in the Mend CLI, that focuses on configuration file analysis to detect misconfigurations and provides resolution information
Added C# support for static container reachability, allowing you to find unused packages in .NET-based images and reduce security noise.
Added SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 to the list of available SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. standards in the Container Image SBOM export via the Mend CLI
Added the ability to suppress container image scan findings from the Mend Platform UI.
Gatekeeper v3.17.0 promotes CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-based VAP enforcement to beta, adds scoped enforcement actions, and supports CONNECT operations.
└──▷ GET THIS VERSION
$ git clone --branch v3.17.0 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.17.0
└──▷ USE IT
Enforce deny in audit but only warn via the webhook for the same constraint, without touching VAP or gator behavior.
Promotes CEL-based policies enforced through Validating Admission Policy (VAP) to beta status.
Adds scopedEnforcementActions field under spec in Constraints, enabling distinct enforcement actions (warn, deny, dryrun) per enforcement point (webhook, audit, gator, VAP) within a single constraint.
Transitions VAP generation configuration from annotations to explicit generateVAP fields in ConstraintTemplate and Constraint resources.
Adds support for intercepting and enforcing CONNECT operations via the Gatekeeper webhook.
Enables separate pod labels for controller-manager and audit deployments for finer-grained pod selection and monitoring.
+1 moreshow less
Makes the Gatekeeper service account configurable and adds an option to opt out of automatic service account creation.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!VAP generation configuration has moved from annotations to fields in ConstraintTemplate and Constraint — existing annotation-based VAP configurations must be migrated to the new generateVAP field to continue generating Validating Admission Policy and binding resources.
0 more releases in this issue1 more release in this issue · 2024-08-14 → 2024-08-21
Gatekeeper v3.17.0-rc.1 adds CONNECT operation support, scoped enforcement actions, generateVAP field, and promotes k8s-native validation to beta.
└──▷ GET THIS VERSION
$ git clone --branch v3.17.0-rc.1 https://github.com/open-policy-agent/gatekeeper.git
# already have the repo? check out this version:$ git checkout v3.17.0-rc.1
└──▷ USE IT
Explicitly control whether a ConstraintTemplate generates a ValidatingAdmissionPolicy using the new generateVAP field.
Supports CONNECT operations in webhook admission rules, enabling policy enforcement on proxy-style requests.
Adds scoped enforcement actions (scopedenforcementactions), allowing different enforcement behaviors to be applied at a more granular scope.
Promotes the k8s-native-validation feature to beta, making CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-based native Kubernetes validation more production-ready.
Adds a generateVAP field to ConstraintTemplates for explicit control over ValidatingAdmissionPolicy generation, replacing the previous annotation-based approach.
Checks for ConstraintTemplate generateVap intent before generating a VAPBinding, preventing unintended binding creation.
+2 moreshow less
Separates pod labels configuration between controller-manager and audit deployments for independent labeling control.
Makes the Gatekeeper service account configurable and adds an option to opt out of automatic service account creation.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!VAP generation control is now driven by the generateVAP field on ConstraintTemplates instead of annotations; existing annotation-based VAP configuration will no longer take effect.
Docker Compose v2.29.2 adds x-initSync extension to guarantee an initial sync on watch start.
└──▷ GET THIS VERSION
$ git clone --branch v2.29.2 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.29.2
└──▷ USE IT
Force an initial sync of watched files when starting docker compose watch, so containers always start with up-to-date content even before the first file change.
Bubblewrap v0.10.0 adds --[ro-]bind-fd to mount filesystems via file descriptor, eliminating TOCTOU risks.
└──▷ GET THIS VERSION
$ git clone --branch v0.10.0 https://github.com/containers/bubblewrap.git
# already have the repo? check out this version:$ git checkout v0.10.0
└──▷ TRY IT
Mount a directory into the sandbox via a pre-opened file descriptor to eliminate TOCTOU race conditions — useful when the caller needs to verify the path before passing it to bwrap.
Bubblewrap v0.6.3 backports --[ro-]bind-fd to mount filesystems via file descriptor without TOCTOU attacks.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.3 https://github.com/containers/bubblewrap.git
# already have the repo? check out this version:$ git checkout v0.6.3
Adds --bind-fd and --ro-bind-fd options (backported from 0.10.0) to mount a filesystem represented by a file descriptor, eliminating time-of-check/time-of-use (TOCTOU) race conditions.
Tracee v0.22.0 adds new kernel events, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. context, configurable pipeline sizing, and broader sys_enter/exit-free LSM hook coverage.
└──▷ GET THIS VERSION
$ git clone --branch v0.22.0 https://github.com/aquasecurity/tracee.git
# already have the repo? check out this version:$ git checkout v0.22.0
Adds security_task_setrlimit event to detect resource-limit manipulation attempts.
Adds security_settime64 event to detect system clock modification via the LSM hook.
Adds tracee_info event that emits metadata about the running Tracee instance.
Adds full-payload packet capture event containing complete packet contents for all captured packets.
Adds packet capture context, enriching captured packets with process/container metadata.
+5 moreshow less
Adds path and ctime fields to the module_load event for richer kernel module load visibility.
Adds prev_comm field to sched_process_exec event, exposing the pre-exec process name.
Makes security_socket_setsockopt, security_file_open, security_socket_connect, security_socket_accept, mem_prot_alert, security_socket_bind, and set_fs_pwd events independent of sys_enter/sys_exit, improving compatibility across kernel versions.
Adds configurable eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. pipeline channel size, enabling tuning for high-throughput environments.
Workspace admins can now define a default access mode for jobs compute. This setting applies to any compute resources created without an explicit mode, simplifying configuration management.
Databricks JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. driver 2.6.40 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery, refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. support, and OAuth redirect port configuration.
ProxyIgnoreList property is now supported when UseProxy is set to 1
Adds OAuth2RedirectUrlPort property to configure the OAuth redirect port for unified default OAuth options
Updated Arrow support. The driver now uses Apache Arrow version 14.0.2
Adds the ability to specify a subset of columns to sync for Mosaic AI Vector Search.
Allows specifying a subset of columns (besides the primary key and embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. column) to be included in a Mosaic AI Vector Search index
Row filters and column masks are GA on Databricks Runtime 12.2+ with new support for constant expressions, materialized views, streaming tables, MERGE, and table sampling.
Support for constant expressions in policy parameters (strings, numeric, intervals, booleans, nulls)
Public Preview support for applying row filters and column masks to materialized views and streaming tables
Support for MERGE statements on tables with applied filters and masks
Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access. GA adds MySQL, PostgreSQL, Redshift, Snowflake, MSSQL, Synapse, and Databricks connectors with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and pushdown improvements.
Adds Lakehouse Federation connectors for MySQL, PostgreSQL, Amazon Redshift, Snowflake, Microsoft SQL Server, Azure Synapse, and Databricks as generally available.
Adds single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) authentication support in the Snowflake and Microsoft SQL Server Lakehouse Federation connectors.
AWS CloudFront integration now in General Availability for collecting web logs.
Integrates AWS CloudFront to collect Web logs from the CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. for threat detection and hunting.
ESET PROTECT 5.4 adds a Vulnerability & Patch Management dashboard, on-demand vulnerability scanning, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for policy IP sets, and new MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. dashboard widgets.
Adds ESET Vulnerability & Patch Management dashboard for centralized visibility
Adds ability to run On-demand scan for vulnerabilities via the UI
Adds REST API endpoints to get and update IP sets for policies based on policy UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
Adds automatic installation and activation capability for Windows security products
Adds automatic activation capability for non-activated security products across Windows, macOS, and Linux
+5 moreshow less
Adds Activation of ESET LiveGuard Advanced on macOS (requires ESET Endpoint Security for macOS 8.0+)
Adds new widgets and layout changes to the ESET MDR dashboard
Adds new incidents statuses in the ESET MDR dashboard and reports
Adds notifications for incident status changes and required user action
Displays ESET MDR dashboard to customers without an active ESET MDR service subscription
Trend Vision One adds detection exception rules for Amazon S3 bucket names in CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. detections.
Detection Model Management now supports creating detection exceptions using the Match Criteria field type cloud_identifier with field requestParameters.bucketName.
Enables exclusion of specific Amazon S3 buckets from AWS CloudTrail detection rules via the bucket name value.
2 details in Everything
24 more releases in this issue
· 2024-08-01 → 2024-08-30
Trend Vision One XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud adds a Credit Usage graph to track ingestion volume.
Adds a Credit Usage view under Cloud Security → Cloud Accounts that displays current and historical data ingestion graphs.
Virtual Network Sensor v1.0.1341 adds the ability to collect and send TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. telemetry to TrendAI Vision One
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud adds detection of unauthorized deletion or tampering with Amazon Bedrock guardrails and knowledge bases.
Adds monitoring capabilities for detecting possible attacks on Gen-AI applications in Amazon Bedrock
Adds detection models for attempted and unauthorized deletion of guardrails and knowledge bases
Adds detection model for tampering with logging in Amazon Bedrock
XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. for Cloud - AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs and Cloud Response for AWS now support AWS Organization connections
Trend Vision One integrates Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. and Office 365 Management API for Exchange Online user behavior analysis in Cloud Email and Collaboration Protection
Adds integration with the Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. API to read Exchange Online activity data for user behavior analysis
Adds integration with the Office 365 Management API to access activity data for enhanced protection capabilities
Trend Vision One adds a new Cloud Security Posture dashboard for comprehensive cloud risk insights
Adds the Cloud Security Posture dashboard providing a comprehensive summary of cloud assets and risk findings (misconfiguration, compliance, vulnerability, threats, identity risk, data posture)
Renames the previous Cloud Posture Overview page to Compliance and Misconfiguration
Service Gateway Firmware v3.0.11 adds TrendAI certificate/token auth and fixes proxy/502 bugs
Adds support for TrendAI Vision One™ certificates and bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. for authentication when accessing service gateway appliance information.
Adds reverse proxy mode for on-premises gateways to protect private general and generative AI services in Zero Trust Secure Access.
Enables on-premises gateways in Zero Trust Secure Access Internet Access to operate in reverse proxy mode for protecting general private applications with access control, threat protection, and data loss protection (DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.)
Enables on-premises gateways in AI Service Access to operate in reverse proxy mode for protecting private generative AI services using rate limiting rules, content inspection, prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. prevention, and denial-of-service attack mitigation
Huntress MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. for Microsoft 365 Unwanted Access now GA with configurable Expected and Unauthorized rules and escalation handling.
Unwanted Access for MDR for Microsoft 365 is now generally available for detecting malicious login activity.
Configurable Expected rules in the Unwanted Access dashboard to specify countries/VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. where logins are allowed, filtering out anomalies.
2 details in Everything
3 more releases in this issue
· 2024-08-02 → 2024-08-21
New Entra Usage Location Not Set and Unexpected Login escalation notifications for MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. customers on Microsoft 365
Adds email and PSA ticket notifications for the Entra Usage Location Not Set low-severity escalation.
Adds email and PSA ticket notifications for the Unexpected Login high-severity escalation.
MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. for Microsoft 365 Unwanted Access enters public beta with session token theft detection and rule configuration.
Introduces Session Token Theft Detection to identify differences within login events from the same session
Adds Unwanted Access Rules dashboard to configure Expected and Unauthorized rules for countries and VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.
Enables Escalations for unknown login locations and unknown VPNs during public beta
ClamAV 1.4.0 adds ALZ and LHA/LZH archive extraction and granular image fuzzy-hash scan controls.
└──▷ GET THIS VERSION
$ git clone --branch clamav-1.4.0 https://github.com/Cisco-Talos/clamav.git
# already have the repo? check out this version:$ git checkout clamav-1.4.0
└──▷ TRY IT
Scan a directory while disabling fuzzy-hash image matching to reduce false positives or improve throughput in environments where image-based phishing detection is handled elsewhere.
Enable image scanning but disable fuzzy hashing in ClamD for a server deployment.
ini
ScanImage yes
ScanImageFuzzyHash no
Supports extraction and scanning of ALZ archives (new file type CL_TYPE_ALZ), with a DCONF toggle to enable/disable.
Supports extraction and scanning of LHA/LZH archives (new file type CL_TYPE_LHA_LZH), with a DCONF toggle to enable/disable.
Adds --scan-image and --scan-image-fuzzy-hash ClamScan flags to independently control image scanning and fuzzy-hash-based image detection.
Adds ScanImage and ScanImageFuzzyHash ClamD config options for daemon-level control over image fuzzy hashing.
Exposes CL_SCAN_PARSE_IMAGE and CL_SCAN_PARSE_IMAGE_FUZZY_HASH libclamav scan option flags for programmatic control.
+1 moreshow less
Adds optimization that skips file hash calculation when the clean file cache is disabled and no matching hash-based signatures exist, reducing unnecessary CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. work.
NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. 1.7 adds investigation console and product pages; PSA integrations support Sophos Switch/AP6 license syncing
└──▷ HOW TO FIND IT
Access the new investigation interface within the Central dashboard after upgrading NDR to version 1.7.
📍Navigate to the NDR section in Sophos Central UI
Configure your PSA connector to map Sophos Switch monthly support license data.
📍In Autotask/ConnectWise integration settings, enable mapping for Sophos Switch licenses
Adds an NDR investigation console in Sophos Central with the release of NDR 1.7.
Introduces new product pages for tools within Sophos Central as part of the NDR 1.7 update.
Expands Autotask and ConnectWise PSA integrations to map and sync monthly support license usage for Sophos Switch and AP6 devices.
Beelzebub v3.2.4 adds source IP and port logging and multi-architecture container support.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.4 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.2.4
Supports multi-architecture container builds, enabling deployment on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and other non-amd64 hosts.
1 detail in Everything
1 more release in this issue
· 2024-08-07 → 2024-08-30
pySigma v0.11.11 adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. D3FEND namespace support, a new set_custom_attribute transformation, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1 data.
└──▷ GET THIS VERSION
$ git clone --branch v0.11.11 https://github.com/sigmahq/pysigma.git
# already have the repo? check out this version:$ git checkout v0.11.11
Adds set_custom_attribute transformation to attach arbitrary metadata to Sigma rule objects during processing pipelines.
Adds MITRE D3FEND namespace support to pySigma's taxonomy layer.
Updates bundled MITRE ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. data to v15.1.
3 details in Everything
1 more release in this issue
· 2024-08-10 → 2024-08-31
v4.39.0 adds 29 new detections for Ivanti CVE-2024-7593, Office 365, and Windows AD, plus a new RMM Software Tracking Dashboard.
└──▷ GET THIS VERSION
$ git clone --branch v4.39.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.39.0
New analytic story for Ivanti Virtual Traffic Manager CVE-2024-7593, covering SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does.RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. and unauthorized account creation detections.
New analytic story for MoonPeak threat actor.
New detection: Ivanti EPM SQL Injection Remote Code Execution.
New detection: Ivanti VTM New Account Creation.
New detections for password spray attacks: Detect Password Spray Attack Behavior From Source and On User.
+3 moreshow less
New Office 365 detections: DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Rule Triggered, Email Access By Security Administrator, Email Reported By Admin/User Found Malicious, Email Security Feature Changed, Email Suspicious Behavior Alert, Safe Links Detection, SharePoint Allowed Domains Policy Changed, SharePoint Malware Detection, Threat Intelligence Suspicious Email Delivered, Threat Intelligence Suspicious File Detected, and ZAP Activity Detection.
New Windows Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. detections covering DCShadow privilege ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. addition, dangerous deny/group/user ACL modifications, domain root ACL deletion and modification, GPO deletion/disabling/new CSE addition, hidden OU creation, AD object owner updates, self DACL assignment, and suspicious attribute modification.
New RMM Software Tracking Dashboard for auditing and monitoring Remote Monitoring and Management alert content.
8 details in Everything
1 more release in this issue
· 2024-08-16 → 2024-08-29
v4.38.0 adds 20 new detections for CrowdStrike identity risk, O365 tenant access, and unusual NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication patterns, plus two new analytic stories.
└──▷ GET THIS VERSION
$ git clone --branch v4.38.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v4.38.0
Adds 9 new CrowdStrike detections covering weak password policies, duplicate passwords across users and admins, identity risk severity (high and medium), privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. for non-admin users, and medium/multiple-low severity alerts.
Adds 6 new Office 365 detections for cross-tenant access changes, external guest invitations, external identity policy changes, privileged role assignments, and applications available to other tenants.
Adds 5 new Windows NTLM detections identifying multiple null-domain authentications and unusual authentication patterns by source, destination, and user.
Introduces two new analytic stories: Compromised Windows Host and Handala Wiper, grouping relevant detections for those threat scenarios.
Adds three new macros — crowdstrike_identities, crowdstrike_stream, and ntlm_audit — to support the new CrowdStrike and NTLM detections.
OpenCTI 6.2.12 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. vulnerability data, active users count feature flag, and connector backpressure
└──▷ GET THIS VERSION
$ git clone --branch 6.2.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.2.12
EPSS support for Vulnerability Entity allows displaying Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data alongside vulnerability indicators.
Connector queuing now implements auto backpressure to manage load when connectors are overwhelmed.
MISP 2.4.196 adds a sighting-based Decaying Model, finer log search timestamps, and REST pagination headers.
└──▷ GET THIS VERSION
$ git clone --branch v2.4.196 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.4.196
└──▷ TRY IT
Retrieve paginated attribute search results and use the X-Skipped-Elements-Count header to track how many elements were skipped — useful when building reliable paging logic over large result sets.
New correlation rule system lets site admins define de-correlation rules — by org_id, orgc_id, event_id, or event_info (with substring matching) — to suppress noisy cross-correlations between selected events while still allowing those events to correlate with non-matching events.
Attribute restSearch now uses internal clustering and ID-based pagination (replacing MySQL offsets) for significantly faster large-dataset and paginated queries.
New legacy restSearch setting switches from sub-queries to joins, providing a major performance boost on older MySQL versions.
ThreatStream v15.1 adds support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques and sub-techniques.
Supports MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques associated with v15.1
ThreatStream adds ThreatBook CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. and Mandiant v4 premium feeds via the App Store.
Feedly Threat Intelligence adds AI Feed integration to newsletters, Strategic Initiative detection model, and UI enhancements.
Adds AI Feeds integration to the newsletter template editor for direct incorporation into Automated Newsletters
Introduces a new Strategic Initiative AI Model to track organizational initiatives, programs, acceleration programs, and donation initiatives
Increases precision of malware disambiguation for ambiguous names such as Sugar or LSD
Adds a tooltip to CVE links in AI Actions responses to provide additional context
Shows a product preview during onboarding for new users starting the Feedly Threat Intelligence trial
+2 moreshow less
Adds an EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and a Product column to the Exploited Vulnerabilities table in Threat Actor and Malware Insights Cards
Adds an Open in Navigator button to the header of Threat Actor and Malware Insights Cards
IntelOwl v6.1.0 adds 20+ new analyzers, a MalwareBazaar ingestor, Passive DNS playbook, and Traefik startup support.
└──▷ GET THIS VERSION
$ git clone --branch v6.1.0 https://github.com/intelowlproject/IntelOwl.git
# already have the repo? check out this version:$ git checkout v6.1.0
└──▷ HOW TO FIND IT
Automatically ingest the latest MalwareBazaar samples into IntelOwl for continuous threat feed enrichment.
📍Navigate to IntelOwl UI › Ingestors › Enable MalwareBazaar ingestor and assign a playbook to trigger on each new sample.
Deploy IntelOwl behind Traefik as a reverse proxy for production environments.
$ python start.py --traefik
Run the new Passive DNS playbook to investigate a domain's DNS history through the dedicated visualizer.
📍In the IntelOwl UI, submit a domain observable, select the Passive_DNS playbook, and view results in the Passive DNS visualizer.
New Detect-It-Easy analyzer identifies packers, compilers, and protectors in files.
New Malprob analyzer submits samples to the Malprob malware probability service.
New Orkl_Search analyzer queries the ORKL threat intelligence library.
New Crt.sh analyzer retrieves certificate transparency logs for a domain.
New Spamhaus_WQS analyzer checks domains/IPs against the Spamhaus Web Query Service.
+28 moreshow less
New Spamhaus_DROP analyzer checks IPs against Spamhaus DROP/EDROP blocklists.
New AdGuard DNS analyzer resolves indicators via AdGuard's DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. service.
New JA4DB analyzer looks up JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprints against the JA4 database.
New GoReSym analyzer extracts Go symbols, types, and metadata from compiled binaries.
New LeakIX analyzer queries LeakIX for exposed services and data leaks.
New APIVoid analyzer checks URLs, IPs, and domains via the APIVoid threat intelligence API.
New IOCExtract analyzer parses raw text to extract indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
New IocFinder analyzer parses and normalizes IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. from unstructured text.
New CriminalIP analyzer queries Criminal IP for IP/domain threat intelligence.
New CriminalIP_Scan analyzer triggers an active scan on Criminal IP.
New PolySwarm analyzer submits files and hashes to the PolySwarm malware intelligence platform.
New Knock analyzer performs subdomain enumeration on domains.
New MobSF analyzer performs static analysis of Android/iOS apps via MobSF.
New Droidlysis analyzer performs static analysis of Android APKs.
New APK Artifacts analyzer extracts artifacts from Android APKs.
New PDF URI extractor and pivoting analyzer pulls URIs from PDF files and enables pivoting.
Improved PE_info analyzer with expanded PE metadata extraction.
Improved Quad9 analyzers with enhanced DNS resolution capabilities.
New MalwareBazaar ingestor automatically pulls fresh samples from MalwareBazaar into IntelOwl.
New Passive DNS playbook and visualizer for streamlined passive DNS investigation workflows.
Supports playbook selection for pivot and ingestor actions, giving analysts control over post-trigger analysis.
Adds Traefik startup option via --traefik / --traefik_local flags for reverse-proxy deployments.
Frontend scan form no longer requires selecting an analyzer, allowing playbook-only submissions.
Replaced the scan form time picker with a date picker for more intuitive time range selection.
Added external link output in analysis results for direct navigation to source platforms.
Auto-creates a default test user when running with debug=true, simplifying development setup.
Adds email sender capability for notification workflows.
Removed reCAPTCHA requirement from the registration flow.
Cribl Stream 4.8 adds Azure worker groups, ServiceNow OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. destination, HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. auth for REST Collectors, and non-root Docker support.
Adds Azure as a provider option when creating new Cloud Worker Groups in Cribl.Cloud.
Adds the ServiceNow Cloud Observability Destination supporting OpenTelemetry ProtocolOpenTelemetry ProtocolOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. (OTLP) via HTTP or gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication..
Adds HMAC (Hash-based Message Authentication Code) Functions to the Knowledge Library for authenticating REST Collectors.
Adds CRIBL_VOLUME_DIR environment variable requirement for running Cribl Stream as a non-root user in Docker.
Adds Mapping ID setting to Teams in Cribl.Cloud for mapping Identity Provider groups.
+6 moreshow less
Adds automatic memory snapshot capture setting in Group’s General Settings for hybrid/on-prem deployments.
Adds log rotation for cribl_stderr.log limiting files to 5 MB each with a maximum of five rotated copies.
Adds Scale Reads setting to the Redis function to specify read node selection (primary, replica, or both).
Adds Enable load balancing setting to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and TCP JSON Sources.
Adds Retry Connection Timeout and Retry Connection Reset settings for Splunk Search Collector/Source and Office 365 Activity Source.
Adds Scope setting to the renamed Microsoft Sentinel Destination.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The Azure Sentinel Destination has been renamed to Microsoft Sentinel.
NodeZero Aug 2024 adds team Rapid Response access, sample report co-branding, ReadOnlyAccess cloud connections with expiry, and RAT support for rapid tests
Adds Rapid Response toggle in User Management to grant alert visibility and email notifications to team members.
Enables co-branding of sample operation reports via a new menu option in the Sample Op viewer for MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs./MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions./C+ licenses.
Introduces a new Cloud Connection type using the ReadOnlyAccess AWS Managed Policy for inspecting S3 objects and Lambda functions.
Adds optional expiration settings to Cloud Connections to limit temporary access duration.
Adds configuration options for Rapid Response tests to support NodeZero RAT for deeper impact analysis.
Stratus Red Team v2.16.0 adds initial EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. attack technique support for Kubernetes-on-AWS adversary simulation.
└──▷ GET THIS VERSION
$ git clone --branch v2.16.0 https://github.com/datadog/stratus-red-team.git
# already have the repo? check out this version:$ git checkout v2.16.0
Adds initial support for EKS attack techniques, enabling adversary simulation against Amazon Elastic Kubernetes Service environments.
Allows specifying a context when instantiating Stratus Red Team runners, propagating it down to Terraform for more flexible programmatic use.
runZero 4.0.240820.0 adds EoL OS asset query, passive AV/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detection, and Alerts UI redesign.
Adds system query for assets past OS Extended End of Life to the query library
Passive sampling tasks now identify Avast, Bitdefender, Carbon Black, ESET, Kaspersky, McAfee, SentinelOne, and Trellix AV/EDR products
Adds Data Source attribution to Attack Paths in Discover and Findings tabs
Data Source attribution is now displayed in the Attack Path summary section when exploring an attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.'s details
1 detail in Everything
10 more releases in this issue
· 2024-08-01 → 2024-08-29
Tenable One Identity Exposure 3.78 updates default IoE logic, restricts Secure Relay encryption to TLS 1.2/1.3, and refines Indicators of Attack.
Sets the default value of the Skip registry key check option to true for the default profile in the Unsecured Configuration of Netlogon Protocol indicator.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!The Secure Relay now only supports Tls12, Tls13, or Tls12, Tls13 for encryption; forcing deprecated standards like SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. v3 prevents the relay from starting.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Suggestion Blocklist to exclude domains and hosts from recommended scans.
Tenable One adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. data source support to Attack Path with new search and detection filters.
New Agent Health Events tab and Health column expose agent diagnostics directly in Tenable One VM.
Adds a new Agent Health Events tab to the agent details page that records available disk space, plugin update failures, integrity check failures, and compilation failures
Adds a new Health column to the Linked Agents page to quickly identify agents with recent negative health events
Tenable ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds Activity Logs and custom dashboards with new widgets
Adds Activity Logs page showing system events grouped by timestamp and actor.
Enables creation of custom dashboards, adding new widgets, or customizing the default Dashboard.
Tenable One ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adds configurable JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token expiration for application tokens.
JWT tokens issued to the application may now have a configurable expiration time.
Adds Tenable FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. Cloud Sensor IP ranges for cloud network scans and scanner/agent communications.
DefectDojo 2.37.0 adds Wizcli, Rapplex, and Kiuwan SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. parsers, drops MySQL/RabbitMQ, and gains new listing-table controls and import severity filtering.
└──▷ GET THIS VERSION
$ git clone --branch 2.37.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.37.0
└──▷ HOW TO FIND IT
Enable or disable listing tables site-wide from the system settings toggle, useful for decluttering the UI for large deployments.
📍In the console, go to System Settings and toggle the listing table switch on or off.
New Wizcli parser for ingesting Wizcli scan results.
New Kiuwan SCA parser for software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. results.
Extends AWS Prowler v3 parser with additional finding support.
Adds minimum severity flag support on import to filter out low-noise findings at ingest time.
Adds a toggle switch in system settings to show/hide listing tables.
+8 moreshow less
Bulk Edit: adds a note when pushing a finding to Jira.
Supports setting --max-fd argument to uWSGI to prevent OOMKill in Kubernetes deployments.
Migrates Okta authentication from python-jose to python_social_auth.
Switches database driver from psycopg2 to psycopg3 (PostgreSQL only).
Restores support for disabling test types via the active flag.
Product metrics now clickable in UI, redirecting to findings filtered by severity.
Centralizes uploaded file serving with improved error handling.
API: Finding properties related_fields, jira_creation, and jira_change are now marked as nullable.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!MySQL is no longer supported — deployments using MySQL as the database backend will break on upgrade.
!RabbitMQ is no longer supported as a message broker — deployments using RabbitMQ will break on upgrade.
Tenable Nessus 10.8.2 adds FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. environment support for Tenable One scanners and updates China endpoint connectivity.
Adds support for Tenable Nessus versions 10.5.0 and later to connect with Tenable One Vulnerability Management in FedRAMP environments
Brinqa 11.28.36 adds kill-switches for risk factors, DLM integration, sidebar dashboards, and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. data models.
Added kill-switch flow to bulk activate version 2 risk factors from the Brinqa Risk Intelligence feed
Added kill-switch to bulk deactivate version 2 risk factors and reactivate stock risk factors
Replaced data purge with Data Lifecycle Management (DLM) in data integration, making it the default behavior via removed feature flag
Linked data lifecycle flows with Source Data Models (SDM), allowing users to launch them directly from the data model page
Enabled dashboard sidebar navigation, removing the dashboard list from the top bar and adding Category organization for dashboards
+4 moreshow less
Added access control to dashboards to restrict assets and risks based on user permissions
Added report inputs as filters at the top of reports for clarity
Created new MITRE data models: Attack Mitigation, Attack Pattern, Attack Tactic, Attack Technique, EOL Advisory
Added configuration capability to push Remediation Campaigns to external tools
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The NIST NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. connector is no longer supported; users must switch to Brinqa Risk Intelligence.
!The cvssV2AttackVector attribute has been renamed to cvssV2AccessVector in the CVE Record and Finding Definition data models.
1 more release in this issue
· 2024-08-23 → 2024-08-26
Fleet 4.55 adds full VPP support for iOS/iPadOS, Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. fleetd packages, FileVaultFileVaultApple's full-disk encryption feature built into macOS, using XTS-AES-128 to encrypt the startup volume so that data is unreadable without the user's credentials. enforcement via Escrow Buddy, and OS updates for iOS/iPadOS.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.55.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.55.0
└──▷ TRY IT
Build a fleetd package targeting Linux ARM64 devices, such as Raspberry Pi or AWS Graviton hosts.
Adds support for generating fleetd packages for Linux ARM64 via the new --arch flag in fleetctl package.
Integrates Escrow Buddy to enforce FileVault key escrow during the macOS Setup Assistant for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-enrolled hosts with disk encryption enabled.
Adds OS update management support for iOS and iPadOS devices.
Adds iOS and iPadOS device details refetch via the existing POST /api/latest/fleet/hosts/:id/refetch endpoint.
Adds user-installed app inventory for iOS and iPadOS devices.
+14 moreshow less
Adds support for deploying Apple VPP (Volume Purchase Program) apps to iOS and iPadOS devices, including UI management for adding, removing, and disabling VPP apps.
Adds VPP support to GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. configuration.
Adds new POST /mdm/apple/vpp_token, DELETE /mdm/apple/vpp_token, and GET /vpp endpoints for VPP token management.
Adds new GET /software/app_store_apps and POST /software/app_store_apps endpoints for App Store app management.
Exposes associated VPP apps in GET /software/titles, GET /software/titles/:id, GET /hosts/:id/software, and GET /device/:token/software endpoints.
Adds support to delete a VPP app from a team via DELETE /software/titles/:software_title_id/available_for_install.
Adds exclude_software query parameter to the Get host by identifier API to reduce payload size.
Adds a UI warning banner when the uploaded VPP token is about to expire or has expired.
Adds global activity feed entries for VPP-related actions.
Adds No Teams support across all software pages, including adding software installers.
Linux lock/unlock scripts now use pam_nologin to keep Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. users locked out when a host is locked.
Installed software inventory now includes Linux .deb packages that are on hold.
Increases Apple SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. certificate renewal threshold to 180 days for MDM enrollments.
Maintenance window calendar events are now recreated within 30 seconds if deleted or moved to the past, with Fleet watching for changes up to 1 week after the original event time.
19 details in Everything
└──▷ BREAKING ON UPGRADE
!MySQL 5.7 is no longer supported; the minimum required version is MySQL 8.0.36.
!The --version flag is removed from the fleetctl package command; package version must now be controlled via the --orbit-channel flag.
!The software field is now mandatory for NO-TEAM and all TEAMs in GitOps configuration; adding software to NO-TEAM before upgrading to 4.55.0 is not supported.
Nudge v2.0.7 adds dynamic SOFA aboutUpdateURL support and auto-restart on MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profile changes.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.7.81783 https://github.com/macadmins/nudge.git
# already have the repo? check out this version:$ git checkout v2.0.7.81783
Adds support for setting aboutUpdateURL to the literal value sofa, which fetches the URL dynamically from the SOFA feed's SecurityInfo key if available
Nudge now automatically quits when an updated Managed Preference (MDM profile) is sent for com.github.macadmins.Nudge, relying on the LaunchAgent to restart it later
SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Bridge 2.9.6 adds SCIM Meta timestamp support and improves Google Workspace sync resilience
Adds schemas:https://scim.specs.username_1.com/ timestamp fields for users and groups in SCIM responses to support compliant provisioning integrations.
Improves Google Workspace sync stability by handling push notification errors without crashing the bridge process.
2 details in Everything
9 more releases in this issue16 more releases in this issue · 2024-08
1Password for Android 8.10.38 adds Watchtower recovery code alerts and passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. creation for hyatt.com
Adds a new Watchtower alert prompting users to set up a recovery code if one is missing.
Enables passkey creation specifically for hyatt.com.
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager August 2024 adds messaging for access requests and splits approval/provisioning tasks.
Adds the ability for employees and SaaS Manager users to exchange messages with access request task owners
Splits access request tasks into distinct approval and manual provisioning triggers
Enhances the access request timeline to show completed, in-progress, and pending steps
1Password for Windows 8.10.44-21 adds in-vault search, LastPass encrypted URL import, and admin-managed lock notifications
└──▷ HOW TO FIND IT
Check if MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. policy overrides your auto-lock timeout.
📍Settings › Security
Adds the ability to search within a list of items, such as a vault or category in the UI
Enables importing login items with encrypted URLs from LastPass via the import wizard
Displays a message in Settings > Security when auto-lock settings are managed by an account administrator
1Password browser extension adds account deletion in settings, device-name display on enrollment, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. button auto-focus
Adds the ability to delete accounts directly within the 1Password extension settings
Updates the Grant access to your account enrollment message to show the device name instead of the operating system
Auto-focuses the single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. button when it is the only available authentication method
OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. custom apps recovered in Object/Tenant flows; per-tenant retention configurable via UI
└──▷ HOW TO FIND IT
Configure how long tenant data is retained during onboarding or later in the UI.
📍Navigate to Settings › Tenants › Edit › Additional Options and set the retention period (default 450 days).
OIDC Custom Applications are now seamlessly recovered during the Object Recovery and Tenant Recovery flows.
Retention Period settings per tenant can be defined by the user during onboarding and modified later under Settings > Tenants > Edit > Additional Options.
New templated dashboard roles and SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. autofill for OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. login across mobile SDKs
Adds templated user roles (admins, developers, support agents) in Workspace settings for simpler permission management
Enables automatic Stytch role assignments based on email domains for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. Provisioning workflows
Adds SMS autofill for OTP login in pre-built UI components across iOS, Android, and React Native SDKs
3 details in Everything
2 more releases in this issue
· 2024-08-09 → 2024-08-30
Adds Sign-In With Ethereum (SIWE) support and ability to unlink retired emails; major FE SDK updates.
Adds Web3Web3A loosely defined model for a decentralized internet built on public blockchains, where applications run via smart contracts rather than centralized servers, giving cyber tools trustless, permissionless data and transaction layers. support for Sign-In With Ethereum (SIWE) including domain-binding via EIP-4361
Enables viewing and unlinking retired email addresses for B2B Auth members
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Frontend SDKs v5.0.0+ (vanilla-js), v21.0.0+ (nextjs), and v19.0.0+ (react) redirect API traffic to api.stytch.com and test.stytch.com, requiring CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. updates if previously targeting web.stytch.com
AI Usage dashboard highlights OAuth integrations for automated grant revocation
Adds a list of integrations associated with AI tools to the AI Usage dashboard to surface OAuth risk insights and discover opportunities to revoke OAuth grants automatically.
New filters to prioritize OAuth grants based on risk insights like vendor trust and scope sensitivity
Adds UI filters for OAuth grant prioritization based on app popularity, configuration choices, vendor trust signals, sensitive scopes, and deceptive practice indicators
Adds enabled filter for ldap_password_validate signal to control LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. credential validation
└──▷ GET THIS VERSION
$ git clone --branch version/2024.6.4 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2024.6.4
Adds support for OVAOVAAn Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. and VHDX hosting on AliCloud.
Updates kernel versions for OVA, VHDX, AMI, and VHD platforms.
Netskope 118 adds Cloud TAP GA, Egnyte NG API protection, SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. policy actions, and time-based SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. bypass rules.
Enables Cloud TAP controlled GA to capture endpoint/branch traffic and forward it to AWS, Azure, or GCP object stores with session keys for decryption.
Adds Egnyte support to Next Generation API Data Protection for policy creation, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and threat protection.
Adds the Apply Sensitivity Label policy action in Next Generation API Data Protection to apply Microsoft Purview labels on OneDrive, SharePoint, and Google Drive files.
Introduces the Scan Content Type criteria under Policies > API Data Protection > SAAS > Next Gen > New Policy > Object to filter by Personal/Team Drive or Direct message/Private/Public channels.
Adds upload activity detection for the Google Gemini application in CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. Real-time Protection.
+16 moreshow less
Adds the domain drive.fife.usercontent.google.com as a new entity for Google Drive application detection.
Adds support for IPv4 and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. DNS over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. in Netskope Private Access (NPA) without requiring Publisher DNS to be enabled.
Adds a Browser Access User Portal allowing end-users to view and launch authorized ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Browser Access applications.
Supports time-based real-time policies for traffic that matches an SSL bypass rule, enforcing block/alert/bypass actions based on policy schedules.
Enables creation of real-time protection policies using custom user attributes synced from the directory importer.
Extends DLP Original file access to Endpoint DLP via a download icon in the Incident Detail section, storing files in a Forensics folder defined by the Forensic Profile.
Adds Network File Share Device Control for the macOS Endpoint DLP agent upon request.
Updates SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. GET /Groups/{id} to support query parameters attributes and excludedAttributes for group membership.
Requires adding the Browser source criteria to all new or edited RBI Isolate policies to prevent non-browser traffic from matching.
Limits duplicate IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. alerts per signature to 30 alerts every 5 minutes via Event Thresholding.
Allows submission of false positive cases for malware files seen in Incidents > Malware table via the tenant UI.
Adds a Malware Retention profile option in real-time Threat Protection policies to retain malicious files in a designated IaaS folder.
Changes the minimum value for Periodic Device Classification in Client Configuration from 5 minutes to 1 minute.
Introduces Master Password support for Netskope Client on macOS devices via Client Configuration.
Adds One-Time Password-based client disable option for SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. services on Windows, configured under Settings > Security Cloud Platform > Client Configuration > Tamperproof.
Makes OS Version Check and AV check (CrowdStrike, SentinelOne, Carbon Black, Microsoft Defender) generally available for Windows and macOS devices.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!The API v2 endpoint /api/v2/spm/rules/cs/{cs_id} is deprecated; you must use /api/v2/spm/rules/categories/cs/subcategories/{id} to get compliance standard information.
New DEM Service Settings allow selective enablement/exclusion of DEM by user/group/OS/device, plus UI zoom and time zone switching.
Adds controls in the DEM Service Settings window to Enable DEM for Selected Users or Exclude Users by Individual User, Organizational Units (OU), User Groups, Device Classification, or Operating System (OS)
Adds a Query Visualization feature in DEM Service Settings to view selection criteria in a human-readable format
Adds time zone switching between local and end-user time zones on the user details page top right section
Adds Focus Mode zoom feature that syncs zoom across all charts on the User Details page
Bytebase 2.22.2 adds workspace-level group roles, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only enforcement, and a new PostgreSQL review rule.
└──▷ GET THIS VERSION
$ git clone --branch 2.22.2 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 2.22.2
Allow assigning roles to groups at the workspace level
Support disallowing sign-in with email and password, allowing only SSO
Add a PostgreSQL SQL review rule: Disallow setting volatile default values on columns
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The change histories page in the project has been removed; history is now located on the database page.
!BranchService.DiffDatabase API is no longer available.
!SQLService.DifferPreview API is no longer available.
1 more release in this issue
· 2024-08-08 → 2024-08-22
Bytebase 2.22.1 adds SQL Editor schema details, GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. PR review support, Microsoft Entra SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and Open NL2SQL to Community plan.
└──▷ GET THIS VERSION
$ git clone --branch 2.22.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 2.22.1
Add Microsoft Entra as a built-in OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. SSO provider for authentication
Enable natural language to SQL (NL2SQL) in the SQL Editor via the OpenAI feature on the Community Plan by configuring your own OpenAI key
Support SQL reviews via PR comments for GitOps workflows
Add support for selecting data sources between Admin and Readonly modes in the SQL Editor, configurable at the environment or project level
Support using database labels as filters for database group conditions in raw expression format
Adds Network Analyzer to Sensors page UI and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth support for managed secrets with DATABASE_URL.
└──▷ USE IT
Configure a secret provider to use IAM authentication for a PostgreSQL database via the DATABASE_URL label, replacing static password requirements.
auth_type: "IAM" is now supported for managed secrets labeled with DATABASE_URL, allowing direct AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. authentication instead of static credentials.
The Network Analyzer view is added to the Sensors page in the UI.
ZIA enhances Malware Protection Policy with targeted download controls for remote access tools and adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. support for Microsoft Cloud App Security partner integration.
└──▷ BREAKING ON UPGRADE
!Existing MCAS partner integrations using token-based authentication can no longer have configuration changes made to them; Zscaler recommends converting to OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0, after which the Token option is no longer available.
!New token-based MCAS integrations are not available as an option in the portal.
Workflow Automation adds integration with Business Insights for automated license management tickets.
Adds Workflow Automation integration with Business Insights to view and manage events for underutilized SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application licenses
Enables configuring workflows that automatically trigger tickets through a ticketing system for resolving Business Insights events
Adds email address as ServiceNow User ID and Network applications using Cloud Path probes for ZDX monitoring
Allows email addresses to be used as the User ID when configuring a Service User Role on ServiceNow for ZDX
Adds support for Network applications configured with only a single Cloud Path probe (no Web probe required), calculating ZDX Scores using End-to-End Latency
Adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attribute-based criteria for ZPA redirection policies via UI and API.
SAML and SCIM attributes are now available as criteria in ZPA Redirection Policy rules to prefer Private Service Edges over Public Service Edges
The cloud service API endpoints for configuring Redirection Policies have been updated to support these new attribute-based criteria
ZIA adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for MCAS, explicit proxy DNS tunneling, EDM format checks, new API endpoints, and traffic capture on allow policies.
Adds dnsoverproxy flag to NSS configuration to tunnel Zscaler cloud-bound connections without internet-facing DNS resolution
Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication method for Microsoft Cloud App Security (MCAS) partner integration via Administration > Partner Integrations
Adds EDM Popular Format Check to DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Advanced Settings to restrict Exact Data Match to SSN, CCN, and CSIN formats
Adds fields %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} to NSS Web log Feed Output Format for Server Destination Port and Other DLP Rules logging
Adds field %s{pcapid} to NSS Web, Firewall, and DNS feeds for PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file path output
+5 moreshow less
Enables Traffic Capture for IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control and Advanced Threat Protection policies when action is set to Allow
Adds GET /webApplicationRules/ruleTypeMapping and /webApplicationRules/{rule_type} endpoints to Cloud App Control Policies API
Adds POST /webApplicationRules/{rule_type}, POST /webApplicationRules/{rule_type}/availableActions, POST /webApplicationRules/{rule_type}/duplicate/{ruleId}, POST /webApplicationRules/{rule_type}/{ruleId}, PUT /webApplicationRules/{rule_type}/{ruleId}, and DELETE /webApplicationRules/{rule_type}/{ruleId} endpoints to Cloud App Control Policies API
Adds Download Sync and Upload Sync activities to the SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Activities Report for OneDrive and SharePoint
Adds support for .fcl, .aac, .greenshot, .heic, .heif, .img, .cap, and .sam file types in File Type Control and DLP policies
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing MCAS partner integrations using token-based authentication remain supported but cannot be modified or recreated; users must convert to OAuth 2.0 to retain functionality
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds region-scoped Terraform onboarding, OS directory exclusion for VMs, and enhanced RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for alerts.
Adds regional scoping when onboarding cloud accounts via Terraform templates to limit resource creation to specified regions
Introduces a new set of data posture policies covering AWS RDS MySQL/PostgreSQL, S3, and Azure Blob Storage/Ransomware risk
Adds region filtering on the Dashboard and Not In exclusion for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engines and dictionaries in Data Inventory filters
Updates RBAC permissions so users who can snooze alerts gain the ability to reset those alerts
Expands Alert Details tab with Policy Category, Compliance Benchmark, and Compliance Category fields
+4 moreshow less
Enables exclusion of OS directories and files during Azure and AWS VM data scanning to prevent unwanted scans
Adds fixed and relative time operators for Date predicates and Included In operator for Boolean Resource Property queries in Investigations and Custom Policies
Allows querying secondary and tertiary CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. resources attached to primary resources using the Associated With predicate
Renames Records and Matched Records terminology to Triggers
Workflow Automation adds an Update Template button for published notification templates and allows deletion of resolved incidents via the UI
Adds an Update Template button to the Notification Template page for editing published templates, replacing the previous Save as Draft and Publish Template buttons.
Adds the ability to delete a resolved incident by selecting the Delete action from the Actions drop-down menu on the Incident Details page.
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds regional Terraform onboarding, OS file exclusion for VMs, new query operators, and trigger terminology.
Adds region specification to Terraform templates for cloud account onboarding so DSPM resources are created only in target regions
Adds OS directory and file exclusion capabilities when scanning AWS and Azure virtual machines to prevent scanning of unwanted data types
Adds region filter support on the Dashboard, Not In (≠) exclude filter for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engines/dictionaries on the Data Inventory page, Fixed/Relative time operators and Included In (⊆) operator for investigation/policy queries, and Associated With predicate for secondary resources
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM format checks, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. MCAS integration, NSS PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. field, file type control updates, and Cloud App Control API endpoints.
Adds %s{pcapid} field to NSS feed output formats for Web, Firewall, and DNS logs to provide packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file paths
Enables DLP Exact Data Match (EDM) policies to enforce format checks for SSN, CCN, and CSIN in Administration > DLP Advanced Settings
Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication option for Microsoft Cloud App Security (MCAS) partner integration via the Select Authentication Method setting in Administration > Partner Integrations
Adds %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} fields to NSS Feed Output Format for web logs and corresponding filters/columns in Web Insights Logs
Adds Cloud App Control Policy rules API endpoints under /webApplicationRules/ for creating, modifying, retrieving, and deleting rules
+2 moreshow less
Enables traffic capture for IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control and Advanced Threat Protection policies when the action is set to Allow
Increases Zscaler Sandbox file size limit to 50MB for Windows EXEs, Android APKs, and Archives
7 details in Everything
└──▷ BREAKING ON UPGRADE
!Existing MCAS partner integrations using token-based authentication cannot have configuration changes made or be created anew; converting to OAuth 2.0 removes the Token option.
ZDX adds macOS Bandwidth Test and Hi-Fi Cloud Path diagnostics sessions
Adds Bandwidth Test as a new Diagnostics session type for macOS devices via the ZDX Admin Portal (requires Client Connector v4.3.1 and ZDX Module v3.9)
Adds Hi-Fi Cloud Path diagnostics session to provide detailed network connectivity and latency information
ZIdentity Admin Portal gets a user activity dashboard and UI redesign; Login ID mapping moves to Basic tab.
Adds ZIdentity Dashboard tracking user activity with counts for users, service entitlement assignments, and authentication/user management event graphs
Moves Login ID attribute mapping from Provisioning tab to Basic tab in Add Primary/Secondary Identity Provider window under Integrations > External Identities
Redesigns ZIdentity UI with modern UX layout to reorganize menus for easier access to common configurations
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The option to map Login ID attribute as an optional configuration for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning is removed; it must be mapped in Basic tab
Adds Force Delete for Cloud Deception settings and new CVE datasets/ThreatParse rules
Adds Force Delete option in Deceive > Cloud Deception > Azure > Settings to remove cloud resources when deployment scripts fail
Adds Force Delete option in Deceive > Cloud Deception > AWS > Settings to remove cloud resources when deployment scripts fail
Adds new Vulnerable Application Datasets for CData API Server, GitLab Server, ServiceNow, Check Point Quantum Gateway, Atlassian Confluence, Zyxel NAS326, Atlassian Jira, and GitHub Enterprise
Adds new ThreatParse Rules to detect exploits for CData API Server CVE-2024-31848, GitLab Server CVE-2023-7028, PHP-CGI CVE-2024-4577, ServiceNow CVEs, Check Point Quantum Gateway CVE-2024-24919, and Atlassian Confluence CVE-2024-21683
Upgrades Decoy Connectors operating system to FreeBSD 14.1
Adds debug mode for isolation profiles in ZPA to capture session diagnostics.
Admins can enable debug mode for isolation profiles to record and gather troubleshooting data for isolation sessions.
Debug recordings generate diagnostics including basic session information, HTTP Archive format files, console logs, and network logs from the web browser.
ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./log fields, new API endpoints for Cloud App Control, and explicit proxy DNS flags.
Adds dnsoverproxy flag to configure NSS in explicit proxy mode for tunneling Zscaler cloud-bound connections.
Adds %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} fields to NSS Feed Output Format for Web Insights Logs.
Adds new Web Insights Logs filters and columns Other DLP Rules and Server Destination Port in the ZIA Admin Portal.
Adds 8 new endpoints for Cloud App Control Policies API under /webApplicationRules/.
Enables Traffic Capture for IPS control and Advanced Threat Protection policies when action is set to Allow.
+1 moreshow less
Increases Sandbox file size limit to 50MB for Windows EXEs, Android APKs, and Archives on zscalerone.net.
ZPA updates OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Predefined Controls default to CRS 3.3.5 on AppProtection Profiles pages
Enables use of OWASP_CRS/3.3.5 ruleset within AppProtection Profiles for ZPA service versions after Aug 6, 2024.
$ git clone --branch v1.10.1 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.10.1
New aws_rolesanywhere_trustanchor BundlePublisher plugin for publishing SPIRE bundles to AWS RolesAnywhere trust anchors.
New Grafana dashboard template for monitoring SPIRE deployments.
SPIRE UpstreamAuthority now optionally uses Preferred TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. on intermediate authorities.
Federation endpoint now supports custom bundles and certificates for authorization.
Adds Admin Dashboard metrics and support for multiple Credential Providers per Access Policy.
Admin Dashboard now displays Client Workloads (Managed), Server Workloads (Managed), Credentials Usage By Type, and Workloads Connections (Managed) for the last 24 hours.
Access Policies support multiple Credential Providers associated with a single policy.
2 details in Everything
1 more release in this issue
· 2024-08-09 → 2024-08-27
New skip-relogin flag for tsh and EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. tagging support in Access Graph
└──▷ GET THIS VERSION
$ git clone --branch v15.4.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.17
Adds --skip-relay flag to tsh ssh and tsh proxy ssh to prevent relogin attempts on connection drop
EKS Cluster auto-enroll configurations now tag temporary Access Entry with teleport.dev/ namespaced tags
Imports S3 Bucket Tags into Teleport Policy's Access Graph via the Access Graph integration role
3 details in Everything
6 more releases in this issue
· 2024-08-07 → 2024-08-29
Teleport v16.2.0 adds NLA for Windows Desktops, DocumentDB IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth, UI join token management, and tctl terraform env
└──▷ GET THIS VERSION
$ git clone --branch v16.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.2.0
└──▷ USE IT
Enable NLA for Windows desktop sessions via environment variable.
shell
export TELEPORT_ENABLE_RDP_NLA=yes
Run the Terraform provider locally using the new subcommand.
$ tctl terraform env
Manage join tokens via the web interface instead of the CLI.
📍Navigate to the Join Tokens section in the Teleport Web UI.
Adds TELEPORT_ENABLE_RDP_NLA environment variable to enable Network Level Authentication for Windows desktop access in the windows_desktop_service.
Adds IAM authentication support for connecting to Amazon DocumentDB resources.
Enables management of join tokens directly through the Teleport web UI, replacing or supplementing tctl tokens CLI commands.
Displays database objects and their access paths for Database Access users within the Access Graph view.
Adds automatic log file reopening integration with logrotate when files are detected as renamed.
+7 moreshow less
Adds teleport.dev/project-id label on auto-enrolled GCP instances.
Updates Slack plugin to list logins permitted by requested roles in notifications.
Tags temporary Access Entries for new EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Cluster auto-enroll configurations with teleport.dev/ namespaced tags.
Imports S3 Bucket Tags into Teleport Policy's Access Graph, requiring s3:GetBucketTagging permission on the integration role.
Adds tctl terraform env subcommand to simplify local execution of the Terraform provider.
Adds native MachineID support to the Terraform provider, allowing usage in delegated environments like GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. without tbot.
Improves Terraform Provider credential handling by sequentially trying sources and failing fast on expired credentials.
Teleport v16.1.8 adds custom notifications via tctl, SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. federation endpoint, and dynamic Opsgenie recipients
└──▷ GET THIS VERSION
$ git clone --branch v16.1.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.1.8
└──▷ USE IT
Use tctl to define a custom notification resource that targets specific Teleport users for alerts or updates.
shell
tctl create -f notification-resource.yaml
tctl allows cluster administrators to create custom notifications targeting Teleport users with tctl create of notification resources.
Proxy API exposes a new SPIFFE compatible federation bundle endpoint for workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. platforms to federate with the Teleport cluster.
Add Download CSV button to Access Monitoring Query results in the UI.
Introduce support for Envoy SDS into the Machine ID spiffe-workload-api service.
Opsgenie plugin recipients can now be dynamically configured by creating Access Monitoring Rules resources with the required Opsgenie notify schedules.
+1 moreshow less
Allow to limit duration of local tsh proxy certificates with a new MFAVerificationInterval option.
Teleport v15.4.16 adds permit_cluster_wide_ssh_dial_timeout and Envoy SDS support to Machine ID SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. Workload API.
└──▷ GET THIS VERSION
$ git clone --branch v15.4.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.16
Permits setting a cluster wide SSH connection dial timeout
Introduces support for Envoy SDS into the Machine ID spiffe-workload-api service
Teleport v14.3.23 adds audit events for AWS/Azure/Discovery actions, tsh puttyconfig port fallback, and more
└──▷ GET THIS VERSION
$ git clone --branch v14.3.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v14.3.23
tsh puttyconfig now uses the registered host port when invoked without --port
Added audit events for AWS and Azure integration resource actions
Added audit events for discovery config actions
tctl alerts ls now displays remaining alert TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.
Teleport v15.4.12 adds SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. federation endpoint, Kubernetes workload attestation, and kubernetes-secret Machine ID destination.
└──▷ GET THIS VERSION
$ git clone --branch v15.4.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v15.4.12
Adds metadata.expires field support for Bot resources to allow automatic expiration of bot credentials
Adds kubernetes-secret schema to the command line to configure Machine ID secret destinations
Adds SPIFFE compatible federation bundle endpoint to the Proxy API for external workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. federation
Adds Kubernetes Workload Attestation to Teleport Workload Identity for pod authentication without secrets
Adds TERM_PROGRAM environment variables Teleport_Connect and TERM_PROGRAM_VERSION in Teleport Connect integrated terminal
New Kubernetes Workload Attestation for Teleport Workload Identity and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Device Trust authorization
└──▷ GET THIS VERSION
$ git clone --branch v16.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.1.3
└──▷ USE IT
Ensure your scripts can identify the Teleport Connect environment via the new TERM variables.
shell
echo $TERM_PROGRAM
tbot now emits a warning on startup when the requested certificate TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. exceeds the maximum allowed value
Added TERM_PROGRAM: Teleport_Connect and TERM_PROGRAM_VERSION: <app_version> environment variables in Teleport Connect's integrated terminal
SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. applications can now be deleted directly from the Web UI
Generate a PDF of a K10 report without any third-party tooling, straight from the browser.
📍In the K10 dashboard, navigate to the Reports view, open the report you want, then use your browser's Print dialog (e.g. File › Print or Ctrl+P / Cmd+P) and select Save as PDF as the destination.
Enables PDF report generation directly from the browser's native print dialog — no external tools required.
1 detail in Everything
1 more release in this issue
· 2024-08-09 → 2024-08-22
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
User Portal adds global restriction for user-level SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. downloads to enhance data security.
User-level downloads for SaaS applications in the User Portal can now be globally restricted.
The global download restriction covers all formats, including Archive and MDS.
2 details in Everything
3 more releases in this issue
· 2024-08-10 → 2024-08-24
New Threat Hunting feature for VMware backups and Long Term Retention policy support for Azure VM recovery points
Introduces Threat Hunting capability for VMware-backed resources, enabling malware IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search, infection scope/timeline insights, automatic quarantine of infected snapshots, and rich metadata in results.
Adds Long Term Retention (LTR) policy configuration for Azure VM recovery points to automatically move data to the cold tier for optimized storage costs.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Smart Scan feature is deprecated for File Servers; full scan mechanism is triggered automatically instead.
Google Workspace DCP adds GA Administrator Management with AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. integration.
New Administrator management with AD/LDAP feature allows centralized management of Druva administrators using existing Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. or LDAP directories via a new AD/LDAP Connector version.
Druva v2.0.7 eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. client, GA AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. admin management, and Group Mailbox restore support
Updates the eDiscovery Download Client to version 2.0.7 for minor enhancements
Makes Administrator Management with AD/LDAP generally available (GA) for centralized DCP administration
Adds full and granular recovery support for Microsoft Group Mailbox data
3 details in Everything
└──▷ BREAKING ON UPGRADE
!AD/LDAP Connector settings have moved from the End Points and SaaS Apps Settings page to the Druva Cloud Settings section in the DCP console
!Upgrading AD/LDAP Connectors is now an exclusive privilege of Druva Cloud Administrators
Secureframe August 2024 adds TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. framework support, manual control overrides, and Trust Center UI customizations.
└──▷ HOW TO FIND IT
Customize your Trust Center's logo and link it to your corporate website.
📍In the site designer, go to App bar and edit the logo URL and description.
Override a control's health status during a compliance assessment.
📍Use the Control Overrides feature to manually set the health status of specific controls.
Document remediation plans for third-party risks in a dedicated field.
📍Edit the new response field in TPRM review findings to add remediation details.
Adds TISAX Framework as a supported compliance framework
Allows manual setting of the health status for controls via Control Overrides
Upgrades the Generative Model for Security Questionnaires to handle over 1,000 questions with improved speed
Enables customization of the Trust Center logo URL and description in the App bar section of the site designer
Simplifies updating and deleting custom domains and secureframetrust.com subdomains in Trust Center settings
+6 moreshow less
Adds a review status column to the main vendors page in Third-Party Risk ManagementThird-Party Risk ManagementAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data.
Adds a new response field for documenting remediation plans in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. review findings
Adds a Documents column to the main vendors page in TPRM, toggleable via column selector
Enables bulk editing of schedules and templates in TPRM from a single modal
Allows direct editing of the Last reviewed at date for vendors in TPRM who have not completed a review
Automatically completes parent reviews in TPRM when all child reviews are completed
Drata adds Salesforce integration for Trust Center automation and NDA requirements.
Adds Salesforce (SFDC) integration to Trust Center for Trust Center Pro users to automate document requests with NDA validation
Adds option to require an NDA for private document access requests in Trust Center
Adds Evidence Guidance for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001:2022 and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. allowing pre-populated evidence mapped to controls without immediate artifact upload
Adds service selection filter when building a custom test in AA Custom Test Builder
4 details in Everything
4 more releases in this issue
· 2024-08-02 → 2024-08-30
Drata adds CyberArk integration and Long Answer custom fields to reports.
Adds CyberArk integration enabling SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access, scoped personnel limits via CyberArk group, and automated MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. check (Test 86) automation
Adds new Long Answer custom field type supporting up to 30,000 characters of text, included in CSV/PDF report exports
Drata adds streamlined prospective vendor security reviews, MIM dashboard, infrastructure error tracking, Slack evidence notifications, and role help links
New dedicated workflow for managing prospective vendor security reviews including observation documentation and TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. risk conversion.
Replaces the account list page with a new Multiple Instance Management (MIM) Dashboard for cross-account compliance metrics.
Adds Slack notifications for control evidence updates configurable by admins.
Role Administration navigation links now open direct help articles for specific roles instead of general documentation.
Risk drawer headers now display the Risk ID alongside the risk name.
+2 moreshow less
Background check statuses added to personnel tracking in My Drata.
Quick Start page redesigned with dedicated sections for creating connections and continuous monitoring guidance.
Adds Groups and Checklists to People module for bulk onboarding/offboarding task management
Adds ability to organize users into Groups via the 'People > Employees > gear icon > Groups page'
Enables assigning checklists of ongoing and offboarding tasks to multiple users simultaneously through group membership
Supports importing groups from connected IDPs and syncing membership changes; imported group membership and names must be managed in the IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., and deleting an imported group returns its users to their prior Scrut default group.
3 details in Everything
3 more releases in this issue
· 2024-08-09 → 2024-08-11
CISO Assistant v1.7.1 adds framework implementation group descriptions and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration without a metadata URL.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.7.1
Shows description of implementation groups in framework detail view
Adds ability to configure Single Sign-On (SSO) without providing a metadata URL
2 details in Everything
4 more releases in this issue
· 2024-08-05 → 2024-08-30
CISO Assistant v1.7.0 adds impact qualification, ICT minimal standard and K ISMS-P controls, plus new homepage.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.7.0
└──▷ HOW TO FIND IT
Apply impact qualification when assessing risk during an audit.
📍In the Audit workspace, select a risk scenario and open the assessment form to find the new impact qualification dropdown field.
View analytics with the new experimental homepage layout.
📍Click the Analytics tab in the main navigation sidebar to load the experimental homepage view.
Adds impact qualification option to assess risk scenarios
Adds ICT minimal standard framework support for control mapping
Adds K ISMS-P framework support for compliance requirements
Adds experimental analytics homepage accessible in the UI
Adds NZISM and ENS-decreto frameworks to CISO Assistant
└──▷ GET THIS VERSION
$ git clone --branch v1.6.7 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.7
└──▷ HOW TO FIND IT
Start using the NZISM standard for your compliance assessments.
📍In CISO Assistant, select NZISM from the framework list when creating a new assessment.
Assess your environment against the ENS-decreto regulations.
📍In CISO Assistant, select ENS-decreto from the framework list when creating a new assessment.
Creates NZISM Framework support via community contribution.
Adds GL integration for costs, PART-IS framework support, and RTS DORA coverage on JET/OVS/TPLT.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.5
CISO Assistant v1.6.4 adds CJIS 5.9.5 framework support, NIS1 FR rules, and expanded GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. translations.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v1.6.4
Adds new version of the CJIS framework (5.9.5) for compliance assessments
Adds proper integration of NIS1 rules for France (FR)
Giskard tests and evaluates LLM applications for performance, bias, and security issues.
Giskard v2.14.5 adds packaged prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. datasets for testing LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. applications.
└──▷ GET THIS VERSION
$ git clone --branch v2.14.5 https://github.com/Giskard-AI/giskard-oss.git
# already have the repo? check out this version:$ git checkout v2.14.5
Pangea adds non-email usernames, password expiration APIs, custom profile fields, Vault FPEFPEFormat-Preserving Encryption, a cipher mode that encrypts data into ciphertext of the same format and length as the plaintext, letting tools tokenize sensitive fields without changing downstream schema or validation logic., Vercel sync CLI subcommand, and Redact unredaction endpoint
Adds non-email username registration capability to allow alphanumeric usernames instead of requiring email addresses.
Adds the ability for Admins to expire passwords individually or at scale via the Pangea User Console or AuthN User API, forcing a new password at next login.
Adds Custom Profile Fields to user profiles, allowing specification of optional/required fields and registration presentation with automatic detection during Import Users.
Adds Format Preserving Encryption (FPE) support in Vault using 128-bit and 256-bit FF3-1 NIST approved algorithms to preserve character formatting of encrypted data.
Adds pangea sync vercel CLI subcommand to sync environment variables from local .env files to Vercel, supporting flags like --branch, --project, --target, and --token.
+1 moreshow less
Adds FPE as a redaction method in Redact service and introduces the new unredact endpoint to recover original text using FPE context for Redact and Secure Audit Log records.
THE CYBER TOOLCHAIN