https://cybertoolchain.io/tools/kunai New releases and features in Kunai, tracked by The Cyber Toolchain. en Tue, 10 Jun 2025 10:01:49 GMT https://github.com/kunai-project/kunai/releases/tag/v0.6.0 https://github.com/kunai-project/kunai/releases/tag/v0.6.0 Tue, 10 Jun 2025 10:01:49 GMT Kunai v0.6.0 adds io_uring_sqe event tracking, parent command line context, config validation, and filter testing. • Adds `io_uring_sqe` event support for tracking I/O ring submission queue entries. • Adds `parent_command_line` field to `execve` and `execve_script` events for richer process execution context. • Includes filter information in scan results to aid understanding and debugging of filtering rules. • New `validate` command to check configuration files for correctness before deployment. • New `test` command to test filters against events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.5.3 https://github.com/kunai-project/kunai/releases/tag/v0.5.3 Thu, 30 Jan 2025 11:08:26 GMT Kunai v0.5.3 adds built-in rule testing to validate detection rules before deployment. • Adds rule testing capability to validate and test detection rules directly from the CLI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.5.0 https://github.com/kunai-project/kunai/releases/tag/v0.5.0 Tue, 21 Jan 2025 13:30:54 GMT Kunai v0.5.0 adds user/group name resolution, per-CPU FS event rate limiting, and three new event types: start, error/log, and event_loss. • Adds user and group name resolution so events include human-readable user/group context for richer audit and security analysis. • New `start` event surfaces detailed agent startup information and system metadata at launch time. • New `log` event (refactored from error event) distinguishes informational, warning, and error messages from the agent. • New `event_loss` event reports when kernel-to-userland event drops occur, giving visibility into data loss under high load. • New per-CPU filesystem event rate limiting (configurable task-level and global limits) prevents event floods and improves resource management. Breaking changes: • The config key `max_eps_io` is renamed to `max_eps_fs`; existing configs using `max_eps_io` will break. • Event IDs have been redefined (`change: redefine new event ids`); any detection rules or pipelines that match on numeric Kunai event IDs may break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.4.0 https://github.com/kunai-project/kunai/releases/tag/v0.4.0 Thu, 28 Nov 2024 14:09:05 GMT Kunai v0.4.0 adds file-create detection, unbuffered output, rule string templates, and replay benchmarking. • New `file_create` event detects and logs file creation activity on the host. • Adds unbuffered output mode for lower-latency event streaming to downstream consumers. • Introduces string template support in detection rules for more flexible rule authoring. • Adds benchmarking capability to the `replay` command to measure event processing throughput. • Reworked user configuration system. Breaking changes: • The user configuration has been reworked; existing configuration files may require updates before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.3.0 https://github.com/kunai-project/kunai/releases/tag/v0.3.0 Tue, 05 Nov 2024 09:49:49 GMT Kunai v0.3.0 adds YARA-X integration, new kill/ptrace/write-close events, Community-ID, hardened mode, and a revamped CLI. • Adds automatic log rotation to keep log files clean and manageable. • Revamps the CLI for a smoother user experience, including a new `logs` command for fast log access and an `install` command to simplify installation. • Introduces a new `kill` security event for tracking kill-signal activity. • Introduces a new `ptrace` security event for deeper visibility into ptrace-based system interactions. • Adds a new security event triggered when a file is written then closed (`write_close`), enabling finer-grained file-activity monitoring. • Integrates YARA-X for advanced malware detection within detection rules. • Supports running and installing Kunai in hardened mode via LSM (Linux Security Modules) integration for enhanced protection. • Enables detection rules to handle specific actions, offering greater response flexibility. • Adds event filtering by name directly within detection rules. • Integrates the Community-ID standard for easier correlation of network events across tools. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.2.6 https://github.com/kunai-project/kunai/releases/tag/v0.2.6 Tue, 30 Jul 2024 06:17:57 GMT Kunai v0.2.6 adds richer rule conditions and negative event-ID filtering for more precise detections. • Adds `none of them`, `none of $VAR_PREFIX`, `any of them`, `any of $VAR_PREFIX`, `all of them`, `all of $VAR_PREFIX`, `N of them`, and `N of $VAR_PREFIX` condition expressions to rule definitions. • Supports prefixing event-IDs with `-` (minus) in event selection to exclude specific event types from processing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.2.5 https://github.com/kunai-project/kunai/releases/tag/v0.2.5 Fri, 19 Jul 2024 07:54:30 GMT Kunai v0.2.5 adds log rotation with max-size limits and compression for long-running deployments. • Adds log rotation support with configurable maximum file size and compression to manage long-running output logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.2.1 https://github.com/kunai-project/kunai/releases/tag/v0.2.1 Mon, 27 May 2024 07:40:54 GMT Adds a `replay` subcommand and `stdout_output` config key to Kunai v0.2.1 • Adds the `replay` subcommand to reprocess previously captured eBPF event data • Adds `Config::stdout_output` configuration option to control whether events are written to stdout Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai https://github.com/kunai-project/kunai/releases/tag/v0.2.0 https://github.com/kunai-project/kunai/releases/tag/v0.2.0 Thu, 11 Apr 2024 14:14:57 GMT Kunai v0.2.0 adds IoC scanning, prctl/probe coverage, and info.event.source field for log correlation • Adds `info.event.source` field to Kunai logs for external tool identification • Adds IoC (Indicators of Compromise) scanning capability via commit implementing fix #22 • Adds `finit_module` probe detection capability • Adds `prctl` probe detection capability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/kunai