Laurel

No entries match these filters. Clear filters

1. v0.8.0 Jul 15, 2026 · issue 020

   Laurel v0.8.0 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. exec hashing, UNIX socket logging, env-var prefix matching, and unified process spawning tracking.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.0 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.8.0

   ⤢
   • New SYSCALL.SPAWNED_BY field unifies process-lineage tracking across both single-exec and fork/exec scenarios.
   • Supports prefix matching for environment variables, enabling selective capture of env vars by prefix.
   • Adds logging output to a UNIX domain socket for integration with local log consumers.
   • Supports calculating SHA-256 hashes for executed binaries, enabling integrity checking of process execution.

   4 details in Everything

2. v0.7.0 Mar 4, 2025 · release notes

   Laurel v0.7.0 adds persistent state, /proc executable labeling, and configurable build identifiers

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.0 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.7.0

   • Save state across restarts eliminates cold-start penalties by persisting the processing offset.
   • Adds Apply labels for executables to processes found in /proc support, improving visibility into ephemeral processes.
   • New Configurable build identifier setting allows distinguishing between deployment artifacts.

   3 details in Everything

3. v0.6.5 Jan 27, 2025 · release notes

   Laurel v0.6.5 adds systemd service enrichment, IO_URING translation, and a config prefix for keys

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.5 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.6.5

   • Adds --key-prefix configuration option to prepend a custom string instead of using capitalized key names for enriched/translated data
   • Enriches process records with _systemd_ service information (e.g., service name, unit state) when processes run as part of systemd services
   • Translates IO_URING audit operations into readable fields, supporting auditd 3.1+ kernels

   3 details in Everything

4. v0.6.4 Dec 16, 2024 · release notes

   Laurel v0.6.4 adds external logging and dynamic process labels via CLI

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.4 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.6.4

   └──▷ USE IT
   Pipe Laurel events directly into a custom processing script for real-time alerting.
   shell copy

   laurel --logger /usr/local/bin/custom_alert_handler.sh

   Dynamically tag processes based on their arguments for specific audit rules.
   shell copy

   laurel --label-add 'cmd:arg' 'bash -i' --label-remove 'cmd:arg' 'ssh host'

   • Adds support to log events to an external program or script instead of stdout/stderr
   • Adds the ability to add or remove process labels based on the execve() command-line arguments

   2 details in Everything

5. v0.6.2 May 16, 2024 · release notes

   Adds configurable filtering to keep first event for new processes in Laurel v0.6.2

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.2 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.6.2

6. v0.6.0 Feb 29, 2024 · release notes

   Laurel v0.6.0 adds UID_GROUPS enrichment and a configurable Syslog marker

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.0 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.6.0

   └──▷ TRY IT
   Identify processes running within specific secondary groups (e.g., docker, wheel) using the new enrichment field.
   copy

   $ jq 'select(.UID_GROUPS | contains("docker"))' laurel.log

   • Adds UID_GROUPS field to the output JSON for secondary group memberships of processes
   • Adds syslog_marker config key to customize the log source identifier written to Syslog

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Removes the deprecated PARENT_INFO sub-structure from the output JSON
7. v0.5.6 Jan 15, 2024 · release notes

   Adds regex filter for raw audit lines and improves enrichment of short-lived processes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.6 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.5.6

   • New regular-expression-based filter for raw audit lines
   • Improvements in enrichment of data from short-lived processes

   2 details in Everything

8. v0.5.2 May 2, 2023 · release notes

   Adds null key filter and containerized deployment support for immutable distros.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.2 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.5.2

   • Adds setup instructions for running Laurel in a container on immutable container distros like CoreOS
   • Provides a dedicated container image for the service

   2 details in Everything

9. v0.2.0 Dec 20, 2021 · release notes

   Laurel v0.2.0 adds ENRICHED log format translation, EOE stream handling, and a new library crate.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.2.0 https://github.com/threathunters-io/laurel.git
   # already have the repo? check out this version:
   $ git checkout v0.2.0

   • Adds translation of numeric/binary values equivalent to auditd log_format=ENRICHED
   • Adds support for input streams without EOE (End Of Event) messages
   • Provides a new library crate

   3 details in Everything

10. v0.1.3 Sep 25, 2021 · release notes

    Laurel v0.1.3 adds --dry-run CLI flag and configurable EXECVE output formatting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.3 https://github.com/threathunters-io/laurel.git
    # already have the repo? check out this version:
    $ git checkout v0.1.3

    └──▷ TRY IT
    Validate your configuration changes before running the agent to catch syntax errors early
    copy

    $ laurel --dry-run

    • Adds --dry-run CLI flag to validate configuration files without executing the tool
    • Adds option to output EXECVE arguments as a single string instead of the default format
    • Changes string encoding logic so valid UTF-8 sequences are preserved and no longer percent-encoded

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Valid UTF-8 sequences in strings are no longer percent-encoded, changing the output format for downstream parsers expecting escaped UTF-8