https://cybertoolchain.io/tools/laurel New releases and features in Laurel, tracked by The Cyber Toolchain. en Wed, 15 Jul 2026 20:23:09 GMT https://github.com/threathunters-io/laurel/releases/tag/v0.8.0 https://github.com/threathunters-io/laurel/releases/tag/v0.8.0 Wed, 15 Jul 2026 20:23:09 GMT Laurel v0.8.0 adds SHA-256 exec hashing, UNIX socket logging, env-var prefix matching, and unified process spawning tracking. • New `SYSCALL.SPAWNED_BY` field unifies process-lineage tracking across both single-exec and fork/exec scenarios. • Supports prefix matching for environment variables, enabling selective capture of env vars by prefix. • Adds logging output to a UNIX domain socket for integration with local log consumers. • Supports calculating SHA-256 hashes for executed binaries, enabling integrity checking of process execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.7.0 https://github.com/threathunters-io/laurel/releases/tag/v0.7.0 Tue, 04 Mar 2025 09:12:05 GMT Laurel v0.7.0 adds persistent state, /proc executable labeling, and configurable build identifiers • `Save state across restarts` eliminates cold-start penalties by persisting the processing offset. • Adds `Apply labels for executables to processes found in /proc` support, improving visibility into ephemeral processes. • New `Configurable build identifier` setting allows distinguishing between deployment artifacts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.6.5 https://github.com/threathunters-io/laurel/releases/tag/v0.6.5 Mon, 27 Jan 2025 12:03:05 GMT Laurel v0.6.5 adds systemd service enrichment, IO_URING translation, and a config prefix for keys • Adds `--key-prefix` configuration option to prepend a custom string instead of using capitalized key names for enriched/translated data • Enriches process records with _systemd_ service information (e.g., service name, unit state) when processes run as part of systemd services • Translates `IO_URING` audit operations into readable fields, supporting auditd 3.1+ kernels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.6.4 https://github.com/threathunters-io/laurel/releases/tag/v0.6.4 Mon, 16 Dec 2024 11:40:44 GMT Laurel v0.6.4 adds external logging and dynamic process labels via CLI • Adds support to log events to an external program or script instead of stdout/stderr • Adds the ability to add or remove process labels based on the execve() command-line arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.6.2 https://github.com/threathunters-io/laurel/releases/tag/v0.6.2 Thu, 16 May 2024 15:34:05 GMT Adds configurable filtering to keep first event for new processes in Laurel v0.6.2 • Configurable filtering behavior: keep first event for new processes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.6.0 https://github.com/threathunters-io/laurel/releases/tag/v0.6.0 Thu, 29 Feb 2024 22:05:38 GMT Laurel v0.6.0 adds UID_GROUPS enrichment and a configurable Syslog marker • Adds `UID_GROUPS` field to the output JSON for secondary group memberships of processes • Adds `syslog_marker` config key to customize the log source identifier written to Syslog Breaking changes: • Removes the deprecated `PARENT_INFO` sub-structure from the output JSON Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.5.6 https://github.com/threathunters-io/laurel/releases/tag/v0.5.6 Mon, 15 Jan 2024 12:36:20 GMT Adds regex filter for raw audit lines and improves enrichment of short-lived processes • New regular-expression-based filter for raw audit lines • Improvements in enrichment of data from short-lived processes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.5.2 https://github.com/threathunters-io/laurel/releases/tag/v0.5.2 Tue, 02 May 2023 18:07:23 GMT Adds null key filter and containerized deployment support for immutable distros. • Adds setup instructions for running Laurel in a container on immutable container distros like CoreOS • Provides a dedicated container image for the service Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel https://github.com/threathunters-io/laurel/releases/tag/v0.2.0 https://github.com/threathunters-io/laurel/releases/tag/v0.2.0 Mon, 20 Dec 2021 00:08:46 GMT Laurel v0.2.0 adds ENRICHED log format translation, EOE stream handling, and a new library crate. • Adds translation of numeric/binary values equivalent to auditd `log_format=ENRICHED` • Adds support for input streams without EOE (End Of Event) messages • Provides a new library crate Full history on Cyber Toolchain: https://cybertoolchain.io/tools/laurel