Wazuh

No entries match these filters. Clear filters

1. v4.14.9 Oct 15, 2026 · issue 110

   Wazuh v4.14.9 raises active response command capacity to 1024, expands FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. whodata to older kernels, and adds a configurable API auth-context payload size limit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.14.9 https://github.com/wazuh/wazuh.git
   # already have the repo? check out this version:
   $ git checkout v4.14.9

   • Adds auth_context_max_payload_size option to configure the API run_as authentication-context payload size limit (raised from 8 KB to 64 KB by default), improving support for AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logins with large group-membership contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Raises from 64 to 1024 the number of active response commands that wazuh-execd can load from etc/shared/ar.conf.
   • Allows FIM eBPF whodata on capable kernels older than 5.8, such as RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.10.
   • Restricts the API access log from writing the run_as authorization context verbatim unless debug logging is enabled; hash_auth_context still identifies it.
   • Adds auth_context_max_payload_size option to configure the API run_as authentication-context payload size limit (raised from 8 KB to 64 KB by default), improving support for AD/LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logins with large group-membership contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

2. advisory CVE-2026-74041 Oct 13, 2026 · issue 128
   • CVE-2026-74041: Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.14.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
3. advisory CVE-2026-74033 Oct 13, 2026 · issue 128
   • CVE-2026-74033: Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects >= 4.1.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. advisory CVE-2026-74037 Oct 13, 2026 · issue 128
   ▶ Watch video
   • CVE-2026-74037: Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.0.0, <= 4.14.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. advisory CVE-2026-74045 Oct 13, 2026 · issue 128
   ⤢ ⤢ ▶ Watch video
   • CVE-2026-74045: Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects >= 3.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-74035 Oct 13, 2026 · issue 128
   • CVE-2026-74035: An empty password bypasses both the password policy and the reserved user guard in security.update_user, allowing a delegated user administrator to take over the wazuh superuser account (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.2, affects >= 4.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-93346 Oct 13, 2026 · issue 128
   • CVE-2026-93346: API brute-force protection is still bypassable by concurrent login requests, the asyncio.Lock fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-74034 Oct 13, 2026 · issue 128
   • CVE-2026-74034: Arbitrary file read as root via agent-injected upgrade_custom command (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects >= 4.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. advisory CVE-2026-74032 Oct 13, 2026 · issue 128
   • CVE-2026-74032: RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Authorization Bypass in Wazuh API (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
10. advisory CVE-2026-74047 Oct 13, 2026 · issue 128
    ⤢ ⤢ ⤢
    • CVE-2026-74047: authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
11. advisory CVE-2026-74040 Oct 13, 2026 · issue 128
    • CVE-2026-74040: Cluster worker can overwrite arbitrary master files (incl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ ossec.conf) → root RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects >= 3.9.0)
12. advisory CVE-2026-74030 Oct 13, 2026 · issue 128
    • CVE-2026-74030: SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. YAML alias expansion causes memory exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.9, affects >= 3.9.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
13. v4.14.8 Sep 25, 2026 · issue 086

    Wazuh v4.14.8 adds audit identity fields to FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. whodatawhodataA Windows audit mode that records which user, process, and path triggered a file-system change, giving cyber tools actor-level context alongside the raw filesystem event. alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.14.8 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.14.8

14. advisory CVE-2026-62365 Aug 18, 2026 · issue 128
    • CVE-2026-62365: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 3.8.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
15. advisory CVE-2026-61811 Aug 18, 2026 · issue 128
    • CVE-2026-61811: Unbounded Recursion in os_xml _getattributes() Causes analysisd Worker Thread Stack Exhaustion (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 3.8.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
16. advisory CVE-2026-61783 Aug 18, 2026 · issue 128
    • CVE-2026-61783: RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.14.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. advisory CVE-2026-54084 Aug 18, 2026 · issue 128
    • CVE-2026-54084: Wazuh agent enrollment NULL pointer dereference via malformed manager response (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
18. advisory CVE-2026-54085 Aug 18, 2026 · issue 128
    • CVE-2026-54085: Missing input validation in multiple active response scripts allows argument injection (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects >= 4.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
19. advisory CVE-2026-61800 Aug 18, 2026 · issue 128
    • CVE-2026-61800: Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.0, affects >= 4.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
20. advisory CVE-2026-74046 Aug 18, 2026 · issue 128
    • CVE-2026-74046: zlib decompression bomb in cluster archive processing lets authenticated peer exhaust wazuh-clusterd memory (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.9, affects >= 4.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
21. advisory CVE-2026-74039 Aug 18, 2026 · issue 128
    • CVE-2026-74039: Authenticated denial-of-service of the Wazuh API via POST /security/user/authenticate/run_as (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= 4.0.0, <= 5.0.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
22. v4.10.4 Jul 30, 2026 · issue 031

    Wazuh v4.10.4 adds detection of suppressive Audit rules that could blind FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. whodata on Linux.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.10.4 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.10.4

    • Adds detection of the -a never,task Audit rule in FIM whodata for Linux, alerting when this rule would suppress file integrity monitoring events.

    1 detail in Everything

23. v4.14.3 Feb 11, 2026 · release notes

    Wazuh v4.14.3 adds hostname and architecture metadata to Windows keep-alive messages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.14.3 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.14.3

    • Adds hostname and architecture metadata fields to the Windows agent's keep-alive message protocol
    • Implements configurable bounds checking for Logcollector max-size configuration serialization

    2 details in Everything

24. v4.14.2 Jan 15, 2026 · release notes

    Wazuh v4.14.2 adds -a never,task Audit rule detection in FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. whodata for Linux and a Windows Server 2025 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Policy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.14.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.14.2

25. v4.14.1 Nov 12, 2025 · release notes

    Wazuh v4.14.1 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role support for AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. flow logs and static/temporary credentials for the Amazon Security Lake subscriber.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.14.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.14.1

    • <aws:iam_role> configuration option in the AWS wodle to assume IAM roles for VPC flow log collection.
    • aws_credentials support in the Amazon Security Lake subscriber enables static (aws_access_key_id, aws_secret_access_key) and temporary (aws_session_token) credentials.

    2 details in Everything

26. v4.14.0 Oct 23, 2025 · release notes

    Wazuh v4.14.0 adds syscollector inventory fields, hot config reload for Linux agents, Amazon Inspector v2 support, and new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.14.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.14.0

    • Added system users and groups to the inventory data (Manager/Agent)
    • Added browser extensions and services to the inventory data (Manager/Agent)
    • Added IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support to Maltiverse integration
    • Added capability to do a hot configuration reload in Linux agents
    • Added support for Amazon Inspector v2

    +2 more show less

    • Added syscollector users and groups endpoints to the RESTful API
    • Added syscollector services and browser_extension endpoints to the RESTful API

    7 details in Everything

27. v4.13.0 Sep 19, 2025 · release notes

    Wazuh v4.13.0 adds hot ruleset reload, global FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification./inventory queries, and new API endpoints for managers and agent summaries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.13.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.13.0

    └──▷ TRY IT
    Trigger a hot ruleset reload for Analysisd using the new management endpoint.
    copy

    $ curl -u wazuh:password -X POST https://localhost:55000/ruleset/reload

    • Analysisd now supports hot ruleset reloads without restarting the service.
    • Adds global queries capability for FIM and system inventory data across all agents.
    • Adds a new /agents/summary RESTful API endpoint to retrieve aggregated agent status.
    • Adds server uuid field to the /manager/info RESTful API response.
    • Adds hot ruleset reload management via new RESTful API endpoints.

    5 details in Everything

28. v4.12.0 May 8, 2025 · release notes

    Wazuh v4.12 adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. whodata to FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification., MS Graph riskDetections integration, and indexed vulnerability package conditions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.12.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.12.0

    • FIM now supports whodata using an eBPF-based integration
    • Added support for the riskDetections relationship in MS Graph
    • Added a time delay option in the MS Graph integration to prevent log loss
    • Added a page size option to the MS Graph integration
    • Deleted the restriction for the use of the AWS profile in the Amazon Security Lake integration

    +1 more show less

    • Added package condition field in indexed vulnerabilities

    6 details in Everything

29. v4.11.2 Apr 2, 2025 · release notes

    Wazuh v4.11.2 adds authentication_pool_size configuration option to the RESTful API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.11.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.11.2

30. v4.11.0 Feb 24, 2025 · release notes

    Wazuh v4.11.0 adds CISA vulnerability content priority, .pkg support, and API revoke action.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.11.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.11.0

    • Adds CISA vulnerability content prioritized over NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. in the vulnerability scanner
    • Extends Syscollector to detect installed .pkg packages on macOS
    • Adds security:revoke permission action for the PUT /security/user/revoke API endpoint

    3 details in Everything

31. v4.10.0 Jan 10, 2025 · release notes

    Wazuh v4.10.0 adds RESTful API endpoint for agent uninstall, new Windows Server 2012 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy, and self-recovery for indexer connector CA files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.10.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.10.0

    • Creates new RESTful API endpoint to trigger the agent uninstall process.
    • Allows multiple Certificate Authority files in the indexer connector.

    2 details in Everything

32. v4.9.1 Oct 17, 2024 · release notes

    Wazuh Manager adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. package support, API enables dual-stack IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. listening, and Agent supports macOS 15

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.9.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.9.1

    • Adds ARM packages support for the Wazuh Manager component
    • Enables the RESTful API to listen on both IPV4 and IPV6 stacks simultaneously

    2 details in Everything

33. v4.9.0 Sep 5, 2024 · release notes

    Wazuh v4.9.0 adds Fluentd alert forwarding, Amazon Security Hub via SQS, Journald logcollector support, and HAProxy helper

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.9.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.9.0

    • Adds alert_forwarding to ossec.conf for Manager to forward alerts to Fluentd
    • Adds Amazon Security Hub integration via AWS SQS in the Agent
    • Adds journald input support in Logcollector (Agent)
    • Adds HAProxy helper script to manage load balancer configuration and automatically balance agents
    • Merges group file endpoints into a single endpoint (GET /groups/{group_id}/files/{filename}) with raw parameter

    +1 more show less

    • Removes the cache configuration option from the Wazuh API

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The cache configuration option is removed from the Wazuh API config, requiring removal if previously set
    • !Group file endpoints are merged; the previous individual endpoint paths for each group file no longer exist (now handled by GET /groups/{group_id}/files/{filename})
34. v4.8.0 Jun 13, 2024 · release notes

    Wazuh v4.8.0 adds GET /manager/version/check API endpoint, MS Graph multi-tenant support, and snap package detection in Syscollector.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.8.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.8.0

    • Added new GET /manager/version/check endpoint to obtain information about new releases of Wazuh
    • Introduced an auto option for the ssl_protocol setting in the API configuration that enables automatic negotiation of the TLS certificate to be used
    • Extended the MS Graph integration module to support multiple tenants

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed PUT /vulnerability, GET /vulnerability/{agent_id}, GET /vulnerability/{agent_id}/last_scan and GET /vulnerability/{agent_id}/summary/{field} API endpoints
    • !Removed the compilation_date field from GET /cluster/{node_id}/info and GET /manager/info endpoints
    • !Deprecated the cache configuration option
    • !Removed custom parameter from PUT /active-response endpoint
35. v4.7.5 May 31, 2024 · release notes

    Wazuh v4.7.5 adds a database endpoint to recalculate the hash of agent groups.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.7.5 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.7.5

36. v4.7.2 Jan 11, 2024 · release notes

    Wazuh v4.7.2 adds timeouts to Cloud/integrations and a Debian 12 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.7.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.7.2

    • Adds configurable timeout setting to external and Cloud integration configurations to prevent indefinite waits

    1 detail in Everything

37. v4.7.0 Nov 28, 2023 · release notes

    Wazuh v4.7.0 adds native Maltiverse integration, Slack customization, and custom AWS SQS log buckets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.7.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.7.0

    • Introduced native Maltiverse integration for the Manager to enrich threat intelligence data.
    • Added configurable options for the Slack integration within the Wazuh Manager configuration.
    • Added support for Custom Logs in Buckets via AWS SQS in the Agent to route log data to Amazon Simple Queue Service.
    • Added geolocation data for the aws.data.client_ip field to provide location context for AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. events.
    • Added package inventory coverage for Alpine Linux, MacPorts, PYPI, and Node packages in Syscollector.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated PUT /vulnerability, GET /vulnerability/{agent_id}, GET /vulnerability/{agent_id}/last_scan and GET /vulnerability/{agent_id}/summary/{field} API endpoints.
38. v4.6.0 Nov 7, 2023 · release notes

    Wazuh v4.6.0 adds X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. cert generation, AWS GuardDuty support, new CLI for API RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., logcollector filters, and FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. wildcards

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.6.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.6.0

    • Adds wazuh-authd capability to generate X509 certificates automatically during agent enrollment
    • Introduces a new CLI subcommand set to manage Wazuh API RBAC resources (users, roles, rules)
    • Adds --prefix parameter to the Azure Storage integration to filter objects by prefix
    • Adds support for Amazon Linux 2022 in the Vulnerability Detector feed
    • Adds support for Alma Linux in the Vulnerability Detector feed

    +4 more show less

    • Adds support for Debian 12 in the Vulnerability Detector feed
    • Adds new logcollector configuration settings ignore and restrict to filter logs before parsing
    • Adds wildcard (*) support in File Integrity Monitoring (FIM) Windows register paths
    • Adds wildcard support for folders in the localfile configuration on Windows

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The unused local_ip agent configuration option has been removed
39. v4.5.3 Oct 10, 2023 · release notes

    Wazuh v4.5.3 adds SUSE Gzip feeds, nested query support in API q parameter, and macOS 14 agent reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.5.3 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.5.3

    └──▷ TRY IT
    Query the agent list using the $ symbol in query values to match exact string prefixes.
    copy

    $ curl -u 'wazuh:wazuh' -k -X GET 'https://localhost:55000/api/v1/agents?q=name=$hostname*'

    • Adds support for the $ symbol in RESTful API query values
    • Adds support for the @ symbol in RESTful API query values
    • Adds support for nested queries in the q API parameter
    • Vulnerability Detector now fetches the SUSE feeds in Gzip compressed format
    • Updates the agent to report the name of macOS 14 (Sonoma)

    5 details in Everything

40. v4.5.1 Aug 24, 2023 · release notes

    Adds discard_regex to AWS Inspector and CloudWatchLogs integrations; native Apple silicon agent support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.5.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.5.1

    • Added the discard_regex functionality to Inspector and CloudWatchLogs AWS integrations
    • Added new validations for the AWS integration arguments

    2 details in Everything

41. v4.4.3 May 26, 2023 · release notes

    Wazuh v4.4.3 adds macOS agent support for Apple Silicon processors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.4.3 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.4.3

    • Unified SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy names across the ruleset

    1 detail in Everything

42. v4.4.2 May 18, 2023 · release notes

    Wazuh v4.4.2 adds Amazon Security Lake integration and localfile deployment support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.4.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.4.2

    • Adds an agent module to publish events as a subscriber to Amazon Security Lake
    • Adds support for deploying localfile configuration blocks to agents
    • Adds macOS 13.0 Ventura SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy to the ruleset

    3 details in Everything

43. v4.4.1 Apr 12, 2023 · release notes

    Wazuh v4.4.1 adds Debian Linux 11 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. policy support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.4.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.4.1

44. v4.4.0 Mar 28, 2023 · release notes

    Wazuh v4.4.0 adds SUSE & Ubuntu Jammy to Vulnerability Detector, Syscollector delta alerts, Alpine agent build, and native Shuffle integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.4.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.4.0

    • Adds SUSE support in Vulnerability Detector for vulnerability scanning
    • Adds Ubuntu Jammy support in Vulnerability Detector for vulnerability scanning
    • Enables delta events in Syscollector when data gets changed to produce alerts

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed wazuh-logtest and wazuh-clusterd scripts to follow the same scheme as other scripts (spaces symbolized with _ instead of -)
    • !Deprecate status field in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.
45. v4.3.7 Aug 24, 2022 · release notes

    Wazuh v4.3.7 adds cluster subcommand and /cluster/ruleset/synchronization API for ruleset synchronization management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.7 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.3.7

    • Added cluster command to obtain custom ruleset files and their hash
    • Added endpoint GET /cluster/ruleset/synchronization to check ruleset synchronization status in a cluster

    2 details in Everything

46. v4.3.6 Jul 20, 2022 · release notes

    Wazuh v4.3.6 adds Ubuntu 22 and Red Hat 9 support in Vulnerability Detector

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.6 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.3.6

    • Vulnerability Detector now supports scanning for vulnerabilities on Ubuntu 22 (Jammy) agents.
    • Vulnerability Detector now supports scanning for vulnerabilities on Red Hat 9 agents.

    2 details in Everything

47. v4.3.4 Jun 9, 2022 · release notes

    Wazuh v4.3.4 Manager adds indefinite alert reading for Integratord and timeouts for Office 365/GitHub/Agent Update modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.4 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.3.4

    • Integratord now tries to read alerts indefinitely instead of performing only 3 attempts.
    • Adds a timeout configuration option for remote queries made by the Office 365, GitHub, and Agent Update modules.

    2 details in Everything

48. v4.3.0 May 5, 2022 · release notes

    Wazuh v4.3.0 adds vulnerability inventory, Arch/Amazon Linux support in VD, verbose logtest, and force option for authd conflicts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.3.0

    └──▷ USE IT
    Enable verbose output when testing custom rules against sample logs to see detailed matching context.
    shell copy

    wazuh-logtest -v

    Force a new enrollment to overwrite an existing agent entry in authd, preventing enrollment conflicts.
    xml copy

    <authd>
      <force>daily</force>
    </authd>

    • Vulnerability Detector introduces a new capability to maintain a vulnerability inventory on the manager, delivering alerts only when vulnerabilities are newly detected or stop applying (previously applied).
    • Added <force> configuration option to authd.conf to control how the server handles conflicts during agent enrollment requests.
    • Vulnerability Detector gains support for Arch Linux and Amazon Linux operating systems.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The UNIX user and group have been renamed from the previous default to wazuh; existing setups using the old names must update their system accounts or configuration.
49. v4.2.2 Sep 28, 2021 · release notes

    Authd now refuses agent enrollment if a valid key already exists; Syscollector inventory data is cleaned up when disabled.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.2.2

    • Adds num_threads configuration option to the Google Cloud Pub/Sub integration module for multithreaded event processing
    • Makes SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. ciphers configurable in the RESTful API and renames the existing SSL protocol configuration option
    • Cleans up agent inventory data on the manager when Syscollector is disabled

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The RESTful API SSL protocol configuration option name has been changed; existing config keys for the protocol must be updated to the new name.
50. v4.2.0 Aug 25, 2021 · release notes

    New API endpoints for agent stats/vulns, Authd TLS control, Logtest location testing, and Wazuh DB CVE reports in v4.2.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.2.0

    └──▷ TRY IT
    Check active agent statistics across all components without SSH access.
    copy

    $ curl -k -u wazuh:wazuh https://localhost:55000/agents/stats

    Retrieve the list of known CVEs affecting a specific agent via the Wazuh DB report.
    copy

    $ curl -k -u wazuh:wazuh https://localhost:55000/agents/001/vulnerabilities

    Disable API rate limiting entirely for a specific user by setting the allow_run_as flag.
    copy

    $ curl -k -X PUT -u wazuh:wazuh https://localhost:55000/users/admin/allow_run_as -H 'Content-Type: application/json' -d '{"value": true}'

    • GET /agents/stats endpoint added to get agent stats from different components.
    • GET /agents/{agent_id}/vulnerabilities endpoint added to get vulnerabilities that affect an agent.
    • PUT /users/{username}/allow_run_as endpoint added to modify users' allow_run_as flag.
    • New <ip_update_interval> config option in the agent to set how often the agent refreshes its IP address.
    • Authd now supports enabling or disabling the TLS port via a new configuration option.

    +2 more show less

    • API max_request_per_minute configuration option can now be disabled by setting it to 0.
    • Logtest now supports testing location information.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GET /cluster/{node_id}/info and GET /manager/info endpoints no longer include the deprecated ruleset_version field.
    • !POST /groups endpoint now requires the group name in the JSON body instead of as a query parameter.
51. v4.1.1 Feb 25, 2021 · release notes

    New API endpoints for rules, CDB lists, decoders, and configuration management; raw config retrieval added.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.1.1

    • Adds new API endpoints to manage rules files
    • Adds new API endpoints to manage CDB lists files
    • Adds new API endpoints to manage decoder files
    • Adds manager and cluster endpoints to update Wazuh configuration (ossec.conf)
    • Adds raw parameter to GET /manager/configuration and GET /cluster/{node_id}/configuration to load ossec.conf in xml format

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !/manager/files and /cluster/{node_id}/files endpoints are deprecated
52. v4.1.0 Feb 15, 2021 · release notes

    Wazuh v4.1.0 adds PCRE2 rules support, macOS Vulnerability Detector, Windows Registry FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification., logtest API endpoints, and a new upgrade module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    • vulnerability-detector module now includes macOS platform support alongside existing OS coverage
    • File Integrity Monitoring (FIM) extends to Windows Registry values for configuration auditing
    • New upgrade module centralizes WPK upgrades with cluster architecture and simultaneous multi-agent support, replacing the previous feature
    • New task module stores and manages background tasks executed on agents or managers
    • <disconnection_timeout> parameter in ossec.conf makes agent disconnection detection interval configurable (replacing deprecated DISCON_TIME)

    +5 more show less

    • GET /rootcheck and related endpoints query and manage rootcheck data via the API
    • GET /tasks/status endpoint checks the status of scheduled tasks
    • New logtest REST endpoints POST /logtest and DELETE /logtest/{session_id} allow running the logtest tool programmatically
    • debug2 mode added to API logs via the debug config option for deeper tracing
    • AWS Module supports Application Load Balancer, Classic Load Balancer, and Network Load Balancer log ingestion

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The binary ossec-logtest is renamed to wazuh-logtest; scripts invoking the old name will fail.
    • !CA configuration section for WPK signature verification moves from active-response to agent-upgrade in ossec.conf; old placement will be ignored or cause errors.
    • !DELETE /agents endpoint status parameter behavior changes; existing automation relying on the previous logic may need adjustment.
53. v4.0.4 Jan 14, 2021 · release notes

    Wazuh v4.0.4 adds secure_headers and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cipher config options to the API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.4 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.0.4

    • Adds new configuration keys api.secure_headers, api.disable_remote_commands, and api.ssl_ciphers to control API security settings

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. token expiration time is now 15 minutes (previously was longer), requiring clients to refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. more frequently.
54. v4.0.2 Nov 24, 2020 · release notes

    Wazuh v4.0.2 adds macOS Big Sur version detection and removes agent 000 from summary API responses.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.0.2

    • Adds GET /agents/summary/os, GET /agents/summary/status and GET /overview/agents endpoints to return summaries that exclude the dummy agent 000
    • Increases maximum name length for security users, roles, rules, and policies to 64 characters in API configuration

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The GET /agents/summary/os, GET /agents/summary/status and GET /overview/agents API endpoints no longer include the dummy agent 000 in their results.
55. v4.0.0 Oct 23, 2020 · release notes

    Wazuh v4.0.0 introduces agent enrollment, API RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., vulnerability detector enhancements, and base64 log format.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    • Enables agents to automatically request a key from the manager if the current key is missing or wrong via the new enrollment capability.
    • Embeds the Wazuh API directly within the Wazuh Manager process, eliminating the need for a separate installation.
    • Adds RBAC support and a JWT authentication method to the Wazuh API.
    • Adds an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. based specification for the Wazuh API with Redoc documentation.
    • Introduces a new YAML configuration file for the Wazuh API replacing previous methods.

    +6 more show less

    • Adds endpoints for managing API users and security in the new unified Wazuh API.
    • Adds asynchronous aiohttp server support for the Wazuh API, improving performance by approximately 5x.
    • Adds base64_log format to the log builder in Logcollector.
    • Allows loading the Debian Security Tracker feed from a custom location in the Vulnerability Detector.
    • Enables automatic MSU feed updates for Windows vulnerability scanning.
    • Uses package vendor to discard false positive vulnerabilities in the Vulnerability Detector.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default manager-agent connection protocol has changed from UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
    • !Removed Wazuh API cache endpoints.
    • !Removed Wazuh API rootcheck endpoints.
56. v3.13.1 Jul 15, 2020 · release notes

    Wazuh v3.13.1 adds <max_retries> and <retry_interval> settings to control agent failover timing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.13.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.13.1

57. v3.13.0 Jun 22, 2020 · release notes

    Adds Google Cloud Pub/Sub integration, configurable FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. file limit, real-time mode field in alerts, and JSON decoder array handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.13.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.13.0

    • New integration for pulling logs from Google Cloud Pub/Sub

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !OpenSCAP policies installation and configuration block is removed.
    • !Static filter options same_systemname and different_systemname are renamed to same_system_name and different_system_name.
58. v3.12.0 Mar 24, 2020 · release notes

    Wazuh v3.12.0 adds FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. sync, SQL storage switch, AWS GovCloud/Cisco Umbrella S3 monitoring, and auto-reconnect

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.12.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.12.0

    • Adds synchronization capabilities for FIM
    • Adds SQL database for the FIM module with configurable storage backends (disk or memory)
    • Adds support for monitoring AWS S3 buckets in GovCloud regions
    • Adds support for monitoring Cisco Umbrella S3 buckets

    4 details in Everything

59. v3.11.0 Dec 23, 2019 · release notes

    Windows and Debian 10 vulnerability detection, MAC OS inventory, global_frequency rules option, Logcollector JSON/field additions, Fluent Forwarder TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalive

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.11.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.11.0

    • global_frequency new rules option to make frequency rules independent from the event source
    • MAC OS X agents add port inventory support
    • MAC OS X agents add process inventory support
    • Windows agents gain vulnerability detector support
    • Debian 10 Buster supported by vulnerability detector

    +4 more show less

    • Logcollector output format adds host's primary IP field
    • Logcollector output format allows JSON escaping for logs
    • SCE/SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. checks condition field added to agent databases
    • Fluent Forwarder supports TCP keepalive

    9 details in Everything

60. v3.10.0 Sep 18, 2019 · release notes

    Wazuh v3.10.0 adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. numerical comparators, AWS vpcflowlogs profile support, and HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against./NIST mappings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.10.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.10.0

    • Add framework function to obtain a full summary of agents.
    • Support symbolic links in SCA file scanning.
    • Add numerical comparator for SCA rules.
    • Extend duplicate file detection for LogCollector.
    • Add HIPAA and NIST 800 53 compliance mapping as rule groups.

    +2 more show less

    • Add SCA compliance groups to rule groups in alerts.
    • Allow existing aws_profile argument to work with _vpcflowlogs_ in AWS Wodle configuration.

    7 details in Everything

61. v3.9.2 Jun 10, 2019 · release notes

    Adds Ubuntu 12.04 support to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. configuration templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.9.2

62. v3.9.1 May 21, 2019 · release notes

    Wazuh v3.9.1 adds Windows Logcollector wildcard support and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. directory validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.9.1

    └──▷ USE IT
    Configure Windows Logcollector to match varied log file patterns using wildcards
    text copy

    [windows]
    log_format = eventchannel
    wildcard = C:\Logs\*.xml

    Ensure SCA rules only run if the target directory exists, preventing silent failures
    text copy

    <sca>
      <enabled>yes</enabled>
      <check_existence_directories>yes</check_existence_directories>
    </sca>

    • Enhanced wildcard support for Windows Logcollector allows matching more complex log paths
    • Added directory existence checking for SCA rules ensures configurations reference valid directories before scanning

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed 5-second reading timeout for File Integrity Monitoring scan, allowing scans to take longer than before
63. v3.9.0 May 2, 2019 · release notes

    Wazuh v3.9.0 adds Security Configuration Assessment module, Logcollector content/date filtering, Fluent forwarder, and rule correlation fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.9.0

    └──▷ USE IT
    Run the cluster daemon with 4 threads for optimized performance on a quad-core manager.
    shell copy

    wazuh-clusterd -t 4

    • Adds the syscheck-adjacent Security Configuration Assessment scan module for compliance checking.
    • Logcollector gains a pattern exclusion option to ignore specific log patterns during collection.
    • Logcollector on Windows now supports wildcards in file paths for flexible log source targeting.
    • Adds a Fluent forwarder module for agents, enabling Fluentd-compatible log shipping.
    • Syscollector can collect network and port inventory data for legacy Windows XP/Server 2003 systems.

    +6 more show less

    • Inventory fields (network, ports, etc.) are now available as dynamic fields within Wazuh rules for custom detection logic.
    • FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. (Whodata) offers an optional startup health-check controlled by the new startup_healthcheck option in configuration.
    • AWS wodle supports filtering resources by organization using the organizations configuration parameter.
    • Whodata handles hot-added symbolic links, allowing continuous monitoring of dynamically linked files.
    • The wazuh-clusterd binary accepts the -t flag to specify the number of threads for cluster operations.
    • Wazuh rules now support same_field and not_same_field options to correlate dynamic fields across different events.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The global option <queue_size> in Analysisd is deprecated; existing configurations using this tag may generate warnings or require migration.
    • !Labels starting with _ are now reserved for internal use; user-defined labels beginning with this character may be ignored or cause conflicts.
64. v3.8.0 Jan 19, 2019 · release notes

    Wazuh v3.8.0 adds Windows Event Channel JSON logs, AWS services coverage, and Agent Key Polling module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.8.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.8.0

    • Logcollector now parses Windows eventchannel logs in JSON format.
    • Options to detect attribute and file permission changes for Windows are added.
    • Audit health-check is added during Whodata initialization.
    • Audit rules auto-reload capability is added to Whodata.
    • AWS wodle now supports AWS Config, AWS Trusted Advisor, AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves., and AWS Inspector. It also adds support for IAM roles authentication in EC2 instances.

    +13 more show less

    • New Agent Key Polling module integrates agent key requests with external data sources via executable calls or local sockets.
    • agent-auth.exe can now run with elevated privileges via a new manifest.
    • Wazuh manager can be started with an empty configuration in ossec.conf.
    • Authentication daemon is now enabled by default.
    • FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. shows alerts for new files by default. The default FIM configuration ignores some temporary files.
    • The regex pattern maximum size is expanded from 2048 to 20480 bytes.
    • Wazuh-DB auto-upgrades FIM databases.
    • A dedicated thread runs AR commands on the Windows agent.
    • An internal option cleans residual files of agent groups.
    • CDB lists are now built during install.
    • maild can select the log file to read from via a new option.
    • A table controls the metadata of the vuln-detector DB.
    • Support for IAM roles authentication in EC2 instances is added to the AWS wodle.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Syscheck option <remove_old_diff> is deprecated and made mandatory.
    • !The build system no longer requires the USE_BIG_ENDIAN building option on Solaris (SPARC) or HP-UX.
65. v3.7.1 Dec 5, 2018 · release notes

    Wazuh v3.7.1 adds optional agent group guessing via remoted.guess_agent_group and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cert creation in install.sh

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.7.1

    • Adds the internal option remoted.guess_agent_group to control whether Remoted guesses the agent's group.
    • Adds an option to configure additional audit keys for monitoring via the configuration file.
    • Enables install.sh to generate SSL certificates and keys during installation.

    3 details in Everything

66. v3.7.0 Nov 10, 2018 · release notes

    Wazuh v3.7.0 introduces multi-group agent support, new wodles for Azure and Docker, remote config queries, and cluster improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.7.0

    • New wodle for Azure environment log and process collection.
    • New wodle for Docker container monitoring.
    • Adding feature to let agents belong to multiple groups. (with API support)
    • Adding feature to remotely query agent configuration on demand.
    • API requests are forwarded to the proper manager node in cluster.

    +7 more show less

    • Disconnect manager nodes in cluster if no keep alive is received or sent during two minutes.
    • Boost Analysisd performance with multithreading.
    • Boost FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. decoding performance by storing data into Wazuh DB using SQLite databases.
    • Added rule testing output when restarting manager.
    • Centralized configuration pushed from manager overwrite the configuration of directories that exist with the same path in ossec.conf.
    • Increased limit of concurrent agent requests: 1024 by default, configurable up to 4096.
    • Osquery integration updated to nest result data into a osquery object, extract pack name, and include query name in alert description.

    12 details in Everything

67. v3.6.0 Aug 29, 2018 · release notes

    Parallelized logcollector, independent rootcheck/syscheck, custom FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification. tags, and expanded AWS integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • Adds syscheck.default_max_depth to the internal_options.conf file to control recursive directory scanning depth in Syscheck
    • Adds custom tags support for FIM directories and registries via a new configuration option
    • Adds support to process logs from AWS Guard Duty, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., Inspector, Macie and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. in the wodle
    • Enables parallel multithreaded log ingestion in logcollector with periodic rescan of new files

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The syscheck.max_depth internal option has been renamed to syscheck.default_max_depth in internal_options.conf
    • !The T multiplier has been removed from the max_output_size option
68. v3.5.0 Aug 10, 2018 · release notes

    Wazuh v3.5.0 adds native Linux/Windows hardware and network inventory, Kaspersky Active Response, and agent registration group/SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    └──▷ USE IT
    Deploy osquery packs to agents using shared configuration folders instead of merging files
    config copy

    Add the osquery pack directory path in your shared configuration:
    
    ```yaml
    ossec_config/
      osquery/
        packs/
          my_pack.conf
    ```
    Then enable results monitoring via `<location>osquery</location>` in your rules.

    • osquery integration with pack files aggregation, background daemon launch, results monitoring, <location> filtering, and folder support in shared configuration
    • New authd registration options for agent group (-G) and source IP (-S)
    • Kaspersky Endpoint Security for Linux integration via Active Response
    • Native Windows hardware inventory collection
    • Native network inventory collection via Syscollector

    +1 more show less

    • CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-CAT scheduling options configuration

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deleted agent_list tool, replaced by agent_control.
    • !Deprecated arguments -i, -F and -r for Authd.
69. v3.4.0 Jul 24, 2018 · release notes

    Wazuh v3.4.0 adds who-data FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification., per-target log formats, and auto-ignore frequency controls

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    • Adds who-data capability to Syscheck for file integrity monitoring with Linux Audit and Windows SACL support.
    • Adds frequency and timeframe options under <auto_ignore> to suppress repeated alerts within a time window.
    • Adds target option in Logcollector to customize the output format per monitored log path.
    • Changes JSON decoder to use a new option controlling how NULL values are treated.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Cluster _client_ node type is renamed to worker.
70. v3.3.1 Jun 18, 2018 · release notes

    Wazuh v3.3.1 adds total_affected_agents and total_failed_ids fields to the DELETE/agents API response

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.3.1

    └──▷ TRY IT
    Inspect how many agents were successfully removed versus failed during a bulk delete operation via the API.
    copy

    $ curl -k -u admin:admin 'https://localhost:55000/agents?delete_after=0&pretty=true' -X DELETE
    # Look for `total_affected_agents` and `total_failed_ids` in the JSON response

71. v3.3.0 Jun 8, 2018 · release notes

    Logcollector supports multiple socket outputs and custom formats; API agents queries gain field filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

    • logcollector.conf now accepts socket_output entries to send logs to multiple sockets simultaneously
    • New output_format config key in logcollector.conf enables building custom log layouts
    • Rules allow static parameters in comments via <parameter_name> syntax
    • JSON events from Logcollector now include millisecond precision in the timestamp field
    • analysisd accepts a new input event offset option for plugin decoders

    +2 more show less

    • Decoders may mix plugin and multiregex children definitions
    • get_agents_overview, get_agent_group, and get_agents_without_group API functions now accept a field filter parameter

    7 details in Everything

72. v3.2.3 May 28, 2018 · release notes

    Wazuh v3.2.3 adds merged file creation option, GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification./GPG13 alerts, Amazon Linux vuln detection, and new cluster protocol.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.3 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.2.3

    • Adds internal option to enable merged file creation by Remoted
    • Creates alert items for GDPR and GPG13 compliance
    • Adds support for Amazon Linux in vulnerability-detector
    • Introduces new protocol for cluster communications with inverted flow

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed cluster database and internal cluster daemon; existing cluster configurations relying on the old daemon will break
73. v3.2.2 May 7, 2018 · release notes

    New Remoted input queue prevents agent connection starvation and improves Vulnerability Detector resilience.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.2.2

    • Introduces an input queue for the Remoted component to prevent agent connection starvation
    • Improves the version comparator algorithm in vulnerability-detector

    2 details in Everything

74. v3.2.1 Mar 3, 2018 · release notes

    Wazuh v3.2.1 adds totalItems to purgeable agents API and configures Java selection for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-CAT

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.2.1

    └──▷ TRY IT
    Check total available purgeable agents before filtering by timeframe in an automation script.
    copy

    $ curl -k -u wazuh:wazuh -X GET "https://localhost:55000/agents/purgeable/24h" | jq '.totalItems'

    • Adds the totalItems field to the output of the GET/agents/purgeable/:timeframe API call.
    • Adds a Makefile option to disable the CIS-CAT module during build.

    2 details in Everything

75. v3.2.0 Feb 8, 2018 · release notes

    Wazuh v3.2.0 adds AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. & CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-CAT for Windows modules, cluster rule sync, and group status API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    • Adds GET/agents/groups/:group_id API endpoint field status to report group state.
    • Adds new Wazuh Module aws-cloudtrail to fetch logs from S3 buckets.
    • Adds support for synchronizing custom rules and decoders across the cluster.
    • Adds Windows support to the CIS-CAT integration module.

    4 details in Everything

76. v3.1.0 Dec 22, 2017 · release notes

    Adds Wazuh Command Module for async execution, VULS integration, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-CAT module, and GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. lookup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    • Adds command module for asynchronous command execution
    • Adds vuls integration for vulnerability assessments
    • Adds cis-cat Wazuh Module to scan CIS policies
    • Adds GeoIP address finding for input logs in JSON format
    • Adds predecoder.timestamp field to JSON alerts

    +2 more show less

    • Adds duration control for cluster database synchronization via new internal option
    • Enables alert and archive output file rotation

    7 details in Everything

77. v3.0.0 Dec 3, 2017 · release notes

    Wazuh v3.0.0 introduces cluster support (wazuh-clusterd), OpenSCAP SSG integration, and a new JSON decoder plugin.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Adds a cluster of managers (wazuh-clusterd) and a control script (cluster_control).
    • Adds integration with VirusTotal for threat intelligence checks.
    • Adds native support for Systemd init system.
    • Adds OpenSCAP SSG datastream content for Ubuntu Trusty Tahr.
    • Adds new decoder plugin for logs in JSON format with dynamic fields definition.

    5 details in Everything

78. v2.1.0 Aug 17, 2017 · release notes

    Wazuh v2.1.0 adds JSON logging, Authd force-insert flag, and agent labeling for alerts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • Adds -F flag to Authd to force insertion of agents even if the name already exists in the registry
    • Enables logging in JSON format through a new configuration option in Wazuh's main config files
    • Adds labeling data for agents to be displayed within alerts, driven by the new agent key management and global.db updates

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Authd now runs in the background by default instead of the foreground
79. v2.0 Apr 24, 2017 · release notes

    v2.0 adds modules manager, OpenSCAP module/dashboards, SQLite storage for FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification./Rootcheck, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. in alerts, and dynamic fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v2.0

    • Wazuh modules manager
    • Wazuh module for OpenSCAP
    • Ruleset for OpenSCAP alerts
    • Kibana dashboards for OpenSCAP
    • Dynamic fields to rules and decoders

    +15 more show less

    • Dynamic fields to JSON in alerts/archives
    • CDB list lookup with dynamic fields
    • GeoIP support in Alerts
    • Internal option to output GeoIP data on JSON alerts
    • Matching pattern negation
    • Syscheck and Rootcheck events on SQLite databases
    • Data migration tool to SQLite databases
    • 64-bit Windows registry keys support
    • Complete FIM data output to JSON and alerts
    • Username, date and inode attributes to FIM events on Unix
    • Report changes (FIM file diffs) to Windows agent
    • File diffs to JSON output
    • New wodle for SQLite database syncing
    • XML settings options to exclude some rules or decoders files
    • Active response enabled on Windows agents by default

    20 details in Everything

80. v1.1 Apr 13, 2016 · release notes

    Wazuh v1.1 adds Slack/PagerDuty integrations, configurable agent deletion behavior, and new CLI flags for authd/syscheck defaults.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v1.1

    • Adds option to avoid manager from exiting when there are no keys via a new configuration or runtime flag (implied by Added option)
    • Creates agents-timestamp file to persist the date an agent was added, enabling time-based agent lifecycle tracking
    • Enables configuring syscheck to skip showing diffs for specific files via a new setting in syscheck config
    • Adds custom Reply-to e-mail header support for email alerting notifications
    • Changes client.keys naming convention for deleted agents from '#-#-#' prefix to '!' prefix, altering how deletions are represented

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !client.keys no longer overwrites the name of a deleted agent with '#-#-#-', but instead prefixes it with '!'. Scripts parsing this file must update their deletion detection logic.
81. v1.0.4 Feb 24, 2016 · release notes

    v1.0.4 adds JSON output for manage_agents and password authorization to Authd

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.4 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v1.0.4

    └──▷ USE IT
    Export the management list in JSON format for programmatic processing.
    shell copy

    ./manage_agents -l -o json

    • Adds JSON output format to the manage_agents command.
    • Adds -f <sec> option to Authd to force agent addition based on last activity time.
    • Adds -d option to manage_agents to force agent addition regardless of duplicated IP.
    • Enables password authorization for the Authd daemon.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default behavior of Authd and manage_agents now prevents adding agents with duplicated IP unless -f or -d is used.
82. v1.0.3 Feb 12, 2016 · release notes

    Wazuh v1.0.3 adds JSON output for several CLI commands including ossec-control and rootcheck_control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.3 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v1.0.3

    └──▷ TRY IT
    Parse Wazuh status in scripts without parsing plain text
    copy

    $ ossec-control status --output-format json

    • ossec-control, rootcheck_control, syscheck_control, and ossec-logtest can now produce JSON CLI outputs
    • Integration with RESTful API is prepared

    2 details in Everything

83. v1.0.2 Jan 29, 2016 · release notes

    New ruleset updater and extensions for ELK Stack 2.x/4.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.2 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v1.0.2

    • Adds the Wazuh Ruleset updater for automatic installation of Wazuh Ruleset v1.05
    • Adds extensions files to support ELK Stack versions ES 2.x, LS 2.1, and Kibana 4.3

    2 details in Everything

84. v1.0.1 Dec 15, 2015 · release notes

    Wazuh v1.0.1 defaults JSON output and splits decoders.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.1 https://github.com/wazuh/wazuh.git
    # already have the repo? check out this version:
    $ git checkout v1.0.1

    • JSON output is now enabled by default
    • Decoders are split into individual files instead of a single block

    2 details in Everything