From 1801361cf898e8f1085d30e600cdf2b7ff1e2dfd Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 16 Sep 2020 11:40:05 -0400 Subject: [PATCH] Update changes.json --- salt/soc/files/soc/changes.json | 43 +++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/salt/soc/files/soc/changes.json b/salt/soc/files/soc/changes.json index 5b0204ae0..1e5a1404b 100644 --- a/salt/soc/files/soc/changes.json +++ b/salt/soc/files/soc/changes.json @@ -1,21 +1,28 @@ { - "title": "Security Onion 2.1.0 RC2 is here!", + "title": "Security Onion 2.2.0 RC3 is here!", "changes": [ - { "summary": "Known Issues " }, - { "summary": "Fixed an issue where the console was timing out and making it appear that the installer was hung." }, - { "summary": "Introduced Import node, which is ideal for running so-import-pcap to import pcap files and view the resulting logs in Hunt or Kibana." }, - { "summary": "Suricata stats.log now rotates once a day. If you have a bunch of suriloss defunct processes on nodes that have it, do the following:" }, - { "summary": "Moved static.sls to global.sls to align the name with the functionality." }, - { "summary": "Traffic between nodes in a distributed deployment is now fully encrypted." }, - { "summary": "Playbook" }, - { "summary": "Ingest Node parsing updates for Osquery and Winlogbeat - implemented single pipeline for Windows eventlogs & sysmon logs" }, - { "summary": "Upgraded Osquery to 4.4 and re-enabled auto-updates." }, - { "summary": "Upgraded to Salt 3001.1" }, - { "summary": "Upgraded Wazuh to 3.13.1" }, - { "summary": "Hunt interface now shows the timezone being used for the selected date range." }, - { "summary": "Fixed Cortex initialization so that TheHive integration and initial user set is correctly configured." }, - { "summary": "Improved management of TheHive/Cortex credentials." }, - { "summary": "SOC now allows for arbitrary, time-bounded PCAP job creation, with optional filtering by host and port." }, - { "summary": "Historical release notes can be found on our docs website: https://docs.securityonion.net/en/2.1/release-notes.html" } + { "summary": "Known Issues " }, + { "summary": "Setup now includes an option for airgap installations" }, + { "summary": "Playbook now works properly when installed in airgap mode" }, + { "summary": "Added so-analyst script to create an analyst workstation with GNOME desktop, Chromium browser, Wireshark, and NetworkMiner" }, + { "summary": "Upgraded Zeek to version 3.0.10 to address a recent security issue" }, + { "summary": "Upgraded Docker to latest version" }, + { "summary": "Re-worked IDSTools to make it easier to modify" }, + { "summary": "Added so-* tools to the default path so you can now tab complete" }, + { "summary": "so-status can now be run from a manager node to get the status of a remote node. Run salt so.status" }, + { "summary": "Salt now prevents states from running on a node that it shouldn't so you can't, for example, accidentally apply the elasticsearch state on a forward node" }, + { "summary": "Added logic to check for Salt mine corruption and recover automatically" }, + { "summary": "Collapsed Hunt filter icons and action links into a new quick action bar that will appear when a field value is clicked; actions include:" }, + { "summary": "Fixed minor bugs in Hunt user interface relating to most-recently used queries, tooltips, and more" }, + { "summary": "so-user-add now automatically adds users to Fleet and TheHive (in addition to SOC)" }, + { "summary": "Introduced so-user-disable and so-user-enable commands which allows administrators to lock out users that are no longer permitted to use Security Onion" }, + { "summary": "Added icon to SOC Users list representing their active or locked out status" }, + { "summary": "Removed User delete action from SOC interface in favor of disabling users for audit purposes" }, + { "summary": "Prune old PCAP job data from sensors once the results are streamed back to the manager node" }, + { "summary": "Hunt filtering to a specific value will search across all fields instead of only the field that was originally clicked" }, + { "summary": "Limiting PCAP jobs to extract at most 2GB from a sensor to avoid users accidentally requesting unreasonably large PCAP via the web interface" }, + { "summary": "so-test is back - run it to easily replay PCAPs and verify that all the components are working as expected (Requires Internet Access)" }, + { "summary": "New Elasticsearch subfield (".security") based on the new community-driven analyzer from @neu5ron - https://github.com/neu5ron/es_stk" }, + { "summary": "Playbook now uses the new .security subfield for case-insensitive wildcard searches"} ] -} \ No newline at end of file +}