From cc56dc5a7f2e7fbaffa411b23838f3d4b510e576 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 15 Oct 2020 19:05:47 -0400 Subject: [PATCH] Update changes.json --- salt/soc/files/soc/changes.json | 45 +++++++++++++++------------------ 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/salt/soc/files/soc/changes.json b/salt/soc/files/soc/changes.json index 7a2115b99..2b1ed31fb 100644 --- a/salt/soc/files/soc/changes.json +++ b/salt/soc/files/soc/changes.json @@ -1,28 +1,25 @@ { - "title": "Security Onion 2.2.0 RC3 is here!", + "title": "Security Onion 2.3.0 is here!", "changes": [ - { "summary": "Known Issues " }, - { "summary": "Setup now includes an option for airgap installations" }, - { "summary": "Playbook now works properly when installed in airgap mode" }, - { "summary": "Added so-analyst script to create an analyst workstation with GNOME desktop, Chromium browser, Wireshark, and NetworkMiner" }, - { "summary": "Upgraded Zeek to version 3.0.10 to address a recent security issue" }, - { "summary": "Upgraded Docker to latest version" }, - { "summary": "Re-worked IDSTools to make it easier to modify" }, - { "summary": "Added so-* tools to the default path so you can now tab complete" }, - { "summary": "so-status can now be run from a manager node to get the status of a remote node. Run salt so.status" }, - { "summary": "Salt now prevents states from running on a node that it shouldn't so you can't, for example, accidentally apply the elasticsearch state on a forward node" }, - { "summary": "Added logic to check for Salt mine corruption and recover automatically" }, - { "summary": "Collapsed Hunt filter icons and action links into a new quick action bar that will appear when a field value is clicked; actions include:" }, - { "summary": "Fixed minor bugs in Hunt user interface relating to most-recently used queries, tooltips, and more" }, - { "summary": "so-user-add now automatically adds users to Fleet and TheHive (in addition to SOC)" }, - { "summary": "Introduced so-user-disable and so-user-enable commands which allows administrators to lock out users that are no longer permitted to use Security Onion" }, - { "summary": "Added icon to SOC Users list representing their active or locked out status" }, - { "summary": "Removed User delete action from SOC interface in favor of disabling users for audit purposes" }, - { "summary": "Prune old PCAP job data from sensors once the results are streamed back to the manager node" }, - { "summary": "Hunt filtering to a specific value will search across all fields instead of only the field that was originally clicked" }, - { "summary": "Limiting PCAP jobs to extract at most 2GB from a sensor to avoid users accidentally requesting unreasonably large PCAP via the web interface" }, - { "summary": "so-test is back - run it to easily replay PCAPs and verify that all the components are working as expected (Requires Internet Access)" }, - { "summary": "New Elasticsearch subfield (.security) based on the new community-driven analyzer from @neu5ron - https://github.com/neu5ron/es_stk" }, - { "summary": "Playbook now uses the new .security subfield for case-insensitive wildcard searches" } + { "summary": "Known Issues " }, + { "summary": "We have a new Alerts interface for reviewing alerts and acknowledging or escalating them. Escalating creates a new case in TheHive. Please note that TheHive no longer receives alerts directly." }, + { "summary": "Kibana no longer presents the option to create alerts from events, but instead allows creation of cases from events." }, + { "summary": "Our Security Onion ISO now works for UEFI as well as Secure Boot." }, + { "summary": "Airgap deployments can now be updated using the latest ISO. Please read this documentation carefully." }, + { "summary": "Suricata has been updated to version 5.0.4." }, + { "summary": "Zeek has been updated to version 3.0.11." }, + { "summary": "Stenographer has been updated to the latest version." }, + { "summary": "soup will now attempt to clean up old docker images to free up space." }, + { "summary": "Hunt actions can be customized via hunt.actions.json." }, + { "summary": "Hunt queries can be customized via hunt.queries.json." }, + { "summary": "Hunt event fields can be customized via hunt.eventfields.json." }, + { "summary": "Alerts actions can be customized via alerts.actions.json." }, + { "summary": "Alerts queries can be customized via alerts.queries.json." }, + { "summary": "Alerts event fields can be customized via alerts.eventfields.json." }, + { "summary": "The help documentation is now viewable offline for airgap installations." }, + { "summary": "The script so-user-add will now validate the password is acceptable before attempting to create the user." }, + { "summary": "Playbook and Grafana no longer use static passwords for their admin accounts." }, + { "summary": "Analyst VM now comes with NetworkMiner 2.6 installed." }, + { "summary": "Strelka YARA matches now generate alerts that can be viewed through the Alerts interface." } ] }