{ "title": "Introducing Hybrid Hunter 1.2.1 Beta 1", "changes": [ { "summary": "Full support for Ubuntu 18.04. 16.04 is no longer supported for Hybrid Hunter." }, { "summary": "Introduction of the Security Onion Console. Once logged in you are directly taken to the SOC." }, { "summary": "New authentication using Kratos." }, { "summary": "During install you must specify how you would like to access the SOC ui. This is for strict cookie security." }, { "summary": "Ability to list and delete web users from the SOC ui." }, { "summary": "The soremote account is now used to add nodes to the grid vs using socore." }, { "summary": "Community ID support for Zeek, osquery, and Suricata. You can now tie host events to connection logs!" }, { "summary": "Elastic 7.6.1 with ECS support." }, { "summary": "New set of Kibana dashboards that align with ECS." }, { "summary": "Eval mode no longer uses Logstash for parsing (Filebeat -> ES Ingest)" }, { "summary": "Ingest node parsing for osquery-shipped logs (osquery, WEL, Sysmon)." }, { "summary": "Fleet standalone mode with improved Web UI & API access control." }, { "summary": "Improved Fleet integration support." }, { "summary": "Playbook now has full Windows Sigma community ruleset builtin." }, { "summary": "Automatic Sigma community rule updates." }, { "summary": "Playbook stability enhancements." }, { "summary": "Zeek health check. Zeek will now auto restart if a worker crashes." }, { "summary": "zeekctl is now managed by salt." }, { "summary": "Grafana dashboard improvements and cleanup." }, { "summary": "Moved logstash configs to pillars." }, { "summary": "Salt logs moved to /opt/so/log/salt." }, { "summary": "Strelka integrated for file-oriented detection/analysis at scale" }, { "summary": "KNOWN ISSUE: Updating users via the SOC ui is known to fail. To change a user, delete the user and re-add them." }, { "summary": "KNOWN ISSUE: Due to the move to ECS, the current Playbook plays may not alert correctly at this time." }, { "summary": "KNOWN ISSUE: The osquery MacOS package does not install correctly." } ] }