New Features
- GitHub: organization audit log events can now be collected through a new GitHub API poller in Add Device.
- UDP receive-buffer drop statistics added for syslog and flow collection.
Plugin & Integration Updates
- Added Ubiquiti UniFi Gateway log parsing and event mapping.
- Ubiquiti UniFi U6 access points: UniFi OS console lines and multi-line syslog bodies are now parsed, with a new event map library.
- Ubiquiti UniFi Network: security and VPN CEF fields are mapped, and previously uncategorized security and VPN events are classified.
- Check Point Log Exporter, LEA and 1400 series: 98 event definitions that landed in Uncategorized are now mapped onto the existing event taxonomy.
- Fortinet FortiGate: logs that carry an epoch timestamp are no longer dropped.
- Microsoft 365: a long audit backlog is caught up in chunks, a malformed response is retried without losing the collection position, a window with no logs still advances the position, and overlapping collection runs are prevented.
- Microsoft Defender XDR: the collection position now advances to the newest incident.
- Google Cloud Audit Logs: one undecodable entry no longer freezes a source, and a lagging source catches up.
- AWS CloudTrail: pagination and error handling are corrected so pages are not missed.
- Custom S3: gzip-compressed objects are detected automatically, objects holding a single JSON array are expanded into one record per element, and unsupported or unreadable content is now reported.
- JDBC pollers (PostgreSQL, SAP, Db2): large tables are collected in ordered, bounded batches with the position saved after each batch, so tables with millions of rows no longer stall collection.
- Symantec DLP incident API poller: events are categorized by the status names the API actually returns.
- Symantec DLP: the label-style syslog template is now parsed.
- ManageEngine DataSecurity Plus: the DLP event detail keys sent by current versions are now mapped.
- SentinelOne: the event generation time is written in the format the search engine indexes.
- MDaemon: unparsed files are no longer deleted, and header values containing ": " are kept.
- ESET Endpoint: log parsing and field mappings are improved.
- McAfee: the syslog and CEF parsers no longer claim or fail on malformed input.
- Palo Alto Networks Traps and Cortex XSOAR: malformed or truncated CEF and LEEF lines no longer break parsing, and LEEF headers are rebuilt correctly.
- DrayTek Vigor: NAT session logs are parsed into typed fields.
- Citrix NetScaler AppFirewall: severity 10 and an optional CEF prefix are accepted.
- Barracuda WAF: the identity field in audit events is mapped correctly.
- Arbor Edge Defense: destination geolocation fields now point to the destination address.
- Arbor Pravail: key-value pairs are no longer lost and the Details field is populated.
- Proofpoint Email Protection: ISO 8601 timestamps and additional detail fields are supported.
- Berqnet Firewall: timestamped DNS and network lines are recognized, and an empty message no longer breaks parsing.
- Cyberoam: a log without a log identifier no longer breaks parsing.
- VanDyke VShell Server: a crash on empty event types is fixed, plain-type records are classified, and severity and username are read from the correct keys.
- HP WiFi Controller: foreign log lines are rejected early instead of slowing the parser down.
- OpenVPN Server: usernames containing a hyphen are now matched.
Other Improvements
- Cluster upgrades are faster and safer: fleet-wide migrations run once from the coordinating node instead of on every node, and configuration work waits until internal coordination is ready.
- Log indexing recovers automatically when its internal message broker subscription dies instead of retrying forever, alarm documents no longer compete with saturated log-indexing traffic, and messages dropped inside the broker are now counted in collection statistics.
- Health checks no longer scan the whole in-memory store every minute, reducing load on busy installations, and health events raised on cluster nodes carry the node's own address instead of the loopback address.
- Index templates are never written from an unloaded configuration, which could open a daily index with the wrong shard count, and the audit template is applied before the first index of the day.
- Credential protection has been strengthened across log sources, threat intelligence feeds and integrations.
- Authentication and access controls have been strengthened.
Bug Fixes
- A temporary stall in the in-memory store no longer kills the incident and action-rule workers.
- Alarm-to-incident latency is reduced, and concurrent alerts no longer corrupt the incident they belong to.
- Windows Event Forwarding: events are no longer lost, nested sections keep their titles as they do with WMI, MSSQL documents are no longer doubled, and MSSQL Application audit events are parsed as they are with WMI.
- Login no longer fails when a cluster member is unreachable, and a degraded cluster returns a clear answer instead of an internal error.
- Custom threat intelligence sources using the Group-IB API or TAXII collect again.
- Rule Flow: static values set by a bucket modifier apply only to that bucket's members.
- Response actions: $GET substitution keeps working when a column path cannot be resolved.
- Searching with an unknown sort column falls back to the time column instead of failing.
- Service Watch no longer flags Logsign's own cluster services as third-party services, and syslog denials are shown per facility on the statistics page.
- Search column discovery returns up to 1000 values and says when more exist.
- Offline reports keep progress, status and failure reasons visible, and a run whose process died is marked as failed instead of staying "running" forever.
- Static libraries: a library that fails to load no longer stops the ones after it, and the shipped FTP settings library loads again on fresh installations.
- Cron jobs removed by an operator now survive the next upgrade, and maintenance jobs no longer restart services that are not assigned to the current cluster node.
- A logout by a user whose account has since been removed is still recorded in the audit log.
- Notification traffic is bounded: a repeating notification is grouped with a counter instead of being appended again, the queue is capped and expires, the scheduled cleanup job is installed again, and response actions whose value already exists are no longer reported as failures.