New Features
- Sources: added optional columns for health checks, check periods, EPS thresholds, and parser fallback settings.
- Windows Events: added standard Object.Process* fields beside the existing process fields for supported Windows event sources.
- Sigma: added regular expression, negative prefix, and negative suffix matching. Re-import existing Sigma rules to use the new Windows mappings.
- Web Access: added an optional TLS frontend with a manual switch and rollback. The switch keeps nginx active until an operator selects the new frontend.
Plugin & Integration Updates
- Heimdal EDR: added API collection for notifications, antivirus, ransomware, DNS security, and privilege-management events.
- VeloCloud SD-WAN Edge: added syslog parsing for firewall records and Edge events.
- Teltonika RutOS: added a syslog parser.
- Quest SharePlex: added syslog parsing for event_log records.
- Securify Identity: added syslog parsing for plain, CEF, and LEEF envelopes.
- ForeScout CounterACT: added classification and field mapping for Enterprise Manager Console login, logout, and inactive-session audit records.
- Extreme XIQ Site Engine: extended the Management Center parser to recognize its syslog records.
- Palo Alto CONFIG: corrected rule and object names from configuration paths. Nested child fields no longer appear in these names.
- CrowdStrike Falcon: vendor severity labels now populate the standard Severity field.
- VMware vCenter: event details now use the standard Logsign fields instead of Details.*. Update searches, rules, and reports that use the earlier fields.
Other Improvements
- Data Collection: oversized records now produce a warning with the source, collector, and record size. These records remain skipped.
- ZooKeeper: package configuration now applies the default heap limit through the server startup settings. The package preserves settings that an operator has configured.
- System Update: added an admission check before APT changes packages. Install logsign-upgrade-gate in a separate transaction before upgrading. The check refuses upgrades for unsupported leaf configurations.
Bug Fixes
- Incidents: bulk Close and Assign now act only on selected incidents. The header checkbox selects the current page. Select All Data warns at the 5,000-incident limit.
- Email Notifications: a timeout while waiting for the SMTP reply now reports a delivery failure. The reply timeout increases to 60 seconds.
- Pollers: checkpoint-store outages now skip the collection cycle instead of resetting the checkpoint and collecting the same records again.
- Libraries: upgrades now preserve deletions of supported shipped records. Shipped mini queries remain an exception. Earlier deletions can require explicit deletion markers.
- Upgrade: list-valued response-action parameters no longer stop the $GET prefix rewrite during configuration migration.
- Cluster: applying a plan from the UI now continues when the API service restarts.
- Cluster: the system now checks every member before it applies a plan or starts initial cluster formation.
- Cluster: corrected migration lease handling after cluster formation, preventing configuration steps from being refused by older lease values.
- Single-Member Cluster Plans: configuration migration now connects to ZooKeeper at the address in the plan.
- Disk Monitoring: added XFS detection. A disk that holds only legacy archives still raises an alarm when full. Collection continues.
- Upgrade: UDP 514 stays bound during package unpack. TCP syslog listeners and finite buffers can still limit collection during upgrades.
- NATS: records with no subscriber now stay in the bounded retry buffer instead of being counted as delivered.
- Archive: added the required bzip2 package for compression on Ubuntu 24.04, including offline installations.
- Windows Events: nxlog no longer uses the event-writer ID when the actor process ID is missing. Searches using the earlier values can change.
- Alarm Rules: corrected notContains list evaluation in the Python engine to match the Go engine. Listed values must all be absent.