Skip to content

v0.1.8 — SIEM telemetry enrichment + syslog keepalive

Choose a tag to compare

View all tags
@leodavidsec leodavidsec released this 06 Jul 10:50
v0.1.8
a3203ac
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Clean-image cut of the reeflex-core now running on the api-dev eval endpoint. No functional change to the decision path vs v0.1.5 — verdicts (allow / require_approval + hold / deny) are identical.

Note: v0.1.7 was the WordPress-adapter hold fan-out patch (reeflex-gate 0.1.7), where reeflex-core stayed at v0.1.5. This is the next core-code change.

Added

  • Decision telemetry enrichment for SIEM. The syslog decision event now carries srcip (caller IP, named so Wazuh GeoIP can enrich it), namespace + agent_id (the originating module/adapter — wordpress / claude / n8n), and target_ref + params (the executed command). The fire-and-forget, non-blocking decision-path invariant is unchanged.

Fixed

  • Syslog TCP keepalive. SO_KEEPALIVE (+ Linux TCP_KEEPIDLE/TCP_KEEPINTVL/TCP_KEEPCNT, ~30s detection) so a restarted syslog collector is detected and delivery resumes, instead of silently dropping events on a half-open connection until the container is restarted.

Image

ghcr.io/reeflex-io/reeflex-core:v0.1.8 (also :latest) — manifest digest sha256:9d8e2879c62b988455389f31820e70bfb5402d751b0895d5f597ff0aa44903a4. Built from this tag; runs on api-dev.reeflex.io.

Assets 2
Loading