2016

Doug Burks edited this page Dec 28, 2016 · 369 revisions
Clone this wiki locally
  • January 2016

    • Issue 820: Snort 2.9.8.0
    • Issue 839: securityonion-capme needs additional input validation
    • Issue 814: Move to Ubuntu 14.04
    • Issue 739: Salt 2015.5.3
    • Issue 829: Apache reverse proxy /elsa-query to ELSA port 3154
    • Issue 824: securityonion-web-page: fix links to ELSA
    • Issue 810: securityonion-web-page: move SSH Logins query to Host Logs category
    • Issue 811: securityonion-tcpudpflow: add SMTP and RDP support
    • Issue 807: securityonion-elsa-extras: Remove NameVirtualHost to eliminate warning
    • Issue 729: Setup: add option for pivot URL (no longer needed)
    • Issue 821: Setup: fix domain name cancellation
    • Issue 822: Setup: remove alphanumeric password requirement
    • Issue 828: Setup: desktop shortcuts
    • Issue 790: sostat: remove snorby
    • Issue 830: soup: remove old linux kernels
    • Issue 815: NSM: add log directory creation to postinst
    • Issue 831: Snort Community Ruleset has moved
    • Issue 812: Bro 2.4.1
    • Issue 816: Snort needs liblzma
    • Issue 818: Suricata 3.0RC3
    • Issue 836: syslog-ng warning when restarting
    • Issue 838: Move downloads from SourceForge to Github
    • Issue 843: NSM: services fail to start when choosing Master only
    • Issue 844: Setup: sosetup-network needs same interface regex as sosetup
    • Issue 845: Setup: Production Mode - Custom - not enabling some services properly
  • February 2016

    • Issue 842: securityonion-elsa: map dashboard displays empty screen
    • Issue 840: securityonion-capme: remove include config from callback
    • Issue 846: Setup: X11 error when running via ssh -X
    • Issue 848: Setup: master-only shouldn't show Snort/Bro in final confirmation screen
    • Issue 847: Suricata 3.0
    • Issue 856: securityonion-capme needs additional input validation in index.php
    • Issue 857: NetworkMiner 2.0
    • Issue 835: PF_RING 6.2
    • Issue 853: NSM: if BPF file is empty, omit option from snort/suricata command
    • Issue 854: NSM: improve check for snort/suricata
    • Issue 855: NSM: remove old references to disable_signature_reference
    • Issue 859: NSM: mkdir -p /var/run/nsm/ before trying to chown
    • Issue 849: sostat: check timezone and warn if not UTC
    • Issue 858: sostat: check default_start_time_offset
  • March 2016

    • Issue 869: GPG signature for ISO image
    • Issue 862: securityonion-capme: merge timestamp changes from Wes Lambert
    • Issue 832: pulledpork.pl refinement
    • Issue 785: sostat: show number of available updates
    • Issue 792: soup: add note about running on master server before running on sensor
    • Issue 865: Setup: only open port 22 in ufw firewall
    • Issue 860: Setup: disable noisy SURICATA events
    • Issue 735: Setup: Production Mode should automatically configure PF_RING instances
    • Issue 874: Setup: add -w option to write out sosetup.conf file
    • Issue 866: NSM: Squert object_mappings table has wrong permissions
    • Issue 876: Setup: division by 0 error on SNIFFING_INTERFACES
    • Issue 861: 14.04.4.1 ISO image
  • April 2016

    • Issue 891: Setup: fix errors when sensors add firewall rules
    • Issue 894: Setup: remove old keyring files
    • Issue 892: securityonion-rule-update: avoid su error
    • Issue 893: Snort 2.9.8.2
    • Issue 896: Suricata 3.0.1
    • Issue 882: ELSA: fix email
    • Issue 881: ELSA: remove non-ascii character from securityonion-elsa-reset-archive
    • Issue 902: Setup: Additonal debug info and input validation
    • Issue 890: Squert ip2c cron job should sleep a random number of minutes
    • Issue 899: Squert ip2c cron job should run as a non-root user
    • Issue 903: Squert ip2c cron job should log to a log file
  • May 2016

    • Issue 864: ELSA: Improve dashboard map shading
    • Issue 906: sosetup.conf: allow passwords with special characters
    • Issue 907: sosetup-fix-ppconf duplicating Snort community ruleset entries
    • Issue 904: Setup should run pulledpork and squert-ip2c as limited user
    • Issue 914: securityonion-setup: mysql calls should use --defaults-file
    • Issue 909: securityonion-rule-update: ensure barnyard/IDS are running before restarting
    • Issue 911: securityonion-rule-update: add cron option to force delay
    • Issue 918: securityonion-rule-update: cron delay should be at least 10 minutes
    • Issue 910: securityonion-squert-cron: add cron option to force delay
    • Issue 917: securityonion-squert-cron: cron delay should be at least 10 minutes
    • Issue 915: securityonion-sostat: mysql calls should use --defaults-file
    • Issue 924: NSM: set DEBUG 1 in /etc/sguild/sguild.conf
    • Issue 736: CapMe: Debug information occasionally gets rendered inside the transcript
    • Issue 738: CapMe: handle large pcaps more gracefully
    • Issue 916: CapMe: Check for gzip encoding and automatically switch to Bro transcript
    • Issue 922: CapMe: Handle sguild failure more gracefully
    • Issue 493: CapMe: send credentials interactively to avoid exposing on command line
  • June 2016

    • Issue 919: Setup: check minimum RAM requirements
    • Issue 923: Setup: warn user if they disable full packet capture
    • Issue 932: Setup: consistently apply title to all zenity windows
    • Issue 931: nsm_sensor_backup-data missing leading slash in directory
    • Issue 908: securityonion-elsa-extras: add securityonion-elsa-reset script
    • Issue 871: CapMe: add session support to avoid re-authenticating every time
    • Issue 930: CapMe: increase memory limit
    • Issue 933: CapMe: handle inactive/failed pcap_agents more gracefully
    • Issue 927: CapMe: Handle pcaps that generate no p0f output
    • Issue 934: CapMe: subdirectories should redirect to main page
    • Issue 935: CapMe: improve input validation on stime and etime variables
    • Issue 936: CapMe: replace include_once with require_once
    • Issue 867: Squert: pivot to CapMe for pcap
    • Issue 929: Squert: update mysql call in scripts
    • Issue 913: 14.04.4.2 ISO image
  • July 2016

    • Issue 952: securityonion-web-page: add FTP Data query to FTP category
    • Issue 957: securityonion-web-page: change public site hyperlinks to https
    • Issue 956: CapMe: only close transcript when 'close' button is clicked
    • Issue 951: sostat: group packet loss stats into one section
    • Issue 960: sostat: output when current monitoring interval has not completed
    • Issue 925: Setup: ask user for MTU of sniffing interface(s) and allow VLAN tags
    • Issue 926: Setup: ask user for HOME_NET
    • Issue 948: Setup: configure email
    • Issue 949: Setup: change http links to https
    • Issue 953: Setup: change "Emerging Threats GPL" to "Emerging Threats Open"
    • Issue 955: Setup: Nonstandard interface names not being detected
    • Issue 304: Setup: support unique interface names
    • Issue 944: NSM: backup scripts should not prompt when run with --force-yes
    • Issue 561: NSM: nsm_server_backup-config should check FORCE_YES
    • Issue 937: NSM: remove sguild DEBUG 1 from postinst
    • Issue 943: NSM: add nsm_server_user-list
    • Issue 941: PF_RING 6.4.1
    • Issue 945: Suricata 3.1.1
    • Issue 946: Snort 2.9.8.3
    • Issue 963: sostat: improve formatting
  • August 2016

    • Issue 966: Setup: sosetup.conf needs to include MTU
    • Issue 592: sosetup: add -y option
    • Issue 967: Squert: Parameter not escaped in ip2c.php
    • Issue 969: Squert: prevent directory listing for subdirectories
    • Issue 827: securityonion-elsa-extras: merge additional patterns
    • Issue 950: ELSA: change Help link to point to ELSA Github
    • Issue 970: securityonion-web-page: add queries for autoruns, dnp3, and modbus
    • Issue 973: securityonion-web-page: Apache ServerName localhost
    • Issue 964: securityonion-web-page: add "bottom" queries for long tail analysis
    • Issue 976: securityonion-web-page: additional protections in securityonion.conf
    • Issue 971: securityonion-sguil-db-purge: add command line options
    • Issue 972: securityonion-sguil-db-purge: update mysql calls
    • Issue 974: securityonion-sguil-db-purge: check for privileges
    • Issue 968: NSM: wipe stats.log when restarting Suricata
    • Issue 980: Setup: sosetup.conf SGUIL_CLIENT_USERNAME alphanumeric only
    • Issue 979: securityonion-elsa-extras: additional patterns for Sysmon 4 and 4.11
    • Issue 983: securityonion-elsa-extras: add "AR-LOG" header to autoruns pattern
    • Issue 975: NSM: configure Snort snaplen via command line argument
    • Issue 981: sosetup-network: bug when configuring management interface only
    • Issue 984: securityonion-web-page: add HTTP top status code
    • Issue 986: Setup: use default MTU
  • September 2016

    • Issue 879: 14.04.5.1 ISO image
    • Issue 994: Suricata 3.1.2
    • Issue 987: Squert ip2c cron job should lock to prevent multiple instances
    • Issue 997: securityonion-elsa-extras: better parsing for event id 4776
    • Issue 985: rule-update should always log to /var/log/nsm/pulledpork.log
    • Issue 990: sostat: Fix redirect to file issue
    • Issue 991: sostat: Remove redundant source call
    • Issue 992: sostat: Enable nullglobs to prevent string literal bug in various for loops
    • Issue 996: sostat: report OS version and sostat version
    • Issue 998: sostat: only show last run of rule-update
    • Issue 961: soup: remove any autoremove recommendations
    • Issue 962: soup: recommend upgrading to 16.04 HWE stack
    • Issue 1001: securityonion-web-page: move Top/Bottom links to beginning of line
    • Issue 1002: securityonion-web-page: fix ELSA FIREWALL_ACCESS_DENY queries
    • Issue 1004: securityonion-web-page: standardize Autoruns queries
  • October 2016

    • Issue 1007: CapMe: transcript data sometimes overruns the transcript window
    • Issue 993: NSM: start/restart errors on systems with ethXX (2 or more numbers)
    • Issue 1005: NSM: redirect iostreams to logfile during ossec-agent restart
    • Issue 1009: soup: change "2>1" to "2>&1"
  • November 2016

    • Issue 1014: Suricata 3.1.3
    • Issue 1010: securityonion-elsa-extras: Windows process enhancements
    • Issue 988: Setup: use lowercase of hostname when creating sensornames
    • Issue 1000: Setup: rename VRT to Talos
    • Issue 989: Setup: postinst should check for existence of account before chown
  • December 2016

    • Issue 492: CapMe needs to handle UDP better
    • Issue 1024: soup: when running on sensor, ensure master server has been updated first
    • Issue 1030: NSM: remove chown from /usr/sbin/so-bro-cron
    • Issue 1026: Suricata 3.2
    • Issue 1032: NSM: don't chown every file in /nsm/bro/extracted
    • Issue 942: NSM: more gracefully handle large number of files in /nsm/bro/extracted
    • Issue 1033: NSM: only allow one instance of nsm_sensor_clean at a time
    • Issue 1023: Bro 2.5
    • Issue 1028: securityonion-bro-scripts: update for Bro 2.5
    • Issue 1029: securityonion-elsa-extras: update for Bro 2.5
    • Issue 883: Squert 1.6.3
    • Issue 868: Squert: Summary page, clicking country, src/dst results in empty page
    • Issue 958: Squert: OSSEC HIDS alerts display NIDS rules