Download the ISO
What's Changed
- Bump version from 3.1.0 to 3.2.0 by @TOoSmOotH in #15918
- Add 3.2.0 option to discussion template by @TOoSmOotH in #15919
- main to dev for hotfix by @TOoSmOotH in #15939
- Remove outdated HOTFIX version number by @TOoSmOotH in #15940
- Jertel/wip by @m0duspwnens in #15944
- refactored soc config by @jertel in #15947
- fix version by @jertel in #15949
- check if there is a version or hotfix to upgrade to before verifiying elasticsearch compatibility by @reyesj2 in #15951
- use so-config-backup script in soup by @reyesj2 in #15952
- run elastic agent regen installer script in post_to_3.2.0 by @reyesj2 in #15954
- config updates by @jertel in #15955
- higstate on host start, not salt-minion start by @m0duspwnens in #15956
- fix elasticsearch template generation issue by @reyesj2 in #15958
- respect elasticfleet enable_auto_configuration setting for so-elastic… by @reyesj2 in #15961
- use pipe exit status for update_docker_containers by @reyesj2 in #15964
- remove startup states from salt config by @m0duspwnens in #15965
- Jertel/wip by @jertel in #15967
- update so-elastic-fleet-package-upgrade script by @reyesj2 in #15966
- userid vs names by @defensivedepth in #15971
- Data stream lifecycle management support by @reyesj2 in #15973
- remove pillar merge by @reyesj2 in #15978
- es|ql defaults by @jertel in #15974
- add context to soup errors by @reyesj2 in #15979
- Pin NIC names by MAC via udev (run-once) from the common state by @TOoSmOotH in #15970
- don't create stack trace when set -e is disabled by @reyesj2 in #15982
- wip by @m0duspwnens in #15983
- Upgrade registry by @jertel in #15984
- allow manager two full highstates during soup, improve elastic script runtime by @m0duspwnens in #15985
- remove heayvnode FleetServer_* directory creation, and skip empty dir… by @reyesj2 in #16006
- Fix premature fail_setup function call in so-setup by @triggerman86 in #16005
- support multiple capinfos versions by @jertel in #16008
- Add UEK8 kernel repo support across install and grid by @TOoSmOotH in #16000
- Set transport for ssl.established:false logs by @defensivedepth in #16009
- Switch boot default to UEK8 kernel and gate kernel repo on salt version by @TOoSmOotH in #16011
- Serve /kernelrepo through nginx so minions can reach the kernel repo by @TOoSmOotH in #16012
- update so-stop | so-start | so-restart scripts by @reyesj2 in #16013
- soup upgrade kafka cluster metadata v4 by @reyesj2 in #16018
- suricata: verify reloaded ruleset is newer than the rules file by @m0duspwnens in #16021
- remove outdated eval script and associated salt utility state by @reyesj2 in #16024
- update airgap soup to sync uek repo from iso by @reyesj2 in #16023
- increase wait_for_so-kibana timeout to 10m by @reyesj2 in #16027
- duplicate repo name in so-repo-sync by @reyesj2 in #16028
- only reload suricata rules if all-rulesets.rules exists by @m0duspwnens in #16029
- avoid setup failure reason ambiguity by @jertel in #16033
- update default hunt query by @reyesj2 in #16035
- support sigma playbooks by @defensivedepth in #16019
- Add cluster_health option to telegraf.conf by @TOoSmOotH in #16039
- Add repo names by @defensivedepth in #16041
- Feature/agentic by @coreyogburn in #16030
- recollate databases by @jertel in #16046
- verify elastic-agent reports healthy status before completing install… by @reyesj2 in #16045
- add missing so-logs-soc annotation by @reyesj2 in #16049
- restart soc after re-initing db by @jertel in #16050
- elastic fleet server persistence by @reyesj2 in #16052
- exit so-setup early for issues with so-elastic-fleet-setup by @reyesj2 in #16055
- toggle pg metrics by @jertel in #16058
- status messages for so-elastic-fleet-setup by @reyesj2 in #16059
- ES 9.3.7 by @reyesj2 in #16062
- prevent login redirect to any API url by @jertel in #16064
- soup: make failed upgrades and hotfixes resumable by @TOoSmOotH in #16069
- Install UEK8 in so-kernel-upgrade when no UEK kernel is present by @TOoSmOotH in #16054
- include so-yaml.py in get_soup_script_hashes() so we ensure its at la… by @reyesj2 in #16074
- Fix typos in CPU affinity descriptions by @dougburks in #16075
- ignore file already closed by @jertel in #16078
- Update baseline agents by @defensivedepth in #16081
- auto state apply by @m0duspwnens in #16071
- PostgreSQL: prevent password log leak + self-heal SOC database bootstrap by @TOoSmOotH in #16084
- postgress updates by @jertel in #16089
- Fix agentMapping defaults: displayName values and DetectionEngineer key by @TOoSmOotH in #16093
- Broader support for SigmaHQ rules + Elastic Defend logs by @defensivedepth in #16087
- Rename Detection Engineer agent key to DetectionEngineer by @TOoSmOotH in #16096
- apply salt.master state instead of just salt.minion during soup by @m0duspwnens in #16097
- template updates by @reyesj2 in #16099
- Remove icsnpp-modbus from defaults.yaml by @TOoSmOotH in #16104
- Map av to both defender and defend by @defensivedepth in #16103
- call highstate in soup with a retry if first fails vs bailing by @reyesj2 in #16106
- Add default esheap value so nodes highstate without the pillar value by @m0duspwnens in #16109
- Express the highstate schedule in minutes instead of hours by @m0duspwnens in #16111
- Revert "elastic fleet server persistence" by @reyesj2 in #16112
- run es-url-updae prior to upgrade by @reyesj2 in #16113
- Add already_running mapping by @defensivedepth in #16114
- add sslverify=0 to minion repo config. Updates are pulled from the ma… by @reyesj2 in #16115
- ignore all TransformTask failures for so_kibana user by @reyesj2 in #16116
- update vm state applid for pillar_push_map by @m0duspwnens in #16117
- Support sigma playbooks for airgap by @defensivedepth in #16118
- Add Gemma configuration to defaults.yaml by @TOoSmOotH in #16119
- Change defaults by @coreyogburn in #16121
- Investigator and Engineer Use Gemma by @coreyogburn in #16122
- 3.2.0 by @TOoSmOotH in #16124
- 3.2.0 by @TOoSmOotH in #16125
New Contributors
- @triggerman86 made their first contribution in #16005
Full Changelog: 3.1.0-20260528...3.2.0-20260729
Contributors
defensivedepth, dougburks, and 6 other contributors