Taranac 1.1.1

[1.1.1] — 2026-07-18

Added

• CEF (ArcSight) syslog format. Audit and AAA events can now be emitted in
  CEF (Common Event Format) for direct ingestion by ArcSight, Sentinel and other
  SIEMs, alongside the existing RFC 3164 / RFC 5424 formats. Events carry the
  canonical rt event-time field so they are timestamped correctly regardless of
  the collector's timezone.

Changed

• SCP/SFTP sources: remote path moved to the recipe. The file path an SCP or
  SFTP source fetches now lives on a file recipe (a new recipe kind), matching
  how HTTP recipes carry their request — the source describes the connection, the
  recipe describes what to fetch. Existing SCP/SFTP sources are migrated
  automatically on upgrade.

Fixed

• Just-in-time credentials shared across concurrent collections. Collecting
  from a second device under the same just-in-time credential no longer fails while
  another collection holds it. The minted password is now an account-scoped "warm"
  lease: every collection borrows the same live password and works in parallel, and
  it is rotated once idle (or as soon as a collector-exposed run drains) — never out
  from under an in-flight login.
• Backups persist across updates. The backups directory is now stored on a
  named volume, so backups survive container recreation and image updates instead
  of being silently lost.