IOCMON v1.3.8

v1.3.8 - (October 24, 2026)

      - MINOR: Added another option to the feeds menu (2) and enabled functionality from the AbuseIPDB
        Reputation provider. Upon enabling (and signing up for another API key!), this service will scan
        true positives identified by your feed lists if they are found on your conntrack, DNS and dropbear
        connections, and provide you with additional intelligence about the IP in question. This info is
        added to various on-screen interfaces, logs and email alerts. Thanks to @SomewhereOverTheRainbow
        for this suggestion!
      - PATCH: Built in better logic to detect if an AMTM autoupdate replaced the script, and will now
        restart the script automatically if it finds a newer version in /jffs/scripts.
      - PATCH: Small corrections to Entware detection logic.
      - PATCH: Changed some of the curl timeout values based on some feedback from @BobWadd
      - PATCH: Small revisions to the #2 Feeds & API menu, and changed some of the layout along with how
        the logic works for enabling a feed/reputation service that requires an API. Thanks @JB_1366!
      - PATCH: This version fixes the change that abuse.ch put into place these last few days where they
        are now requiring an API key for their URLhaus list, available via API. The good news here is
        that you can use the same exact API key you have for ThreatFox. Thanks to @ankhazam for bringing
        this up!
      - PATCH: Revamped some of the stats, giving a bit more info on what is downloaded, deduped and
        used in the end, and making sure this all matches what goes into the log files. I know it can be
        a bit confusing as I'm parsing large json files down to only its usable items, like ThreatFox
        going from 40K lines down to 4K usable items.

IOCMON v1.2.7

v1.2.7 - (October 15, 2026)

      - MINOR: Built an integration with @Adamm's excellent Skynet Firewall script, where IOCMON can
        now optionally upload periodic updated feed list content directly into Skynet's Ban list. This
        feature will add up-to-date security intelligence directly to your inbound/outbound flows on your
        router, preventing clients from reaching known malicious sites or command & control servers. This
        option is set through Advanced Settings -> 9.5.5. I've made Q-Feeds an optional component as it
        tends to be quite large, and will add 200,000+ items to your ban list. As with any fast-changing
        security feed, false positives are possible, so tread lightly. This additions now seems to
        classify IOCMON as a lightweight Asus-Merlin IDS/IPS tool. Ha! :P
      - PATCH: Added further critical watch capabilities over the sensitive information available under
        the /etc folder, which includes passwords, groups, permissions, .pem files, etc. This is now
        hashed separately as other critical file paths currently are, and will generate mandatory alerts
        when something has changed. Advanced configuration menu items 9.4.14 and 9.4.15 were added,
        giving you the ability to tweak what is or isn't being watched under /etc.
      - PATCH: Improved reliability of the Skynet import, as I noticed it had failed to import on one of
        the latest feed refresh cycles.
      - PATCH: Added new Configuration Menu item 5: "OTX Alienvault Threat Report". Many thanks to
        @Visortgw for the suggestion to add a way to provide OTX URLs to view the threat analysis using
        an easy link to get there directly. This report also keeps track of the number of instances
        a threat was reported, and which local device was involved.
      - PATCH: Firmed up further fixes with the profile.add and services-start files - thanks @JB_1366!
      - PATCH: Various spacing and other aesthetic fixes.
      - PATCH: Added another hot key to the main UI, for [N]=OTX Report. This will generate a quick OTX
        AlienVault Threat Report over the last 7 days, sorted by date. Thanks @visortgw for the idea!
      - PATCH: The (5) OTX AlienVault Treat Report can now be sorted by frequency, or by date, which is
        user-selectable from an option under this menu.
      - PATCH: Provided for a way to move the iocmon.log from /jffs/addons/iocmon.d to the state folder
        on your external drive, using menu item 10.6.3. Thanks for the suggestion, @JB_1366!

IOCMON v1.1.5

v1.1.5 - (October 11, 2026)

      - PATCH: Based on a report from @Twiglets, it seemed that the "log-queries" entry detection logic
        also falsely detected a hashed/commented out entry that contained the same string. Built new
        logic to ignore comments in Advanced Settings 9.2.1 Watch DNS Lookups.

IOCMON v1.1.4

v1.1.4 - (October 9, 2026)

      - PATCH: Ran into an issue with Diversion, as it was complaining about a duplicative "log-queries"
        entry in the /jffs/configs/dnsmasq.conf.add file. Built in new logic that checks for the
        existence of the "log-queries" entry in the /etc/dnsmasq.conf file before determining if it          
        should be written to the .conf.add file.
      - PATCH: Added a new configuration menu 9.2.7 which allows you to mirror dnsmasq DNS lookups to
        a local IOCMON-managed log file. This is for those systems who don't have an established way of
        logging dns queries so that IOCMON has a method of still being to monitor these.

IOCMON v1.1.0

v1.1.0 - (October 8, 2026)

      - PATCH: Added other popular text editors, such as VI, as optional ways of looking at log files.
        This is currently modeled after the same method used in TAILMON, and is based on the contents of
        your local "EDITOR=" variable. Thanks to @XIII for bringing this one back! :)
      - MINOR: Added a new item #6 to the Configuration Menu, allowing you to import/export your IOCMON
        configuration. This allows you to save your configuration, along with all exceptions you have
        added over time, and lets you import this same configuration on another router either during the
        initial setup, or post-setup from the configuration menu. Please note: this option lets you
        optionally export with or without your API keys. Also, the External Drive path/name is not used
        as this would most likely change from router to router, and uses the local default. Thanks to
        @twiglets for this suggestion!
      - PATCH: Firmed up the processing of items in SERVICES-START, POST-MOUNT and CRU so that they
        only change items when deemed necessary, and won't be the cause of creating additional alerts.
      - PATCH: Added the proof-of-concept toggles to yes/no items in the menus, greatly inspired by
        Wireless Report by @JB_1366! Let me know if they visually help distinguish the overall state
        quicker than it would be to read the yes/no's.
      - PATCH: Firmed up more governance in the config menus when a primary item is disabled, that the
        dependent items under it are now grayed out and unavailable to change. If previous values were
        entered, those items will stay until the primary item is enabled again.
      - PATCH: Fixed 9.5.2 and realigned the menu settings per @Visortgw's OCD request. ;)
      - PATCH: Reorganized the main Configuration menu and added section headers, much like what you
        would see in BACKUPMON.
      - PATCH: Added a new menu item 9.4.3 "Critical-path MOD alert mode (.ssh/startup-scripts/.conf.add)"
        which allows you to choose how you would like to be alerted when critical files are modified.
        You can choose between "Upon File Modification", when a file is touched, modified, may not
        change its contents or it may have content changes, or "Upon File Hash Mismatch", when a file
        actually changes in contents. Thanks to @XIII for the great suggestion.
      - PATCH: Added /jffs/.ssh to the critical file paths to watch.
      - MINOR: Revamped the DNS Exceptions menu (9.2.2) to make the experience dealing with this ever-
        growing list more manageable. It includes 2 columns, that will span over multiple pages if
        needed, being able to move next/previous, edit and search for wildcards.
      - MINOR: Great suggestion by @JB_1366... the Recent IoC Detections list now includes a [Z] option
        that allows you to easily add a DNS domain exception using one of the numerical indicators next
        to the IoC domain entry to be added.
      - PATCH: Think I finally found a fix to the screen corruption issue when rejoining a brand new
        screen session after a fresh reboot where IOCMON started on its own. This would redraw the timer
        line after 80 characters repeatedly until you either logged in, or the screen refreshed while
        logged in. Thanks to the persistence of @JB_1366 to have me nip this in the bud.

IOCMON v1.0.1

v1.0.1 - (October 4, 2026)

      - PATCH: Some minor compatibility tweaks for new installs that run the script with the "-screen"
        command before having the Screen Entware tool installed yet, and wasn't allowing the user to
        run the script. IOCMON will now revert to a standard SSH Terminal session if the Screen tool
        isn't found and is being run with that command.
      - PATCH: Cleaned up extra space/comments around version number for compatibility.

IOCMON v1.0.0

v1.0.0 - (October 3, 2026)

      - MAJOR: The IOCMON Asus/Merlin Security Intelligence Monitor officially goes live with a wide
        release today. Thank you to EVERYONE who has been involved in testing, and coming up with great
        suggestions and additions. Please keep them coming to continue making this tool even better!
        Up next on the roadmap: A web interface so you can interact with IOCMON from the router UI. Will
        be dipping my toe into this for the first time, so this will be a work-in-progress. :)

IOCMON v.0.6.7

v0.6.7 - (October 1, 2026)

      - PATCH: Minor changes to the Github download links to point to the latest releases file, to help
        enable a more formal release metrics process.

IOCMON v0.6.6

v0.6.6 - (September 29, 2026)

      - PATCH: The -autoupdate switch now restarts IOCMON into the new version after a successful
        download. Previously, it would download the new version, but wouldn't get used until it was
        manually restarted. Thanks @Visortgw for noticing! :)
      - PATCH: Key combo [R!] (or r!) will instantly-clear the currently-viewed log immediately. This
        is a hidden easter egg that only @JB_1366 knows about. These release notes will erase themselves
        in 10 seconds to hide all tracks.
      - PATCH: Key combo [E!] (or e!) from any of the config menu sub menus will allow you to skip past
        all the minutia, pass go, collect $200, and return directly to the main UI! Thanks to @JB_1366
        for the great efficiency ideas.
      - PATCH: Alias for IOCMON has now been changed to iocmon="sh /jffs/scripts/iocmon.sh -screen -now",
        which helps keep screen compatibility when just executing "iocmon" from the commandline. Thanks
        @Visortgw for the idea and validation from @JB_1366!
      - PATCH: If [P]ause is enabled and you happen to [X] detach from screen like @Visortgw likes to do,
        the script will now resume it's regular routine and continue watching your environment after you
        have detached. Thanks @Visortgw!
      - PATCH: When pressing [E]xit, the script will ask you if you want to continue, just incase you
        wanted to [X] detach instead. Again, thanks to @Visortgw for the relentless testing! :)

IOCMON v0.6.1

v0.6.1 - (September 28, 2026)

      - PATCH: Fixed some inconsistencies with the -autoupdate switch installing a stable version over a
        beta version, even when the beta track was already selected. Thanks @XIII and @Ripsshod!
      - PATCH: Moved the location of dropbear_attempts.log from /jffs/addons/iocmon.d to the external
        drive's state folder.

      - v0.5.9 - (September 27, 2026)
      - PATCH: Worked on fixing an issue with screen corruption when coming from a router reboot when
        IOCMON starts on its own using 'screen'. The timer line would throw some corruption and redraws.
      - PATCH: Alert banner location is configurable under menu 8.1, and allows you to choose the top or
        bottom of the screen. By default, Top of the screen is enabled. - thanks for the suggestion, @XIII!
      - PATCH: Alert banner content/email level options are available under 8.1 as well, giving you the
        choice of receiving all alerts generated by IOCMON, or to just focus on hits when something matches
        from a feed. By default, All Alerts is enabled. Thanks for the idea, @Ripshod!
      - PATCH: Added the ability to whitelist IPs or CIDR IP ranges under menu item 8.5 (Network & System
        Watches). These IPs are excluded from matching with any potential false positives found on the
        threat feeds. Thanks @Visortgw for the suggestion!
      - PATCH: Fixed a few more flaws detecting correct CIDR ranges, and now limits anything beyond a /32.

      - v0.5.6 - (September 26, 2026)
      - MINOR: Added another feed integration. Pleased to announce Q-Feeds as another malicious domain and
        IP feed resource. Q-Feeds is free, but requires a signup in order to get an API key. This key will
        need to be input into the Feeds menu under the Configuration Menu. Huge thanks to @Slapdaddy for
        bringing up this suggestion. This resource adds a tremendous number of additional malware source
        indicators to check against! Due to its size, and being on the free community edition, feeds are
        only updated every 24hrs by default. Which is why the settings suggest only updating 1x/day,
        however you can change that if you please.
      - PATCH: Included the menu item numbering system to each of the sub menus and their sub menus for
        easier reference where you are, or when following instructions. Thanks to @Twiglets for that great
        suggestion!

All changes since IOCMON v0.5.3 are included above!