TA-opnsense v1.5.4

What's Changed

• Updated Splunk Add-on version to 4.1.3.
• Updated Splunk Python SDK to version 1.7.4

Full Changelog: v1.5.3...v1.5.4

TA-opnsense v1.5.3

What's Changed

• Fixed "unknown" action for nat rules #85.
• Added the field dest_interface for CIM compliance.

Full Changelog: v1.5.2...v1.5.3

TA-opnsense v1.5.2

What's Changed

• Updated Add-on builder packages.
• Updated documentation to address required log formats #67.

Full Changelog: v1.5.1...v1.5.2

TA-opnsense v1.5.1

Note

(Only applies if you are upgrading from a version < 1.5.0)
This version includes packages for the new version of Add-on builder (v4.0.0) which may cause API credentials to no longer work after updating. After updating to this version, you may have to re-enter the API credentials for the modular inputs to work again by editing the existing account configurations.

Updates

• Updating field extractions for Suricata events in Drop mode - #58
• Adding default allowed action for suricata events
• Fixed certificate issue when no cert checking is enabled - #61

TA-opnsense v1.5.0

Note:

This version includes the packages for the new version of Add-on builder which may cause API credentials to be lost. After updating to this version, you may have to re-enter the API credentials for the modular inputs to work again.

• deprecating sourcetype "opnsense:access" and moving to "opnsense:audit"
• updated CIM mapping for Authentication events
• updated to latest add-on builder version

TA-opnsense v1.4.3

• fixed script to initial an upgrade check - #49
• added ability to use a cron schedule for the modular input interval - #52
• added ability to specify port number for modular input - #53

TA-opnsense v1.4.2

• Adding support for absolute paths in modular input setup for certificates - #44
• Fixed issue with the Verify Certificate checkbox not working properly - #47

TA-opnsense v1.4.1

• Fixed incorrect sourcetype transform for modular input - issue #41
• Increased the truncate limit to allow large events.

TA-opnsense v1.4.0

• Added modular input to pull system information (Available Updates, Versions, Installed Packages/Plugins).
• Updated the suricata sourcetyper to recognize the json data without the standard syslog message header.
• Fixed ipv6 ICMP events not extracting properly - issue #37

TA-opnsense v1.3.2

New

• Added meta field for event length (opnsense_event_length)
• Added sourcetype for Syslog-ng logs (opnsense:syslog)
• Added action for "Redirect" if port forwarding logging rules exist

Fix

• Fixed "unknown" severity for opnsense:suricata:json events - issue #27
• Fixed IGMP events not being extracted - issue #32
• Fixed Access logs not being extracted - issue #35