Skip to content

Release 1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 17:33
· 2 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.0
This tag was signed with the committer’s verified signature.
TheophileDiot Théophile Diot
GPG key ID: 7C44E4D7742628F8
Verified
Learn about vigilant mode.
3cd9f4a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

BunkerWeb add-on for Splunk 1.0.0

Changes

  • [FEATURE] Add the bunkerweb:access, bunkerweb:error and bunkerweb:modsec_audit sourcetypes with timestamps, line breaking and search-time field extraction.
  • [FEATURE] Map access and audit events to the CIM Web and Intrusion Detection data models, with the web, ids and attack tags.
  • [FEATURE] Add a live test that installs the package on a pinned Splunk Enterprise container, ingests samples/ and asserts the extracted and CIM fields.
  • [BUGFIX] Wait for container bootstrap and the authenticated management API before installing the app or continuing after a restart in the live test.
  • [MISC] Check pull requests with pre-commit, Splunk AppInspect and the Plumber CI/CD gate; analyze them with CodeQL.
  • [MISC] Publish tagged releases from a protected environment, with a SHA256SUMS file, a CycloneDX SBOM and signed build provenance.

Installation

Download TA-bunkerweb-1.0.0.tgz, check it against SHA256SUMS and install it as described in the
README.

Assets 8
Loading