Skip to content

Releases: darizotas/ta-windows-wec

Comply with AppInspect check check_reload_trigger_for_all_custom_confs

08 Dec 23:25
e3e85cd
Compare
Choose a tag to compare

Comply with AppInspect check check_reload_trigger_for_all_custom_confs

v1.1.0

17 Dec 20:24
555deb6
Compare
Choose a tag to compare
  • New sourcetype added (windows:wec:subscription:registry) that includes the list of inactive event sources pruned from the subscription registry key. Inactive means that the heartbeat of the event source recorded in the registry is older than the retention period (by default 60 days)

v1.0.2

05 Nov 15:06
f3f29f4
Compare
Choose a tag to compare

This version integrates bug fixes for the issues:

v1.0.1

28 Sep 08:59
59d8011
Compare
Choose a tag to compare

Bug fixes:

  • Fixed logging details when ignoring a "malformed"/incomplete event source.
  • Events produced for the different subscriptions now use the same timestamp. This makes searches consistent.
    Improvements:
  • Split event sources (both details and runtime sourcetypes) into chunks so that:
    1. the browser does not get unresponsive trying to render big, big json arrays of event sources.
    2. events do not hit the KV JSON maximum char limit.
  • List of event sources is disabled by default for the sourcetype "windows:wec:subscription:details". See Event Source Splitting.

Other changes:

  • relaxing requirements for runtime event source parsing. Even those not reporting last hearbeat time will be included.

v1.0.0

13 May 14:32
Compare
Choose a tag to compare
  • Subscription details and related event log statistics
  • Subscription runtime status

Note: Splunk appinspect not compliant because of rwx permissions in bin folder. However, it targets Windows Platform