Releases: darizotas/ta-windows-wec
Releases · darizotas/ta-windows-wec
Comply with AppInspect check check_reload_trigger_for_all_custom_confs
v1.1.0
- New sourcetype added (windows:wec:subscription:registry) that includes the list of inactive event sources pruned from the subscription registry key. Inactive means that the heartbeat of the event source recorded in the registry is older than the retention period (by default 60 days)
v1.0.2
v1.0.1
Bug fixes:
- Fixed logging details when ignoring a "malformed"/incomplete event source.
- Events produced for the different subscriptions now use the same timestamp. This makes searches consistent.
Improvements: - Split event sources (both details and runtime sourcetypes) into chunks so that:
- the browser does not get unresponsive trying to render big, big json arrays of event sources.
- events do not hit the KV JSON maximum char limit.
- List of event sources is disabled by default for the sourcetype "windows:wec:subscription:details". See Event Source Splitting.
Other changes:
- relaxing requirements for runtime event source parsing. Even those not reporting last hearbeat time will be included.