Signalith 0.3.2

Before you upgrade

• Enter runs the search. In the Search page's query box, Enter now runs the search and Shift+Enter starts a new line. Ctrl+Enter (⌘+Enter on a Mac) still runs it. With suggestions open, Tab takes the highlighted one, and Enter does once you moved to one with the arrow keys.
• Splunk pack rules have high and critical severities. security_content now gives nearly every TTP rule the same risk score, which made every one medium. TTP rules are now ranked by the ATT&CK techniques they detect: 77 critical (ransomware, wiping, exploitation of a named CVE), 196 high (credential theft, defenses disabled, lateral movement and the like), 492 medium. Anomaly rules stay low. Saved searches, dashboards and notifications that filter on severity may see more Splunk pack findings. See Splunk security content.
• The Docker quick start runs the newest release. Up to 0.3.1 it ran the image built from main, so a new install got unreleased code. It now runs the release named in deploy/docker/docker-compose.yml, and git pull moves it to each new release. To keep running the newest build of main, put SIGNALITH_VERSION=main in deploy/docker/.env before you git pull; do so if you updated from main after 0.3.1 came out, since going back to an older version isn't supported. See Running another version.
• The Windows install line turns on process creation auditing. Installing or re-running the Signalith Agent on Windows now turns on Audit Process Creation with the command line (Security event 4688), as the CIS benchmarks recommend, so the many rules that read program starts work without Sysmon. Add -NoProcessAuditing to the line to leave it as it is. See Process creation auditing on Windows.
• Agents do not update themselves from 0.3.1 yet. The 0.3.1 and 0.3.2 agent programs are not signed with the release key, so an agent installed from 0.3.1 keeps running 0.3.1. To move it to 0.3.2, run the install line from Add data again on that computer. Signed updates start with the next release.

What's new

• Turn on the Windows logs detections need from the install line. With Also turn on logs that are off by default on Add data (-EnableLogs), the Windows agent's install line turns on PowerShell script block logging and the DNS client, Task Scheduler, CryptoAPI and device driver logs, which PowerShell and other rules read. Removing the agent turns off what it turned on. Script block logging records scripts with any password written into them. See Logs that are off by default. (BUY-04)
• A starter set of detections. Each pack card's one-click button now turns on about 140 high and critical rules that read only what hosts send as installed, instead of every high and critical rule. Browse rules marks the rules that need Sysmon, process auditing, PowerShell logging or the Linux audit log. See The starter set.
• The Docker quick start, locked to the release. Each release now has signalith-<version>-docker.tar.gz: the quick start with Signalith's image locked to the digest the release built and signed, so it runs exactly that image and needs no git. See The quick start locked to a release.
• A failed Windows install or upgrade is undone. If the .msi fails partway, a new install removes what it set up (services, the OpenSearch program, firewall rules; data is kept), and an upgrade puts the previous version back and starts it again, instead of leaving nothing installed. An OpenSearch upgrade whose service does not start goes back to the version before; one that starts but never answers is left for you to retry with the .msi. See Install from packages. (WIN-02)
• The Windows installer downloads OpenSearch through a proxy. It uses the computer's proxy setting (netsh winhttp), or HTTPS_PROXY, or one you name with OPENSEARCHPROXY=host:port, and checks there is room on the disk before the 1 GB download. A proxy that needs a password is not supported; use OPENSEARCHZIP. See Install from packages. (WIN-03)
• Replace a cluster's certificate authority. signalith cluster tls rotate-ca (also on the Servers page) replaces the CA in steps: prepare, switch, retire, with abort before the switch. While it changes, servers and agents trust both the old and the new CA, so nothing drops off. Agents report which CAs they trust, and the Endpoints page flags one that trusts a CA no server uses. See Replacing the cluster's CA. (CTL-01)
• A findings queue built for a team. The queue sorts and pages on the server (200 at a time, sorted by urgency or time), filters to unassigned findings, keeps its filters in the link, and has A (assign to me) and R (resolve) keys. Each user can save filters as named views, and the queue can group findings by detection or entity. Each urgency has a pick-up and a resolve target (Settings > Detections), the queue shows when a finding is due or how late it is, and a rule can send a finding again when nobody picks it up in time. Resolving asks for a disposition, and a new Posture card ranks the noisiest detections by false positives. See The findings queue.
• Analysts propose exceptions, admins approve them. An analyst can propose an exception from a finding with the values, how long and why; an admin approves or declines it on the Approvals page, and requests expire after 14 days. See Proposing an exception.
• Exceptions for many detections at once. An exception can cover every detection, a content pack's rules or a tag's, and a finding can add one ("Except this host from all rules"). See Exceptions for many detections. (DQ-09)
• Content pack rules keep their author's credit in notifications. Email, Slack and Teams messages about a pack rule's finding carry its credit line, and webhooks get finding.credit.
• SigmaHQ pack: antivirus rules. Six antivirus rules join the SigmaHQ pack, and its report now accounts for every rule in SigmaHQ's checkout, with why each left-out rule is left out. (DQ-06)

Fixes

• The network sensor installer no longer silently stops a Fluent Bit or Suricata already running. If fluent-bit.service or suricata.service runs (or is enabled) for something else, it stops before changing anything and says how to go on: --docker leaves it alone, --take-over stops it and --uninstall starts it again. See Network sensor. (DEP-05)
• A detection with no throttle window and a lookback longer than its schedule no longer raises a new finding for the same row on every overlapping run.
• In a cluster, a server whose job lease renewal was answered late no longer takes the lease back after it ran out, which briefly stopped jobs and refused tenants' requests.

Search

• where a > b compares two fields. A bare name on the right of a where comparison now names a field, as in Splunk: where bytes_out > bytes_in and where failures > successes compare the fields on each row that has them, where they compared with the text before and silently dropped or kept the wrong rows. On rows without such a field the name is still text. A search that meant the text should put it in double quotes, as in where user="admin". (SL-02)
• Weeks start on Sunday everywhere, and earliest= checks its time. earliest=-7d@w, bin span=1w and timechart span=1w now all start weeks on Sunday, as Splunk's @w does; bin and earliest= used Monday and timechart used Thursday. earliest= and latest= read epoch times as seconds (they were milliseconds, so earliest=1767225600 meant January 1970), accept chained modifiers such as @d-1h, quarters (@q) and @w1 to @w6, and refuse a time they cannot read instead of returning nothing. A saved search with such a time now shows the error. See Query language.
• timechart ... by picks its series over the whole range and counts each in every bucket, where a value outside one bucket's top 10 showed 0 there; it adds OTHER and NULL series as Splunk does (useother=f, usenull=f leave them out).
• Closer to Splunk: sort 10 -count keeps 10 rows and sort keys take num(), str(), ip() and auto(); a multivalue field matches where and search when one of its values does; stats and top by a multivalue field count each value; values() keeps up to 10,000 values with their types and marks the result truncated when it leaves some out.
• stats sum(bytes*) and stats values(*) as * cover every matching field, as in Splunk, where the pattern was read as one field's name and gave nothing; timechart, chart, streamstats and by * refuse a * field name instead of returning empty columns. New: head limit=N, stdevp, varp and sumsq, and the eval functions sha512, random, pi, exact, isbool, ipmask, atan2, hypot and the trigonometric functions.
• The Ask box no longer runs a query for a question it half understood: a word that made it into no filter, grouping or data model now counts as not understood ("accounts locked out today" read as user=locked with full confidence), and such a query waits for you to run it, or goes to the AI model when one is set up. It now knows account lockouts and the DNS, web, registry, intrusion detection, alert and certificate data.
• New page: Splunk SPL compatibility lists the commands and functions that work as in SPL, the ones that work differently and the ones that are missing.
• Checked against Splunk with a new set of searches and their expected rows: sort puts upper case before lower case, sum() of a group with no numbers is empty instead of 0, and top gives percent to six decimal places.
• The Search page runs searches in your browser's time zone, shown next to the results: @d and the other snaps, timechart and bin days and weeks, strftime and relative_time follow it instead of UTC. Detections and dashboards still run in UTC.
• A result is marked Sampled when commands such as eval, rename, bin or dedup before stats ran over only the newest search.max_events events of more that matched, so its counts cover only those; Explain says so too. Backtests count such runs as capped.
• With more than 50,000 groups, top, rare and stats ... | sort -count | head N keep the largest groups (ranked in OpenSearch) instead of the first 50,000 by name, so the top rows are the right ones; such results show Ranked.
• Three searches that read back differently from how they were written are fixed: a bare name in where that needs quotes, a field name starting with [, and timechart limit=10.

Signalith Agent

• Fluent Bit's buffer on each computer is capped at 1 GB (4 GB on a network sensor). While Signalith cannot be reached the oldest events are dropped past that, rather than filling the computer's disk. Agents pick this up by themselves; a Fluent Bit you set up by hand gets it when you download its configuration again from Add data. (ASI-01)
• When Signalith refuses a computer's token three times in a row, the agent stops Fluent Bit and osquery instead of reading events Signalith would drop, and starts them again from where they were once the token is accepted. (ASI-01)
• An agent update now rolls back when the new version starts but cannot reach Signalith, not only when it fails to start. (ASI-04)
• The agent's service and osquery's on Linux may use at most 512 MB of memory each (two CPU cores for the agent, one for osquery), and each collector on Windows at most 512 MB. Run the install line again on a computer set up before to get them. (ASI-15)
• osquery's curl and curl_certificate tables are off on every host, and sending a live query asks for your password again when you have not entered it in the last 15 minutes. (ASI-12)
• A server installed with the Windows installer (.msi) or the Windows zip now carries the Signalith Agent's programs. On 0.3.1 its Add data page said "This server has no agent program for Windows" and the install line could not set up any computer.
• The Windows install lines (for an agent and for a new server) now work in Windows PowerShell 5.1, the one Windows comes with. On 0.3.1 they stopped with "An unexpected error occurred on a send" there and only worked in PowerShell 7.

Load balancers

• The HAProxy and keepalived samples in deploy/loadbalancer now check /readyz for syslog too (over TLS, TCP and UDP), so a server that is starting, stopping, drained or cut off from OpenSearch gets no syslog from the balancer. Copy the new checks into a balancer set up from the old samples. See Load balancers. (DEP-01)

First hour

• The Security page no longer says the built-in admin still has the Docker setup's first password after it was changed from the account menu. A server that shares its users with the cluster (the Docker quick start's too) now reads the password in use, the page checks again right after a change, and the fix points to Change password with no restart.
• A plain word in a search matches the start of a word that has dots or underscores in it, as in Splunk: mimikatz finds mimikatz.exe.
• The setup guide's security step is done only when nothing is at risk and nothing needs attention, as the Security page counts them; it said Done while the page listed things to fix.
• The Health page and the Health card say OpenSearch refuses writes when OpenSearch's disk is past its high or flood-stage watermark. The cluster stays green then, so Health said Healthy while new events, findings and detection runs failed. See Data retention.
• Loading the sample data runs the detections four at a time, which took a test load with 119 rules on from about 4 minutes to about 2. Rules turned on while the sample is loaded say that they only watch new events, and how to run them over the sample week. The Detection health card no longer counts a rule turned on less than 30 days ago as having no match in 30 days.
• The Windows agent collects the exploit protection log's user mode events (Microsoft-Windows-Security-Mitigations/UserMode) as well as its kernel mode ones, which the Sigma exploit protection rules read. Run the install line again on a computer set up before, or download the Fluent Bit or OpenTelemetry Collector configuration again from Add data.

Compliance

• The Compliance page shows evidence only for what Signalith observed. Built-in items count once events arrive, an empty findings queue or an unused feature is no longer evidence, clock-sync controls use the hosts' time-sync checks, plain syslog and retention without the data behind it show as partial, controls that ask for more than a SIEM can see say so and stay partial, and notes on controls are audited and no longer raise the score. See Compliance. (COMP-01, 02, 04 to 07, 14)
• Controls a SIEM cannot show (PCI DSS 8.3.4, HIPAA risk analysis, SOC 2 CC4.1) are no longer listed, and eleven more say what they ask for beyond Signalith. (COMP-03)
• Sign-in and process logs count as evidence only when every computer running the agent or osquery sends them, and the evidence names those that do not. Configuration checks no longer count for hosts on a platform they do not cover, and checks that fail to run everywhere show as gaps. Reports and CSV exports name the mapping version, the Signalith version and who exported them, and say how each kind of evidence was measured. (COMP-08, 09, 11)

Behavior baselines

• Behavior baselines are quieter and sturdier. Data volume is judged against the same hour of the day too, so nightly backups and weekly syncs no longer add risk. A check whose search fails waits on its own while the others go on, a reset check learns the stored history again instead of starting from nothing, programs and kinds of change keep up to 2,000 values per user or host, and an hour's search reads up to 250,000 rows. See Behavior baselines. (UEBA-01, 02, 03, 06, 07, 08)
• An admin can forget one value for one user or host, such as a country learned while an account was misused, with Forget it on the risk event, without resetting the check for everyone. A new or long-unused account's first sign-in from the internet now adds half the new-country risk instead of waiting out the learning period. (UEBA-04, 05)

Shared detections

• With detections.sync: mirror, a server whose detections or dashboards folder is found empty (or that would remove many shared files of one kind at once) no longer deletes the shared library on every server: it removes nothing of that kind, writes the files back, and says so in its log, the audit log and the Servers page. This guards against accidents, not against removals made a few files at a time. To allow one such removal, put a file named allow-mass-delete in that folder and remove the files within the hour. See Servers. (CTL-04)

Syslog

• Syslog batches OpenSearch refuses for now (down, too busy, write block, 5xx, timeout) wait in a spool on the server's disk (syslog-spool in the state folder, 1 GB by default, syslog.spool_mb) and are written again, oldest first, once it takes writes, also after a restart. When the spool is full the oldest batches are dropped and counted; the Health page shows the spool and warns when it dropped events or is over half full. See When OpenSearch is down. (SS-03)
• Syslog over TLS (port 6514) no longer sends TLS session tickets. A TLS 1.3 sender that never read them reset the connection when it closed, and lines it had not yet sent were lost. Syslog senders do not resume sessions, so nothing else changes.

Servers

• The OpenSearch card on the Servers page shows the shards in use against cluster.max_shards_per_node, and warns when OpenSearch holds, or at today's data models and retention will hold, 80% of the shards it allows, on one node too. When OpenSearch refuses a new day's index for lack of shards, the server log says so and senders are asked to send the events again instead of losing them. See Server settings. (SS-02)
• A server that just restarted no longer signs people out when it cannot read their session from OpenSearch for a moment: it tries again briefly, then answers 503 with Retry-After, and the page stays signed in. Signed-out, changed and ended sessions are refused as before. See Users.
• On the Servers page, a rule that ran late on one server no longer makes the server it moved to look like it is falling behind.

Security fixes

• OpenTelemetry Collectors that send a batch again (after a 503, or an answer they never got) no longer store its log records twice: each record gets a document ID from the request, as agent and HEC batches do.
• Log records OpenSearch can only take later (it is too busy, or its disk is full) are now answered over OTLP with 503 and Retry-After, so the Collector sends them again instead of dropping them as a partial success.
• Syslog and auth.log lines, and CEF and LEEF records, whose time has no zone (RFC 3164's Oct 11 09:15:02) are no longer read in the server's time zone, which filed events from hosts in other zones hours off. They take the collector's time (Fluent Bit's date, the OpenTelemetry or HEC time, or when Signalith received them), and the time the host wrote is kept in device_clock. A time with a zone name Signalith doesn't know is no longer read as UTC or as the server's time. See Ingest limits.
• The Security page's HTTPS check no longer says Good when a reverse proxy, even one on the same computer, takes sign-ins or agent events over plain HTTP: requests the proxy marks X-Forwarded-Proto: http are now counted, under the client's address.
• With HTTPS off and the web page on 127.0.0.1, the HTTPS check now also looks at the agent address: an agent port other computers can reach over plain HTTP needs attention, and is at risk once agents send to it.
• Signalith now recognizes that it runs in a container in Kubernetes pods too (the Helm chart sets SIGNALITH_CONTAINER=1), so the Security page checks the pod's protections instead of asking for a systemd service, and the report names the deployment correctly.
• Triage of findings, investigation cases, detections and their exceptions are now written to the audit log, with what changed from and to, so the signed audit log shows who closed, suppressed or changed what. See Audit.
• Threat intel changes (indicators added, deleted or uploaded, and feeds added, changed, deleted, tested or refreshed) are now written to the audit log, with a feed's address logged without its key.
• A manual or uploaded threat intel indicator can no longer be a network broader than /8 (IPv4) or /16 (IPv6), such as 0.0.0.0/0, which would have matched nearly every event. Feeds already skipped these.
• Investigate with AI now guards the masked values themselves, not only the masked fields: when the model asks for a search with a value, wildcard pattern or free-text word that could match a masked value under any field name, the investigation stops without telling the model, so it can no longer probe a masked user name through another field such as TargetUserName. Regular expressions are no longer allowed in its searches, where may only compare a field with a value as written, not with another field, < and > work only on _time and on counts made by stats or top, and values may use only ASCII characters while some are masked. See Investigate with AI.
• Threat intel feed addresses in logs and on the page for non-admins no longer keep a fragment (#...), which could hold a key.
• An error answer from the AI model's service is shown only when it is the service's own JSON error message; other text in its place is logged instead.
• An error on the server no longer shows its underlying cause, such as OpenSearch's address or a file path, to whoever made the request. The page says that something went wrong, with a short reference that an admin can find, with the details, in the server log.
• One account can no longer sign everyone else out. Each user keeps at most 50 sign-in sessions; a 51st ends that user's oldest, never another user's. Before, enough sign-ins by one account on a single server pushed out the sessions of every other user, admins included.
• Windows: Signalith's own account no longer has access to OpenSearch's folder. C:\ProgramData\SignalithOpenSearch, which holds the CA key and the admin certificate, gave NT SERVICE\Signalith full control. It is now SYSTEM and Administrators only (OpenSearch's own account keeps its settings, data and logs). Running the 0.3.2 installer fixes an existing install.
• The NVD API key stays on its server. It no longer follows a redirect to another server, and the NVD, KEV and EPSS downloads now go through the same checks as threat intel feeds, so they never reach this machine, Signalith's OpenSearch or a cloud metadata service. An NVD mirror on this machine needs intel.allow_loopback_feeds, as feeds do.
• Approving a server means typing its fingerprint. The Servers page and signalith cluster approve <name> at a terminal ask for the fingerprint the new server shows on its sign-in page or in its log, instead of a checkbox or a yes next to the fingerprint OpenSearch holds, which anyone who can write to OpenSearch could have made. Lists of waiting servers show only the first group of each fingerprint.
• The audit integrity check catches deleted audit indices. With every audit index, or every record in them, deleted, Check integrity and signalith audit verify reported a clean result. They now report the records removed when servers sign their records, also when other records were put in their place.
• signalith tls import works again after reset-key. A server rebuilt with a new key can import the cluster's certificate authority again instead of having to set the cluster up from scratch. (CTL-02)
• Leaked signing keys can be revoked. A new offline root key signs revocation lists. Servers download the list with the content bundle, remove a content update signed with a revoked key, refuse revoked agent updates and hand the list to agents. See Key management.
• Exceptions made from a finding match its values exactly: a logged value such as a user named * no longer becomes a wildcard that silences every result with that field. (DQ-09)
• Built with Go 1.26.10, which fixes a standard library crypto/x509 vulnerability reachable from certificate loading.

Install

System	Download
Debian, Ubuntu	signalith_0.3.2-1_amd64.deb or _arm64.deb, then sudo apt install ./signalith_0.3.2-1_amd64.deb
Red Hat, Rocky, Alma, Fedora, SUSE	signalith-0.3.2-1.x86_64.rpm or .aarch64.rpm, then sudo dnf install ./signalith-0.3.2-1.x86_64.rpm
Windows	signalith-0.3.2-x64.msi, double-click it
Docker	signalith-0.3.2-docker.tar.gz, the quick start locked to this release's image: unpack it, then docker compose -f deploy/docker/docker-compose.yml up -d in its folder; see The quick start locked to a release. The image alone: docker pull ghcr.io/jrsamsanchez/signalith:0.3.2
Kubernetes	helm install signalith oci://ghcr.io/jrsamsanchez/charts/signalith --version 0.3.2 -n signalith --create-namespace; see Kubernetes

Then sudo signalith initial-password (on Windows, signalith initial-password in PowerShell as Administrator) shows the first admin password. Signalith needs OpenSearch 2.x or 3.x; see Install from packages.

Adding a server to a cluster? Use Add a server on the Servers page: it gives one line to run on the new computer. install.sh and signalith-0.3.2-windows-amd64.zip (the program and install.ps1) are the same install scripts, for automation; see Adding servers.

Already using Signalith's apt or dnf repository? sudo apt upgrade or sudo dnf upgrade installs this release.

Check your download

gh attestation verify <file> --repo jrsamsanchez/Signalith

or check SHA256SUMS against SHA256SUMS.sigstore.json (Sigstore), as the docs show. See the code signing policy.
SHA256SUMS.asc is a GPG signature of the same file, made with the key in signalith-release-key.asc.

The SBOM is in signalith-0.3.2.spdx.json (SPDX) and signalith-0.3.2.cdx.json (CycloneDX).

What's Changed

• Agent: cap Fluent Bit's buffer, stop on a refused token, check updates reach Signalith by @jrsamsanchez in #458
• Docs: truth pass, buyer pages, and a two-screen README by @jrsamsanchez in #455
• Notifications keep the rule author's credit (GP-05) by @jrsamsanchez in #471
• Check /readyz for syslog in the load balancer samples by @jrsamsanchez in #454
• Honest CI: checks that test what they claim, alerts on red main by @jrsamsanchez in #472
• Load generator: replay real recorded Windows events, and a 7-day soak by @jrsamsanchez in #460
• where: a bare name on the right compares with that field (SL-02) by @jrsamsanchez in #461
• Windows: download OpenSearch through the computer's proxy, and check disk room first (WIN-03) by @jrsamsanchez in #475
• Integration: the spread upgrade test accepts a previous release that spreads by @jrsamsanchez in #481
• Security fixes: OTLP duplicates and retries, zoneless syslog times, HTTPS check, Kubernetes detection by @jrsamsanchez in #469
• Analyst workflow: queue views, due times, dispositions, proposed exceptions by @jrsamsanchez in #457
• Website and docs: 0.3.1 is out by @jrsamsanchez in #476
• Build with Go 1.26.10 for the crypto/x509 fix by @jrsamsanchez in #487
• Agent: memory and CPU limits, osquery curl tables off, live queries ask for the password by @jrsamsanchez in #474
• Security fixes: audit triage, cases and intel; indicator check; AI masking; server error bodies by @jrsamsanchez in #468
• Sensor installer: ask before taking over a running Fluent Bit or Suricata (DEP-05) by @jrsamsanchez in #486
• MSI test: sign in as signalithadmin, the admin 0.3.1 makes by @jrsamsanchez in #492
• Search: results that match Splunk's, a results corpus, and a compatibility page (SL-01, SL-03 to SL-13, SL-16, SL-21) by @jrsamsanchez in #483
• Show compliance evidence only for what Signalith observed by @jrsamsanchez in #450
• Docker quick start runs the newest release instead of main by @jrsamsanchez in #453
• Website: the Windows installer sets up OpenSearch by @jrsamsanchez in #443
• Revoke leaked signing keys with a root-signed list by @jrsamsanchez in #466
• Security fixes: per-user sessions, OpenSearch folder rights, NVD key, join approval, audit check by @jrsamsanchez in #462
• deb test: sign in as signalithadmin, the admin 0.3.1 makes by @jrsamsanchez in #494
• Compliance catalog re-read and baselines fixes (COMP-03, COMP-10, UEBA-01/02/03/06/07/08) by @jrsamsanchez in #495
• Warn before OpenSearch runs out of shards, on any number of nodes by @jrsamsanchez in #459
• Refuse a mirror sync that would empty the shared library by @jrsamsanchez in #464
• Keep people signed in when a session can't be read for a moment; fair late-run health per server by @jrsamsanchez in #489
• Syslog TLS: don't lose lines when a sender closes right after sending by @jrsamsanchez in #490
• Exceptions for many detections at once: all, a pack or a tag (DQ-09) by @jrsamsanchez in #473
• First hour: true first-password check, Enter runs search, mimikatz finds mimikatz.exe, Splunk severities by @jrsamsanchez in #463
• Windows: undo a failed install or upgrade (WIN-02) by @jrsamsanchez in #485
• Replace the cluster's certificate authority, and import it after a key reset by @jrsamsanchez in #497
• Syslog: spool batches OpenSearch refuses for now, and replay them by @jrsamsanchez in #467
• Compliance coverage per computer, and forgetting one baseline value (COMP-08/09/11, UEBA-04/05) by @jrsamsanchez in #500
• SigmaHQ pack: account for every upstream rule, add antivirus rules (DQ-06) by @jrsamsanchez in #501
• Release notes for 0.3.2: replace the cluster CA, tls import after reset-key by @jrsamsanchez in #504
• Detections: a starter set as the first click, rules marked by the logging they need, process auditing on Windows by @jrsamsanchez in #502
• Content workflow: sign only pack changes merged to main (SSD-05) by @jrsamsanchez in #505
• Query: fix three parse round trips the fuzzer found by @jrsamsanchez in #506
• First hour: honest setup guide and Health, faster sample load, user mode exploit protection log by @jrsamsanchez in #507
• Job lease: a late renewal never revives a lease that ran out by @jrsamsanchez in #499
• Sensor CI: tell shellcheck the uninstall output belongs to the CI user by @jrsamsanchez in #508
• Windows agent: turn on the logs detections need from the install line (-EnableLogs) by @jrsamsanchez in #509
• Windows: installer and zip carry the agent programs; install lines work in PowerShell 5.1 by @jrsamsanchez in #512
• Release notes for 0.3.2: findings queue, exceptions, key revocation, multi-server fixes by @jrsamsanchez in #513

Full Changelog: v0.3.1...v0.3.2