Skip to content

v0.27

Choose a tag to compare

View all tags
@Justin-Waters Justin-Waters released this 30 Oct 22:51
· 51 commits to main since this release
v0.27
af26d48

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.27 in .env.

New

  • Search the Database by field, beside the words: src_ip=192.168.48.20,192.168.48.21 (a comma means any of these), ip= (either address), dst_ip, user="Jonathan Martinez", host, program, source=Firewall, severity=high,critical, category, country, asn, threat=true, and any field a parser picked out, like action=login. Terms are separated by spaces and all apply. It works in the API and the MCP search tool too.
  • The Database loads 100 events at a time. Scroll to the end, or choose Show more events, for the next 100. The Newer and Older buttons and Results per page are gone.

Fixed

  • Searching a word also found events that merely had a field named after it (such as failed in a log's meta.failed). The search now indexes the values of those fields, not their names.
  • A user limited to some sources can't use source= to find out which other sources exist.

Improved

  • The first start after updating rebuilds each day's search index, which can take a while on a large database.
Assets 9
Loading