v0.28.1

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.28.1 in .env.

Fixed

• Managing an alert (acknowledging, closing or reopening it) raised new alerts. Each of those actions is written to the audit log with a message that names the alert, and the built-in rule "Mass ingestion of late logs" matched that name, so one real late-logs event led to alert 2, then 3, with every close raising the next.
• No rule, built in or custom, now counts SIEMLite's own audit events about alerts (alert.* actions from the INTERNAL source), however its search is worded. The same holds for a "more than" rule on the INTERNAL source. An outside log whose action starts with alert. still counts.
• The two built-in rules that read the audit log match what the event is, not words in its message: "Mass ingestion of late logs" is action=ingest.late and "Failed sign-ins to SIEMLite" is action=signin.failed. An alert rule's search takes the same field terms as the Database search box (action=..., src_ip=a,b, source=...). On update, those two rules are re-worded only if they are still as shipped; edited and custom rules are left alone.

Improved

• On the first start after updating, the alerts of "Mass ingestion of late logs" that the audit events had raised or inflated are corrected once: an alert with no event of its own is closed (by SIEMLite) and an inflated count is lowered. It is noted in the audit log.
• Database schema v18.