Skip to content

v0.30.1

Choose a tag to compare

View all tags
@justwaters justwaters released this 11 Nov 07:43
· 10 commits to main since this release
v0.30.1
a5c93c4

Install or update

docker compose pull && docker compose up -d

Or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:v0.30.1 in .env.

Fixed

  • A custom JSON parser no longer does unbounded work on a hostile log line. Very large, wide or deeply nested lines are limited, and the same fields are kept on every run (before, which 50 fields were kept changed from run to run).
  • A line with many extra keys can no longer push the fields a parser maps (user, source address, severity, app) out of the event. A line that lost fields is marked fields_truncated.
  • When a line carries several names for the same field (user, username, account), the real name now wins on every line instead of whichever happened to be applied last. The same holds for the app name.
Assets 9
Loading