v1.0.2

Fixed

• Oracle Linux hosts (os-release ID ol) are now matched against Red Hat advisories; previously they received no OS vulnerabilities, and cleanup would have removed such links
• Oracle Linux package releases with an inserted .0.N segment are compared as their RHEL equivalents, so outdated packages are no longer reported as patched
• The agent sets the immutable attribute through the kernel interface instead of running chattr, so it no longer triggers its own "file attribute lock" detection rule; symlinks, hard links and special files under protected directories are skipped
• The dependency vulnerability check fails when govulncheck does not complete, instead of passing silently

v1.0.1

Changed

• Release images are built for both linux/amd64 and linux/arm64
• Build and release tooling is pinned to fixed versions

Fixed

• When deploy.sh runs as root, config/server.yaml is restricted to the service user (0640)

v1.0.0

Added

• Security baseline: 30 policies, 614 rules covering CIS Benchmark, MLPS 2.0 and middleware checks
• Asset center: processes, ports, users, packages, containers and more
• Vulnerability management: PURL collection + OSV.dev matching + CVSS v3.1 scoring + SBOM export
• Antivirus: ClamAV + YARA-X dual-engine scanning with quarantine
• File integrity monitoring: AIDE-based FIM with policy, event, and task management
• Runtime detection: Tetragon/eBPF event collection + CEL rule engine + MITRE ATT&CK mapping
• Container security: K8s cluster management, container CIS baseline
• Alert center: aggregation, whitelisting, auto-response, tracing timeline
• Threat intelligence: MISP IOC import + Redis cache + CEL real-time matching
• Embedded detection rules with builtin tagging system
• Plugins are delivered per host architecture: one platform can manage amd64 and arm64 hosts at the same time
• Single-node quick start: ./deploy.sh quickstart generates all secrets and certificates and starts the stack

Known issues

• With a non-default HTTPS_PORT, the HTTP-to-HTTPS redirect drops the port.
• Vulnerability matching for Rocky Linux only covers advisories published after the first start.
• The agent's self-protection raises a "file attribute lock" alert on the host it is installed on.