4.4.0

[atomicturtle]

OSSEC changelog (4.4.0) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

• @atomicturtle
• @ddpbsd
• @bearxy123
• @AdUser

Release Notes

OSSEC 4.4.0 adds three main capabilities; other enhancements and fixes are listed below.

• Windows FIM attributes and ACLs — Opt-in check_attrs for Hidden/System/attribute change alerts and check_acl for NTFS DACL/ACE matrix alerts (How to monitor Windows hidden files? #1352, Add opt-in Windows FIM **check_acl** / CHECK_ACL so agents can detect NTFS DACL/ACE changes and raise integrity alerts with human-readable permission detail. #2285).
• GeoIP via libmaxminddb — Replaces EOL GeoIP Legacy with GeoLite2 MMDB lookups, plus ASN/country enrichment and GeoIP IDS rules (Replace geoip database support with maxminddb #1828, Replace EOL GeoIP Legacy with libmaxminddb for analysisd. #2259).
• JSON syslog alerts — ossec-csyslogd forwards analysisd JSON alerts so agent_name is a first-class field. jsonout stays on when the XML tag is omitted; alerts rotation remains with monitord (Feature request - hostname in syslog output #1907, Forward analysisd JSON alerts over syslog #2302).

General

• @atomicturtle - Add opt-in Windows FIM check_attrs for Hidden/System/attribute change alerts (How to monitor Windows hidden files? #1352)
• @atomicturtle - Add opt-in Windows FIM check_acl for NTFS DACL/ACE matrix alerts
• @ddpbsd / @atomicturtle - PR 1828 - Replace EOL GeoIP Legacy with libmaxminddb (GeoLite2 MMDB) for analysisd GeoIP
• @atomicturtle - GeoIP IDS rules (multi-country auth, impossible-travel) plus ASN/country enrichment; SSH invalid-user dstuser extraction; feed if_matched_group when sid_prev_matched is also set
• @atomicturtle - PR 2302 - Forward analysisd JSON alerts over syslog so agent_name is a first-class field; keep jsonout on when undeclared

Bug Fixes

• @AdUser / @atomicturtle - PR 2106 - Stop Dovecot lip= from capturing a trailing comma as dstip
• @bearxy123 / @atomicturtle - PR 2107 - Check cdb mmap failure with MAP_FAILED instead of DJB x+1 idiom
• @atomicturtle - PR 2303 - Stop remoted from writing the sender counter into agent 0 rids on key reload (An existing agent may get disconnected, when a new agent is added #2065)
• @atomicturtle - PR 2304 - Stop remoted from mapping a v4 local_ip onto a dual-stack IPv6 socket (ossec-remoted not listening IPv4 #1611)
• @atomicturtle - PR 2308 - Use a four-part win32ui manifest version so the Windows agent UI can start (Windows OSSEC Agent: win32ui.exe fails to start due to invalid assemblyIdentity version "1.5" #2307)

---

This discussion was created from the release 4.4.0.