Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update 4.3 changelog with latest ruleset changes #11827

Merged
merged 7 commits into from
Jan 20, 2022
Merged

Update 4.3 changelog with latest ruleset changes #11827

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0f2aa9e
Added Ruleset Changelog
72nomada Jan 17, 2022
0bff216
Update Changelog spacing issue.
72nomada Jan 17, 2022
c074be2
Updated changelog missing prs links
72nomada Jan 17, 2022
8a6e090
Solved spacing issues on ruleset changelog
72nomada Jan 17, 2022
3afb8b3
Update CHANGELOG.md
davidjiglesias Jan 20, 2022
43faa33
Update CHANGELOG.md
davidjiglesias Jan 20, 2022
60595c4
Update CHANGELOG.md
davidjiglesias Jan 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 54 additions & 15 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,27 +279,66 @@ All notable changes to this project will be documented in this file.

#### Added

- Added Rules and Decoders for Wazuh API. ([#10428](https://github.com/wazuh/wazuh/pull/10428))
- Added Rules and Decoders for TrendMicro Cloud One. ([#10458](https://github.com/wazuh/wazuh/pull/10458))
- Added Rules for Sophos UTM Firewall. ([#10496](https://github.com/wazuh/wazuh/pull/10496))
- Added SCA policy for Solaris 11.4. ([#10369](https://github.com/wazuh/wazuh/pull/10369))
- Added Rules for Cloudflare WAF. ([#10658](https://github.com/wazuh/wazuh/pull/10658))
- Added Rules and Decoders for FortiAuth. ([#10667](https://github.com/wazuh/wazuh/pull/10667))
- Added Carbanak detection rules. ([#11306](https://github.com/wazuh/wazuh/pull/11306))
- Added Cisco FTD rules and decoders. ([#11309](https://github.com/wazuh/wazuh/pull/11309))
- Added decoders for AWS EKS service. ([#11284](https://github.com/wazuh/wazuh/pull/11284))
- Added F5 BIG IP ruleset. ([#11394](https://github.com/wazuh/wazuh/pull/11394))
- Added GCP VPC Storage, Firewall and Flow rules. ([#11191](https://github.com/wazuh/wazuh/pull/11191))
- Added Gitlab v12 ruleset. ([#11323](https://github.com/wazuh/wazuh/pull/11323))
- Added Microsoft Exchange Server rules and decoders. ([#11289](https://github.com/wazuh/wazuh/pull/11289))
- Added Microsoft Windows persistence by using registry keys detection. ([#11390](https://github.com/wazuh/wazuh/pull/11390))
- Added Oracle Database 12c rules and decoders. ([#11274](https://github.com/wazuh/wazuh/pull/11274))
- Added rules for Carbanak step 1.A - User Execution: Malicious File. ([#8476](https://github.com/wazuh/wazuh/pull/8476))
- Added rules for Carbanak step 2.A - Local Discovery. ([#11212](https://github.com/wazuh/wazuh/pull/11212))
- Added rules for Carbanak step 2.B - Screen Capture. ([#9075](https://github.com/wazuh/wazuh/pull/9075))
- Added rules for Carbanak step 5.B - Lateral Movement via SSH. ([#9097](https://github.com/wazuh/wazuh/pull/9097))
- Added rules for Carbanak step 9.A - User Monitoring. ([#11342](https://github.com/wazuh/wazuh/pull/11342))
- Added rules for Cloudflare WAF. ([#11373](https://github.com/wazuh/wazuh/pull/11373))
- Added ruleset for ESET Remote console. ([#11013](https://github.com/wazuh/wazuh/pull/11013))
- Added ruleset for GITHUB audit logs. ([#8532](https://github.com/wazuh/wazuh/pull/8532))
- Added ruleset for Palo Alto v8.X - v10.X. ([#11137](https://github.com/wazuh/wazuh/pull/11137))
- Added SCA policy for Amazon Linux 1. ([#11431](https://github.com/wazuh/wazuh/pull/11431))
- Added SCA policy for Amazon Linux 2. ([#11480](https://github.com/wazuh/wazuh/pull/11480))
- Added SCA policy for apple macOS 10.14 Mojave. ([#7035](https://github.com/wazuh/wazuh/pull/7035))
- Added SCA policy for apple macOS 10.15 Catalina. ([#7036](https://github.com/wazuh/wazuh/pull/7036))
- Added SCA policy for macOS Big Sur. ([#11454](https://github.com/wazuh/wazuh/pull/11454))
- Added SCA policy for Microsoft IIS 10. ([#11250](https://github.com/wazuh/wazuh/pull/11250))
- Added SCA policy for Microsoft SQL 2016. ([#11249](https://github.com/wazuh/wazuh/pull/11249))
- Added SCA policy for Mongo Database 3.6. ([#11247](https://github.com/wazuh/wazuh/pull/11247))
- Added SCA policy for NGINX. ([#11248](https://github.com/wazuh/wazuh/pull/11248))
- Added SCA policy for Oracle Database 19c. ([#11245](https://github.com/wazuh/wazuh/pull/11245))
- Added SCA policy for PostgreSQL 13. ([#11154](https://github.com/wazuh/wazuh/pull/11154))
- Added SCA policy for SUSE Linux Enterprise Server 15. ([#11223](https://github.com/wazuh/wazuh/pull/11223))
- Added SCA policy for Ubuntu 14. ([#11432](https://github.com/wazuh/wazuh/pull/11432))
- Added SCA policy for Ubuntu 16. ([#11452](https://github.com/wazuh/wazuh/pull/11452))
- Added SCA policy for Ubuntu 18. ([#11453](https://github.com/wazuh/wazuh/pull/11453))
- Added SCA policy for Ubuntu 20. ([#11430](https://github.com/wazuh/wazuh/pull/11430))
- Added SCA policy for. Solaris 11.4. ([#11286](https://github.com/wazuh/wazuh/pull/11286))
- Added Sophos UTM Firewall ruleset. ([#11122](https://github.com/wazuh/wazuh/pull/11122))
- Added Wazuh-api ruleset. ([#11357](https://github.com/wazuh/wazuh/pull/11357))

#### Changed

- Updated Amazon Linux 2 SCA up to version 2.0.0. ([#10315](https://github.com/wazuh/wazuh/pull/10315))
- Updated RedHat Enterprise Linux 8 SCA up to version 1.0.1. ([#10354](https://github.com/wazuh/wazuh/pull/10354))
- Updated Amazon rules to add more granularity. ([#10507](https://github.com/wazuh/wazuh/pull/10507))
- Updated macOS Big Sur SCA up to 1.2.0 version. ([#10558](https://github.com/wazuh/wazuh/pull/10558))
- Updated audit rules. ([#11016](https://github.com/wazuh/wazuh/pull/11016))
- Updated AWS s3 ruleset. ([#11177](https://github.com/wazuh/wazuh/pull/11177))
- Updated Exim 4 decoder and rules to latest format. ([#11344](https://github.com/wazuh/wazuh/pull/11344))
- Updated MITRE DB with latest MITRE JSON specification. ([#8738](https://github.com/wazuh/wazuh/pull/8738))
- Updated multiple rules to remove alert_by_email option. ([#11255](https://github.com/wazuh/wazuh/pull/11255))
- Updated NextCloud ruleset. ([#11795](https://github.com/wazuh/wazuh/pull/11795))
- Updated ProFTPD decoder. ([#11232](https://github.com/wazuh/wazuh/pull/11232))
- Updated RedHat Enterprise Linux 8 SCA up to version 1.0.1. ([#11242](https://github.com/wazuh/wazuh/pull/11242))
- Updated rules and decoders for FortiNet products. ([#11100](https://github.com/wazuh/wazuh/pull/11100))
- Updated SCA policy for CentOS 7. ([#11429](https://github.com/wazuh/wazuh/pull/11429))
- Updated SCA policy for CentOS 8. ([#8751](https://github.com/wazuh/wazuh/pull/8751))
- Updated SonicWall rules decoder. ([#11263](https://github.com/wazuh/wazuh/pull/11263))
- Updated SSHD ruleset. ([#11388](https://github.com/wazuh/wazuh/pull/11388))

#### Fixed

- Fixed enabled-like checks for Amazon Linux 2 SCA. ([#10315](https://github.com/wazuh/wazuh/pull/10315))
- Fixed enabled-like checks for RedHat Enterprise Linux 8 SCA. ([#10354](https://github.com/wazuh/wazuh/pull/10354))
- Fixed typos and not working tests for Centos 7 SCA. Thanks to RonnyMaas (@RonnyMaas). ([#10406](https://github.com/wazuh/wazuh/pull/10406))
- Fixed YML syntax problems in Solaris 11.4 SCA. ([#10707](https://github.com/wazuh/wazuh/pull/10707))
- Fixed a typo in the Xbox Live Networking Service check for SCA. ([#10375](https://github.com/wazuh/wazuh/pull/10375))
- Fixed bad character on rules 60908 and 60884 - win-application rules. ([#11117](https://github.com/wazuh/wazuh/pull/11117))
- Fixed Microsoft logs rules. ([#11369](https://github.com/wazuh/wazuh/pull/11369))
- Fixed PHP rules for MITRE and groups. ([#11405](https://github.com/wazuh/wazuh/pull/11405))
- Fixed rules id for Microsoft Windows Powershell. ([#11214](https://github.com/wazuh/wazuh/pull/11214))

### Other

Expand Down