Version 2.3.4

• Upgrade osquery to SHA a338c86170947344ddd23e80e4e3f636ff8eb5ab (Just after osquery 3.2.5)
• Windows packaging fixes
• Misc fixes to misc.py
• Better win_firewall dependency detection

Version 2.3.3

Fixes since 2.3.3

• Fix for fallback_fileserver_backend
• Fix for pulsar TOP_STALENESS
• Windows packaging fixes
• Error handling around raising inotify max user watches
• Fix post-upgrade script for cent7 packages

2.3.x release notes:

Major fixes:

• FIM security improvements around hardlinks (should be enabled only on the most critical directories, as it requires a separate inotify watch for each file -- default behavior only watches the directories, but that allows for missed changes via hardlinks)
• Fix for multiple hubble processes issues (kills previous process if found when hubble -d is started)
• Fix for wrong systemd run-level, causing hubble to sometimes come up before the network and stop reporting.
• Automatically remove stale gitfs lockfiles in case of an ill-timed kill -9 or restart
• Better retry for fileserver updates, especially on startup
• Automatically increase max watches in for inotify to keep FIM running smoothly
• Add a couple of new grains (local_ip and fixes to local_fqdn to try to be more consistent in our fqdn and ip reporting, especially when round robin DNS is in play)
• Fixes for underlying salt v2018.3.0

Major features:

• Azure blob storage support
• S3 bucket support
• Moving user config to separate files (/etc/hubble/hubble.d/*.conf) to aid in config verification and updates
• New pulsar module for windows based on NTFS journaling which improves performance
• Ability to fallback on local fileserver sources in case of no default gateway to reach public storage (such as S3)
• Ability to collect the contents of changed files in FIM. (very narrow scope to prevent accidentally harvesting secrets)
• Timing information for osquery queries so we can catch performance issues earlier
• New splunk log level so we can log more information to splunk, as well as all error and warning logs, for easier debugging
• Periodic grains refresh so hubble will pick up on hostname changes automatically. Logs the new grains to splunk if splunklogging is configured.
• New version of osquery with bugfixes and more features
• Added git into the package builds, so that our packages have no requirements

Version 2.3.2

Major fixes:

• FIM security improvements around hardlinks (should be enabled only on the most critical directories, as it requires a separate inotify watch for each file -- default behavior only watches the directories, but that allows for missed changes via hardlinks)
• Fix for multiple hubble processes issues (kills previous process if found when hubble -d is started)
• Fix for wrong systemd run-level, causing hubble to sometimes come up before the network and stop reporting.
• Automatically remove stale gitfs lockfiles in case of an ill-timed kill -9 or restart
• Better retry for fileserver updates, especially on startup
• Automatically increase max watches in for inotify to keep FIM running smoothly
• Add a couple of new grains (local_ip and fixes to local_fqdn to try to be more consistent in our fqdn and ip reporting, especially when round robin DNS is in play)
• Fixes for underlying salt v2018.3.0

Major features:

• Azure blob storage support
• S3 bucket support
• Moving user config to separate files (/etc/hubble/hubble.d/*.conf) to aid in config verification and updates
• New pulsar module for windows based on NTFS journaling which improves performance
• Ability to fallback on local fileserver sources in case of no default gateway to reach public storage (such as S3)
• Ability to collect the contents of changed files in FIM. (very narrow scope to prevent accidentally harvesting secrets)
• Timing information for osquery queries so we can catch performance issues earlier
• New splunk log level so we can log more information to splunk, as well as all error and warning logs, for easier debugging
• Periodic grains refresh so hubble will pick up on hostname changes automatically. Logs the new grains to splunk if splunklogging is configured.
• New version of osquery with bugfixes and more features
• Added git into the package builds, so that our packages have no requirements

Version 2.3.0

Preliminary release notes (will be updated when this becomes an official release)

Major fixes:

• FIM security improvements around hardlinks (should be enabled only on the most critical directories, as it requires a separate inotify watch for each file -- default behavior only watches the directories, but that allows for missed changes via hardlinks)
• Fix for multiple hubble processes issues (kills previous process if found when hubble -d is started)
• Fix for wrong systemd run-level, causing hubble to sometimes come up before the network and stop reporting.
• Automatically remove stale gitfs lockfiles in case of an ill-timed kill -9 or restart
• Better retry for fileserver updates, especially on startup
• Automatically increase max watches in for inotify to keep FIM running smoothly

Major features:

• Azure blob storage support
• S3 bucket support
• Moving user config to separate files (/etc/hubble/hubble.d/*.conf) to aid in config verification and updates
• New pulsar module for windows based on NTFS journaling which improves performance
• Ability to fallback on local fileserver sources in case of no default gateway to reach public storage (such as S3)
• Ability to collect the contents of changed files in FIM. (very narrow scope to prevent accidentally harvesting secrets)
• Timing information for osquery queries so we can catch performance issues earlier
• New splunk log level so we can log more information to splunk, as well as all error and warning logs, for easier debugging
• Periodic grains refresh so hubble will pick up on hostname changes automatically. Logs the new grains to splunk if splunklogging is configured.
• New version of osquery with bugfixes and more features

Version 2.2.11.2

2.2.11.1 + win_pulsar_winaudit fixes

Version 2.2.11.1

Identical to the 2.2.11 release, but with azure SDK and splunklogging fixes.

Version 2.2.8.1

This release is identical to 2.2.8 but with the addition of this patch: #273

Version 2.2.11

This is an unofficial release.

Please use 2.2.8 until 2.3.0 is out.

Thanks!

Version 2.2.10

This is an unofficial release.

Please use 2.2.8 until 2.3.0 is out.

Thanks!

Version 2.2.9

This is an unofficial release.

Please use 2.2.8 until 2.3.0 is out.

Thanks!