Skip to content

Commit af7d0f3

Browse files
Merge pull request #46 from NextronSystems/v4
chore: add 4.2.0 changelog and update screenshot
2 parents 29bb00e + 2e89b1a commit af7d0f3

File tree

6 files changed

+182
-92
lines changed

6 files changed

+182
-92
lines changed

administration/api.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ API
44
---
55

66
The API documentation has been integrated into the web interface.
7-
You can find it in the ``Documentation`` menu.
7+
You can find it in the top right corner's help menu.
88

99
.. figure:: ../images/cockpit_api_documentation.png
1010
:alt: API Documentation

changelog/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,6 @@ Cockpit version 4.
1010
.. toctree::
1111
:caption: Contents
1212

13+
log2
1314
log1
1415
log0

changelog/log0.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.. Index:: AC4 Changes
1+
.. Index:: 4.0 Changes
22

33
Analysis Cockpit v4.0
44
---------------------

changelog/log1.rst

Lines changed: 106 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,24 @@
1-
.. Index:: AC4 Changes
1+
.. Index:: 4.1 Changes
22

33
Analysis Cockpit v4.1
44
---------------------
55

6+
Analysis Cockpit 4.1.9
7+
######################
8+
9+
Release Date: Thu, 4 Jul 2024 15:17:00 +0200
10+
11+
.. list-table::
12+
:header-rows: 1
13+
:widths: 15, 85
14+
15+
* - Type
16+
- Description
17+
* - Breaking Changes
18+
- If you are upgrading from a version older than 4.1.5, please read the release notes of 4.1.5 carefully.
19+
* - Bugfixes
20+
- Fixed grouping criteria issues when applying suggested cases
21+
622
Analysis Cockpit 4.1.8
723
######################
824

@@ -15,23 +31,23 @@ Release Date: Tue, 2 Jul 2024 11:02:00 +0200
1531
* - Type
1632
- Description
1733
* - Security
18-
- OS Security Fix (AC-577)
34+
- OS Security Fix
1935
* - Bugfix
20-
- Fixed missing grouping criteria when applying suggested cases (AC-556)
36+
- Fixed missing grouping criteria when applying suggested cases
2137
* - Bugfix
22-
- Fixed too many events in LogWatcher's 'All Events' section (AC-561)
38+
- Fixed too many events in LogWatcher's 'All Events' section
2339
* - Bugfix
24-
- Fixed an escape issue in conditions with double backslashes (AC-564)
40+
- Fixed an escape issue in conditions with double backslashes
2541
* - Bugfix
26-
- Fixed inaccurate estimated remaining time for reindexing (AC-566)
42+
- Fixed inaccurate estimated remaining time for reindexing
2743
* - Bugfix
28-
- Fixed an off-by-one date error in the incoming events graph (AC-567)
44+
- Fixed an off-by-one date error in the incoming events graph
2945
* - Bugfix
30-
- Fixed non-working table search for some columns in the 'Manage Dashboards' section (AC-570)
46+
- Fixed non-working table search for some columns in the 'Manage Dashboards' section
3147
* - Bugfix
32-
- Fixed 'csrf error' popup when using the 'Session expired' login dialog (AC-571)
48+
- Fixed 'csrf error' popup when using the 'Session expired' login dialog
3349
* - Bugfix
34-
- Fixed an startup error when using 'Matched Signatures' with wide date range (AC-585)
50+
- Fixed an startup error when using 'Matched Signatures' with wide date range
3551

3652
Analysis Cockpit 4.1.5
3753
######################
@@ -49,108 +65,108 @@ Release Date: Wed, 19 Jun 2024 09:41:00 +0200
4965

5066
* **Highlights**
5167

52-
- Added the ability to create custom Event Dashboards in the Baselining and All Events sections. (AC-6)
53-
- Added event insights by ChatGPT, enabling automatic analysis of THOR events with assessments and recommendations. Also, added the ability to ask ChatGPT to explain THOR events or terms within an event. (AC-89)
54-
- Introduced a new 'Matched Signatures' section showing all matched signatures chronologically. (AC-83)
55-
- Added the ability to collect files from an asset via the Management Center. (AC-10)
56-
- Implemented a Data Retention Policy for retaining events for a specified period and automatically deleting them afterwards. (AC-12, AC-175)
57-
- Added graphs and statistics to the Overview Dashboard. (AC-235, AC-299, AC-300, AC-301, AC-303, AC-309, AC-310, AC-316, AC-317)
68+
- Added the ability to create custom Event Dashboards in the Baselining and All Events sections.
69+
- Added event insights by ChatGPT, enabling automatic analysis of THOR events with assessments and recommendations. Also, added the ability to ask ChatGPT to explain THOR events or terms within an event.
70+
- Introduced a new 'Matched Signatures' section showing all matched signatures chronologically.
71+
- Added the ability to collect files from an asset via the Management Center.
72+
- Implemented a Data Retention Policy for retaining events for a specified period and automatically deleting them afterwards.
73+
- Added graphs and statistics to the Overview Dashboard.
5874

5975
----
6076

6177
* **Features**
6278

63-
- Added the ability to assign priorities to cases. (AC-84)
64-
- Introduced a new field 'compromised' to track compromised assets. (AC-69)
65-
- Added a detailed diagnostics status page showing system health and connectivity. (AC-182)
66-
- Added a Diagnostics Pack that can be downloaded and sent to Nextron Systems for support. (AC-298)
67-
- Included a base64 and hex decoder in the context menu of THOR events. (AC-18)
68-
- Added a new field 'under investigation' to track ongoing investigations in cases. (AC-79)
69-
- Added the ability to schedule reports, including the option to send them via email. (AC-229)
70-
- Added the ability to enforce 2FA or password resets for users. (AC-231)
79+
- Added the ability to assign priorities to cases.
80+
- Introduced a new field 'compromised' to track compromised assets.
81+
- Added a detailed diagnostics status page showing system health and connectivity.
82+
- Added a Diagnostics Pack that can be downloaded and sent to Nextron Systems for support.
83+
- Included a base64 and hex decoder in the context menu of THOR events.
84+
- Added a new field 'under investigation' to track ongoing investigations in cases.
85+
- Added the ability to schedule reports, including the option to send them via email.
86+
- Added the ability to enforce 2FA or password resets for users.
7187

7288
----
7389

7490
* **Improvements**
7591

76-
- New index structure for events in Elasticsearch, significantly improving performance. (AC-313)
77-
- Re-added the 'Incoming events' graph in Baselining and All Events sections. (AC-2, AC-289, AC-341)
78-
- Improved the query for compromise assessment mode. (AC-348)
79-
- Added the ability to edit case details and conditions in the 'Add to Case' dialog. (AC-28, AC-172)
80-
- Added the ability to bulk merge cases, including merging cases with different assignment types. (AC-238, AC-167)
81-
- Forwarded OS information to the Security Center now uses data from the Management Center. (AC-85)
82-
- Display which users have set up 2FA in the user management section. (AC-13)
83-
- Added a stop button for 'Auto Baselining'. (AC-14)
84-
- Enhanced bulk actions in the case table, allowing editing of tags, priorities, and more. (AC-23)
85-
- Automatically adjust heap size for Elasticsearch and MariaDB based on system memory. (AC-160)
86-
- Re-added the 'Last 30 days' filter in the event table of an asset or case. (AC-196)
87-
- Added a 'Delete' button in the table of connected Management Centers. (AC-197)
88-
- Enhanced security by preventing API endpoint leaks and using a more secure password hash algorithm. (AC-215, AC-370)
89-
- Refactored the case comments section. (AC-266)
90-
- Display additional asset information like file systems and MAC addresses. (AC-286)
91-
- Improved support for THOR 10.7, especially for case assignments using Auto Case IDs. (AC-287)
92+
- New index structure for events in Elasticsearch, significantly improving performance.
93+
- Re-added the 'Incoming events' graph in Baselining and All Events sections.
94+
- Improved the query for compromise assessment mode.
95+
- Added the ability to edit case details and conditions in the 'Add to Case' dialog.
96+
- Added the ability to bulk merge cases, including merging cases with different assignment types.
97+
- Forwarded OS information to the Security Center now uses data from the Management Center.
98+
- Display which users have set up 2FA in the user management section.
99+
- Added a stop button for 'Auto Baselining'.
100+
- Enhanced bulk actions in the case table, allowing editing of tags, priorities, and more.
101+
- Automatically adjust heap size for Elasticsearch and MariaDB based on system memory.
102+
- Re-added the 'Last 30 days' filter in the event table of an asset or case.
103+
- Added a 'Delete' button in the table of connected Management Centers.
104+
- Enhanced security by preventing API endpoint leaks and using a more secure password hash algorithm.
105+
- Refactored the case comments section.
106+
- Display additional asset information like file systems and MAC addresses.
107+
- Improved support for THOR 10.7, especially for case assignments using Auto Case IDs.
92108

93109
----
94110

95111
* **UX**
96112

97-
- Improved the error message when Elasticsearch aborts a query due to RAM issues. (AC-86)
98-
- Prevented 'raw contains' search with an empty value. (AC-1)
99-
- Enabled submitting a Lucene query with the 'Enter' key. (AC-39)
100-
- Moved submit buttons from left to right. (AC-21)
101-
- Enhanced the visibility of the right-click context menu for events. (AC-16)
102-
- Improved the 'Merge case' dialog and positioning of search bubbles in the event table. (AC-34, AC-42)
103-
- Show 'group scan' in the scan table. (AC-46, AC-47)
104-
- Reuse the last status and type of the previous guided baselining case as the default for the next one. (AC-49)
105-
- Added a description to unresolvable Auto Case IDs. (AC-51)
106-
- Improved the column preferences dialog for tables with many columns. (AC-59)
107-
- Removed links from breadcrumbs. (AC-62)
108-
- Added dark mode for API documentation. (AC-71)
109-
- Hide the Valhalla link for some YARA rules, e.g., external or custom rules. (AC-74, AC-27)
110-
- Enabled dragging and dropping condition terms in the 'Create Case' dialog. (AC-102)
111-
- Moved example events in 'Create Case' from top to bottom and made them expandable. (AC-103, AC-104)
112-
- Improved error messages for login failures due to incorrect credentials. (AC-151)
113-
- Enabled selecting asset labels and case tags from a dropdown when creating reports. (AC-228)
114-
- Enhanced cosmetics for tooltips in event charts. (AC-177)
115-
- Allowed searching for displayed text instead of numeric values in most tables. (AC-204, AC-282)
116-
- Removed zero bytes ('\x00') from THOR events in the GUI. (AC-19)
117-
- Preserved conditions when switching from guided to custom mode in the condition builder. (AC-36)
118-
- Display version number and 'up-to-date' status on the overview page. (AC-223)
119-
- Hide deleted Management Centers in the connected Management Centers table. (AC-251)
120-
- Updated menu items for the sandbox. (AC-253)
121-
- Showed actual values instead of numeric values in event charts (e.g., for case type). (AC-256)
122-
- Improved change history for cases, showing the diff of conditions. (AC-259)
123-
- Added THOR key highlighting in Guided Baselining. (AC-284)
124-
- Rearranged menu items in the settings section. (AC-307)
125-
- Enhanced cosmetics for the 'similar cases' dropdown in the 'Create Case' dialog. (AC-264)
126-
- Optionally hide all non-favorite THOR keys. (AC-319)
127-
- Moved manuals and API documentation to the navbar. (AC-339)
128-
- Highlighted searched terms in the Event table. (AC-355)
113+
- Improved the error message when Elasticsearch aborts a query due to RAM issues.
114+
- Prevented 'raw contains' search with an empty value.
115+
- Enabled submitting a Lucene query with the 'Enter' key.
116+
- Moved submit buttons from left to right.
117+
- Enhanced the visibility of the right-click context menu for events.
118+
- Improved the 'Merge case' dialog and positioning of search bubbles in the event table.
119+
- Show 'group scan' in the scan table.
120+
- Reuse the last status and type of the previous guided baselining case as the default for the next one.
121+
- Added a description to unresolvable Auto Case IDs.
122+
- Improved the column preferences dialog for tables with many columns.
123+
- Removed links from breadcrumbs.
124+
- Added dark mode for API documentation.
125+
- Hide the Valhalla link for some YARA rules, e.g., external or custom rules.
126+
- Enabled dragging and dropping condition terms in the 'Create Case' dialog.
127+
- Moved example events in 'Create Case' from top to bottom and made them expandable.
128+
- Improved error messages for login failures due to incorrect credentials.
129+
- Enabled selecting asset labels and case tags from a dropdown when creating reports.
130+
- Enhanced cosmetics for tooltips in event charts.
131+
- Allowed searching for displayed text instead of numeric values in most tables.
132+
- Removed zero bytes ('\x00') from THOR events in the GUI.
133+
- Preserved conditions when switching from guided to custom mode in the condition builder.
134+
- Display version number and 'up-to-date' status on the overview page.
135+
- Hide deleted Management Centers in the connected Management Centers table.
136+
- Updated menu items for the sandbox.
137+
- Showed actual values instead of numeric values in event charts (e.g., for case type).
138+
- Improved change history for cases, showing the diff of conditions.
139+
- Added THOR key highlighting in Guided Baselining.
140+
- Rearranged menu items in the settings section.
141+
- Enhanced cosmetics for the 'similar cases' dropdown in the 'Create Case' dialog.
142+
- Optionally hide all non-favorite THOR keys.
143+
- Moved manuals and API documentation to the navbar.
144+
- Highlighted searched terms in the Event table.
129145

130146
----
131147

132148
* **Bugfixes**
133149

134-
- Fixed an issue where bulk updating cases with many events would fail. (AC-87)
135-
- Fixed an error when creating a case without a name. (AC-95)
136-
- Corrected the event count in the detailed view of the most frequent event values. (AC-35)
137-
- Fixed sorting of the level by criticality instead of alphabetically. (AC-70)
138-
- Fixed issues with hiding columns in the column preferences. (AC-157)
139-
- Reduced occurrence of MariaDB deadlock errors. (AC-161)
140-
- Fixed 'could not create GUI notification file' error. (AC-163)
141-
- Resolved errors when downloading sandbox files. (AC-173)
142-
- Made the 'Re-link' button visible in the connected Management Centers table. (AC-198)
143-
- Corrected the event count in some Group Scans. (AC-203)
144-
- Fixed typos in success and error messages. (AC-207, AC-208)
145-
- Improved report generation speed by eliminating unnecessary data. (AC-25)
146-
- Ensured the green loading indicator is always visible. (AC-220)
147-
- Fixed the backup script. (AC-315)
148-
- Resolved cut-off elements in the UI. (AC-326, AC-327)
149-
- Corrected a typo in the version number in /etc/issue. (AC-217)
150-
- Fixed issues with the http proxy configuration on fresh installations. (AC-545)
150+
- Fixed an issue where bulk updating cases with many events would fail.
151+
- Fixed an error when creating a case without a name.
152+
- Corrected the event count in the detailed view of the most frequent event values.
153+
- Fixed sorting of the level by criticality instead of alphabetically.
154+
- Fixed issues with hiding columns in the column preferences.
155+
- Reduced occurrence of MariaDB deadlock errors.
156+
- Fixed 'could not create GUI notification file' error.
157+
- Resolved errors when downloading sandbox files.
158+
- Made the 'Re-link' button visible in the connected Management Centers table.
159+
- Corrected the event count in some Group Scans.
160+
- Fixed typos in success and error messages.
161+
- Improved report generation speed by eliminating unnecessary data.
162+
- Ensured the green loading indicator is always visible.
163+
- Fixed the backup script.
164+
- Resolved cut-off elements in the UI.
165+
- Corrected a typo in the version number in /etc/issue.
166+
- Fixed issues with the http proxy configuration on fresh installations.
151167

152168
----
153169

154170
* **Chore**
155171

156-
- Reduced the time range of signature feedback collection from 90 days to 30 days. (AC-131)
172+
- Reduced the time range of signature feedback collection from 90 days to 30 days.

changelog/log2.rst

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
.. Index:: 4.2 Changes
2+
3+
Analysis Cockpit v4.2
4+
---------------------
5+
6+
Analysis Cockpit 4.2.0
7+
######################
8+
9+
Release Date: Mon, 2 Dec 2024 11:49:00 +0100
10+
11+
----
12+
13+
* Features
14+
15+
- Introduced a new notification type to alert users on events without case assignments
16+
- Added a new notification type that triggers when a new asset is affected by a case
17+
- Added an option to run event retention based on the ``time`` field instead of ``@timestamp``
18+
- Enhanced the Overview page with connectivity details for Management Center and Security Center
19+
- Enabled Management Center to connect with Security Center via a reverse proxy, eliminating the need for direct access
20+
- Cases can now be assigned directly to specific users, supporting user-specific workflows
21+
- Added LDAP users to the User Management table for improved user administration
22+
23+
----
24+
25+
* Improvements
26+
27+
- Converted 'Started' and 'Duration' graphs in the scan table to more intuitive line charts
28+
- Established a real-time sync API between Management Center and Analysis Cockpit for Thunderstorm events
29+
- Added "Expunge Deleted Events" setting for complete event deletion in retention settings
30+
- Made the 'Assets' column in the Management Centers table sortable
31+
- Implemented a fallback in event table filters to truncate search terms over 1000 characters
32+
- Improved ``rsyslog`` configuration by switching to ``imptcp`` from ``imtcp``
33+
- Cases can now be sorted correctly by their status in the case table
34+
35+
----
36+
37+
* UX
38+
39+
- Automatically clear empty condition fields in the 'Create Case' condition builder
40+
- Added a 'Back' button in the 'Create Scheduled Report' dialog for easier navigation
41+
- Added a loading indicator when testing proxy connections
42+
- Enabled ChatGPT prompt submission with the 'Enter' key
43+
- Expanded THOR event right-click context menu to additional views
44+
- Adjusted retention settings page to use full-width layout
45+
- Added THOR's 'Archive' field as an option for file collection from assets
46+
- Removed the option to delete oneself from the User table
47+
- Restricted creation of THOR dashboards for Aurora and vice versa
48+
- Enhanced handling of ElasticSearch error messages for better troubleshooting
49+
- Made the right sidebar resizable for flexible layout adjustment
50+
51+
----
52+
53+
* Bugfixes
54+
55+
- Resolved an issue with event assignments to already merged cases; this update will automatically correct any prior mis-assignments
56+
- Restored missing example events for certain findings in the Security Center
57+
- Added missing API key in curl examples within API documentation
58+
- Addressed timezone issues in MariaDB by setting the timezone in configuration
59+
- Correctly display negation filters in the 'Save Dashboard' dialog
60+
- Validated 'Run at' field in retention settings before submission
61+
- Increased Elasticsearch's ``max_nested_depth`` to 100 to prevent query failures
62+
- Corrected a typo in API documentation for ``GET /events/search`` endpoint
63+
- Fixed processing of Bifrost file names
64+
- Ensured UUIDs are generated for new suggested cases
65+
- Added a ``.gitignore`` file to the config directory to avoid certain files from being backed up
66+
- Fixed updates in the 'Actual events' column
67+
- Addressed empty entries in case change logs when adding comments without other changes
68+
69+
----
70+
71+
* Chore
72+
73+
- Corrected a typo in the licensing section

images/cockpit_api_documentation.png

-16.1 KB
Loading

0 commit comments

Comments
 (0)