Release Notes for UTMStack v11.2.3

In this release, we've introduced several new features and improvements to enhance your experience with UTMStack. We've also addressed some bugs to ensure smoother operation.

What's New

• Added enhanced log parsing capabilities for VMware and Netflow filters.
• Introduced updates for Microsoft 365 and SonicWall filters for better integration.
• Added support for new Cisco filter updates, including Cisco ASA and Meraki.
• Updated the UTMStack filter configuration to version 3.0.5.

Improved

• Enhanced sorting in the asset view to prioritize asset status and last input.
• Improved error handling and response mapping for module configuration validation.
• Enhanced configuration encryption to support file data types.
• Updated layout styles for the API documentation component for better clarity.

Fixed

• Resolved issues with cloud region URL parsing for CrowdStrike configuration.
• Fixed timestamp handling in correlation rules and logstash filter services.
• Improved validation checks for alert targets and log objects.
• Cleaned up alert detail view logic and HTML formatting for better readability.

EventProcessor Changelog

Sparkle Features

• Log Pusher: Added support for Unix socket-based log pushing.
• Log Pusher: Added UUID generation to log entries for improved tracking.
• Plugins: Added UUID to alert payloads for better identification.
• Reliability: Implemented a circuit breaker for rule evaluation failures to prevent system instability.

Bug Fixes

• Feeds: Fixed analyze function to return immediately for denied, blocked, or failed actions.
• Log Pusher: Improved error handling when closing connections.
• Memory Management: Fixed memory release issue after successful queue registration.
• Feeds: Added playground mode check and improved error handling.

Enhancements & Refactoring

• Plugins (CEL): Optimized rule reloading with change detection and state tracking.
• Plugins (CEL): Unified error handling for rule processing and correlation evaluation.
• Plugins (CEL): Refactored rule processing logic and modularized key functions.
• Plugins (General): Renamed analysis plugin to cel and updated build paths.
• Rule Management: Added support for tenant-specific and global rule disabling; refactored rule indexing.
• Rule Properties: Updated rule properties for better categorization and technique details.
• Configuration: Updated NewDynamicSourceManager to handle nil configuration gracefully.

Build & Maintenance

• Build System: Added log-pusher and opensearch-fetcher binaries to Dockerfile and build artifacts.
• Build System: Fixed Dockerfile paths for plugins directory.
• Cleanup: Removed deprecated plugin configuration files.
• Cleanup: Removed unused libraries and deprecated integration_test.go files.

Documentation

• Plugins: Added comprehensive README for the CEL analysis plugin.
• General: Added links to the official wiki for detailed implementation guides.

Dependency Updates

• Go SDK: Upgraded github.com/threatwinds/go-sdk to v1.1.14 across all modules.
• Genproto: Updated google.golang.org/genproto to latest versions.
• Modules: Updated dependencies and enhanced error handling (added delays).

We hope you enjoy the new features and improvements in this release!

Full Changelog: https://github.com/utmstack/UTMStack/compare/v11.2.2...v11.2.3