UTMStack v11.3.0 (pre-release) — 2026-10-28

v11.3.0 is a reliability and data-model release. The headline change is a rename of the raw-event storage field (log → event) with a new utm.* namespace for charting, plus a set of fixes for disk protection, installer memory handling, and the alert/compliance UI. Upgrading does not reindex existing data, but customer-created filters, rules, and dashboards that use the old log.* bag must be updated (see Breaking).

Security

• CVE-2026-82042 (follow-up): the internal API-key filter now also allows the rule-flood-guard's three backend endpoints. Previously those calls 401'd silently, which disabled the flood guard's ability to auto-disable runaway rules. No action required.

Breaking

• Customer-owned content that references the log.* event bag must be migrated to event.* (or utm.* for charts). UTMStack v11.3.0 renames the raw per-vendor event bag from log to event. Every filter, rule, and dashboard shipped by UTMStack was migrated for you, and the Log Explorer / Alerts search UI still accepts legacy log.* filter values. Customer-created content is not migrated, and it stops working against new data:
• Custom correlation rules — where / afterEvents / groupBy expressions referencing log.* no longer match any new event.
• Custom filters — steps that read from (log.* sources) or write to (log.* targets) the old bag name no longer see the data.
• Custom dashboards / charts / visualizations — queries and filters that reference log.* fields return empty on new indices.
• How to migrate: rename raw bag fields log.<field> → event.<field>. For aggregations and charts, event.* is not aggregatable (it is stored as a flat field), so use the utm.* namespace or the promoted standard fields (action, severity, deviceTime, origin.*, target.*, tenantId), which are unchanged. Old pre-upgrade data keeps the log bag and is retained per its index lifecycle.

Added

• Geolocation coordinate maps on dashboards (Leaflet), with OpenStreetMap tiles. Six previously-broken compliance map charts are fixed.
• New operational dashboards: GCP, NetFlow, and pfSense.
• Compliance report PDF export is available from every compliance view (evaluation detail, report viewer, and results), not just the legacy screen.
• utm.* aggregatable field namespace for charts. Raw per-vendor fields moved to event.*; promoted, aggregatable fields live under utm.* (e.g. utm.action, utm.severity).

Changed

• Raw event field renamed log.* → event.* in the schema. New events store under event; old events keep log and are read with a dual-read pass, so no reindex and no data loss. Custom dashboards or saved filters that hard-code log.* paths must be updated to event.* (see upgrade notes below).
• Threat Intelligence page now opens threatwinds.com in a new tab instead of embedding galaxy.threatwinds.com in an iframe.
• Installer memory model: /utmstack/updates/memory-allocation.json is now the single authority for per-service memory. Normal updates never re-balance it. Use utmstack_installer --recalculate-memory to recompute and rewrite it. Fresh installs seed the file once.
• Emergency disk auto-delete: when OpenSearch's disk usage reaches 85%, the oldest raw-log indices are now actually deleted (down to 70%). Previously the delete loop only removed indices that had aged 30 days into the ISM delete state, so on fresh or high-volume installs it deleted nothing and the disk could still reach 100% and tip OpenSearch into flood-stage. Alerts, statistics, and system indices are never auto-deleted.

Fixed

• SOAR incident-response commands re-running forever — a command that dispatched but whose result callback never landed (backend restart, stream close) was re-sent every 30 seconds. One rule in the wild created ~39,000 duplicate firewall rules in a week. Commands now go to EXECUTING the moment they're dispatched, so the scheduler can't re-select them, and any EXECUTING row left over from a backend restart is reset to PENDING once at boot.
• Data Sources: applying a note (or editing an alias) removed the source from its group and silently dropped assetGroupId/assetGroupName from new alerts. Note and alias now use dedicated field-scoped endpoints that touch only that column.
• Alerts page opened by bare URL hung on "Loading…" — direct navigation to /data/alert/view without ?alertType=... never triggered the initial search. Now it loads, defaulting to the Alerts view (Status column, status tabs, Datasource Group filter) exactly like the menu link.
• Alerts "Row to filters" bricked the list — the default selection turned composite columns (Target, Adversary, Impact) and numeric columns (Echoes) into IS_ONE_OF filters with invalid (non-list) values, which the backend rejected with a 500; every later search on the page failed until a reload. Composite columns are now offered unchecked by default and every emitted value is normalized to a valid list; the backend additionally returns a 400 (not 500) for structurally invalid filters.
• Data Processing → Pipelines showed other vendors' numbers — the status job queried v11-statistics-* with a tokenized match on dataType, so firewall-sonicwall matched firewall-pfsense and similar, and read only a single 10-minute document's count. It now reads exact dataType.keyword for all of the module's data types, sums count over the last 24 h, resets to 0 when empty, and stops picking an arbitrary data type for multi-filter modules.
• Crypto-mining netflow rule false positives — the rule fired on any TCP flow to a mining-pool port, so one-way SYN+ACK probes (132 bytes) to dead IPs correlated into HIGH alerts. It now requires a completed TCP handshake and more than 10 KB transferred in the flow.
• Installer silently rebalanced memory on update when memory-allocation.json was missing/corrupt, overwriting the operator's distribution. A normal update now refuses to deploy a non-authoritative distribution instead of guessing; the file is written only on fresh install (one-time seed) or explicit --recalculate-memory.
• Installer memory profile (#2918): event-processor-manager capped at 4 GB (was 60 GB), backend raised to 8 GB, and the backend JVM given MaxRAMPercentage=75 so it stops OOMing on Log Explorer with large result sets. Run utmstack_installer --recalculate-memory on existing installs to apply.
• web-pdf floor: raised to 1250 MB so headless Chromium doesn't OOM on printPage at 16 GB hosts.
• 39 correlation rules (Palo Alto, Azure, AWS) were silently inactive because their technique field was blank and the backend rejects blank techniques on sync. Each is populated now; they load on boot.
• Compliance evidence columns came back empty after the event-bag rename — the stored-query remap covered compact JSON but not the spaced form the UI writes. Both forms are remapped now.
• Compliance PDF export hung on large reports — the web-pdf renderer was printing every row (up to 10k) and running out of memory, and the backend had no HTTP timeout. Exports are capped at 250 rows ("Showing first 250 of M rows") and the backend now times out at 120 s with a 504 instead of spinning forever.
• Coordinate maps on the overview and dashboards were blank — they bucketed on origin.ip.keyword, which doesn't exist on new (typed ip) indices, and the nginx CSP blocked the tile hosts. Maps now bucket on origin.ip (with a .keyword multi-field for old indices) and the CSP allows *.tile.openstreetmap.org / *.tile.thunderforest.com.
• User Auditor: reads both event-bag generations after the rename; the monthly back-fill no longer jumps ~29 days on the first run after the 1st; the OpenSearch client is built eagerly so the first scheduled scan doesn't NPE.
• Adversary View returned a 500 for alerts stored before the rename — pre-upgrade bags are read with a null guard now.
• NetFlow v9 byte-array ports were mangled (e.g. 22935 instead of the real port) and dataSource kept the :port suffix. The filter v3.2.0 + agent 11.1.5 decode correctly.
• Geolocation data refreshed to MaxMind GeoLite2 City 2026-10-20 + ASN 2026-10-22 (was 2024-08 builds). Notably, the old data mapped some 2a00:8c40:* (Fastly) IPv6 ranges to the US centroid; new data resolves them to Madrid/Canary, eliminating a class of "impossible travel" false alarms.
• Event processor / go-sdk: bumped to go-sdk v1.1.38 across all Go modules; the cel plugin's OpenSearch connection regression (silently killing every CEL-dependent rule) is fixed; text-search operators (contains, startsWith, regexMatch, …) now work on object/array fields by searching the raw JSON text.
• Backend boot crash caused by a snakeyaml 2.0 bump (NoSuchMethodError in Spring Boot 3.1.5's YAML loader) is reverted; snakeyaml stays at 1.33.
• Rule definition sync is limited to system rules, and the previous stored status is preserved across boots.
• Federation: user removal fixed.
• Nginx panel is force-reloaded after updates and the shared key is persisted, so the frontend no longer 401s after an update.
• Agent: spool cleanup enforces a 500-row batch bound and drops pending records past a hard disk cap (5× retention) so a stalled endpoint can't fill the disk.
• Log Explorer: event.* sub-fields are selectable as columns and filters; the filter picker lists them; the sort control is hidden for flattened bag fields (sorting them was a 400).
• Data Sources asset-group pagination SQL typo fixed (missing space before ORDER BY).

Upgrade notes

• No reindex, no data migration. Old v11-log-* indices keep their log field and are read alongside event by the backend; only new data uses event.
• Custom log.* content: see Breaking above. Shipped content is migrated; customer-owned filters, rules, and dashboards using the old bag name are the operator's responsibility.
• Memory: if you hand-tuned service memory with docker service update --memory, that tuning is not persisted and the installer will re-apply memory-allocation.json on the next update. To make a custom distribution stick, edit /utmstack/updates/memory-allocation.json or run utmstack_installer --recalculate-memory.
• Disk auto-delete will now remove old raw-log indices when OpenSearch's data disk reaches 85%. If you rely on logs older than a few days, keep the disk comfortably below that threshold or attach more storage.
• Agent must be updated to 11.1.5+ for the NetFlow v9 port fix; the installer ships it in this release.

Full diff: v11.2.16...v11.3.0