Tags: utmstack/UTMStack
Tags
fix(rules/windows): exclude benign AMSI 'sentinel' harness from Power… …Shell rule (#2311) The 'Suspicious PowerShell (Encoded / Download Cradle / AMSI Bypass)' rule (4104 script block) fired on every PowerShell session: the injected defensive PSBreakpoint/AMSI 'sentinel' instrumentation harness contains the literal token 'AmsiInitFailed', which matches the first regex branch. With groupBy:[dataSource] this collapsed into a single alert with thousands of echoes. Add a per-script-block exclusion for the harness's unique markers (sentinelbreakpoints, \windows\sentinel\, Po_wer_Spl_oit_Indicators). All attack tokens are preserved; a real payload run through the harness is a separate 4104 event that still fires. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(rules/windows): correct 15 broken correlation rules + add 7 new d… …etections (#2270) Validated end-to-end by firing real payloads on a live Windows agent and confirming each alert in UTMStack (22/22 fired). Fixes regex backslash-escaping, the non-existent eventDataFileName field on 4663, eventDataProcessName on 4688 (use log.data.NewProcessName), the unpopulated log.channel clause, and the WinRM 4624-ProcessName issue. Adds 7 detections (shadow-copy deletion, suspicious PowerShell, Office-spawned shell, LOLBins, scheduled tasks, log tampering, credential dumping). Hardened for false positives; groupBy/deduplicateBy set on dataSource so a burst yields a single alert. Co-authored-by: rvald26 <rick@utmstack.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com>
Release/v11.2.10 (#2239) * update actions workflow * fix(workflows): unblock PR checks on large diffs + private go modules * fix(approver): use english in sticky PR comments * Feature/cleanup rules and filters (#2091) * refactor(filters): update macOS filter configuration * chore(rules): remove Office365 brute force detection rule * chore(rules): remove PowerShell Empire detection rule * chore(rules): remove RDP brute force attacks rule * fix[frontend](soar/create-rule): added fixed create/edit rule undefin… (#2087) * fix[frontend](soar/create-rule): added fixed create/edit rule undefined id error * chore[](): updated go packages * fix[frontend](environment):environments on gitignore and removed the actual local dev environment * chore[](): updated go packages * feat[backed](elasticSearchService): added batch processing of request… (#2090) * feat[backed](elasticSearchService): added batch processing of requests and auto rebuild on IO errors * chore[backend](): updated go dependencies * fix[backend](elastic-service): sanitized csv before exportation and changed error messages * fix[frontend](socai): added default template for empty previous socai… (#2095) * fix[frontend](build): added environment.ts (#2099) * fix[backend](visualizations): removed utm-geoip legacy index references on region map visualizations (#2098) Co-authored-by: Osmany Montero <osmontero@icloud.com> * Hotfix/socai custom header (#2101) * fix[frontend](socai): added default template for empty previous socai config (#2092) * fix[frontend](socai): added default template for empty previous socai configuration * fix[frontend](socai): setted customHeaders as password key type * fix[frontend](socai): dont let empty description on modules * fix[backend](socai): generate the modulegroup with new keys if no other exists on db * fix[backend](changeset): added customHeader entries as password type * fix(frontend): update nginx from 1.19.5 to 1.30.1 Remediate 22 known CVEs including CVE-2026-42945 (actively exploited in the wild for RCE). nginx:1.19.5 (Oct 2020) was affected by buffer overflows, memory disclosure, HTTP/2 injection, SSL session reuse, and multiple other vulnerabilities patched in the 1.30.1 stable release. * Backlog/fix/socai module disabled (#2102) * fix[backend](socai): changed socai default module keys * fix[backend](modules): added default keys on module creation response * fix[frontend](socai): handled empty (disabled) module configuration * Backlog/fix/tag rules (#2106) * fix[frontend](rules): improved post event count validation * fix[frontend](tag_rules): added events related fields on tag rule creation --------- Co-authored-by: Osmany Montero <osmontero@icloud.com> * fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement (#2107) * fix[frontend](alerts-view): added a loading indicator and improved fast filtering reinforcement * chore[](): updated go packages * fix(deps): patch 5 Dependabot vulnerabilities (2 critical, 1 high, 2 medium) (#2103) - google.golang.org/grpc: 1.78.0 -> 1.79.3 (GHSA-p77j-4mvh-x3m3, critical) - github.com/jackc/pgx/v5: 5.8.0 -> 5.9.2 (GHSA-9jj7-4m8r-rfcm critical, GHSA-j88v-2chj-qfwx low) - go.opentelemetry.io/otel: 1.39.0 -> 1.41.0 (GHSA-mh2q-q3fh-2475, high) - com.itextpdf:itext7-core: 7.1.7 -> 7.2.0 (GHSA-hhh6-cm2m-3fhc, GHSA-8c9h-4q7g-fp7h, GHSA-c32g-2mgr-cfq7, medium x3) - org.postgresql:postgresql: 42.7.2 -> 42.7.11 (GHSA-98qh-xjc8-98pq, high) Signed-off-by: Osmany Montero <osmontero@icloud.com> * fix(deps): upgrade golang.org/x/sys from v0.44.0 to v0.45.0 * fix[frontend](alerts-view): add a duplication avoid on alert filter fields count (#2127) * refactor(rules): drop "now-" prefix from within field (#2176) * fix[backend](tags): removed false positive alerts from releaseToOpen schedule (#2178) * fix[installer](setup): added lock on installer final phase (#2180) * fix[frontend](alerts): properly handle update alerts errors (#2193) * feat(rules/o365): add Inbox Forward Rule with Email Exfiltration detection rule (#2221) * feat(rules/o365): add Audit Log Purge detection rule (#2220) * feat(rules/o365): add Admin Role/Permission Granted detection rule (#2219) * feat(rules/o365): add Admin Role Assignment detection rule (#2218) * refactor(rules/google): update GCP correlation rules (#2194) * feature(rules/google): add rule GCS Sensitive Data Access (#2187) * feature(rules/google): add rule GCS Bucket Deleted (#2186) * Tune bruteforce correlation and drop unreliable PTH rule (#2192) * fix(rules/windows): tighten bruteforce_attack correlation scope * fix(rules/windows): scope multi-failure-then-success rule by source * chore(rules/windows): remove pass_the_hash_detection rule * fix(rules/windows): fix of the redundant field 'origin.host' that appears twice in the deduplicateBy array. * feature(rules/google): add rule Privileged Role Granted - Owner or Editor (#2190) * feature(rules/google): add rule Cloud Logging Sink Modified (#2189) * feature(rules/google): add rule Firewall Open Ingress (#2182) * Update filters: GCP, Sophos XG, Windows (#2175) * feat(filters/gcp): add Cloud Audit Logs (protoPayload) support * fix(filters/sophos-xg): guard renames and actionResult against missing fields * chore(filters/windows): rename log.data.SubStatus field * fix(filters/sophos-xg): correct operator precedence in actionResult guard * feature(rules/google): add rule Audit Logging Configuration Changed (#2181) * Add GCP rule: IAM Policy Changed - Privilege Escalation (#2188) * feature(rules/google): add rule IAM Policy Changed - Privilege Escalation * fix(rule/google): changing 'exists(log.protoPayload.request.policy.auditConfigs)' to 'exists(log.protoPayload.request.policy.bindings) to improve detection logic * feature(rules/google): add rule Firewall Rule Deleted (#2183) * feature(rules/google): add rule GCS Bucket Created (#2185) * fix(rules/google): rebalance CIA impact scores for GCP rules (#2227) * feat[ci](pr-review): severity-based merge gate; exclude rules/filters/definitions from AI review * fix[ci](pr-review): don't gate routine go.mod/go.sum bumps as Tier 3 * fix[backend](alert_responses): reduces schedule time to executeResponse se from 5mins to 15 seconds (#2230) * fix[backend](alert_responses): reduces schedule time to executeResponse from 5mins to 15 seconds * fix[backend](go_deps): updated go dependencies * fix[backend](alert_responses): fixed powershell commands syntax errors (#2228) * fix[backend](alert_responses): fixed powershell commands syntax errors * fix[backend](go_deps): updated go dependencies * fix[backend](incident_response_audit): enabled filters on agents-with command query (#2226) * fix[backend](incident_response_audit): enabled filters on agents-with-command query * fix[backend](go_deps): updated go dependencies --------- Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com> Co-authored-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com> * fix[backend](compilance_reports): migrated compilance reports from ol… (#2232) * fix[backend](compilance_reports): migrated compilance reports from old table to new one * fix[backend](compilance_reports): added rollback marker robustness and unconditional sentinel deletion * chore: update golang dependencies * fix[ci]: fix changelog script failing when tag doesn't exist yet and unblock installer on changelog failure * ci: simplify v11 pipeline to trigger on release events instead of push to v11 --------- Signed-off-by: Osmany Montero <osmontero@icloud.com> Signed-off-by: Yorjander Hernandez Vergara <99102374+Kbayero@users.noreply.github.com> Co-authored-by: Jose L Quiñones Rojas <73146718+JocLRojas@users.noreply.github.com> Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com> Co-authored-by: Osmany Montero <osmontero@icloud.com> Co-authored-by: developutm <development@utmstack.com>
ci(v10): stop deploying installer to dev/rc runners, only publish to … …release
Release/v11.2.8 (#2083) * fix[frontend](settings): sending email configuration parameters on check * fix[frontend](integrations_guides): updated eset integration images * add correct status code for authentication errors * fix[frontend](alerts-view): setted echoes column as readonly (not sortered) * fix[frontend](alerts-view): added last echoe timestamp to alerts that have echoes * fix[frontend](integrations/json):updated json input guide * fix[backend](collectors): avoid sending masked values to collectors * fix[backend](csv_export): fixed csv export to include composed columns (adversary,etc) * fix[frontend](tagging rules): fixed tagging rules ocnditions check * fix[frontend](logexplorer): fixed sidebar selected fielrs and available filters menu proportion * fix[frontend](ciscoswitch_integration): removed fixed integration name from guide * deleted: rule Office 365 Impossible Travel Login Detection removed from o365 * feat(filters/fortinet): add CEF format support to fortigate filter * fix[ci]: build agent with CGO disabled * fix[installer]: generate complex password for OpenSearch * update golang dependencies * fix[agent](auditd): treat unavailable audit subsystem as skip, not error * fix[backend](collectors): enforce sending clear text passwords to collector * fix[frontend](integration_guides): restored linux agent install path * fix[backend](alerts): added last echoe field on alerts * fix[frontend](alerts): added last echoe timestamp to alert table --------- Co-authored-by: AlexSanchez-bit <sanchez.saez.alex01@gmail.com> Co-authored-by: JocLRojas <joc.l.rojas02@gmail.com>
Release/v11.2.5 (#1957) * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * fix(module.service): return full response body instead of filtering AS_400 module Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: add CollectorConfigDTO and unique server name validation * feat: add CollectorConfigBuilder for constructing CollectorConfig from DTO * feat: add CollectorGrpcService for managing collector operations via gRPC * feat: update CollectorConfig validation and add CollectorService for gRPC integration * feat: update CollectorValidatorService to use CollectorConfigDTO for validation * feat: refactor UtmCollectorResource to use CollectorConfigDTO and CollectorOpsService * feat: add logging to updateConfigurationKeys method in UtmModuleGroupConfigurationService * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * fix(module.service): return full response body instead of filtering AS_400 module Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * feat: add CollectorConfigDTO and unique server name validation * feat: add CollectorConfigBuilder for constructing CollectorConfig from DTO * feat: add CollectorGrpcService for managing collector operations via gRPC * feat: update CollectorConfig validation and add CollectorService for gRPC integration * feat: update CollectorValidatorService to use CollectorConfigDTO for validation * feat: refactor UtmCollectorResource to use CollectorConfigDTO and CollectorOpsService * feat: add logging to updateConfigurationKeys method in UtmModuleGroupConfigurationService * fix(module.service): return full response body instead of filtering AS_400 module Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * refactor(collector): simplify DTOs and enhance service methods for listing collectors * feat(assets-view): refactor asset detail handling and improve status display Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(RequestDsl): enhance search request handling for LIST_CHART visualization * feat(RequestDsl): enhance search request handling for LIST_CHART visualization * feat: add updates for Windows visualizations and default time range adjustments * feat(netflow-filter): add IANA protocol mapping and improve field processing * feat(assets-view): refactor asset detail handling and improve status display Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(netflow-filter): add update for Netflow filter version 3.1.1 and enhance field processing * refactor(azure-plugin): extracts event processing logic into separate functions to handle JSON format detection (array vs object) * feat(windows-visualizations): update outdated fields in Windows visualizations and normalize field names * feat(windows-visualizations): update field names in Windows visualizations for consistency * feat(open-alerts): optimize open alerts handling and improve local storage updates Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(visualization-list): integrate UtmToastService for error handling in visualization fetching Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(windows-visualizations): update field names in Windows visualizations for consistency * feat(windows-visualizations): update field names in Windows visualizations for consistency * feat(bitdefender-gz): add renaming for log.deviceIps, log.dvchost, and log.act fields * feat(bitdefender-visualizations): normalize field names in Bitdefender GZ visualizations * feat(vmware-visualizations): normalize field names in VMware visualizations * feat(bitdefender-filter): add Bitdefender GravityZone filter update with field renaming and cleanup * feat(dashboard-render): improve dashboard loading logic and enhance error handling for filters Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * feat: add CollectorConfigDTO and unique server name validation * feat: add CollectorConfigBuilder for constructing CollectorConfig from DTO * feat: add CollectorGrpcService for managing collector operations via gRPC * feat: update CollectorConfig validation and add CollectorService for gRPC integration * feat: update CollectorValidatorService to use CollectorConfigDTO for validation * feat: refactor UtmCollectorResource to use CollectorConfigDTO and CollectorOpsService * feat: add logging to updateConfigurationKeys method in UtmModuleGroupConfigurationService * fix(module.service): return full response body instead of filtering AS_400 module Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: implement gRPC client and service for collector management # Conflicts: # backend/src/main/java/com/park/utmstack/config/CollectorConfiguration.java # backend/src/main/java/com/park/utmstack/grpc/client/CollectorServiceClient.java # backend/src/main/java/com/park/utmstack/grpc/client/PanelCollectorServiceClient.java # backend/src/main/java/com/park/utmstack/service/collectors/CollectorOpsService.java * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: implement gRPC client and service for collector management * feat: remove unused GrpcInternalKeyInterceptor from collector service clients * feat: update CollectorConfig validation and add CollectorService for gRPC integration * refactor(collector): simplify DTOs and enhance service methods for listing collectors * feat(collector): add methods for deleting collectors and updating groups * feat(collector): add bulk upsert functionality for collector configurations * refactor(collector): remove unused imports and simplify error handling in UtmCollectorResource * feat(as400): add IBM AS/400 log collector Implement standalone collector service for IBM AS/400 systems integration with UTMStack . * feat(pipeline): update UTMStack collector build process to include AS400 collector * feat(ibm-as400): update filter to version 3.0.1 with enhanced JSON parsing. * update vmware-esxi filter * update version vmware-esxi filter * feat(collector): enhance collector configuration management and validation * feat(vmware-esxi-filter): add update for VMware ESXi filter with enhanced parsing and cleanup * feat(collector): enhance save button behavior and loading state in group configuration Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * refactor(collector): remove unused reset and update methods in utm-module-collector service Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(collector): add deleteAllConfigs method and update delete integration logic Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(collector): add deleteAllConfigs method and update delete integration logic Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * refactor(collector): clean up UtmCollectorResource by removing unused methods and comments * feat(collector): implement search functionality for asset groups with filtering and pagination * refactor(collector): clean up imports and remove commented-out code in service classes * feat(collector): enhance collector management with improved error handling and new delete audit events * feat[shared]: create shared dependencies * feat[installer]: remove mfa in dev environments * refactor[agent]: restructure collector, commands, and dependency management * chore[go-deps]: update golang dependencies * fix(collector): update sortable column from assetIp to hostname and disable starInterval Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * refactor(collector): streamline collector configuration and update API endpoints Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat[agent]: add macOS build pipeline and standardize binary naming * refactor[agent]: sync updater with release/v11.2.3, remove legacy files * fix[plugins]: add missing skipTlsVerification param to DoReq calls * fix[ci]: correct macOS artifact paths in agent-manager build * fix[frontend](guides): update agent guides * fix(agent-manager): correct FilterScope to properly chain WHERE clauses and fix LIKE syntax * feat(agent): add shell selection for command execution and fix agent registration * fix(agent): download version.json during install before agent registration * fix(updater,frontend): add legacy binary migration and fix agent search filter * fix(agent): return errors from low-level packages instead of calling Fatal/Exit * refactor[agent](collector): use fsnotify for config changes instead of polling * feat(agent): add shell field to UtmCommand for enhanced command execution context * feat(fortinet): update fortinet filter * fix(filter): update IBM AS 400 filter with enhanced JSON parsing and field mappings * fix(filter): update IBM AS 400 filter * chore(cleanup): remove unused integrations (Redis, Nginx, PostgreSQL, Apache, MySQL, MongoDB, Elastic, Logstash, Kibana, Kafka, NATS, Traefik, Audit, HAP, IIS, OSQuery) * chore(cleanup): remove integrations (Redis, Nginx, PostgreSQL, Apache, MySQL, MongoDB, Elastic, Logstash, Kibana, Kafka, NATS, Traefik, Audit, HAP, IIS, OSQuery) * feat(logstash): enhance logstash stats retrieval with improved error handling and pipeline status management * fix(system_linux): update filter with enhanced JSON parsing and field normalization * feat(filter): add Linux filter update with enhanced JSON parsing and field normalization * feat(visualization): add update for Linux visualizations to normalize field names and improve dataset consistency * feat(windows): update windows filter * feat(saml): enhance SAML registration with improved error handling and environment variable validation * feat(saml): improve SAML provider loading with enhanced error handling and logging * feat(saml): enhance SAML provider loading with improved error handling and logging * feat(correlation): add updates for winevent correlation rules * feat(winevent): add updates for winevent correlation rules and filter * feat(winevent): update filter version and rename log fields for improved clarity * feat(visualizations): update Windows visualizations to align with logstash filter v3.1.0 field transformations * feat(import): disable back button during loading and fix spacing in upload error message Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(idp): enhance metadata URL validation with improved error handling and encryption key checks * feat(idp): refactor encryption key handling with dedicated validation method * feat(saml): implement SAML metadata fetching and provider loading with timeout handling * feat(saml): enhance SAML2 login success handling with improved user not found logging and provider reloading * feat(saml): update host retrieval in SAML2 login success handler to use X-Forwarded-Host header * feat(saml): refactor SAML metadata fetching to improve error handling and registration building * feat(platforms): enhance platform creation with additional Linux ARM64 support and update Windows service paths Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix(config): detect filter and rule deletions by tracking active row counts hasChanges only checked MAX(timestamp) increases, missing deletions where the timestamp didn't advance. Now also compares COUNT of active rows so deactivations and hard deletes trigger config file regeneration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Update go-sdk dependency across multiple plugins * feat(logstash): integrate Monaco Editor for YAML filter definition and enhance form styling Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: update filter card interaction to improve usability Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(rule-view): integrate Monaco Editor for YAML editing and enhance styling Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: update Windows service paths for UTMStack agent Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(db): add unique constraint on asset_name in utm_tenant_config table * feat(tenant-config): add findByAssetName method to retrieve UtmTenantConfig by asset name * feat(data-input-status): add methods to retrieve data input status by source and build sources list from tenant config * feat(data-input-status): add methods to retrieve data input status by source and build sources list from tenant config * feat(data-input-status): add methods to retrieve data input status by source and build sources list from tenant config * feat(data-input-status): add methods to retrieve data input status by source and build sources list from tenant config * feat(data-input-status): add alias column and update logic for data input status * feat: remove alert from addTag function in fields-selector component Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix: deprecate enable parameter in TFA section Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat(.gitignore): add .env file to ignore list * fix: update winevent correlation rules * fix: update winevent correlation rules * fix: update bit-defender correlation rules * fix: update deceptive-bytes correlation rules * fix: update eset correlation rules * fix: update kaspersky correlation rules * fix: update cisco-asa correlation rules * fix: update cisco-switch correlation rules * fix: update cisco-firepower correlation rules * fix: update cisco-meraki correlation rules * fix: update cisco-meraki correlation rules * fix: update aws correlation rules * fix: update azure correlation rules * fix: update google correlation rules * feat: add crowdstrike correlation rules * feat: add crowdstrike correlation rules * refactor(rule-view): move and rename rule-view component files Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: add crowdstrike correlation rules * feat: implement asset synchronization service and source activity provider * feat: add data source validation service for critical data sources * refactor(asset-sync): rename sync method and improve logging messages * fix(filters): correct IP and hostname field mapping in Windows events * feat(filters): enhance Fortinet field mapping and cleanup * fix(agent): use net.ListenPacket for UDP port binding check net.Listen only supports TCP, causing all UDP integrations to fail with "port already in use by another process" error. Now using net.ListenPacket for UDP protocol validation. * feat(macos): update filter to version 3.0.1 and rename fields for consistency * feat: enhance asset synchronization by resolving asset names from tenant configuration * fix: update fortigate and windows filter * feat: enhance configuration saving logic with support for multiple groups Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix(asset-sync): adjust scheduling parameters for data synchronization * fix: remove duplicate imports in int-generic-group-config component Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: implement password reset functionality with expiration handling and logging * feat: implement password reset functionality with expiration handling and logging * feat: implement password reset functionality with expiration handling and logging * feat: update layout for password reset component Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: enhance password reset logic to handle missing key scenario Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: improve password reset feedback and add back to login button Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * chore: fix conflicts * feat: update UTMStack deployment pipeline to build and upload AS400 collectors * refactor(as400): reorganize logservice package and improve log processing logic * fix: update path for AS400 collector JAR in deployment pipeline * fix: correct updater service name in DownloadUpdater function * feat: update AS400 installation instructions and add pre-installation requirements Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix(as400): update service path to include 'as400' in InstallUpdater and UninstallUpdater functions * feat: add SAML2 proxy configuration for authentication * fix: improve installation and uninstallation scripts for AS400 collector Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix(as400): correct REPLACE_KEY declaration - Change REPLACE_KEY from const to var to allow -ldflags -X injection * fix: handle null return case in saveCollector method Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * refactor: update FileFieldEnum values for consistency with new logging format Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * feat: enhance module deletion process with event processing and DTO mapping * feat: implement deleteAndFetch method for module group deletion with event processing * refactor(crowdstrike): migrate from polling to real-time event streaming - Replaced polling-based event collection with real-time streaming architecture - Implemented persistent stream management with automatic reconnection - Added dynamic configuration reloading with live stream updates - Introduced per-stream offset tracking to prevent duplicate events * fix: uncomment admin authority container in management sidebar Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> * fix[backend](data-sources): fixed data sources variable source selection on filter * fix[frontend](o365_integration_guide): removed unneeded steps and signalized security indications about storing certificates * changeset[backend](rules): added 'Windows Token Manipulation' removal change set' * feat(filters/azure): add WAF properties and client connection field mappings * feat(filters/crowdstrike): refactor field mappings and add detection support * feat(filters/filebeat): add CPU and memory usage fields for systemd units * feat(filters/o365): integrate geolocation plugin for origin IP enrichment * changeset[backend](rules): updated croudstrike rules changelog * changeset[backend](filters): updated o365, crowdstrike, system_linux and azure filters * fix[backend](filters): fixed azure filter definition * fix[backend](filters): fixed crowdstrike filter definition * fix[backend](filters): fixed filebeat linux filter * fix[backend](filters): fixed o365 linux filter * changeset[backend](filters): added ibm_as400 filter changeset * fix[backend](filters): fixed as400 and azure syntax errors * update windows-events filter * update windows-events filter * changeset[backend](window rule): removed 'Windows: Execution of Persistent Suspicious Program' * changeset[backend](windows filter): updated windows filter changeset * Update Go SDK * update windows-events filter * chanelog[frontend](window_filter): updated windows filter * fix[frontend](file_classification): setted action mask to a decimal integer * fix[frontend](file_classification): fixed event fields and names to fit filters * fix[frontend](file_classification): fixed access mask enum type setted to numeric values and matched to hex on filter show * fix[frontend](file_classification): fixed overflow and scroll on tabular view * fix[frontend](file_classification): sync scroll with logexplorer one * fix[frontend](cisco-switch-int-guide): changed cisco switch int guide command 'cisco' by 'cisco-switch' * fix[frontend](cisco-int-guide): added right data type names on cisco integrations * fix[frontend](collector): fixed collector details endpoint call * fix[backend](collector): fixed collission path error on asset-group (PUT) and asset-groups (GET) * fix[frontend](collector): fixed collection groups endpoint name * changeset[backend](windows dll filter): removed rundll32 no arguments and abuse rule * update microsoft365 filter * changeset[backend](o365 filter): updated o365 filter * fic[backend](changeset): fixed o365 filter changeset ' * fix(as400): resolve installation and config handling issues - Add DEBIAN_FRONTEND=noninteractive to prevent apt hanging during Java install - Filter Log4j2 INFO/DEBUG messages from stderr to avoid false error logs - Allow empty server configuration when all configs are removed from panel - Stop JAR process and remove config file when no servers are configured * fix[backend](o365_filter_changeset): fixed xml parsing error * update azure-eventhub filter * changeset[backend](azure): updated azure event hub filter --------- Signed-off-by: Manuel Abascal <mjabascal10@gmail.com> Co-authored-by: Manuel Abascal <mjabascal10@gmail.com> Co-authored-by: JocLRojas <joc.l.rojas02@gmail.com> Co-authored-by: Yadian Llada Lopez <yadian.llada@gmail.com> Co-authored-by: Osmany Montero <osmontero@icloud.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: AlexSanchez-bit <sanchez.saez.alex01@gmail.com> Co-authored-by: Alex Sánchez <alessq732@gmail.com> Co-authored-by: Alex Sánchez <alex.sanchez@utmstack.com>
PreviousNext