From d043aee8fda43f4a2f1d1e3f5d7b1bfde8f29915 Mon Sep 17 00:00:00 2001 From: "Scott R. Shinn" Date: Fri, 19 Apr 2019 11:33:51 -0400 Subject: [PATCH] V3.3.0 tagging Signed-off-by: Scott R. Shinn --- BUGS | 2 +- CHANGELOG | 71 +++++++++++++++++++++++++++++++++++ CONFIG | 2 +- INSTALL | 2 +- README.md | 2 +- contrib/version_bump.sh | 6 ++- src/VERSION | 2 +- src/headers/defs.h | 2 +- src/init/ossec-client.sh | 2 +- src/init/ossec-local.sh | 2 +- src/init/ossec-server.sh | 2 +- src/win32/help.txt | 2 +- src/win32/ossec-installer.nsi | 2 +- 13 files changed, 87 insertions(+), 12 deletions(-) diff --git a/BUGS b/BUGS index 3d9efc1dc..d50415391 100644 --- a/BUGS +++ b/BUGS @@ -1,4 +1,4 @@ -OSSEC v3.2.0 +OSSEC v3.3.0 Copyright (C) 2019 Trend Micro Inc. diff --git a/CHANGELOG b/CHANGELOG index 5a5d11791..ba79cdd2f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,74 @@ +OSSEC changelog (3.3.0) + +Release Maintainers + +Dan Parriott +Scott R. Shinn (http://www.atomicorp.com) + +Contributors on this release + +almirb (Almir Bolduan) +aquerubin (Antonio Querubin) +atomicturtle (Scott R. Shinn) +Bob-Andrews (Bob Andrews) +ddpbsd (Dan Parriott) +jubois +MangyCoyote +mephesto1337 + + + +Release Notes + + OSSECCON 2019, from the whole team here at OSSEC it was really fantastic meeting everyone at the show, and we look forward to seeing you all again at OSSECCON 2020! + PCRE2, Jubois made a major update to the IDS foundation in OSSEC 3.3.0 with PCRE2 (https://www.pcre.org/current/doc/html/pcre2.html) library. This is an extremely powerful update to the overall pattern analysis functionaility in OSSEC. In order to build this with the native distribution pcre2 packages (pcre2-devel, etc), you will need to use: export PCRE2_SYSTEM=yes. This adds several new xml tags: + - pcre2 (to replace regex) + - match_pcre2 + - program_name_pcre2 + - prematch_pcre2 + - srcgeoip_pcre2 + - dstgeoip_pcre2 + - srcport_pcre2 + - dstport_pcre2 + - user_pcre2 + - url_pcre2 + - id_pcre2 + - status_pcre2 + - hostname_pcre2 + - extra_data_pcre2 + + Dynamic Decoders, discussed in the "Beyond Security" talk at OSSECCON 2019, this allows for user-defined keys in decoders. These are exposed in JSON output for inclusion with other data analytics tools. This adds a new internal option: analysisd.decoder_order_size to define the maximum number keys allowed in a single decoder. + + +Whats New + + (jubois) - PCRE2 regular expression support - PR#1652 + (atomicturtle) - ossec-analysisd, Dynamic decoder support. Original: Vikman Fdez-Castro - PR#1678 + (ddpbsd) - ossec-execd, Switch "white lists" to "allow lists" - PR#1687 - NARRATE HERE + +New Rules / Decoders + (Bob-Andrews) - rootcheck, update for NullSessionShares - PR#1669 + (Bob-Andrews) - topleveldomainrules.xml, Shady TLD web traffic detection - PR#1671 + (Bob-Andrews) - last_rootlogin_rules.xml, Sensitive login detection - PR#1671 + (Bob-Andrews) - unbound_rules.xml, added rule for maybe critical TLD request - PR#1672 + (Bob-Andrews) - rootcheck, Deleted repeating rules - PR#1674 + (ddpbsd) - Update info links in Windows rules - PR#1675 + (aquerubin) - Added decoder for pam_succeed_if - PR#1684 + + +General + (MangyCoyote) - ossec-analysisd, support Syslog ISO timestamp events with optional fraction of second - PR#1664 + (ddpbsd) - Fix compilation with PCRE2_SYSTEM=yes - PR#1666 + (aquerubin) - ossec-batch-manager.pl, update regexp for ipv6 addresses - PR#1667 + (mephesto1337) - Fix part of issue#1663, compiling with PCRE2_SYSTEM=yes - PR#1677 + (ddpbsd) - active-response, Fix for issue#1647, log disable-account.sh to the correct location - PR#1683 + (aquerubin) - Copy resolv.conf on build event - PR#1685 + (almirb) - active-response, Corrected the way active-response logs are generated on windows - PR#1689 + (atomicturtle) - ossec-execd, Expose filename variable in AR add/delete events - PR#1695 + + + + OSSEC changelog (3.2.0) diff --git a/CONFIG b/CONFIG index 664585e4e..fac52b8df 100644 --- a/CONFIG +++ b/CONFIG @@ -1,4 +1,4 @@ -OSSEC v3.2.0 +OSSEC v3.3.0 Copyright (C) 2019 Trend Micro Inc. diff --git a/INSTALL b/INSTALL index da63f9c05..dbe2f7fdc 100644 --- a/INSTALL +++ b/INSTALL @@ -1,4 +1,4 @@ -OSSEC v3.2.0 +OSSEC v3.3.0 Copyright (C) 2019 Trend Micro Inc. diff --git a/README.md b/README.md index 36a113195..ed377bb50 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -OSSEC v3.2.0 Copyright (C) 2019 Trend Micro Inc. +OSSEC v3.3.0 Copyright (C) 2019 Trend Micro Inc. # Information about OSSEC diff --git a/contrib/version_bump.sh b/contrib/version_bump.sh index b07fe6d83..ae4986caf 100755 --- a/contrib/version_bump.sh +++ b/contrib/version_bump.sh @@ -33,7 +33,11 @@ sed -i -e "s/Agent v${OLDVERSION}/Agent v${NEWVERSION}/" src/win32/help.txt # misc sed -i -e "s/OSSEC v${OLDVERSION}/OSSEC v${NEWVERSION}/" INSTALL sed -i -e "s/OSSEC v${OLDVERSION}/OSSEC v${NEWVERSION}/" README.md +sed -i -e "s/OSSEC v${OLDVERSION}/OSSEC v${NEWVERSION}/" CONFIG +sed -i -e "s/OSSEC v${OLDVERSION}/OSSEC v${NEWVERSION}/" BUGS # update defs.h -sed -i -e "s/v${OLDVERSION}/v${NEWVERSION}" src/headers/defs.h +sed -i -e "s/v${OLDVERSION}/v${NEWVERSION}/" src/headers/defs.h + +# Update CONFIG diff --git a/src/VERSION b/src/VERSION index 6d260c3af..b299be978 100644 --- a/src/VERSION +++ b/src/VERSION @@ -1 +1 @@ -v3.2.0 +v3.3.0 diff --git a/src/headers/defs.h b/src/headers/defs.h index 097e6f99b..b18dd1942 100644 --- a/src/headers/defs.h +++ b/src/headers/defs.h @@ -39,7 +39,7 @@ /* Some global names */ #define __ossec_name "OSSEC HIDS" -#define __version "v3.2.0" +#define __version "v3.3.0" #define __author "OSSEC Foundation" #define __contact "contact@ossec.net" #define __site "https://www.ossec.net" diff --git a/src/init/ossec-client.sh b/src/init/ossec-client.sh index 51c8f0a3c..265d03f2d 100755 --- a/src/init/ossec-client.sh +++ b/src/init/ossec-client.sh @@ -11,7 +11,7 @@ DIR=`dirname $PWD`; ### Do not modify below here ### NAME="OSSEC HIDS" -VERSION="v3.2.0" +VERSION="v3.3.0" DAEMONS="ossec-logcollector ossec-syscheckd ossec-agentd ossec-execd" [ -f /etc/ossec-init.conf ] && . /etc/ossec-init.conf diff --git a/src/init/ossec-local.sh b/src/init/ossec-local.sh index 325e2a0b1..1a85a2095 100755 --- a/src/init/ossec-local.sh +++ b/src/init/ossec-local.sh @@ -19,7 +19,7 @@ if [ $? = 0 ]; then fi NAME="OSSEC HIDS" -VERSION="v3.2.0" +VERSION="v3.3.0" DAEMONS="ossec-monitord ossec-logcollector ossec-syscheckd ossec-analysisd ossec-maild ossec-execd ${DB_DAEMON} ${CSYSLOG_DAEMON} ${AGENTLESS_DAEMON}" ## Locking for the start/stop diff --git a/src/init/ossec-server.sh b/src/init/ossec-server.sh index a48463e37..5a12515b3 100755 --- a/src/init/ossec-server.sh +++ b/src/init/ossec-server.sh @@ -19,7 +19,7 @@ if [ $? = 0 ]; then fi NAME="OSSEC HIDS" -VERSION="v3.2.0" +VERSION="v3.3.0" [ -f /etc/ossec-init.conf ] && . /etc/ossec-init.conf; diff --git a/src/win32/help.txt b/src/win32/help.txt index b2e2b6f9c..0a4156f0d 100644 --- a/src/win32/help.txt +++ b/src/win32/help.txt @@ -1,4 +1,4 @@ -** OSSEC Windows Agent v3.2.0 ** +** OSSEC Windows Agent v3.3.0 ** ** Copyright (C) 2014 Trend Micro Inc. ** diff --git a/src/win32/ossec-installer.nsi b/src/win32/ossec-installer.nsi index a4b0e59fa..4064220f0 100644 --- a/src/win32/ossec-installer.nsi +++ b/src/win32/ossec-installer.nsi @@ -25,7 +25,7 @@ ; general !define MUI_ICON favicon.ico !define MUI_UNICON ossec-uninstall.ico -!define VERSION "3.2.0" +!define VERSION "3.3.0" !define NAME "OSSEC HIDS" !define SERVICE "OssecSvc"