Skip to content

0.2.0

Compare
Choose a tag to compare
@misje misje released this 15 May 20:53
· 68 commits to master since this release

Added

  • Enrich User-Account (user_id) from SIDs in registry keys
  • Search registry keys with a number of options, include partial matches,
    ignoring SIDs in keys, and accepting several hive name formats

Changed

  • Use OpenCTI API version 6.1.1 and test against this version

Fixed

  • Use correct section level in config reference docs.
  • Fix spelling and other minor details in docs
  • Use correct setting names (with WAZUH_ prefix) in docker-compose examples
  • When enriching reg. keys, include full path (a bug caused only the hive name
    to be produced)
  • Fix lucene regex escaping: only escape single backslashes
  • Fix path escaping: Don't search-replace a minimum of two backslashes. One is
    enough