Skip to content

Version 2.3.0

Pre-release
Pre-release

Choose a tag to compare

@basepi basepi released this 12 Apr 21:54
· 2370 commits to develop since this release
520115e

Preliminary release notes (will be updated when this becomes an official release)

Major fixes:

  • FIM security improvements around hardlinks (should be enabled only on the most critical directories, as it requires a separate inotify watch for each file -- default behavior only watches the directories, but that allows for missed changes via hardlinks)
  • Fix for multiple hubble processes issues (kills previous process if found when hubble -d is started)
  • Fix for wrong systemd run-level, causing hubble to sometimes come up before the network and stop reporting.
  • Automatically remove stale gitfs lockfiles in case of an ill-timed kill -9 or restart
  • Better retry for fileserver updates, especially on startup
  • Automatically increase max watches in for inotify to keep FIM running smoothly

Major features:

  • Azure blob storage support
  • S3 bucket support
  • Moving user config to separate files (/etc/hubble/hubble.d/*.conf) to aid in config verification and updates
  • New pulsar module for windows based on NTFS journaling which improves performance
  • Ability to fallback on local fileserver sources in case of no default gateway to reach public storage (such as S3)
  • Ability to collect the contents of changed files in FIM. (very narrow scope to prevent accidentally harvesting secrets)
  • Timing information for osquery queries so we can catch performance issues earlier
  • New splunk log level so we can log more information to splunk, as well as all error and warning logs, for easier debugging
  • Periodic grains refresh so hubble will pick up on hostname changes automatically. Logs the new grains to splunk if splunklogging is configured.
  • New version of osquery with bugfixes and more features