Version 2.3.0
Pre-release
Pre-release
Preliminary release notes (will be updated when this becomes an official release)
Major fixes:
- FIM security improvements around hardlinks (should be enabled only on the most critical directories, as it requires a separate inotify watch for each file -- default behavior only watches the directories, but that allows for missed changes via hardlinks)
- Fix for multiple hubble processes issues (kills previous process if found when
hubble -dis started) - Fix for wrong systemd run-level, causing hubble to sometimes come up before the network and stop reporting.
- Automatically remove stale gitfs lockfiles in case of an ill-timed kill -9 or restart
- Better retry for fileserver updates, especially on startup
- Automatically increase max watches in for inotify to keep FIM running smoothly
Major features:
- Azure blob storage support
- S3 bucket support
- Moving user config to separate files (
/etc/hubble/hubble.d/*.conf) to aid in config verification and updates - New pulsar module for windows based on NTFS journaling which improves performance
- Ability to fallback on local fileserver sources in case of no default gateway to reach public storage (such as S3)
- Ability to collect the contents of changed files in FIM. (very narrow scope to prevent accidentally harvesting secrets)
- Timing information for osquery queries so we can catch performance issues earlier
- New splunk log level so we can log more information to splunk, as well as all error and warning logs, for easier debugging
- Periodic grains refresh so hubble will pick up on hostname changes automatically. Logs the new grains to splunk if splunklogging is configured.
- New version of osquery with bugfixes and more features