CHANGES

2.3.0-dev.119 | 2024-03-28 12:40:14 +0100

  * Bump 3rdparty submodules with 9 updates.

2.3.0-dev.117 | 2024-03-28 11:42:56 +0100

  * Bump submodules.

  * Group dependabot dependencies.

2.3.0-dev.105 | 2024-03-11 11:10:50 +0100

  * Bump submodules.

2.3.0-dev.96 | 2024-02-26 09:46:01 +0100

  * Bump submodules and GH actions.

2.3.0-dev.94 | 2024-01-15 10:58:04 +0100

  * Fix synchronization issue with console. If a query couldn't be
    processed, client and server could get synchronized.

  * Update license headers.

2.3.0-dev.90 | 2024-01-12 14:49:01 +0100

  * Linux: Integrate `bpftools` and add central manager for handling
    BPF programs. We now require `clang` for building the agent on
    Linux.

  * Linux: Add BPF-based `processes_events` and `sockets_events`
    tables. These remain experimental for now and may require further
    fine tuning.

  * Linux: Add function retrieve kernel version.

  * Add Dependabot configuration.

  * Update README.

  * Bump IXWebSocket.

2.3.0-dev.80 | 2024-01-09 09:15:06 +0100

  * Add `processes_events` and `sockets_events` tables on macOS. The
    former uses Endpoint Security, the latter a Network Extension.
    These remain experimental for now.

2.3.0-dev.78 | 2024-01-08 10:25:51 +0100

  * GH-8: Support attaching interactive console to a running agent.

    By default, an agent now creates a UNIX socket for its console that an
    external client can connect to. To connect to an already running
    agent, execute `zeek-agent -r` on the same machine (note that client
    and server must be running as the same user, probably `root`). Client
    and server can specify a different socket path through `-s <PATH>`.
    The environment variable `ZEEK_AGENT_SOCKET` can be set to specify the
    path as well.

    Remote consoles aren't support on Windows yet.

    Internally, we switch the classic local console over to the same IPC
    mechanism we now use for remote consoles, so that there's only one
    implementation. For Windows, where actual IPC isn't implemented yet,
    we provide a dummy implementation for this purpose that just forwards
    data inside the main (and only) process.

    Note: This has a known issue on Windows where the local console
    stops taking input after the first command. That remains to be
    fixed.

  * Reformat Zeek scripts with `zeek-script`.

  * Fix help message.

  * Fix return value of scheduler loop.

  * Bump `spdlog`.

  * Bump `fmt`.

2.3.0-dev.71 | 2023-12-20 12:11:13 +0100

  * Notarization updates and fixes. We now use Apple's new
    `notarytool` along with App Store Connect credentials.

  * Rework the EndpointSecurity manager.

  * Rework handling of macOS deployment target.

    By default, our deployment target is now the current platform's major
    version. That avoids problems with system libraries not matching in
    for what they were built.

    To set a different deployment target, there's now a corresponding
    `configure` option. We set that for CI builds.

    As part of this change, we also raise the CI's deployment target to
    Monterey.

  * Use `gawk` in `auxil` scripts.

  * Support tables that are disabled at first, but may later become active.

  * Make tables thread-safe.

  * Add helper to table class for getting current system time.

  * Build without Broker by default.

    Broker support isn't needed anymore with Zeek >= 5.0. We now build
    without it by default. To re-enable Broker support for Zeek 4.x,
    you can still configure with ``--enable-broker``.

    The pre-build binaries also no longer include Broker support.

  * Silence new clang-tidy warnings.

2.3.0-dev.61 | 2023-12-12 10:33:37 -0700

  * Avoid dereferencing cookie field that could intentionally be unset

2.3.0-dev.59 | 2023-12-11 09:56:46 -0700

  * Merge branch 'topic/timw/fix-timestamp-parsing'

    * topic/timw/fix-timestamp-parsing:
      Don't add timezone offset to ISO time, since it results in errors
      Parse 'timestamp' fields from json received from Zeek correctly

  * Don't add timezone offset to ISO time, since it results in errors

  * Parse 'timestamp' fields from json received from Zeek correctly

  * Update pathfind submodule for #include fix

2.3.0-dev.55 | 2023-12-01 09:42:11 -0700

  * Add section about building for Windows to README

  * CI: Use correct vcpkg root for Windows builds

  * Update vcpkg to 2023.11.20

    This fixes the build on Windows failing to find zlib.

  * Update doctest to v2.4.11

    This fixes, among other things, build failures on macOS due to sprintf
    being fully deprecated in XCode 14.

  * CI: Update ubuntu builds to use zeek 5.0.9 for ubuntu22, remove zeek 4.0 build

  * CI: Update github actions used across all jobs

  * CI: Update to macOS 13

    GitHub's action runner complains that we're still trying to use macOS 11
    and is killing the builds. This requires some tinkering with the brew
    packages that are installed, but don't like to update cleanly (python
    and php specifically).

2.3.0-dev.47 | 2022-11-29 15:58:23 -0800

  * Minor grammar fixes (William Stearns)

2.3.0-dev.45 | 2022-10-31 18:18:38 +0100

  * GH-52: Switch `glob::glob` to use `ghc::filesystem`.

  * Reorganize platform-specific code.

  * Factor out our CMake compile and link options.

  * Move macOS installer app into platform code.

2.3.0-dev.39 | 2022-08-05 10:29:03 +0200

  * Add a macOS network extension to the agent.
    On macOS, the agent was already running as a system extension. This
    adds the appropriate magic to hook into the OS as a "Network
    Extension", so that we gain access to network activity. We don't use
    this yet for anything, but this gets all the infrastructure pieces in
    place.

  * Add `stderr` as a log destination.

2.3.0-dev.36 | 2022-08-05 10:27:48 +0200

  * Use `p-ranav/glob` library for Windows `files` table.

2.3.0-dev.33 | 2022-07-28 13:56:49 +0200

  * Fix ccache on Windows

  * Update CI jobs to use `ccache-action@v1.2.2`.

2.3.0-dev.31 | 2022-07-19 11:15:45 +0200

  * Adding Windows installer packaging.

  * Publish Windows installer as part of the release workflow.

  * Add keys to ccache configs in CI to avoid collisions.

  * Set `ZEEK_AGENT_VERSION_{MAJOR,MINOR_PATCH}` values during CMake.

2.3.0-dev.25 | 2022-07-12 13:16:30 +0200

  * Extend macOS support:

    - Add installer application and turn the agent into a system
      extension. The installer does three things: (1) it asks the
      system to install the extension persistently; (2) it interacts
      with the user through a small UI, including offering some basic
      configuration; and (3) it communicates with the running
      extension through XPC for configuration and status checks.
      Application and extensions get bundled into a DMG, and signed
      and notarized during CI.

    - Implement `system` logging on macOS.

    - Read preferences from system's `org.zeek.zeek-agent` via
      `defaults`.

    - Relocate default paths for configuration and state to
      `/Library/Application Support/ZeekAgent`, or the user's version
      of that if not running as root. (This may not be final yet.)

    - Make Endpoint Security available internally (not used yet).

    - Add new icons for macOS. (Matti Bispham)

  * Switch default log level to `info`.

  * Make agent robust against platforms potentially not being able to
    determine paths for configuration and state files.

  * Fix bug on Linux/macOS determining admin mode.

2.3.0-dev.10 | 2022-07-08 13:37:18 +0200

  * Rework Windows build to use `vcpkg` for dependencies.

  * Fix a couple of minor issues for Windows.

  * Rename our internal format method to avoid ambiguity with
    `std::format`.

  * Remove duplicated `out_ptr` license info.

2.3.0-dev.5 | 2022-07-07 16:51:52 +0200

  * Prettify WebSocket error messages.

  * Do not install IXWebSocket headers.

  * Update CI configuration to not treat `v.*-dev` tags as releases.

  * Revert unintended submodule bumps.

2.2.0 | 2022-07-05 12:04:10 +0200

  * Port to Windows. (Binary build to come with next release.)

  * GH-25: Add `files_columns` table that extracts selected columns
    from on-disk files und sends them over to Zeek as a record. See
    the `README` for documentation.

  * GH-7: Extend the type system for table columns. We can now
    represent addresses, booleans, counts, intervals, ports, records,
    sets, times, and vectors end-to-end, so that they arrive as such
    at Zeek. We also update our tables to use the new types where
    appropriate.

  * GH-34: Disable communication with a Zeek instance if it's package
    version is too old.

  * Add a 2nd 'differences' mode to queries where no initial snapshot
    is provided. We now have (1) "snapshot-and-diffs", which sends an
    initial snapshot first, followed by diffs; and (2) "diffs", which
    sends an empty initial result and then just diffs.

  * Add WebSocket transport layer compatible with Zeek 5.0. We now try
    both Broker and WebSocket when connecting to Zeek. The former will
    work with Zeek 4.0, the latter with Zeek 5.0.

  * Add Broker version to agent handshake.

  * Support default values for table parameters.

  * Make exception available to table's data acquisition methods to signal failure.

  * Move numerical version number computation from CMake to runtime.

  * Fix deadlock in scheduler.

  * Fix potential dereference of unset optional.

  * Fix usage message.

  * Fix `assert` that could wrongly trigger.

  * Fix console getting stuck on queries with errors, and reduce
    unintended latency until query executes.

  * Fix CI issue on Ubuntu.

  * Fix potential deadlock in unit test.

  * Fix trace-level debug logging.

  * Fix linker issue on Linux.

  * Make --test output available on failure in BTest suite.

  * Clean up unused state in Zeek communication code.

  * Format Zeek scripts with current zeek-format.

  * Update SQLite to 3.38.1 to give us built-in JSON support.

  * Update stduuid module.

2.0.4 | 2022-03-04 16:55:11 +0100

  * Add new log options. In the configuration file we now provide more
    control of log messages:

        [log]
        type=<stdout|system|file>
        level=<error|warn|info|debug|trace>
        path=<path for type 'file'>

    Default remains logging to stdout at level INFO.

  * Fine-tune log levels. We elevate some high-level messages to INFO
    level that can be useful to users, and we move some noisy debug
    messages to TRACE level (which is available only in debug builds).

  * Expose Broker's SSL options in configuration file. This also moves
    all Zeek options into a `[zeek]` section of the configuration
    file.

  * Link against standard version of OpenSSL by default. So far we
    hardcoded always using the static OpenSSL libraries. Now that's
    done only when with configured with ``--enable-static``, otherwise
    we use whatever CMake determines being the default.

  * Fix column type in `files_lines` table.

  * Fix enforcement of maximum idle timeout.

  * Add missing include to appease GCC 11.2.1.

  * Update toml++.

2.0.3 | 2022-02-22 13:36:47 +0100

  * Adapt to package's new default listening port.

  * Fix problem with column caching.

2.0.2 | 2022-02-21 16:36:16 +0100

  * Push all asynchronous activity to the main thread to avoid most
    inter-thread locking.

  * Fix configure's `--sanitizer` argument.

  * In `.schema` output, break out table parameters separately.

2.0.1 | 2022-02-21 15:26:44 +0100

  * Add a test build of the source code tarball to CI.

  * Extend query API to allow specifying tables that must/must not be
    present. Agents will ignore queries not meeting expectations.

  * Extract version information from Zeek's hello message.

  * Adapt to changes to options in the Zeek package.

  * Fix differential queries returning empty removed rows.

  * Fix time filtering for differential queries.

  * Fix double table deactivation.

  * Guard against an error case in Darwin system logs collector.

2.0.0 | 2022-02-14 16:14:48 +0100

  * Initial release.