forked from outflanknl/RedELK
-
Notifications
You must be signed in to change notification settings - Fork 0
/
releasenotes.txt
66 lines (56 loc) · 4.96 KB
/
releasenotes.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
RedELK release notes
### version 1.0.2
* Fixed silly bug in enrich.py that disabled Greynoise enrichment
### version 1.0.1
* Fixed bug in logstash filter rule when Apache doesn't have a hostname configured
* Tuned verbosity of Alarm.py
### version 1.0
* Support for Apache redirectors
* Support for Cobalt Strike 4.0
* Fixed bug in useragent alarm, now uses config file as input
* Added example configurations for HAProxy and Apache that show how to setup the logging required for RedELK
* Added example Cobalt Strike Mallable profile that works with the example configs of Apache and HAProxy
* Added RedELKFieldnames.md with detailed info on the field names in RedELK
* ES index haproxytraffic renamed to redirtraffic to better suit the support for Apache (and future redirectors)
* ES field name overhaul to better suit the support for Apache
* Renamed of Kibana views, visualisations and dashboards for better usability, i.e. Redirector Traffic, Red Team Operations, CS Downloads, CS Keystrokes, CS IOCs, CS Screenshots and CS Beacons.
* Adjustment of logstash filter rules to support the aforementioned renaming as well as Apache.
* Adjusting enrichment and alarming python scripts to support the aforementioned renaming.
* Changed alarm script to use redir destination c2* instead of cobaltstrike*
* Minor changes to type definitions of fields, e.g. IPs now stored as IP instead of string.
* Explicit check and quit with error for non-apt based distrubutions during installation.
* Redir installation script now checks for presence /etc/logrotate.d/haproxy before trying to adjust it.
* Dozens of minor changes
### version 0.9
* Support for Cobalt Strike 3.14
* Upgraded jvm to OpenJDK 11.0
* Upgraded Filebeat, Elasticsearch, Logstash and Kibana to 6.8.2
* Support for Cobalt Strike Downloads: downloaded files from each teamserver can be searched and downloaded directly from the RedELK Kibana interface. No more need to login to each teamserver to search and download files.
* Support for MITRE ATT&CK numbers in Cobalt Strike's task output. This is indexed as field "attack_technique". Fancy visuals are not yet included in this release.
* New alarm: rogue user-agents that connect to your C2 backend. Basic list (e.g. curl*, python*) is pre populated on /etc/redelk/rogue_useragents.conf
* Support for Cobalt Strike SMB and TCP type beacons. Regardless of type (SMB or TCP) linked beacons are now tracked in ES field 'beacon_linked' (true/false). Parent or child state is tracked in the field 'beacon_linkmode' (child or parent) and IP address of the parent/child is tracked in the fields 'target_linkparentnode' and 'target_linkchildnode'.
* Full support for changed logging in Cobalt Strike version 3.14. This includes more log files, structured time format logging as well as changed timestamp to now include (UTC) time zone. Thanks @fastlorenzo for quick fix on the time zone part.
* Modified hyperlinks in Kibana to screenshots, log files, etc. to include the new timestamp as used in Cobalt Strike version 3.14.
* Cobalt Strike profiles are rsynced to RedELK server. Interpretation and full inclusion in RedELK is to be done at a later moment.
* Much improved error checking and reporting in installation scripts.
* Installer now checks state of Kibana before continuing and inserting templates.
* Improved pre-install checks, e.g. already installed packages and existing directories.
* Version of ELK packages is fixed instead of installing the latest available version.
* Installer now better states essential manual post-installation steps.
* Fixed bug that made installers crash with 'unsupported locale settings' in some circumstances. Locale is now set explicitly during installation.
* Ownership and permission of logstash certificates are now set to work on Ubuntu 18.04 and higher.
* Modified Cobalt Strike logstash rules to use UTC instead of system's time zone.
* Fixed bugs in ES template to now have every IP address defined as type IP address.
* Many, many under the hood optimizations and bugfixes of python scripts used for enrichment and alarming.
* Added tracking of IP addresses for which alarms are sent; 1 alarm per applicable IP address.
* RedELK now tracks abuse.ch for known botnet IP addresses SSL certs of botnets. Data goes to /etc/redelk/abuse*.conf files. Alarming to be done in later release.
# RedELK now tracks multiple sources for known rogue domain names. Data goes to /etc/redelk/roguedomains.conf. Alarming to be done in later release.
### Version 0.8
* Default Kibana index is now set during installation - thanks @neu5ron
* Fixed installer bug in copying logstash certificates directory - thanks @justsly
* Fixed bug in redirector logstash rule, useragent regex was missing - thanks @justsly
* Multiple typos and errors in installation scripts - thanks @justsly and @fastlorenzo
* Significant addition of known AV username-hostname combinations
* Date header added to sending of emails - thanks @fastlorenzo
* Reformat of TOR exit node IP list for easier interpretation
### Version 0.7 - initial public version