« back to all changes in this revision
Viewing changes to NEWS
- browse files at revision 8
- compare with another revision
- download diff
- download tarball
- view history from revision 8
- Committer: Bazaar Package Importer
- Author(s): Pierre Chifflier
- Date: 2009-06-14 10:00:20 UTC
- mfrom: (1.1.7 upstream)
- Revision ID: james.westby@ubuntu.com-20090614100020-479f60e0m8ae7hq0
Tags: 0.9.15-1
New upstream release
- files added:
- sensor.py
- files removed:
- scripts/prewikka-httpd~
- files modified:
- NEWS
added
removed
NEWS
1
* 2009-06-08, prewikka-0.9.15:
2
3
- Make it obvious when a column is filtered by replacing the old sober
4
star with a big "[filtered]" red marker. If the column filter is
5
saved, then the marker color will go from red to black.
6
7
- Once the user filtered a given field by clicking on it, deny further
8
click so that it is clear that the filter is currently active.
9
10
- Re-write the inline filter implementation using Cheetah + Jquery, in
11
place of generating an enormous amount of javascript code. This
12
drastically reduce the size of the events listing HTML page, and will
13
allow for much easier modification of the inline-filters.
14
15
- Only propose filter operator relevant to the selected path.
16
17
- Inline filter now present a single input field (with no path and
18
operator selection). Using this field, the user can filter on what is
19
seen in the associated column. For example, in the classification
20
column, the filter will trigger a search on classification.text,
21
classification.reference.name and classification.reference.origin.
22
23
There is also an [advanced] button allowing the user to specify both
24
the path and the operator.
25
26
- Implement a reset button in each inline filter column, that allow to
27
switch between different version of the filter: last saved filters,
28
default filters, or current filters.
29
30
- The user can now click an alert completion to set an inline filter on
31
the completion value.
32
33
- Clicking on a port / protocol now trigger a CSS menu allowing to
34
filter on the port and protocol information, or to get information
35
concerning this port / protocol.
36
37
- Clicking on a classification reference now trigger a CSS menu which
38
allow to filter on the reference, or to get more information
39
concerning it.
40
41
- Clicking on classification now add a filter on the selected
42
classification (previously, it would have unfolded aggregated alerts
43
for the selected entry, which is now done clicking the alert count).
44
45
- Until now, the default user that was automatically created by Prewikka
46
if there was no administrative user was "admin". As of now you can
47
define the initial administrative username and password from the
48
configuration file. (fix #289).
49
50
- Fix escaping for reference details URI parameters.
51
52
- Fix ModPython content-type handling.
53
54
- Invalid variable name, fix #339.
55
56
- Update to JQuery 1.3.2, and fit small JQuery API change.
57
58
- If the installed libprelude or libpreludedb version is too old,
59
Prewikka will require the user to upgrade. Currently, Prewikka depend
60
on libpreludedb 0.9.12, and libprelude 0.9.23.
61
62
- Fix IDMEFDatabase exception on empty criteria string (fixes #346).
63
64
- Analyzer retrieval fixes and speedup (fixes #350).
65
66
67
1
68
* 2008-03-27, prewikka-0.9.14:
2
69
3
70
- Let the user choose the type of sorting (default to time descending,
7
74
as well as message summary (require twisted.names and twisted.internet),
8
75
see the additional dns_max_delay settings parameters in prewikka.conf.
9
76
10
- In the alert summary view, handle portlist and ip_version service fields,
77
- In the alert summary view, handle portlist and ip_version service fields,
11
78
and show alert messageid.
12
79
13
80
- Fix exception when rendering ToolAlert.
32
99
33
100
- Only perform additional database request when using Sensor localtime:
34
101
this bring a performance improvement of about 36% on aggregated query,
35
when using either frontend localtime (the default), or UTC time.
102
when using either frontend localtime (the default), or UTC time.
36
103
37
104
- JQuery support: Port most of the javascript code to make use of JQuery.
38
105
Add show/hide effect to CSS popup. More filtering functionality in the
39
SensorListing view.
106
SensorListing view.
40
107
41
108
- Cleanup the Authentication class, so that uper Prewikka layer can act
42
109
depending whether the backend support user creation / deletion. Anonymous
44
111
45
112
- Better integration of CGI authentication allowing user listing and deletion.
46
113
47
- Report template exception directly to the user.
114
- Report template exception directly to the user.
48
115
49
116
- Fix exception if an alert analyzer name is empty.
50
117
56
123
(which is a minor issue since the user is already authenticated). Thanks
57
124
to Helmut Azbest <helmut.azbest@gmail.com> for the fix.
58
125
59
- Fix a typo making mod_python use the parent method (patch from
126
- Fix a typo making mod_python use the parent method (patch from
60
127
Helmut Azbest <helmut.azbest@gmail.com>).
61
128
62
- In the configuration file, recognize section even if there are whitespace
63
at the beginning of the line.
129
- In the configuration file, recognize section even if there are whitespace
130
at the beginning of the line.
64
131
65
132
- Localization fixes, by Sebastien Tricaud <toady@gscore.org>, and
66
133
Bjoern Weiland.
110
177
111
178
* 2007-05-26, prewikka-0.9.11.2:
112
179
113
- In case a database schema upgrade is required, or the Prewikka
180
- In case a database schema upgrade is required, or the Prewikka
114
181
database does not exist, make the error available from the Prewikka
115
console, rather than exiting badly (which previously required the
182
console, rather than exiting badly (which previously required the
116
183
user to parse its web server log in order to find out the problem).
117
184
118
185
119
186
* 2007-05-25, prewikka-0.9.11.1:
120
187
122
189
123
190
- Fix incorrect locale switch when accessing certain pages.
124
191
125
192
126
193
* 2007-05-21, prewikka-0.9.11:
127
194
128
195
- Prewikka has been internationalized: user might choose the language
129
196
used in their settings tabs. Additionally, you might specify
130
197
a default locale using the "default_locale" configuration keyword.
131
198
132
- Brazilian Portuguese translation, by Edelberto Franco Silva<edeunix@edeunix.com>.
199
- Brazilian Portuguese translation, by Edelberto Franco Silva<edeunix@edeunix.com>.
133
200
- French translation, by Sebastien Tricaud <sebastien@gscore.org>.
134
201
- German translation, by Bjoern Weiland <mail@bjou.de>.
135
- Russian translation, by Valentin Bogdanov <bogdanov.valentin@gmail.com>.
202
- Russian translation, by Valentin Bogdanov <bogdanov.valentin@gmail.com>.
136
203
- Spanish translation, by Carlo G. Añez M. <carlo.anez@gmail.com>.
137
204
138
- New powerfull and scalable agent view, grouping agent together by
139
Location and Node.
140
205
- New powerfull and scalable agent view, grouping agent together by
206
Location and Node.
207
141
208
- In the Alert/Heartbeat summary view, number analyzers backward so that
142
209
it reflect the ordering in the analyzer list.
143
144
- Improved support for resizing menu.
145
146
- Fix a konqueror rendering bug with the inline filter.
210
211
- Improved support for resizing menu.
212
213
- Fix a konqueror rendering bug with the inline filter.
147
214
148
215
- Various bug fixes.
149
150
216
217
151
218
* 2007-04-05, prewikka-0.9.10:
152
219
153
- Don't show all source and target when they reach a predefined limit, instead
220
- Don't show all source and target when they reach a predefined limit, instead
154
221
provide an expansion link.
155
222
156
223
- Add two new view in the Events section: CorrelationAlert and ToolAlert.
157
158
- Ability to filter and aggregate on all IDMEF path. If the filtered path is
159
an enumeration, automatically provide the list of possible value.
160
161
- Add a combo box for the user to choose which criteria operator to use.
162
163
- Provide an enumeration filter for the type of alert (Alert, CorrelationAlert,
224
225
- Ability to filter and aggregate on all IDMEF path. If the filtered path is
226
an enumeration, automatically provide the list of possible value.
227
228
- Add a combo box for the user to choose which criteria operator to use.
229
230
- Provide an enumeration filter for the type of alert (Alert, CorrelationAlert,
164
231
ToolAlert, OverflowAlert).
165
232
166
233
- Prewikka can now aggregate by analyzer.
167
168
- When a session expire and the user login, the user is redirected to the page
234
235
- When a session expire and the user login, the user is redirected to the page
169
236
he attempted to access when the session expired.
170
237
171
238
- When an error occur, the default Prewikka layout is now preserved.
172
173
- Correct handling of empty value for hash key generation. Fix #204.
174
175
- Use new libpreludedb function that return the results as well as the number
176
of results. This avoid using COUNT() in some places (namely, this speedup
239
240
- Correct handling of empty value for hash key generation. Fix #204.
241
242
- Use new libpreludedb function that return the results as well as the number
243
of results. This avoid using COUNT() in some places (namely, this speedup
177
244
non aggregated view by ~50%).
178
245
179
246
- Avoid iterating the list of database result more than needed.
180
247
181
248
- Support IDMEF Action, SNMPService, and WebService class.
182
249
183
250
- Improved support for small screen resolution.
184
185
251
252
186
253
187
254
* 2007-02-06, prewikka-0.9.9:
188
255
189
256
- Improve database performance by reducing the number of query. (Paul Robert Marino)
190
257
191
258
- Activate CleanOutput filtering (lot of escaping fixes).
192
259
193
260
- More action logging.
194
261
195
262
- Bug fixes with the error pages Back/Retry buttons.
196
263
197
264
- Fix error on group by user (#191).
198
265
199
266
- Fix template compilation error with Cheetah version 2 (#184).
200
267
201
268
202
269
* 2006-11-23, prewikka-0.9.8:
203
270
204
271
- Save/load user configuration when using CGI authentication mode (#181).
205
272
206
273
- Show Prewikka version in the About page (#177).
207
274
208
- Use Python logging facility (available backend: stderr, file, smtp, syslog),
275
- Use Python logging facility (available backend: stderr, file, smtp, syslog),
209
276
multiple simultaneous handler supported (#113).
210
277
211
278
- Fix anonymous authentication.
222
289
223
290
224
291
* 2006-08-18, prewikka-0.9.7.1:
225
292
226
293
- Fix filter interface bug introduced in 0.9.7.
227
294
228
295
- Improved error reporting on filter creation.
232
299
233
300
* 2006-08-16, prewikka-0.9.7:
234
301
235
- Use preludedb_delete_(alert|heartbeat)_from_list(). Require
236
libpreludedb 0.9.9. Provide a deletion performance improvement
302
- Use preludedb_delete_(alert|heartbeat)_from_list(). Require
303
libpreludedb 0.9.9. Provide a deletion performance improvement
237
304
of around 3000%.
238
305
239
- Handle multiple listed source/target properly. Separate
306
- Handle multiple listed source/target properly. Separate
240
307
source/target in the message listing.
241
308
242
309
- Make host command/Information link available from the Sensor
243
310
listing.
244
311
245
- Always take care of the "external_link_new_window" configuration
246
parameter.
247
248
- Make external command handling more generic. Allow to specify
312
- Always take care of the "external_link_new_window" configuration
313
parameter.
314
315
- Make external command handling more generic. Allow to specify
249
316
command line arguments.
250
317
251
- Allow to define unlimited number of external commands rather than
252
only a defined subset (fix #134).
318
- Allow to define unlimited number of external commands rather than
319
only a defined subset (fix #134).
253
320
254
321
- Avoid toggling several popup at once in the HeartbeatListing.
255
322
257
324
258
325
- New address and node name lookup provided through prelude-ids.com service.
259
326
260
- Link to new prelude-ids.com port lookup instead of broken portsdb
327
- Link to new prelude-ids.com port lookup instead of broken portsdb
261
328
database (fix #162).
262
329
263
330
- Various bug fixes.
271
338
272
339
- Show multiple source/target in message listing/summary.
273
340
274
- Fix invalid use of socket.inet_ntoa() to read ICMP Gateway Address,
341
- Fix invalid use of socket.inet_ntoa() to read ICMP Gateway Address,
275
342
which is stored as string (#156).
276
343
277
344
- Fix aggregation on IDMEF-Path that are not string.
299
366
- Intelligent display for CorrelationAlert. Include correlated
300
367
alert information in the alert listing.
301
368
302
- Intelligent printing of Network centric information.
369
- Intelligent printing of Network centric information.
303
370
304
371
- Fix Cheetah compilation for the heartbeat page.
305
372
319
386
- Distribute SQLite schema.
320
387
321
388
- Fix exception in the heartbeat analysis view when the heartbeat_count
322
or heartbeat_error_margin settings are explicitly set (#124).
389
or heartbeat_error_margin settings are explicitly set (#124).
323
390
324
- Fix Cheetah 1.0 heartbeat listing exception (#119).
391
- Fix Cheetah 1.0 heartbeat listing exception (#119).
325
392
326
393
- Open external link in new windows by default. Add a configuration option
327
394
to disable opening external link in new window (#61).
328
395
329
- Provide the ability to specify the configuration file that Prewikka
396
- Provide the ability to specify the configuration file that Prewikka
330
397
use (#117).
331
398
332
399
- Sanitize the limit parameter in case the input value is not correct
333
instead of triggering an exception (#118).
400
instead of triggering an exception (#118).
334
401
335
- Handle the preludeDB "file" setting (for use with SQLite like database).
402
- Handle the preludeDB "file" setting (for use with SQLite like database).
336
403
337
404
- Fix filter saving issue in the heartbeat listing.
338
405
348
415
349
416
- Add an "Unlimited" timeline option.
350
417
351
- Fix classification escaping problem that could lead to empty
418
- Fix classification escaping problem that could lead to empty
352
419
listing when unwiding alert with classification text containing backslash.
353
420
354
- Don't print un-necessary separator when the protocol field is
421
- Don't print un-necessary separator when the protocol field is
355
422
empty in the alert listing.
356
423
357
- Improve Correlation Alert display. Allow focus both on the Correlation Alert
424
- Improve Correlation Alert display. Allow focus both on the Correlation Alert
358
425
summary and on the correlated alert listing.
359
426
360
- Don't propagate the "save" parameter, so that the user don't end up saving
361
settings without knowing about it.
427
- Don't propagate the "save" parameter, so that the user don't end up saving
428
settings without knowing about it.
362
429
363
430
364
431
* 2005-11-30, prewikka-0.9.1:
365
432
366
- Resolve the protocol number from the message summary view.
433
- Resolve the protocol number from the message summary view.
367
434
368
- Separate port and protocol value, so that we don't end up
435
- Separate port and protocol value, so that we don't end up
369
436
linking the protocol to portdb if there is no port.
370
437
371
438
- Ability to setup IDMEF filter using iana_protocol_name and iana_protocol_number.
373
440
- Sanitize timeline years value on system which does not support time
374
441
exceeding 2^31-1. Fix #104.
375
442
376
- Mark CorrelationAlert explicitly in the AlertListing.
443
- Mark CorrelationAlert explicitly in the AlertListing.
377
444
378
- Make inline filter mark more visible.
445
- Make inline filter mark more visible.
379
446
380
447
- Ability for the user to save settings for the current view.
381
448
384
451
- Fix a bug where clicking the IP address popup would cause
385
452
Firefox to go back to the top of the page. Fix #112.
386
453
387
- Don't hardcode path to /usr/bin/python, but resort to
454
- Don't hardcode path to /usr/bin/python, but resort to
388
455
/usr/bin/env to find it.
389
456
390
457
394
461
395
462
- Minor rendering fix.
396
463
397
- Handle service.iana_protocol_name / service.iana_protocol_number
464
- Handle service.iana_protocol_name / service.iana_protocol_number
398
465
as well as service.protocol.
399
466
400
467
436
503
437
504
- Show target file in the message listing.
438
505
439
- Much more information in the alert summary view.
506
- Much more information in the alert summary view.
440
507
Especially useful for users of integrity checker.
441
508
442
509
488
555
- XHTML conformance in most of the code.
489
556
490
557
- Fix possible exception with filtered classification text.
491
558
492
559
- Allow filtering on heartbeat.analyzer.name.
493
560
494
561
503
570
Fix Javascript warnings. Correct URL escaping. Make it work
504
571
better in Apple's Safari browser.
505
572
506
- More error checking when saving custom filter. Error out in case a
573
- More error checking when saving custom filter. Error out in case a
507
574
filter reference non existing criteria. Add the substr operator.
508
575
509
- Fix bug in the whole alert/heartbeat navigation system, simplify
510
and cleanup the code, always report the current filtered field 'action' to
576
- Fix bug in the whole alert/heartbeat navigation system, simplify
577
and cleanup the code, always report the current filtered field 'action' to
511
578
the user.
512
579
513
- Make the mouse pointer behave like it does for javascript links on Alert
580
- Make the mouse pointer behave like it does for javascript links on Alert
514
581
listing table head.
515
582
516
- Fix alert mixup when expanding an aggregated classification with different
583
- Fix alert mixup when expanding an aggregated classification with different
517
584
severity.
518
585
519
586
- Fix low/mid/high/none severity filtering.
520
587
521
588
- Fix a bug where agents with multiple address would disappear.
530
597
- Add an heartbeat_error_margin configuration keyword.
531
598
532
599
- Saving modification to an existing filter now work.
533
534
- Make prewikka.cgi catch exceptions that are raised during the prewikka
600
601
- Make prewikka.cgi catch exceptions that are raised during the prewikka
535
602
initialization step and display an error screen to the user instead of
536
603
a server internal error.
537
604
565
632
- Update Auth cookie expiration time.
566
633
567
634
- Fix escaping issue.
568
635
569
636
570
637
* 2005-04-05, prewikka-0.9.0-rc4:
571
638
581
648
login for no appearent reasons.
582
649
583
650
- Set default session expiration time to 60 minutes.
584
585
651
652
586
653
* 2005-03-31, prewikka-0.9.0-rc3:
587
654
588
655
- Installation cleanup / bugfix.
Loggerhead is a web-based interface for Breezy
Version: 2.0.1