3.6.0 Release notes

Logcollector

Logcollector has been enhanced with two new features:

• Now it works in multithread mode. This will improve the throughput and prevent delays among outputs.

• Wildcard reloading is now supported: files that match a wild-carded location will be monitored, no need to restart the agent.

File integrity monitoring

The policy monitoring (rootcheck) and file integrity monitoring (syscheck) engines now run independently, so they both can perform a scan at the same time.

Two new features have been added to file integrity monitoring:

• Tags for monitored items. This will make alert matching and classification easier.

• A new option to limit the recursion level (scanning folder depth) has been introduced.

Wazuh modules

• Introducing a re-work of the AWS S3 integration, now supporting CloudTrail, GuardDuty, Macie, IAM, and VPC Flow log data.

• The download of OVAL files for Vulnerability Detector has been fixed since Red Hat has changed its protocol to send this files.

• Custom command execution (wodle command) supports MD5/SHA1/SHA256 validation of the target binary for execution authorization.

Log analysis and management

• The manager will provide remote message statistics, including counting of messages received or dropped, and number of active TCP sessions.

• The size limit for logs has been extended from 6 KiB to 64 KiB.

• The analysis engine now interprets the hostname field of the input logs as the name of the agent, instead of name+IP. This allows CDB list lookup of agent name.