3.2.2 Release notes

Manager-agent communication

It has been created an input buffer in the manager side, this queue will act as a congestion control by processing all the events incoming from agents.

Between other features of this queue, it dispatches events as fast as possible avoiding any delay in the communication process, and it warns when gets full stopping to ingest more events.

In addition, the capacity of the buffer is configurable in the remote section of the Local configuration.

Wazuh modules

Vulnerability-detector module has an improvement within the version comparator algorithm to avoid false positive alerts. It also has been fixed the behavior when the software inventory of an agent is missing.

Wazuh app: Kibana

The Wazuh app received lots of new improvements for this release. In addition to several bugfixes and performance improvements, these are the major highlights for this Wazuh app version:

• New dynamic visualization loading system. Now the app loads visualizations on demand, and never store them on the .kibana index.

• A new design for the Ruleset tab, providing the information about the rules and decoders in a cleaner, more organized way.

• A new system for role detection over index patterns when using the X-Pack plugin for the Elastic Stack.

• Refinements and adjustments to the user interface.

Other relevant changes

In addition to the previous points, another more changes included are:

• The Slack integration has been updated since some used parameters were deprecated by Slack. This integration allows Wazuh to send notifications to Slack when desired alerts are triggered.

• It has been fixed the agent group file deletion when using the Auth daemon. As well as the client of the daemon for old versions of Windows.

• Fixed the filter of the output syslog daemon when filtering by rule group.