4.14.0 Release notes - 23 October 2025

This section lists the changes in version 4.14.0. Every update of the Wazuh solution is cumulative and includes all enhancements and fixes from previous releases.

Highlights

The 4.14.0 release enhances the IT Hygiene capability with an expanded inventory that now includes browser extensions, endpoint services, users, and groups. It also introduces a new Microsoft Graph API dashboard for monitoring activity and audit events from Microsoft cloud services, and adds support for hot reload of Wazuh agent configuration. In addition, this release introduces multiple stability, performance, and security improvements across the platform.

  • Inventory – Browser Extensions: Added a unified inventory model to track browser extensions across Windows, macOS, and Linux systems. Enables security auditing and compliance monitoring for Chrome, Firefox, Safari, and other browsers.

  • Inventory – Services: Introduced a normalized inventory of Windows services and Linux systemd units. Provides visibility into service states, startup types, and critical services across endpoints.

  • Inventory – Users & Groups: Implemented a cross-platform inventory for system users and groups. Supports normalized data structures, relationships, and consistent queries across agents, Wazuh-DB, and the Dashboard.

  • Wazuh agent configuration hot reload: The Wazuh Agent can now apply remote configuration changes dynamically without breaking its connection to the server. All daemons except agentd are restarted during reload, improving resilience and reducing disruptions across large deployments.

  • Microsoft Graph API dashboard: A new dashboard has been added to visualize and query Microsoft Graph services, including Microsoft Azure cloud events.

What's new

This release includes new features or enhancements as the following:

Wazuh manager

  • #30848 Added system users and groups to the inventory data.

  • #31614 Added browser extensions and services to the inventory data.

  • #31731 Added IPv6 support to the Maltiverse integration.

  • #30192 Improved databaseFeedManagerTesttool.

  • #30793 Adapted wazuh-maild to the RFC5322 standard.

  • #31218 Improved the Active Response endpoint performance.

Wazuh agent

  • #30235 Added support for Parquet version 2 in the AWS wodle.

  • #30797 Added hot configuration reload support for Linux agents.

  • #31163 Added support for Amazon Inspector v2.

  • #30369 Added system users and groups to the inventory data.

  • #805 Added browser extensions to the inventory data.

  • #807 Added services to the inventory data.

  • #31418 Added missing AWS regions us-gov-west-1 and us-gov-east-1 to the AWS wodle.

  • #32413 Added Windows kernel version information to IT Hygiene.

  • #31640 Changed rootkit error messages to warnings due to future deprecation.

RESTful API

  • #30913 Added Syscollector users and groups endpoints.

  • #31513 Added Syscollector services and browser_extensions endpoints.

Ruleset

  • #30745 Added SCA content for Rocky Linux 10.

  • #31747 Added SCA content for Debian 13.

Other

  • #31272 Updated packaging dependency to 25.0.

  • #30536 Updated requests to version 2.32.4.

  • #30624 Updated urllib3 to version 2.5.0 and protobuf to version 5.29.5.

  • #30916 Upgraded Python embedded interpreter to 3.10.18.

  • #31779 Updated OpenSSL to 3.0.15 and cpp-httplib to v0.25.0.

  • #29586 Updated SQLite dependency to version 3.50.4.

Wazuh dashboard

  • #7777 Added visualizations field validations when creating wazuh-states index patterns.

  • #7554 Created Users & Groups inventories. #7587 #7792 #7787

  • #7586 Added the ability to set the Wazuh data path (wazuh directory) within the directory defined through the path.data setting.

  • #7641 Added a new Browser Extensions tab in IT Hygiene. #7696 #7729 #7774 #7785

  • #7516 Added Microsoft Graph API module. #7644 #7661

  • #7646 Added a new Services tab in IT Hygiene. #7695 #7729 #7773 #7790

  • #7711 Added a final step in the Deploy new agent section to navigate back to the agent list.

  • #7712 Updated OS logos.

  • #7742 Changed the Services tab label to Listeners in IT Hygiene > Networks.

Resolved issues

This release resolves known issues as the following:

Wazuh manager

  • #29663 Fixed internal decoder RC startup.

  • #29673 Fixed queue stats RC over wazuh-analysisd.

  • #29672 Fixed race condition in the event queue.

  • #29699 Fixed regexCompile race condition.

  • #30653 Fixed malformed alerts in alerts.log when the <group> tag contains newline characters.

  • #31599 Fixed and improved dpkg version comparison algorithm in Vulnerability Detector.

Wazuh agent

  • #30831 Fixed errors in Azure Graph event fields.

  • #30877 Added the missing prov`i`der field to the whodata section in the syscheckd JSON configuration.

  • #31700 Fixed journald disabled filters when both configuration blocks have no filters.

  • #30215 Fixed whodata FIM compatibility with the latest audit versions.

  • #31875 Fixed mismatch between MTU values in the database and indexer for Windows agents.

RESTful API

  • #31046 Fixed secure headers configuration.

  • #31315 Fixed display of sensitive information for non-privileged users.

Ruleset

  • #29976 Fixed multiple Rocky Linux SCA checks generating incorrect results.

  • #30173 Fixed missing check (2.3.7.6) in Windows Server 2019 v2.0.0.

  • #30276 Fixed camel casing in ownCloud ruleset header.

  • #30489 Fixed false positive in check 2.3.3.2 for macOS 13, 14, and 15 SCA.

  • #30529 Fixed bug in rule 92657.

  • #30528 Fixed field names in Office 365 rules.

  • #30515 Fixed action field in Fortigate rules.

  • #30612 Fixed Auditd EXECVE sibling decoders.

  • #31227 Fixed issues with Windows OS languages other than English.

  • #30717 Reworked SCA policy for Debian Linux 12.

  • #32025 Fixed missing comma in 0393-fortiauth_rules.xml.

  • #32102 Fixed Windows SCA user account checks.

  • #32106 Fixed inaccuracies in Ubuntu 24.04 SCA policy.

  • #32143 Fixed incorrect service name in Ubuntu firewall service check.

Wazuh dashboard

  • #7811 Fixed missing scan settings in Inventory Data.

  • #7796 Fixed the Endpoint summary to correctly display outdated agents without filters, resolving previous inconsistencies.

  • #7596 Fixed missing provider and queue_size fields in whodata configuration.

  • #7630 Fixed an error that caused PDF report tables to overflow the page width.

  • #7611 Fixed TypeError when changing API host ID in wazuh.yml configuration.

  • #7669 Fixed behavior and appearance alignment with OpenSearch (Wazuh Indexer) Dev Tools.

Changelogs

The repository changelogs provide more details about the changes.

Product repositories

Auxiliary repositories