Skip to content

Releases

4.4.1

4.4.1 Latest
Latest

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 18 Oct 17:27
4.4.1
4bb34a1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.4.1) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

OSSEC 4.4.1 is a maintenance release on the v4.4.0 branch.

Bug Fixes

Contributors

atomicturtle
Assets 4
Loading

4.4.0

4.4.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 05 Oct 20:19
4.4.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
3e69293
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.4.0) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

OSSEC 4.4.0 adds three main capabilities; other enhancements and fixes are listed below.

  • Windows FIM attributes and ACLs — Opt-in check_attrs for Hidden/System/attribute change alerts and check_acl for NTFS DACL/ACE matrix alerts (#1352, #2285).
  • GeoIP via libmaxminddb — Replaces EOL GeoIP Legacy with GeoLite2 MMDB lookups, plus ASN/country enrichment and GeoIP IDS rules (#1828, #2259).
  • JSON syslog alerts — ossec-csyslogd forwards analysisd JSON alerts so agent_name is a first-class field. jsonout stays on when the XML tag is omitted; alerts rotation remains with monitord (#1907, #2302).

General

  • @atomicturtle - Add opt-in Windows FIM check_attrs for Hidden/System/attribute change alerts (#1352)
  • @atomicturtle - Add opt-in Windows FIM check_acl for NTFS DACL/ACE matrix alerts
  • @ddpbsd / @atomicturtle - PR 1828 - Replace EOL GeoIP Legacy with libmaxminddb (GeoLite2 MMDB) for analysisd GeoIP
  • @atomicturtle - GeoIP IDS rules (multi-country auth, impossible-travel) plus ASN/country enrichment; SSH invalid-user dstuser extraction; feed if_matched_group when sid_prev_matched is also set
  • @atomicturtle - PR 2302 - Forward analysisd JSON alerts over syslog so agent_name is a first-class field; keep jsonout on when undeclared

Bug Fixes

Contributors

AdUser, atomicturtle, and 2 other contributors
Loading
0 Join discussion

4.3.0

4.3.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 25 Aug 14:05
4.3.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
82f8583
This commit was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.

OSSEC changelog (4.3.0) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

OSSEC 4.3.0 adds three main capabilities; other enhancements and fixes are listed below.

  • FIM maintenance mode — Per-agent mode via agent_control -M (enable, disable, status, end with -u <id>). While enabled, syscheck accepts file changes into the baseline without generating integrity alerts. end restarts syscheck/rootcheck and clears maintenance when that scan finishes (#677, #1289, #1681).
  • TCP/TLS syslog_output — ossec-csyslogd supports TCP and optional TLS (protocol, tls, tls_verify, tls_ca) in addition to UDP. Alert payloads (default/CEF/JSON/Splunk) may use up to OS_MAXSTR instead of a 2048-byte limit (#1762).
  • ModSecurity audit logs — Collect libmodsecurity serial audit logs with the modsec-audit localfile format, and decode nginx ModSecurity error-log events with new rules (#1390).

General

Bug Fixes

  • @atomicturtle - PR 2295 - Fix syscheck queue/restart races and honor FIM <frequency> under realtime
  • @atomicturtle - Make PCRE2 JIT optional (soft-fail compile, match via pcre2_match) so analysisd starts on macOS (#2040)
  • @atomicturtle - Restore ossec-lua binary names after Lua 5.4.7 upgrade (#2245)
  • @atomicturtle - Accept AR expect username (alias of user), fall back to srcuser, and document fixed script argv (#2104)
  • @atomicturtle - Decode cPanel login lines from webmaild/whostmgrd/cpaneld as well as cpsrvd (#1132)
  • @atomicturtle - Avoid FIM false positives from xxx hash placeholders and checksum read failures (#1590, #1704)
  • @atomicturtle - Match web-accesslog URLs that contain spaces; do not treat POST as a simple ignored request (#914, #922)
  • @atomicturtle - Require more attack-group context and same_location for rule 40501 (#1082)
  • @atomicturtle - Stop treating MJ12bot as a malicious user agent in rule 31508 (#1317)
  • @atomicturtle - Ignore snap and /dev/loop df 100% alerts under rule 532 (#1418)
  • @atomicturtle - Label /var/ossec/logs as var_log_t for logrotate and allow logrotate_t on ossec_log_t (#1948)
  • @atomicturtle - Replace dead Honeynet Project link in rule 40601 (#2111)
  • @atomicturtle - Limit PHP CGI rule 31110 to .php and cgi-bin URLs (#1101)
  • @atomicturtle - Ignore ProFTPD sreaddir buffer growth as a false positive (#1015)
  • @atomicturtle - Pass CFLAGS/LDFLAGS into bundled ossec-lua/ossec-luac via MYCFLAGS/MYLDFLAGS (#1568)
  • @atomicturtle - Open csyslogd syslog_output sockets before chroot so hostnames work without losing OS_Connect multi-address fallback (#1744)
  • @atomicturtle - Emit a single To: plus one comma-separated Cc: for granular/extra recipients so ISPs stop rejecting duplicate To headers (#1901)
  • @atomicturtle - Strip Recv-Q/Send-Q from default netstat listen check to stop rule 533 false positives (#495, #2063)
  • @reyjrar / @atomicturtle - PR 235 - Canonicalize Windows FIM paths so realtime and scheduled scans use the same slash form
  • @lazyp / @atomicturtle - PR 564 - Skip leading XML declarations (and UTF-8 BOM) in OS_ReadXML
  • @AdUser / @atomicturtle - PR 2105 - Insert SQL NULL for missing alert src_ip/dst_ip in os_dbd (not the string 'NULL')
  • @doke2 / @atomicturtle - PR 663 - Log AGENTCONFIG path when reading shared agent.conf in syscheckd
  • @crlorentzen / @atomicturtle - PR 1124 - Fix PIX/ASA 6-308001/605004/605005 field extraction (masked/empty users, remote IP)

Contributors

reyjrar, AdUser, and 10 other contributors
Loading
1 Join discussion

4.2.0

4.2.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 02 Aug 21:32
4.2.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
928b24e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.2.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

This release focuses on analysisd scalability and broader stability. Key enhancements include an always-on multi-threaded analysisd pipeline for Linux servers, pthread migration for manager daemons, rootcheck file-hash enrichment in alerts, and a self-contained Windows agent installer that ships required MinGW/OpenSSL runtime DLLs. It also includes numerous fixes across authd, maild, syscheck, logcollector, and rules.

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and Hu6li
Loading
0 Join discussion

4.1.0

4.1.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 27 May 15:44
4.1.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
67eefdc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (4.1.0)

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

Key enhancements include SMTP authentication support, IPv6 whitelisting improvements, and support for large files (>2GB). This release also includes multiple bug fixes for analysisd and logcollector crashes. This changelog is not yet complete

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and mobstef
Loading
0 Join discussion

4.1.0 RC1

4.1.0 RC1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 11 Apr 20:30
4.1.0-rc1
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
f657be9
This commit was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.

OSSEC changelog (4.1.0) support@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

This changelog is not yet complete

Key enhancements include SMTP authentication support, IPv6 whitelisting improvements, and support for large files (>2GB). This release also includes multiple bug fixes for analysisd and logcollector crashes. This changelog is not yet complete

Security Fixes

General

Bug Fixes

Contributors

atomicturtle and mobstef
Loading

# OSSEC 4.0.0 Release Notes

# OSSEC 4.0.0 Release Notes

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 01 Feb 21:47
4.0.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
69986fa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Maintainers

Contributors on this release

Release Notes

Major security and stability release addressing critical memory safety issues and modernizing cryptographic implementations. This release includes fixes for multiple heap use-after-free (UAF) vulnerabilities, uncontrolled recursion in XML parsing, and implementation of secure random number generation for agent key creation. Additionally, file integrity monitoring has been modernized with SHA-256 support, and several external dependencies have been updated to their latest stable versions.

⚠️ Breaking Changes

Warning

AES Encryption Now Default for Agent Communication

OSSEC 4.0.0 agents now use AES encryption by default for agent-server communication. This is NOT backwards compatible with OSSEC 3.8.0 and older servers.

Migration Options:

  1. Upgrade servers first (recommended): Update all OSSEC servers to 4.0.0 before upgrading agents.
  2. Use legacy Blowfish encryption on 4.0.0 agents: Add the following to your agent's ossec.conf: 
    <client>
  <crypto_method>blowfish</crypto_method>
</client>

Configuration Changes

  • SHA-256 File Integrity Monitoring: SHA-256 is now enabled by default for all monitored directories. No configuration changes are required for new installs.
  • To disable SHA-256 (if needed for compatibility): 
    <syscheck>
  <directories check_sha256sum="no">/etc</directories>
</syscheck>

🔒 Security Fixes

  • Critical Memory Safety: Fix critical UAF bug in memory leak fix (Issue #1818) - PR 2178
  • Heap UAF: Fix Issue #1817: Heap UAF in OSSEC Alert decoder with leak-free Eventinfo refactor - PR 2177
  • Recursion Fix: Fix uncontrolled recursion in os_xml _ReadElem (Issue #1953) - PR 2175
  • Secure RNG: Implement secure RNG for agent key generation using OpenSSL RAND_bytes - PR 2167

General Fixes & Improvements

  • FIM Modernization: SHA-256 integration and safe buffer handling - PR 2166
  • Lua Update: Update Lua to version 5.4.7 - PR 2165
  • zlib Update: Update zlib to version 1.3.1 - PR 2164
  • cJSON Update: Update cJSON to version 1.7.18 - PR 2163
  • Windows Builds: Build fixes for Windows - PR 2162
  • Packaging: Add RPM spec file - PR 2147
  • Agent Auth: Handle SSL EOF condition in agent-auth - PR 2146
  • Performance: Ignore ENOENT in OS_RemoveCounter to prevent benign error messages - PR 2171
  • Stability: Improve logcollector crash fix to check read function pointer (Issue #2156) - PR 2168
  • Testing: Improve error message in ossec-testrule for missing rule matches (Issue #2093) - PR 2170
  • CLI: Fix help/version argument exit codes - PR 2174
  • Bugfix: Fix for Issue #2056 in syscheck decoder - PR 2173
  • Code Quality: Clean up redundant NULL checks in report filter function (Issue #2133) - PR 2169

Contributors

atomicturtle
Loading
0 Join discussion

3.8.0

3.8.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 05 Jan 21:26
3.8.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
a282687
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OSSEC changelog (3.8.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

Update to authd to enforce chrooting, and privilege separation. The authd daemon will by default run as the ossec user. Adds support for AIX 7.x on power architecture (8/9/10).

General

Contributors

pwntester, ngarratt, and 6 other contributors
Loading
0 Join discussion

3.7.0

3.7.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 17 Jan 16:06
3.7.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
1ecffb1
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.7.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (http://www.atomicorp.com)

Contributors on this release

Release Notes

Support for Journald

What's Changed

New Contributors

Full Changelog: 3.6.0...3.7.0

Contributors

nurse, icy, and 13 other contributors
Loading

3.6.0

3.6.0

Choose a tag to compare

View all tags
@atomicturtle atomicturtle released this 14 Feb 21:05
3.6.0
This tag was signed with the committer’s verified signature.
atomicturtle Scott R. Shinn
GPG key ID: EE1B0E6B2D8387B7
Verified
Learn about vigilant mode.
9772223
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

OSSEC changelog (3.6.0) scott@atomicorp.com

Release Maintainers

Dan Parriott

Scott R. Shinn (http://www.atomicorp.com)

Contributors on this release

Release Notes

Its that time of year again, our annual independent security audit! Joining our previous two years auditors, Apple Security and OVH Internet is security researcher Daniel McCarney (@cpu) who performed a very in depth analysis on our IDS engine updates (PCRE2, and more). With a project as critical as OSSEC in securing cloud and enterprise assets its very important to us to have independent assessments of the framework. So again we want to thank all of our auditors, old and new for their contribution to the project.

Coder? Tester? Enthusiast? If you're interested in joining our team, or just interacting with the OSSEC community , email us for a slack invite at: invite@ossec.net

General

Loading