CHANGES

2.3.0-dev.10 | 2024-01-15 10:56:14 +0100

  * Various maintenance:

      - Add pre-commit config.
      - Reformat Zeek scripts with `zeek-script`.
      - Update license.
      - Hardcode Ubuntu version for CI.

2.3.0-dev.5 | 2024-01-09 08:54:27 +0100

  * `authorized_keys`: Split file globs by platform. Scanning
    `/home/*` can cause trouble on macOS so we now maintain separate
    globs per platform.

2.3.0-dev.3 | 2022-07-12 10:57:09 +0200

  * By default, listen on 0.0.0.0 for WebSocket. Zeek's default is 127.0.0.1.

2.2.0 | 2022-07-06 10:28:27 +0200

  * Enable WebSocket support on Zeek >= 5.0.

  * Update tables for Windows changes.

2.1.0 | 2022-03-29 12:36:09 +0200

  Requires Zeek Agent >= 2.1.0.

  * Extend SSH table script to log `sshd` configuration options. We
    also rename the SSH script and some of its identifiers to reflect
    the broadened scope.

  * Change default subscription mode to not return an initial table
    snapshot. So far differential queries first returned an initial
    snapshot of the table, and then ongoing diffs from there onwards.
    Because doing so leads to substantial event volume when connecting
    to an agent, the default now skips the initial snapshot: the first
    result will just be empty, and it's then diffs from there onwards.
    The old behavior can be restored through options that all table
    scripts offer to changer their subscription modes back.

  * Update to agent's new column types for built-in tables. A number
    of table columns have changed their types with Zeek Agent 2.1.

  * Remove commit ID from generated version number.

  * Add missing script documentation, plus small script clean up.

  * Reformat Zeek scripts with current zeek-format.

2.0.2 | 2022-03-04 16:31:32 +0100

  * Tweak release naming.

2.0.1 | 2022-02-22 13:35:59 +0100

  * Change default listening port to 9998.

2.0.0 | 2022-02-21 15:06:23 +0100

  * Ensure that we are always listening on the default Broker port.

  * Extend query API to allow specifying tables that must/must not be present.

  * Publish GitHub releases for the package on tag creation.

  * Provide version of Zeek and package to agents.

  * Add CI running tests.