Tags: wumn290/whids
Tags
Changes: - 0xrawsec#87 Improve golang unit testing - auto generating OpenAPI definition from tests - OpenAPI definition
Fixed 0xrawsec#85: Add API endpoint to manage IOCs spread on endpoint… …s for detection
Fixed issues: - 0xrawsec#78: request feature - list closed report on a defined time period - 0xrawsec#77: Missing query criticality parameter on get /endpoint call - 0xrawsec#65: Archive reports - 0xrawsec#66: Implement /endpoint/{UUID}/report/archive - 0xrawsec#63: Make manager's data persistent
Fixed issues: - 0xrawsec#75 List endpoints by group / status in /endpoints - 0xrawsec#74 Implement API endpoint to update endpoints fields - 0xrawsec#73 List of ever loaded modules in report - 0xrawsec#72 Track list of loaded modules - 0xrawsec#61 Integrate with ETW
Changes: - new way to store events - new way to search for events Fixed issues: - 0xrawsec#68 showkey parameter in /endpoints - 0xrawsec#64 Change /alerts to /detections - 0xrawsec#60 Add score /endpoints - 0xrawsec#58 Date last alert in /endpoints - 0xrawsec#57 Add group member to manager API endpoint structure - 0xrawsec#56 Skip parameter in /logs /alerts - 0xrawsec#55 Limit parameter in /logs /alerts - 0xrawsec#54 Filter parameter in /rules API endpoint
Refactoring: - hids package - hook functions taking hids as first parameter to easily access config from hooks - removed global variables shared between hooks and HIDS - manager command handler moved from api package to hids to easily access hids config Fixed issues: - Implement actionnable rules: 0xrawsec#28 - Implement event count: 0xrawsec#29 - Enrich events with signature information: 0xrawsec#32 - Automatic canary folder management: 0xrawsec#33 - Ability to configure audit policies from WHIDS config: 0xrawsec#34 - Set File System Audit ACLs from config: 0xrawsec#35 - Generate IR ready reports on detections: 0xrawsec#36 - Dump process tree: 0xrawsec#38 - Enrich event with Gene process scoring: 0xrawsec#40 - Add Admin API to list and download artifacts dumped: 0xrawsec#42 - Directory listing command: 0xrawsec#44 - Implement hash command: 0xrawsec#45 - Implement osquery command: 0xrawsec#46 - Implement terminate command: 0xrawsec#47 - Implement stat command: 0xrawsec#48 - Implement walk command: 0xrawsec#49 - Implement find command: 0xrawsec#50 - Implement report command: 0xrawsec#51 - Implement processes command: 0xrawsec#52 - Implement drivers command: 0xrawsec#53
PreviousNext