v1.9.0-beta1

This version adds experimental support for Elasticsearch.

v1.8.1

This minor release of NFR fixes an issue where some of the IP packets from zeek logs where incorrectly skipped by the log reader/monitor.

v1.8.0

New NFR release which brings improvements to Bro/Zeek log monitoring:

• Added support for HTTP logs, so you can now score HTTP traffic from http.log file.
• Fixed issues with DNS/IP log parser.

This is a recommended upgrade for all the Bro/Zeek users.

v1.7.0

New NFR version capable of reading HTTP events from Suricata log files. There was also a bug with fetching a lot of alerts at once (#66), which got fixed.

Finally, new JSON field has been added (#70) – severity – indicating max severity across all the threats. This is useful for filtering high severity alerts without need to parse threats dictionary. At the same time type field has been removed as it was always set to "alert", hence not very useful.

v1.7.0-beta1

Added initial support for reading and submitting HTTP events – currently only from Suricata log files. At this point the only output supported is a native JSON.

v1.6.0

This release brings improvements (and breaking changes) to alerts format for files and syslog. A new, CEF format, is now available and significant changes to JSON format has been introduced. In the previous versions, after fetching alerts from API, a beefy JSON object with array of alerts was emitted. This array could hold up to 1000 alerts and was really hard to work with. Since NFR version 1.6.0, each alert is presented as a separate JSON object.

v1.5.2

This is a minor release fixing issue with MSDNS logs not being parsed according to a local timezone, but always UTC. This was causing problems mainly for users ahead of UTC as uploaded events were seen as being set far in the future and ignored by scoring system.

v1.5.2-edge

Side release with support for reading BlueCat DNS Edge format.

v1.5.1

Disable JA3 as it's causing problems, but is not being used by AlphaSOC API yet.

v1.5.0

This release brings better support for monitoring files on Windows and MSDNS file format + some general bug fixes.