Skip to content

v4.3.5

Compare
Choose a tag to compare
@pyth0n1c pyth0n1c released this 18 Sep 16:46
· 198 commits to main since this release
dbd3ea9

In addition to some cleanup, this release includes two significant features:

  1. Versioning enforcement has been added to that when a Detection is updated in a new release, its version field MUST be updated. This is important so that applications built with contentctl can take advantage of Splunk Enterprise Security 8's "Detection Versioning" feature! This enforcement has been added to the inspect workflow.
  2. The enrichments workflow has changed, When building with enrichments, both the Atomic Red Team and Mitre CTI repos must be checked out. This update was made because it results in faster builds (when enrichments are enabled) and more stable and reliable builds using the Mitre CTI repo. We previously used the MITRE TAXII server, which is accessed via API in the attackcti client, but that API was frequently down, making us unable to build/test/release ESCU.

What's Changed

Full Changelog: v4.3.4...v4.3.5