v1.5.0

New Features

• Add transform configuration option for acquisition (#2144) @blotus
• Add experimental support for re2 (#2138) @blotus
• S3 acquisition datasource (#2130) @blotus
• support ip and cidr based whitelists for capi and 3rd party blocklists (#2132) @buixor
• try to make reproducible build work (#2119) @sabban
• Distance support : Impossible travel (#2108) @buixor
• Implement "cscli config show-yaml" (#2191) @mmetc
• Add ParseKV and UnmarshalJSON helper (#2184) @LaurenceJJones
• add Hostname helper in expr and templating (#2193) @blotus
• Add B64decode expr helper (#2183) @blotus
• add a LogInfo expr helper (#2179) @buixor

Improvements

• Add cscli papi status and cscli papi sync (#2091) @blotus
• add papi_url in credentials file when enabling console_management, and remove it when disabling console_management (#2095) @blotus
• display source in alerts list when an alert has multiple decisions (#2098) @blotus
• New PAPI commands: reauth + force_pull (#2129) @blotus
• do not try to load PAPI is url is not set (#2099) @blotus
• CI: Static builds by default; replace bincover with go -cover from 1.20 (#2150) @mmetc
• File acquisition: log "file reopen" events instead of writing to stderr (#2139) @mmetc
• Allow running func tests while running containers with crowdsec (#2137) @mmetc
• match expr helper (#2126) @buixor
• properly update the time structure within event (#2122) @buixor
• add ToString() helper (#2100) @blotus
• Docker readme: update build instructions, recommend acquis.d and config.yaml.local (#2115) @mmetc
• add --origin to cscli decisions delete (#2109) @buixor
• support for regexps result cache (#2104) @buixor
• CI: Cache all built go modules (#2081) @mmetc
• Explain successful parsers only (#2063) @LaurenceJJones
• Option to disable remote lapi registration (#2010) @LaurenceJJones
• Stream decisions from db (#1927) @blotus
• CI: functional docker tests (#2056) @mmetc
• Show s00 stats instead of "first_parser" (#2055) @LaurenceJJones
• optimize blocklist fetch (#2039) @nitescuc
• optimization - remove useless login call (#2036) @nitescuc
• Add IsIPV4() and IsIP() helpers (#2050) @blotus
• more strings helpers (#2040) @buixor
• update default windows acquisition configuration (#2195) @blotus
• allow batching when importing decisions (#2192) @buixor

Bug Fixes

• Wait for both api and agent chans if necessary when daemonize is false or running on windows (#2155) @blotus
• check if the acquis tomb is dying while processing logs in replay mode for file/s3/docker (#2152) @blotus
• Properly load k8s audit configuration (#2158) @mmetc
• Allow subcommands to be activated by feature.yaml (#2156) @mmetc
• fix awkward stacktrace in conditional filter (#2145) @buixor
• Docker: don't re-register local agent if not needed (#2141) @mmetc
• Docker: correct behavior of AGENTS_ALLOWED_OU, BOUNCERS_ALLOWED_OU (#2140) @mmetc
• Unit tests: remove leftover files (#2134) @mmetc
• Report docker systems in version and user agents (#2136) @mmetc
• fix dateparse (#2135) @buixor
• CI: avoid conflict with pkg/build cache in golangci-lint action (#2123) @mmetc
• actually fix expr-debugger to work with the new version (#2124) @blotus
• cscli explain : avoid concurrent map writes (#2113) @buixor
• Fix cscli explain when running from testenv (#2114) @AlteredCoder
• Load lapi config for config show output (#2097) @mmetc
• Fix docker tests by increasing timeout (#2107) @mmetc
• Unit tests: fix authentication to localstack (#2106) @mmetc
• Fix log destination in one-shot mode (#2084) @mmetc
• CI: Limit parallel docker builds for performance on small machines (#2082) @mmetc
• ugly workaround to fix the tests (#2080) @sabban
• fix the way acquisition is stopped (#2069) @sabban
• Strip version with ~ instead of - (#2076) @AlteredCoder
• Fix docker tests (network creation) (#2077) @mmetc
• email plugin: add "starttls" as accepted encryption_type in the comment (#2068) @mmetc
• Propagate taints to top collections (fix #2064) (#2066) @mmetc
• fix message "empty scenario" (#2065) @mmetc
• Do not try to refresh JWT token when doing a login request (#2059) @blotus
• add indexes on the FK between alerts and {decisions,metas,events} (#2188) @blotus
• defaults to inotify to detect changes in file datasource to avoid too many call to stat() (#2181) @blotus

Chore / Deps

• timeout of ci jobs (20 -> 30) (#2160) @buixor
• Rename k8s_audit to k8s-audit (easier to type, consistent with labels) (#2153) @mmetc
• use expr.Function for custom functions instead of passing them in the env (#2133) @blotus
• Only use pgx for postgresql database (#2118) @blotus
• Update expr (#2110) @blotus
• Fix docker tests by increasing timeout (again) and move compose test to plugin (#2112) @mmetc
• Lint (type inference): remove redundant type declarations (#2111) @mmetc
• Run lint after tests instead of separate workflow (#2103) @mmetc
• Build notification plugins with current crowdsec; mod tidy (#2102) @mmetc
• Make: extract "goversion.mk" to reuse it in bouncers (#2101) @mmetc
• Rename directory "tests" to "test" (#2094) @mmetc
• Add tests and typo fixes (#2092) @mmetc
• Bump golang.org/x/net from 0.0.0-20220418201149-a630d4f3e7a2 to 0.7.0 in /plugins/notifications/slack (#2088) @dependabot
• Bump golang.org/x/net from 0.0.0-20220418201149-a630d4f3e7a2 to 0.7.0 in /plugins/notifications/splunk (#2086) @dependabot
• Bump golang.org/x/net from 0.0.0-20220418201149-a630d4f3e7a2 to 0.7.0 in /plugins/notifications/http (#2087) @dependabot
• Bump golang.org/x/net from 0.0.0-20220418201149-a630d4f3e7a2 to 0.7.0 in /plugins/notifications/email (#2085) @dependabot
• Bump golang.org/x/net from 0.0.0-20220722155237-a158d28d115b to 0.7.0 (#2089) @dependabot
• CI: limit -dev docker image to amd64 to speed up the pipeline (#2090) @mmetc
• Bump golang.org/x/text from 0.3.7 to 0.3.8 in /plugins/notifications/http (#2074) @dependabot
• Bump golang.org/x/text from 0.3.7 to 0.3.8 in /plugins/notifications/email (#2073) @dependabot
• Bump golang.org/x/text from 0.3.7 to 0.3.8 in /plugins/notifications/splunk (#2071) @dependabot
• Bump bats-core to 1.9 (#2083) @mmetc
• Bump golang.org/x/text from 0.3.7 to 0.3.8 (#2072) @dependabot
• Bump golang.org/x/text from 0.3.7 to 0.3.8 in /plugins/notifications/slack (#2070) @dependabot
• Docker tests: use pytest-cs 0.2 (#2079) @mmetc
• Pin pytest-cs to a stable tag, cache virtualenvs, don't install ipython in CI (#2075) @mmetc
• chore: simplify pkg/database/alerts (#2062) @mmetc
• replace log.Fatal -> fmt.Errorf (#2058) @mmetc
• Bump github.com/containerd/containerd from 1.6.12 to 1.6.18 (#2060) @dependabot
• Bump github.com/docker/distribution from 2.7.1+incompatible to 2.8.0+incompatible (#1996) @dependabot
• CAPI error code handling tests (#2027) @rr404
• CI: set GOBIN instead of go install + cp (#2030) @mmetc
• CI: build with go 1.20 (#2031) @mmetc
• test: bats-detect tests for "cscli setup" (#2057) @mmetc

Geolite2 notice

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Installation

Take a look at the installation instructions.