v1.6.1

• Minor improvements
  • Dropped CLI installation verification for CLI's not used by ULS
• Housekeeping
  • Added parallel testing processes to speed up testing (see Testing Readme)
  • added randomization tokens for "mocked" edgerc file (to avoid race condition in prallel testing)

v1.6.0

• Features

  • Support for Akamai Guardicore Segmentation (experimental)
    • Available feeds: netlog, incident, agent, system
      Please ensure to update your .edgerc file for GC usage
  • Support for Akamai Linode Cloud (experimental)
    • Available feed: audit
      Please ensure to update your .edgerc file for GC usage

• Minor improvements

  • ULS Install Script allows fully working ULS installation via a single script
  • ULS Updater helps to maintain a proper updated version of ULS + Modules
  • Amended Command Line Usage documentation on how to use the installer / updater
  • bumped python container (docker) to version 3.10.7
  • bumped ETP-CLI version to 0.3.9 which should massively reduce the fetch lag
  • Added documentation to explain high availability options for ULS

v1.5.1

• Bugfix
  • Use cli-eaa version 0.5.0.2 fixing a timezone issue on the EAA ADMIN feed

v1.5.0

• Performance improvements
  • Rework to handle large number of events (100k+ per minute) and fail safe
    when the Output can't cope with the pace of incoming events.
  • New parameters in bin/config/global_config.py:
    • If your output is slower than incoming events,
      ULS can buffer input_queue_size events. If buffer gets full, ULS will stop with an error message.
    • HTTP output can now aggregate messages, two options:
      • output_http_aggregate_count
      • output_http_aggregate_idle
• Minor improvements
  • new attributes in monitoring output:
    • event_ingested_interval # events read from CLI input
    • event_bytes_interval # total size in bytes processed
• Housekeeping
  • Documented missing dependencies in test/README.md

v1.4.0

• Features

  • Device Inventory (DEVINV) feed added for EAA (requires eaa-cli >= 0.4.9.1)

• Minor improvements

  • bumped EAA to version v0.5.0
  • bumped ETP to version v0.3.8
  • bumped python to version 3.10.4-slim-bullseye

• Bugfix

  • Fixed a bug in the test scripts to support real .edgerc

Version History

v1.3.5

• Minor improvements
  • More QRADAR log source type definitions (thx to bitonio)
  • Added docker-compose ETP - Tenant example

v1.3.4

• Minor improvements
  • Added QRADAR log source type definitions (thx to bitonio)
  • Added SUMO Logic (thx to huskar20 for the contribution)
  • bumped CLI-MFA to v0.0.9
  • added resources, nodeSelector, tolerations and affinity to the helm values.yaml / template

v1.3.3

• Bugfix
  • Adopted to new MFA CLI Version (only single feed "EVENT" available anymore)
  • Amended new dates to the file headers
  • Added volume to dockerfile as data storage for "autoresume"

v1.3.2

• Features

  • Kubernetes deployment example / Helm charts added (start here)

• Minor improvements

  • Bumped ETP-CLI to version 0.3.7 in Dockerfile
  • Bumped EAA-CLI version to 0.4.6 in Dockerfile

• Bugfixes

  • fixed issue when using file handler and rotation at "midnight" - running back in time for 30 days
  • added a sanity (dictionary) check for "--httpauthheader"
  • fixed a bug in http reconnecting forever in certain circumstances
  • added a sanity check for "HTTP_OUT_FORMAT" to avoid issues with the ´%s´ seclector
  • removed forced http authentication token "--httpauthheader" (allow None)
  • discovered a bug in configparser -> see FAQ entry

v1.3.1

• Bugfixes
  • fixed a checkpoint issue when using ETP / THREAD
  • some doc fixes