laurel

• Log CPU usage as part of status report
• Fix permissions inside container image

• New configuration option to filter events based on IP addresses, ports in SOCKADDR messages
• Bug fixes to avoid wrong/misleading SYSCALL.SCRIPT enrichments

• Fix bug in log rotation mechanism that would cause the statefile mechanism to fail
• Re-introduce container builds

New features and fixes:

• Save state across restarts (#133, #260)
• Apply labels for executables to processes found in /proc (#261)
• Fix parsing errors in some non-"enriched" messages from auditd
• Fix missing user/group translations (#253 )
• More flexible permissions for log files
• SELinxu and AppArmor policy updates (#255, #256 )
• Configurable build identifier

New features and fixes:

• Processes running as part of systemd services get service information added as part of the PID enrichment (https://github.com/threathunters-io/laurel/pull/243)
• Translate IO_URING operations (like auditd 3.1+) (https://github.com/threathunters-io/laurel/pull/248)
• Option to use a prefix instead of capitalized key names for enriched/translated data (https://github...