New
Wazuh v4.14.1
Manager
Added
- Added IAM role support for VPC flow logs in the AWS wodle. (#32009)
- Added support for static and temporary AWS credentials in the Amazon Security Lake subscriber. (#32514)
Changed
- Optimized wazuh-db startup by executing agent schema creation in a single transaction. (#32401)
- Improved vulnerabilities index upgrade with hash-based mapping validation, automatic safe reindex, and backup cleanup. (#32463)
- Improved C++ logging mechanism to avoid unnecessary heap allocations. (#32069)
- Improved IndexerConnector error handling and response parsing to provide structured logging of 4xx/5xx errors. (#32521)
- Reduced default verbosity of wazuh-authd when handling invalid connections. (#32525)
- Remoted now reads internal options at process startup. (#32697)
Fixed
- Fixed manager vulnerability scan not triggering due to incorrect syscollector event provider topic name. (#32045)
- Fixed IndexerConnector abuse control to prevent data loss on failed syncs. (#32787)
- Fixed user tag handling by adding 'user' as an alias for the 'dstuser' static field. (#32107)
- Fixed JSON validation issues in Analysisd and SCA components. (#32057)
- Fixed a bug in Vulnerability Scanner where the DB offset was updated even in error cases. (#32829)
Agent
Added
- Added support for Homebrew 2.0+ in IT Hygiene for macOS. (#32746)
Changed
- Changed how the fim_check_ignore function works in case of negative regex cases. (#31080)
- Changed how null values for hotfixes are handled in the Windows agent. (#31375)
- Improved service shutdown procedure. (#32874)
Fixed
- Fixed indefinite waiting in FIM whodata health check. (#32383)
- Fixed graceful shutdown in FIM. (#31241)
- SHA256 of commands is now verified on every execution. (#32049)
- Fixed duplicate
<ca_store>configuration block during RPM package upgrades. (#32528) - Fixed a bug that prevented overwriting
<registry_limit>or<file_limit>options from remote configuration. (#31144) - Fixed a bug in Logcollector that prevented following symlinks when resolving wildcarded files. (#29853)
- Unified detection logs for wildcarded files in Logcollector. (#31222)
- Fixed a bug in FIM that did not recognize Registry keys unless they were UTF-8. (#32027)
- Fixed a bug in Logcollector that ignored all files with
<age>filter on Windows. (#32731) - Reverted IT Hygiene package vendor format on Debian: now includes name and email again. (#32812)
- Fixed a bug in IT Hygiene that reported duplicated Edge browser extensions. (#32785)
- Fixed reload of the
<labels>block via remote configuration. (#32838) - Fixed Windows installer to deploy SCA policies for Windows 2022 instead of Windows Server 2025. (#32836)
Ruleset
Changed
- Reworked SCA Policy for Microsoft Windows 10 Enterprise. (#31449)
- Fixed bug in Windows SCA. (#31349)
- Fixed mistaken alert due to expected regex. (#31102)
- Fixed SCA checks in Oracle Linux 9. (#31886)
- Fixed bugs in Windows Server 2016 SCA. (#32509)
- Fixed bugs in PAM decoder. (#32523)
- Fixed MacOS Sequoia SCA scans with errors. (#32480)
- Windows Server 2016 SCA policy not configured correctly. (#32802)