Repository navigation

Sensor base 0.76.6 - #146

Closed

djoreilly wants to merge 2021 commits into

SUSE:sensor-base-0.76.6from

djoreilly:sensor-base-0.76.6

Closed

Sensor base 0.76.6#146
djoreilly wants to merge 2021 commits into
SUSE:sensor-base-0.76.6from
djoreilly:sensor-base-0.76.6

This pull request is big! We're only showing the most recent 250 commits

Commits on Jan 7, 2026
Commits on Jan 8, 2026
- bugfix: DeleteMonitoringData.yaml also delete /monitoring_logs/* data (#4618)
  Niicolaa
  authored
  553514b
- fix: missing rpm release specification (#4620)
  Niicolaa
  authored
  7e4caea
Commits on Jan 12, 2026
- docs: update oidc-cognito authenticator (#4623)
  nullifysecurity
  authored
  aabf6f6
- Initial commit of local doc search (#4624)
  scudette
  authored
  2df6503
- Refined CSS for docs viewer. (#4626)
  scudette
  authored
  0c0cd70
Commits on Jan 13, 2026
- Update watch_ebpf() to use a policy (#4627)
  scudette
  authored
  84bf571
- Update watch_ebpf() to track policies in events. (#4628)
  scudette
  authored
  41c2e9a
Commits on Jan 14, 2026
- Bugfix: Prevent API call deadlock when logging before the event loop (#4631)
  scudette
  authored
  45f6b61
Commits on Jan 20, 2026
- fix: correct survey typo (#4635)
  0xThiebaut
  authored
  9096e25
Commits on Jan 21, 2026
- fix: side effect in getTypeFromComponents function (#4637)
  nullifysecurity
  authored
  0bc0043
Commits on Jan 29, 2026
- Update Acquisition.yaml (#4644)
  vojtechjelinek
  authored
  6101a68
- feat: expand the path using the environment in Admin.Client.UpdateClientConfig (#4630)
  0xThiebaut
  authored
  a9306a3
Commits on Feb 3, 2026
- Add version to Windows.Detection.Amcache to allow hutning on version … (#4646)
  mgreen27
  authored
  28d20b6
Commits on Feb 4, 2026
- Refactor process tracker. (#4647)
  scudette
  authored
  19ab65a
- Build(deps): Bump lodash from 4.17.21 to 4.17.23 in /gui/velociraptor (#4639)
  dependabot[bot]
  authored
  6fa5a70
- Update AMCache artifact (#4648)
  mgreen27
  authored
  ca23c7a
Commits on Feb 5, 2026
- Update docs search to include breadcrumbs (#4649)
  
  scudette
  and
  snyk-bot
  authored
  cc8aa11
Commits on Feb 9, 2026
- Bugfix: Notebook cell type selector not working (#4650)
  
  scudette
  and
  snyk-bot
  authored
  3114992
Commits on Feb 10, 2026
- Added logic to map clients by hostname if the Client ID is unknown for hunts. (#4615)
  
  ilostab
  and
  scudette
  authored
  71c6e75
Commits on Feb 11, 2026
- Build(deps): Bump axios from 1.13.2 to 1.13.5 in /gui/velociraptor (#4655)
  dependabot[bot]
  authored
  c531fbe
Commits on Feb 12, 2026
- Refactored rsyslog plugin (#4658)
  scudette
  authored
  f61cd39
Commits on Feb 14, 2026
Commits on Feb 19, 2026
- Bugfix: In flight flow calculation was stuck sometimes (#4668)
  scudette
  authored
  5c8ad24
Commits on Feb 20, 2026
- Add regex filters for IPs and ports in KernelNetwork.yaml (#4670)
  mgreen27
  authored
  8d84532
Commits on Feb 21, 2026
- fix(reformat): reformat overwrites content (#4672)
  nullifysecurity
  authored
  9ddb189
Commits on Feb 23, 2026
- feat(vql): add reformat function (#4675)
  
  nullifysecurity
  and
  scudette
  authored
  d7c0225
- Rate limit hunt dispatcher housekeeping thread (#4679)
  scudette
  authored
  18aea42
Commits on Feb 24, 2026
- Revise Amcache.yaml description for clarity (#4681)
  mgreen27
  authored
  843abe9
- User stats are now tracked and shown in the user screen (#4682)
  
  authored
  eee6e71
Commits on Feb 25, 2026
- Added write_file() function as an alias to copy() (#4683)
  scudette
  authored
  ed6e91f
- Bugfix: Overlay accessor failed to wrap LStat output (#4685)
  scudette
  authored
  7a78061
Commits on Feb 26, 2026
- feat: Use 50 workers for Server.Utils.CancleHunt for big environments (#4689)
  Niicolaa
  authored
  91fa1b7
- Bugfix: increase max size of embedded config to 100Mb (#4690)
  scudette
  authored
  0d48ee9
Commits on Feb 28, 2026
- Bugfix: Missing audit message on VFS Download request (#4692)
  scudette
  authored
  611f3bf
Commits on Mar 1, 2026
- Bugfix: deaddisk command did not recognize parition images correctly. (#4693)
  
  scudette
  and
  dependabot[bot]
  authored
  0cfdbac
Commits on Mar 2, 2026
Commits on Mar 3, 2026
- Update version on modified VQL plugins/functions (#4700)
  scudette
  authored
  e85682e
Commits on Mar 22, 2026
- Bugfix: Client Search bar did not unescape url params (#4706)
  scudette
  committed
  1ba90b5
- Bugfix: watch_evtx() plugin failed to cancel properly. (#4710)
  scudette
  committed
  5d14908
- Update FSEvents.yaml (#4708)
  
  herpf
  and
  scudette
  committed
  348ed72
- Build(deps): Bump dompurify from 3.3.1 to 3.3.2 in /gui/velociraptor (#4707)
  
  dependabot[bot]
  authored and
  scudette
  committed
  0502043
- VQL functions/stored queries can now define default values (#4711)
  scudette
  committed
  5581b53
- Added an index() plugin to build local full text indexes (#4715)
  scudette
  committed
  ed82f1d
- Update elastic client library to Version 9.3 (#4717)
  scudette
  committed
  6091b4d
- Updated build to reduce binary size. (#4719)
  scudette
  committed
  9ff38ec
- feat: add tags to hunt function (#4723)
  
  nullifysecurity
  authored and
  scudette
  committed
  9701a2f
- Support free form kwargs in a more natural way (#4724)
  scudette
  committed
  a67a9f0
- Improve Debian Packages artifact (#4721)
  
  misje
  and
  scudette
  committed
  3912f06
- Invert incorrect logic in snap status filter (#4725)
  
  misje
  authored and
  scudette
  committed
  691502e
- Order journal entries by time (#4726)
  
  misje
  authored and
  scudette
  committed
  8ad082f
- Improve styling of bundled docs search (#4727)
  
  predictiple
  authored and
  scudette
  committed
  4affbbf
- Fix overzealous css heading selector (#4729)
  
  predictiple
  authored and
  scudette
  committed
  aefce37
- Add two VQL suggestions to Evtx artifact (#4728)
  
  misje
  authored and
  scudette
  committed
  1a2d9d8
- Cache bleve index for some time. (#4731)
  scudette
  committed
  2b90700
- Debounce index freshness check to ensure we do not check too often (#4733)
  scudette
  committed
  b7d3644
- Change index() plugin to use Batch mode which is much faster (#4734)
  scudette
  committed
  96f544a
- Add support for alphanumeric-only e-mail barrier (#4735)
  
  misje
  authored and
  scudette
  committed
  ffd25f5
- Added more checks to the artifact verifier (#4736)
  scudette
  committed
  c17c050
- Build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4740)
  
  dependabot[bot]
  authored and
  scudette
  committed
  cc8f9a5
- Build(deps): Bump github.com/russellhaering/goxmldsig from 1.3.0 to 1.6.0 (#4739)
  
  dependabot[bot]
  authored and
  scudette
  committed
  49f197d
- Rework automated OIDC role assignment (#4741)
  scudette
  committed
  872b1f9
- Build(deps-dev): Bump flatted from 3.2.7 to 3.4.2 in /gui/velociraptor (#4745)
  
  dependabot[bot]
  authored and
  scudette
  committed
  537c8b6
- Update the cache() and memoize() plugins to use disk based lru (#4746)
  scudette
  committed
  1ba1616
- Added filters on users list in the user management screen. (#4747)
  scudette
  committed
  c123eba
- Rework command line parser for run mode. (#4749)
  scudette
  committed
  d801ec6
- Added API support to the artifacts collect command. (#4750)
  scudette
  committed
  c6704e0
- Prepare for the 0.76.1 release
  scudette
  committed
  844a96b
Commits on Mar 24, 2026
- Allow a zip file to be imported with the --definitions flag (#4752)
  scudette
  committed
  18f46b4
- Bugfix: unzip -p did not work (#4753)
  scudette
  committed
  ace3b08
Commits on Mar 25, 2026
Commits on Apr 8, 2026
- Update sumo build targets (#4767)
  scudette
  committed
  4007f0f
- Use random tracee policy names (#4766)
  
  misje
  and
  scudette
  committed
  b614f4c
- Bugfix: Hunt dispatcher did not load index while it was being built (#4770)
  
  scudette
  and
  dependabot[bot]
  committed
  f8fda88
- Refactor hunt dispatcher to improve tracking (#4775)
  scudette
  committed
  5031b75
- Update SysmonInstall.yaml (#4776)
  
  iboje
  authored and
  scudette
  committed
  2c4dfd8
- Refactored journal service (#4777)
  
  scudette
  and
  dependabot[bot]
  committed
  454a4df
Commits on Apr 15, 2026
- Various bugfixes back ported to 0.76 branch (#4788)
  scudette
  authored
  1c6f3b7
Commits on Apr 28, 2026
- Build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  
  dependabot[bot]
  authored and
  scudette
  committed
  6cee195
- Build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#4783)
  
  dependabot[bot]
  authored and
  scudette
  committed
  bc80de2
- Build(deps): Bump axios from 1.13.5 to 1.15.0 in /gui/velociraptor (#4784)
  
  dependabot[bot]
  authored and
  scudette
  committed
  eca8226
- Refactored event queues to carry the caller to watchers (#4785)
  scudette
  committed
  2c00916
- Bugfix: Start dispatcher in background to avoid pauses at startup (#4786)
  scudette
  committed
  d11d82d
- Initial implementation of a velociraptor container. (#4791)
  scudette
  committed
  2099688
- Fix external links (#4793)
  
  predictiple
  authored and
  scudette
  committed
  84e3142
- Fix broken syntax -- causes build failure (#4794)
  
  weslambert
  authored and
  scudette
  committed
  b85b14f
- Add ability to message users in the GUI (#4795)
  scudette
  committed
  a79bb66
- Add DeadDisk remap fix for Registry.Hunter (#4796)
  
  mgreen27
  authored and
  scudette
  committed
  94f5728
- Genericize the Server.Import.Exchange utility artifact (#4797)
  
  predictiple
  authored and
  scudette
  committed
  bc94f41
- Spelling fix (#4798)
  
  predictiple
  authored and
  scudette
  committed
  18dd7df
- Remove hunt dispatcher housekeeping thread. (#4802)
  
  scudette
  and
  dependabot[bot]
  committed
  c779d7d
- Store GUI state in sessionStorage (#4804)
  scudette
  committed
  dc8049b
- Bugfix: When using WSS client info messages were replayed. (#4805)
  scudette
  committed
  ac20786
- Place limits on memory allocations to avoid out of memory errors. (#4806)
  
  scudette
  and
  dependabot[bot]
  committed
  7165598
- Bugfix: verify yaml fields in secrets. (#4807)
  scudette
  committed
  7700994
- Prepare for 0.76.4 release
  scudette
  committed
  1ae66ef
- Update axios dep
  scudette
  committed
  dbd2e69
Commits on Apr 30, 2026
- Remove support for old client APIs (#4812)
  scudette
  committed
  8ba3219
- Update Prefetch.yaml (#4811)
  
  mgreen27
  authored and
  scudette
  committed
  b5d192e
- Prepare for 0.76.5 release
  scudette
  committed
  a58cde8
Commits on Jun 3, 2026
- Sync master to 0.76 release branch (#4859)
  scudette
  authored
  20c779e
Commits on Jun 22, 2026
- build: create magefiles/ directory
  
  jeffmahoney
  authored and
  djoreilly
  committed
  bcd1e2d
- magefile.go: use current architecture for Linux builds
  
  jeffmahoney
  authored and
  djoreilly
  committed
  387aada
- Add systemd-dev as build dependency for github workflow
  
  jeffmahoney
  authored and
  djoreilly
  committed
  26726bd
- github: run testcases on Linux builds in new workflow
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2f8ae10
- linux: add lsattr() function to enumerate file attributes
  
  lorddoskias
  authored and
  djoreilly
  committed
  7dd4b7b
- Linux.Detection.ImmutableFiles: Enumerate immutable files under a path
  
  lorddoskias
  authored and
  djoreilly
  committed
  a7882f5
- Add parser to read systemd journal on Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d569ed2
- Update the Linux.Syslog.SSHLogin artifact to scan the systemd journal
  
  jeffmahoney
  authored and
  djoreilly
  committed
  72d7911
- Update the Linux.Events.SSHLogin artifact to scan the systemd journal
  
  jeffmahoney
  authored and
  djoreilly
  committed
  243e4ef
- SUSE: Add SSHLogin artifacts
  
  jeffmahoney
  authored and
  djoreilly
  committed
  26990ad
- SSHLogin: require _TRANSPORT != 'kernel' from watch_journal()
  
  jeffmahoney
  authored and
  djoreilly
  committed
  272793f
Commits on Jun 23, 2026
- vql/linux/bpf: add support to add bpf plugins for Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  a193a87
- vql/linux/bpf/tcpsnoop: Add tcpsnoop plugin
  
  authored and
  djoreilly
  committed
  f1e010a
- vql/linux/bpf/dnssnoop: Add dnssnoop() plugin
  
  authored and
  djoreilly
  committed
  7953700
- vql/linux/bpf/chattrsnoop: Add plugin to catch changes to inode attributes
  
  authored and
  djoreilly
  committed
  afb7d5d
- vql/linux/bpflib: add sample vmlinux.h includes for test builds
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2dcb129
- Add custom artifacts for login and logout attempts recorded by auditd
  
  guangyee
  authored and
  djoreilly
  committed
  8af1252
- Linux.Events.ProcessExecutions: catch 32-bit execve calls
  
  chajain
  authored and
  djoreilly
  committed
  a5ebe5f
- Add artifact to monitor user group updates (#24)
  
  guangyee
  authored and
  djoreilly
  committed
  efd1cb3
- file_store/directory/buffer: add direct-serialized interface
  
  jeffmahoney
  authored and
  djoreilly
  committed
  faa2e3c
- utils/refcount: add simple refcount implementation
  
  jeffmahoney
  authored and
  djoreilly
  committed
  064fc94
- file_store/directory/listener_bytes: Add listener to use serialized interface
  
  jeffmahoney
  authored and
  djoreilly
  committed
  738963f
- vql/linux/audit: use go-libaudit v2 for live audit message processing
  
  jeffmahoney
  authored and
  djoreilly
  committed
  c24562d
- vql/linux/audit: rearchitect plugin for scalability
  
  jeffmahoney
  authored and
  djoreilly
  committed
  21164d2
- Extend audit artifacts to use new interface
  
  chajain
  authored and
  djoreilly
  committed
  6d5160a
- vql/linux/cronsnoop: Add cronsnoop() plugin
  
  authored and
  djoreilly
  committed
  e042aba
- Updating the NewFiles and ProcessStatuses Artifacts
  
  chajain
  authored and
  djoreilly
  committed
  1ddfcca
- Add Linux.Sys.Bash to Server.Monitor.Shell artifact
  
  jeffmahoney
  authored and
  djoreilly
  committed
  a44726d
- rpm: introduce rpm vql plugin
  
  jeffmahoney
  authored and
  djoreilly
  committed
  28dab6a
- vql/functions/hash: cache results on Linux
  
  jeffmahoney
  authored and
  djoreilly
  committed
  5eaa142
- hash: fix nil pointer dereference panic
  djoreilly
  committed
  3d78319
- Fix shadowed variable in hash.go
  djoreilly
  committed
  5939624
- SUSE: add Docker files
  
  jeffmahoney
  authored and
  djoreilly
  committed
  d5fb773
- SUSE: Add docker-compose environment
  
  jeffmahoney
  authored and
  djoreilly
  committed
  53f3f39
- cronsnoop: fix panic when crontab has empty line
  djoreilly
  committed
  f41a73a
- vql/linux/audit: actually add test cases
  
  jeffmahoney
  authored and
  djoreilly
  committed
  f441797
- vql/linux/audit: don't overload EAGAIN
  
  jeffmahoney
  authored and
  djoreilly
  committed
  67f3199
- vql/linux/audit: gofumpt -extra
  
  jeffmahoney
  authored and
  djoreilly
  committed
  e7310ab
- vql/linux/audit: fix staticcheck checks
  
  jeffmahoney
  authored and
  djoreilly
  committed
  fba6610
- bpf: add libbpf/include/uapi to the include path for bpf.h
  
  jeffmahoney
  authored and
  djoreilly
  committed
  bfe03a3
- bpf: only build libbpf in the go generate stage
  
  jeffmahoney
  authored and
  djoreilly
  committed
  386650a
- vql/linux/audit: fix test suite handling
  
  jeffmahoney
  authored and
  djoreilly
  committed
  dc82507
- vql/linux/audit: Clean up context handling in shutdown goroutine
  
  jeffmahoney
  authored and
  djoreilly
  committed
  da183b8
- vql/linux/audit: mainEventLoop shouldn't exit on canceled context
  
  jeffmahoney
  authored and
  djoreilly
  committed
  ed5fc7d
- vql/linux/audit: Make messageQueue lifetime more apparent
  
  jeffmahoney
  authored and
  djoreilly
  committed
  13f28b9
- vql/linux/audit: limit messageQueue scope to within runService
  
  jeffmahoney
  authored and
  djoreilly
  committed
  ab4bca1
- vql/linux/audit: Close reassembler if NewListenerBytes fails
  
  jeffmahoney
  authored and
  djoreilly
  committed
  7f46b9c
- vql/linux/audit: Fix typo causing double-lock in notifyMissingRule
  
  jeffmahoney
  authored and
  djoreilly
  committed
  5eaa779
- vql/linux/audit: Fix DeleteRule in mock client
  
  jeffmahoney
  authored and
  djoreilly
  committed
  c90729e
- vql/linux/audit: Change listener lifecycle to enable testing
  
  jeffmahoney
  authored and
  djoreilly
  committed
  9813963
- vql/linux/audit: Fix audit client lifecycle
  
  jeffmahoney
  authored and
  djoreilly
  committed
  167e9bb
- vql/linux/audit: Add more client failure test cases
  
  jeffmahoney
  authored and
  djoreilly
  committed
  45ff56d
- vql/linux/audit: tests, check various rule scenarios
  
  jeffmahoney
  authored and
  djoreilly
  committed
  4ce4212
- vql/linux/audit: simplify polling in listener
  
  jeffmahoney
  authored and
  djoreilly
  committed
  f7ac8a4
- vql/linux/audit: make stats reporting separate from debug prints
  
  jeffmahoney
  authored and
  djoreilly
  committed
  aa49772
- vql/linux/audit: make explicit that goroutines in the main errgroup don't return errors
  
  jeffmahoney
  authored and
  djoreilly
  committed
  bbb1cce
- vql/linux/audit: handle top-level cancelation properly
  
  jeffmahoney
  authored and
  djoreilly
  committed
  a54c216
- vql/linux/audit: remove unused waitgroup from main event loop
  
  jeffmahoney
  authored and
  djoreilly
  committed
  bffc1dc
- vql/linux/audit: remove unnecessary error handling for reassembler
  
  jeffmahoney
  authored and
  djoreilly
  committed
  b085ce5
- vql/linux/audit: pull parts of shutdown into shutdown watcher
  
  jeffmahoney
  authored and
  djoreilly
  committed
  85b25ce
- vql/linux/audit: add auditService.Log()
  
  jeffmahoney
  authored and
  djoreilly
  committed
  1b1eda6
- vql/linux/audit: limit messageQueue to within runService
  
  jeffmahoney
  authored and
  djoreilly
  committed
  178ec50
- vql/linux/audit: fix goroutine lifetimes
  
  jeffmahoney
  authored and
  djoreilly
  committed
  f5a93c3
- vql/linux/audit: fix shutdown races
  
  jeffmahoney
  authored and
  djoreilly
  committed
  2ee3eb6
- vql/linux/sdjournal: Fix open/close lifetimes
  
  jeffmahoney
  authored and
  djoreilly
  committed
  a94dce3
- velociraptor: add dummy main function for mage
  
  jeffmahoney
  authored and
  djoreilly
  committed
  8b7b33b
- sdjournal: Correctly seek to current tail
  
  xTeixeira
  authored and
  djoreilly
  committed
  c4c3d52
- Fix audit filter key typo in Linux.Events.NewFiles
  djoreilly
  committed
  f1d3e9f
- Move NewFiles artifact to SUSE
  djoreilly
  committed
  d4d1fca
- Fix SystemLogins artifacts file extensions
  djoreilly
  committed
  9de58e9
- Fix absolute path case in ExecutableFiles artifact
  djoreilly
  committed
  cb12b1d
- Add artifact to collect systemd service events
  djoreilly
  committed
  1a3c9bb
- Add hash fields to Linux.Events.ProcessExecutions
  djoreilly
  committed
  07d23ad
- Add SUSE.Linux.Events.NewZeroSizeLogFile artifact
  djoreilly
  committed
  78376cc
- SUSE.Linux.Events.Crontab: Add task execution artifacts
  
  xTeixeira
  authored and
  djoreilly
  committed
  368930a
- Add artifact to monitor ssh authorized_keys files
  djoreilly
  committed
  9198b6c
- Add SUSE.Linux.Events.Timers artifact
  
  xTeixeira
  authored and
  djoreilly
  committed
  2278ab7
- Fix Linux.Events.ImmutableFile not showing hash in GUI
  djoreilly
  committed
  2690819
- chattrsnoop: don't log.Fatal() on hash error
  djoreilly
  committed
  a899717
- chattrsnoop: handle os.Stat() error properly
  djoreilly
  committed
  37768ac
- chattrsnoop: include full error details in logs
  djoreilly
  committed
  bcb9592
- Make ImmutableFile artifact consistent with others
  djoreilly
  committed
  a232c36
- Move ImmutableFile artifact to SUSE
  djoreilly
  committed
  56f1fc3
- Add artifact to collect new hidden files
  djoreilly
  committed
  7ec00e6
- Add server artifact to delete old client data on server
  djoreilly
  committed
  3048b58
- Add client monitoring artifact for RPMs
  djoreilly
  committed
  3620ed4
- Add SUSE.Linux.Sys.At artifact
  
  xTeixeira
  authored and
  djoreilly
  committed
  f0fea63
- Raise client connection log level to ERROR
  djoreilly
  committed
  1941d4a
- Rename SUSE specific artifacts to have SUSE prefix
  djoreilly
  committed
  1ab772a
- tcpsnoop: fix garbled results on s390
  djoreilly
  committed
  2f98d00
- Add artifact to collect new files without owner
  djoreilly
  committed
  23a4269
- bpf plugins: set a logger callback
  djoreilly
  committed
  632c924
- tcpsnoop: remove unused filtering code
  djoreilly
  committed
  0fc22b2
- chattrsnoop: fix bpf_probe_read for s390
  djoreilly
  committed
  73fbdba
- chattrsnoop: fix immutable attribute set on s390
  djoreilly
  committed
  0bc592f
- dnssnoop: fix htons() so it works on s390 too
  djoreilly
  committed
  03ac165
- dnssnoop: fix loading protocol from ip header on s390
  djoreilly
  committed
  7c404ba
- chattrsnoop: replace global variables with locals
  djoreilly
  committed
  88dfea5
- Fix systemd Services artifact missing events
  djoreilly
  committed
  d7078bf
- Fix undefined binary.NativeEndian build errors
  djoreilly
  committed
  caabc4f
- Fix services artifact symbol pid not found error
  djoreilly
  committed
  f379490
- chattrsnoop: fix do_vfs_ioctl kprobe failure
  djoreilly
  committed
  9858284
- chattrsnoop: fix wrong FS_IOC_SETFLAGS value for ppc
  djoreilly
  committed
  4d35cf3
- chattrsnoop: correct read size for flags
  djoreilly
  committed
  2a88c61
- github: run linux unit tests
  djoreilly
  committed
  101bcb0
- sdjournal: fix package causing test failures
  djoreilly
  committed
  a8c9061
- audit: prevent Windows loading audit package
  djoreilly
  committed
  a40c32c
- audit: fix race in subscriber
  djoreilly
  committed
  536881d
- audit: fix audit client data races
  djoreilly
  committed
  5b3a298
- github: fix deprecated upload artifact
  djoreilly
  committed
  d2c5121
- audit s390x: fix arch filter rules errors
  djoreilly
  committed
  dcb21b5
- rpm plugin: fix ndb magic error
  djoreilly
  committed
  8887079
- RPM artifact: start checks immediately on artifact load
  djoreilly
  committed
  2b2cba3
- audit: fix auditBuf allocation and go vet warnings
  djoreilly
  committed
  b0c30db
- audit: reduce FileBufferLeaseSize to ease GC overhead
  djoreilly
  committed
  be7dd4a
- Linux.Events.ProcessExecutions: remove parent cmdline
  djoreilly
  committed
  79e4b7e
- tcpsnoop: fix missing ipv6 outbound connections
  djoreilly
  committed
  2148b67
- tcpsnoop: fix ipv6 local and remote addresses order
  djoreilly
  committed
  9669d12
- chattrsnoop: move hashing from plugin to artifact
  djoreilly
  committed
  121ef0f
- chattrsnoop: fix files not getting closed
  djoreilly
  committed
  e67db8b
- bpf plugins: add context to error logs
  djoreilly
  committed
  7885be0
- bpf plugins: remove depreciated libbpfgo calls
  djoreilly
  committed
  2c5f986
- tcpsnoop: move parsing to its own function
  djoreilly
  committed
  5eba54a
- bpf: fix plugins not stopping when context cancelled
  djoreilly
  committed
  c227b64
- audit: update go-libaudit dependency for pcc64le arch filter fix
  djoreilly
  committed
  eb1e003
- Add execsnoop plugin to capture execve system calls
  djoreilly
  committed
  6e653a3
- Use execsnoop plugin in artifacts when possible
  djoreilly
  committed
  4f300c1
- audit: fix watch rules in artifacts
  djoreilly
  committed
  f0e3eee
- Update go-rpmdb to fix panic
  djoreilly
  committed
  9850b2e
- Add plugin and artifact for sending client events to rsyslog
  djoreilly
  committed
  d4bfd7b
- Remove SHA1 file signatures
  djoreilly
  committed
  30439c0
- Add machine-id to event artifacts
  djoreilly
  committed
  ac50e82
- Fix symbol not found errors from SUSE.Linux.Events.Services
  djoreilly
  committed
  1d481ec
- Exclude velociraptor tracee ebpf from build
  djoreilly
  committed
  e5835f8
- Fix artifacts for different VQL array() behaviour in v0.74+
  djoreilly
  committed
  9c31c75
- Fix services artifact systemctl show parse errors
  djoreilly
  committed
  0b9cb9f
- Fix SshAuthorizedKeys artifact to work with v0.76
  djoreilly
  committed
  79e36dd
Commits on Jun 24, 2026
- Upgrade github.com/ProtonMail/gopenpgp to V3
  djoreilly
  committed
  9c6aff1
- Update github.com/cloudflare/circl
  djoreilly
  committed
  3882725
- Update golang.org/x/crypto
  djoreilly
  committed
  7697f57
Commits on Jun 25, 2026
- Don't create offline yaml tool dependencies
  djoreilly
  committed
  5da807d

Commits

Commits on Jan 7, 2026

Commits on Jan 8, 2026

Commits on Jan 12, 2026

Commits on Jan 13, 2026

Commits on Jan 14, 2026

Commits on Jan 20, 2026

Commits on Jan 21, 2026

Commits on Jan 29, 2026

Commits on Feb 3, 2026

Commits on Feb 4, 2026

Commits on Feb 5, 2026

Commits on Feb 9, 2026

Commits on Feb 10, 2026

Commits on Feb 11, 2026

Commits on Feb 12, 2026

Commits on Feb 14, 2026

Commits on Feb 19, 2026

Commits on Feb 20, 2026

Commits on Feb 21, 2026

Commits on Feb 23, 2026

Commits on Feb 24, 2026

Commits on Feb 25, 2026

Commits on Feb 26, 2026

Commits on Feb 28, 2026

Commits on Mar 1, 2026

Commits on Mar 2, 2026

Commits on Mar 3, 2026

Commits on Mar 22, 2026

Commits on Mar 24, 2026

Commits on Mar 25, 2026

Commits on Apr 8, 2026

Commits on Apr 15, 2026

Commits on Apr 28, 2026

Commits on Apr 30, 2026

Commits on Jun 3, 2026

Commits on Jun 22, 2026