Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

NEWS additions for v7.1 [nomail] [skip ci]

Browse source
This commit is contained in:
Tim Wojtulewicz 2024-12-10 16:11:11 -07:00
parent 9e19b51f41
commit 7b8f9b5385
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
NEWS
View file

@ -119,8 +119,8 @@ New Functionality
analyzer used for processing the packet when the event is raised. The analyzer used for processing the packet when the event is raised. The
``unknown_protocol.log`` file was extended to include this information. ``unknown_protocol.log`` file was extended to include this information.
- The MySQL analyzer now generates a ``mysql_user_change()`` event when - The MySQL analyzer now generates a ``mysql_user_change()`` event when the user
the user changes mid-session via the ``COM_USER_CHANGE`` command. changes mid-session via the ``COM_USER_CHANGE`` command.
- The DNS analyzer was extended to support TKEY RRs (RFC 2390). A corresponding - The DNS analyzer was extended to support TKEY RRs (RFC 2390). A corresponding
``dns_TKEY`` event was added. ``dns_TKEY`` event was added.
@ -182,6 +182,12 @@ New Functionality
The analyzer is currently mostly interesting if you want to experiment with The analyzer is currently mostly interesting if you want to experiment with
SSL; we do not yet recommend to enable it in normal Zeek deployments. SSL; we do not yet recommend to enable it in normal Zeek deployments.
- The majority of the metrics reported via stats.log are also now reported via
the Telemetry framework, and are visible in the output passed to Prometheus.
- A new weird ``DNS_unknown_opcode`` was added to the DNS analyzer to report
when it receives opcodes that it cannot process.
Changed Functionality Changed Functionality
--------------------- ---------------------
@ -226,8 +232,9 @@ Changed Functionality
Previously, ``network_time()`` was used. This matters if ``Broker::publish()`` Previously, ``network_time()`` was used. This matters if ``Broker::publish()``
is called within scheduled events or called within remote events. is called within scheduled events or called within remote events.
Removed Functionality - The SSL analyzer now reports the correct version when an SSLv2 client hello is
--------------------- used. Zeek previously always reported these as v2, even when the v2 client
hello indicated support for a later version of SSL.
Deprecated Functionality Deprecated Functionality
------------------------ ------------------------