Releases: ceramicskate0/SWELF
0.6.1.0
v0.6.0.0
Testing version of new approach to app
0.5.0.4
v0.4.3.1
Bug Fixes:
-Fixed issue 85, 86
New Stuff:
-Added issue 82 (CMDLine Args to keyvalue outputs) (Sysmon and PS logs only for now)
-Added Service checks from issue 83 (docs on wiki)
0.4.3.0
Fixed
-bugs with sending output to SIEM
- minor bug and formatting issue fixes
-Added
-tcp tranmission (issue 80)
- option to delete local log files after read and sent to SIEM
notes:
#transport_protocol=tcp OR udp (to be released in 0.4.3.0)(if not defined udp is default)
#delete_local_log_files_when_done={anything} (to be released in 0.4.3.0)(if not defined do nothing is default, if defined with anything it will remove)
0.4.2.2
Fixed:
- Bug with commandline method when using evtx log read.
0.4.2.1
- able to pull central config from github web page
- started moving settings to reg. (as backup)
- Added ability to change SWELF's name to anything to help hide from fingerprinting by adversaries
0.4.2.0
Release Notes:
- Added appconfig command "debug" to output all eventlog data to eventdata field of event log and forces verbose logging.
- Added tagging to the event data field to tag each eventlog with the search that was used to find it.
- Began work to multithread application (issue 73). Threading works for Powershell plugins,local log reads, and initial work done for searchs but has issues with stability and is hard set to single thread.
- Added user level file lock to sensitive config file (that will not work or log if not supported native by OS)(future release to resolve non support)(issue 21).
- Added errorlog file size auto management
- Added SWELF Eventlog ID standardization
- Resolved issue 49
- SWELF Icon redesign
-Deprecated method removal and code cleanup. - Minor algo and functional Bug fixes and resource optimization (to numerous to list).
Search Commands Supported at this release are:
"count:", "eventdata_length:", "commandline_length:", "commandline_contains:", "commandline_count:", "regex:", "log_level:", "not_in_log:","search_multiple:" , "network_connect:"
//SWELF EVENT LOG ERRORS LIST
SWELF_Information = 996;
SWELF_SuccessAudit = 995;
SWELF_Error = 998;
SWELF_FailureAudit = 999;
SWELF_WARNING = 997;
0.4.1.2
Bug fixes:
- issues 67 (Again)
- SWELF 0.4.1.1 not returning findings
0.4.1.1
Added increased error logging