Release 25.08

Release notes for 25.08.2¶

Release date: 04/Nov/2025
Type: Standard
Main changes: redborder-webui

This is the release notes for the patch 25.08.3 of redBorder NDR version 25.08. This release introduces cluster compatibility improvements for Airflow and enhances malware management with new Yara rule handling, cloning, and deletion capabilities. Web UI functionality is expanded, including incident note images, specific asset-based detections, and log download options for superadmins. Additional refinements improve SSO settings, CLI usability, and secure data uploads. Numerous bugs have been resolved across the platform, including fixes in malware workflows, IPS behavior, PostgreSQL management, and UI stability, ensuring increased reliability, performance, and security.

What's new¶

#23213 [airflow] Make dag processor and airflow triggerer cluster compatible
#23168 [airflow] Update version
#23083 [airflow] Make airflow compatible with a cluster-node environment
#22844 [redborder-ips][redborder-intrusion] Normalize register directory log proxy/manager mode from rb-register-common to rb-register directory
#23145 [redborder-webui][malware] Add cloning for yara policies
#23036 [redborder-webui] Add a button to "download" webui logs only for superadmins
#22827 [redborder-webui] Implement specific detections base on asset type
#22825 [redborder-webui] Add images to Incident Notes
#22823 [redborder-webui][malware] Create system to manage/update yara rules
#22789 [logstash-filter-virustotal][cookbook-logstash][malware] Bring back VirusTotal analysis
#22773 [postgresql] Create a script to monitor postgresql syncronization. Should be use as health check to inform when postgresql is out of sync
#22750 [rb-reputation][malware] Integrate rb-reputation in manager
#22731 [logstash-filter-aerospike-malware-score][malware] Bring back logstash-filter-aerospike-malware-score
#22338 [rb-sequence-ozzie][malware] Integration of rb-sequence-ozzie and ozzie (Or alternative)
#17729 [snort2][redborder-ips][malware] Integrate File changes

Improvements¶

#23199 [redborder-webui] Add a Are you sure? message on deleting incident Note
#21654 [redborder-webui] show clear information of the raw data of ips cannot be shown
#22786 [redborder-webui][malware] Add user roles into malware
#22922 [redborder-webui] Move vrt rules from repo.redborder.com to packages-sc.redborder.com
#23098 [redborder-webui][sso] Add more settings about SSO
#23161 [redborder-webui][malware] Create a job to remove yara policies
#23127 [redborder-cli] Sort managers by name when executing rbcli node exec / copy command
#23130 [redborder-cli] complete the auto completion of the command rbcli
#22752 [logstash-filter-s3-upload-malware-results][malware] Upload data using SSL and https
#22843 [cookbook-rb-manager][cookbook-posgresql][cookbook-redis] Do not use serf members to get the sync IPs

Resolved Issues¶

#22869 [logstash-filter-clamscan] Clamscan analysis fails to connect
#22858 [logstash-filter-s3-upload-malware-results][malware] Endpoint is not using cdomain
#23032 [redborder-cli] User should not be able to disable PostgreSQL in a single-node environment
#23114 [cookbook-logstash]In sflow pipeline tagging template remove the check of proxy "blocked"
#22781 [cookbook-rb-monitor][cookbook-rb-proxy][cookbook-rb-manager] Missing flow sensors and its monitors in redborder-monitor configuration
#22903 [cookbook-rb-firewall] Wrong removing keepalived iptables rule
#23047 [cookbook-rb-firewall] fix typo in config.rb
#21003 [cookbook-ips][cookbook-rb-intrusion] Cannot produce messages to kafka when register using virtual ip
#23033 [cookbook-rb-manager][postgresql] Disabling PostgreSQL in a master node is not working
#23195 [redborder-manager] Airflow cookbook is missing in listCookbooks
#22854 [redborder-manager] during fresh install, webui databag is created instead of nginx databag
#23038 [redborder-ips] PF RING not working after kernel update
#22746 [redborder-ips][redborder-intrusion] IPS & intrusion should not access to passwords data bag
#23040 [redborder-webui] Only admin should be able to export user data in csv.
#23216 [redborder-webui][malware] Make sure that policies have sources when creating them
#23165 [redborder-webui][malware] Fix js problems and slowness with yara policies rule showing view
#23150 [redborder-webui][malware] Wrong rules created when changing severity on a yara policy
#23215 [redborder-webui] Do not allow code injection in platform alerts
#23059 [redborder-webui] IPS rules can't be open in rule version's section because a js is sometimes duplicated
#23010 [redborder-webui] Error when sharing a dashboard with Domain
#23000 [redborder-webui] Users with role "Viewer" or "Incident responder" cant filter in assets view
#22930 [redborder-webui] Adapt yara rules front end to NG and fix legacy bugs
#22572 [redborder-webui] Non-admin user can Path Traverse to scanner profiles
#22917 [redborder-webui] ApplyUpdateJob is not generating StoredJob in case of an error
#22887 [redborder-webui][malware] in Tools -> Yara rules fails
#22870 [redborder-webui][malware] Override node dont have the default values if you don't save in malware settings -> update
#22847 [redborder-webui][malware] Add failing views: Raw, Compare, Unique, State changes and IOCs
#23129 [redborder-webui][malware] Yara Rule version checkbox doesn't do anything
#23121 [redborder-webui] Sensors cannot be seen when disabling some modules
#22784 [redborder-webui][malware] Update freezes when weights are not 1
#22783 [redborder-webui][malware] Fix malware audits
#23063 [redborder-webui][malware] Can't edit yara policies

Release notes for 25.08.2¶

Release date: 23/Sept/2025
Type: Standard
Main changes: redborder-webui

This is the release notes for the patch 25.08.2 of redBorder NDR version 25.08.

This release includes multiple enhancements and fixes across the RedBorder platform. Key updates include integration of rb-exporter in intrusion, enriched inventory and asset management from the Scanner Module, default alarms based on client asset type, improved user roles and permissions, incident tagging, and performance improvements like replacing Memcached with Redis for incident creation. Several UI issues, job logging, and sensor configuration bugs have been resolved. Additionally, we now have a MISP available at misp.redborder.com. While these updates roll out, the team is actively working on the future Malware module and more.

What's new¶

#22470 [cookbook-rb-intrusion] Integrate rb-exporter in intrusion
#22266 [redborder-webui] Reintroduce audits for Settings Controller (optimized version)
#22210 [redborder-webui] (Scanner Module) Use scanner data to enrich existing inventory devices and create new ones (assets)
#22021 [redborder-webui] Create a set of default alarms for traffic base on new field Client Asset Type
#18250 [redborder-webui] Add user roles
#22618 [redborder-webui] Make help users roles
#22469 [redborder-webui] Add tags (labels) to incident
#22442 [redborder-webui] Add how long it took to run a delayed job in the stored job
#20809 [redborder-webui] Basic AI agent for redborder-webui
#22472 [redborder-webui] Replace title/description generation with redborder-agents instead of rb-llm

Improvements¶

#22468 [redborder-webui] Add "Add default homenets" option to sensor API creation (flow sensors)
#22410 [redborder-cli] Add column "Cgroup" to rbcli service list
#22172 [redborder-webui] Replace Memcached with Redis for Incident Creation
#22645 [redborder-webui] When import sensor tree "Override domains and sensors", inform user that assets and incidents associaed with the old domains will be wiped

Resolved Issues¶

#22465 [redborder-webui] Edit not is not formatting note (incident -> worklog) correctly and deleting the format on note updates
#22126 [redborder-webui] Fix broken "log" menu buttons in /monitor/indexing
#22304 [redborder-webui] Creating rules without files category, activate rules in the category
#22286 [redborder-webui] Cannot edit IPS sensor while configuring it
#22542 [redborder-webui] JS breaks when incidents are empty-
#22411 [redborder-webui] Don't export incident id when exporting alarms
#22399 [redborder-webui] Going to second page of Druid Queries makes the user list dissapear (wrong pagination)
#22398 [redborder-webui] Cannot sort correctly by Activity in Tools -> User
#22383 [redborder-webui] Adapt monitor segments' heatmap to darkmode
#22382 [redborder-webui] ap_state settings are not saved on the manager
#22705 [redborder-webui] Fix monitor -> diagram view
#22553 [redborder-webui][cookbook-rb-manager][cookbook-rb-chrony] add ntp servers configured in the platform
#22644 [reborder-manager] rb_psql is pointing to master.postgresql.service.${DOMAIN}
#20693 [redborder-manager] Virtual IP of webui should be Virtual IP of nginx
#22582 [cookbook-rb-manager] All data indexed for rb_monitor in case of namespaces
#21998 [cookbook-logstash] Investigate if sflow data should go through "netflowenrich" step in netflow pipeline
#22306 [redborder-druid] Install kafka-emitter during the mock and copy the files instead of in %post
#22604 [redborder-logstash-plugins] Some plugins are not updated
#22566 [cookbook-keepalived] iptables redirect rule not applied in nodes with nginx enabled and webui disabled
#20613 [manager] Sflow messages from different sources show multiple valid domains as array
#22435 [redborder-repo] Unknown configuration option: sslcheck = 0
#22433 [cookbook-rb-ips] jq: error (at :44): null (null) has no keys
#22431 [cookbook-redis] system trying to update redis to 7.2.8.1 and fails.
#22406 [snort3] Alert_kafka fails to generate raw packet data for some packets
#22761 [cookbook-webui] Aerospike should point to sync ip in webui
#22728 [cookbook-nginx] Wrong certifications generation for s3.crt (subjectAltName recommended in one line) and wrong cert names
#22710 [cookbook-rb-firewall] rich rules not being checked correctly
#22666 [cookbook-snort3] undefined method instance_params
#22643 [cookbook-redis] Redis sentinel is restarting each chef-client run

Release notes for 25.08.1¶

Release date: 29/Jul/2025
Type: Standard
Main changes: redborder-intrusion

This is the release notes for the patch 25.08.1 of redBorder NDR version 25.08.

This release includes major enhancements across the redborder platform. Key updates include Snort3 integration with SnortML for neural network-based exploit detection, improved CLI and bypass control mechanisms, and a new health check script. The manager now replaces MongoDB with a built-in alternative, while SNMP v3 support and improved incident linking have been added to the WebUI. Additional improvements enhance the dashboard, job scheduling, and incident grouping. Several bugs were also resolved, including namespace restrictions and sensor naming issues.

What's new¶

#22319 [redborder-intrusion] validate and compare metrics with snort2
#22211 [redborder-intrusion][snort3] - Integrate SnortML for Neural Network Based Exploit Detection
#22064 [redborder-intrusion] - Improve CLI Snort3 UI (add bp, bp support, fix rule count)
#22007 [redborder-intrusion] Control bypass bassed on Kernel AF_PACKET notifier (net/packet/af_packet.c#L4234)
#21774 [redborder-intrusion] Bypass Controlled by Snort and Software Bypass for LibDaq & Snort3
#22061 [redborder-intrusion] - Create watchdog health check script for snort3 (enable bp, restore snort...)
#22054 [snort3] - Add bulk mode for HTTP alert sending to the manager (FIFO queue)
#22218 [redborder-manager] Replace MongoDB with integrated alternative & refactor Logstash scanner plugin (mongocve)
#18850 [redborder-manager][...] Add internal virtual ips
#22019 [redborder-monitor][redborder-webui] Add snmp v3 support
#22136 [redborder-webui] Extract client_mac from Traffic Alarm then notify to vault so we can link incidents to assets
#21983 [redborder-webui][snort3] show reputation events in intrusion module
#21949 [redborder-webui] Add a menu to Queue Jobs to set run at on demand
#21734 [redborder-common] Add script to backup chef nodes and roles

Improvements¶

#22153 [redborder-intrusion] - Add segment to status dashboard and add ascii banner
#18458 [redborder-cookbooks] Remove +x permissions on cookbook templates
#21846 [rb-druid-indexer] Dimensions should be passed via config file written by cookbook-druid
#21520 [redborder-webui] Group Linked Incidents into Single Row in Incident List
#21313 [redborder-webui] In monitor indexing, show task lag

Resolved Issues¶

#22333 [cookbook-rb-ips][cookbook-rb-intrusion] Remove cookbook-cron from depend
#22299 [logstash-filter-druid-metrics] Sensor name is wrong in druid metrics
#22267 [redborder-webui] Disallow linking of incidents from different namespaces
#22252 [redborder-webui] Linked incidents in incident's view should show every incident in the linked incident chain
#22236 [cookbook-rb-scanner] scanner profile started in proxy, runs also in manager