0.3.0 - Githubissues

0.3.0 - 2024-06-09

Search docker URLs when searching for URL SCOs
Ignore observables with the empty SHA-256 hash (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855)
Create file SCOs from Office 365 logs in enrichment
Create directory SCOs from Office 365 logs in enrichment
Use vulnerability score for vulnerability_incident_cvss3_score_threshold check if CVSS3 score is unavailable
Search directories in Office 365
Add a small sleep() of 100 ms, potentially solving #11
New setting rule_exclude_list that allows for ignoring certain alert rules altogether
New setting incident_rule_exclude_list that prevents incident creation for certain alert rules
Mention in event creation in docs that incidents from sighted vulnerabilities are not created by default unless configured
Document alert rules in glossary, with screenshots of the rule viewer in Wazuh
Add a timeout to OpenSearch queries (default 20 s), preventing a complete freeze if OpenSearch fails to reply
Add new setting vulnerability_incident_active_only that allows for only creating incidents for sighted vulnerabilities if they are no longer active

OpenCTI 6.1.10 is used
No longer enrich URLs without host and scheme by default (e.g. "/", "/foo/bar"), but leave the possibility as a new configuration option, *enrich_urls_without_host".
If the vulnerability being enriched does not contain any CVSS3 information, extract this from alerts before running the logic in vulnerability_incident_cvss3_score_threshold. This allows for creating incidents based on CVSS score threshold even if this information is not present in the source entity.

Avoid crashing when enriching untriaged vulnerabilities (when published is not set)
Set confidence explicitly for sightings as a workaround for OpenCTI bug
6835. This ensures that sightings now get the correct confidence (that of

the user/group running the connector).
Fix bug in vulnerability_incident_cvss3_score_threshold logic
Fix a number of typos and bugs in documentation
Do not use months in timedeltas in tests, causing issues with 30/31 days in a month
Remove "Observable" from incident description, since not all enriched entities are observables
Do not match file names partially (regex mistake)

Remove all traces of the Wazuh API. It was only partially implemented, and will be added back when development of this as a separate enhancement is completed.
Remove some debug output