20240508.1

What's Changed

• Bug-Fix analyzers fetching active sessions by @jkppr in #3093

Full Changelog: 2024050...20240508.1

20240508

What's Changed

• Save searches without results by @jkppr in #3060
• Bump nginx version by @jkppr in #3077
• tsdev.sh update by @rocketeeer in #3081
• Support for observables in Yeti analyzers by @tomchop in #3061
• Added check to invalid API endpoints to close issue #3005 by @TedmanNguyen in #3058
• Updating the documentation by @jkppr in #3057
• Remove sigma_rule_status.csv from Installation Helper Scripts by @Aevyz in #3063
• Update api-upload-data.md by @berggren in #3068
• Fix tsctl on a prod deployment by @jkppr in #3088
• UI build 20240508 by @jkppr in #3089

New Contributors

• @Aevyz made their first contribution in #3063
• @rocketeeer made their first contribution in #3081
• @TedmanNguyen made their first contribution in #3058

Full Changelog: 2024032...2024050

20240328

Note
Upgrading to this Timesketch version requires a database upgrade!
See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

• DFIQ new UI and navigation by @berggren in #3041
• User profile and settings support by @berggren in #3048
• Enhancements to Yeti indicators by @tomchop in #3038
• More precise field selection when searching by @tomchop in #3044
• Use subqueryload to make loading events with comments faster by @tomchop in #3049
• Improvements to the sigma handling by @tomchop in #3050
• Update run_analyzers in the api client by @jkppr in #3037
• Fix a bug in the feature_extraction analyzer by @jkppr in #3047

Full Changelog: 2024020...2024032

20240207

What's Changed

• Collapsable left panel by @berggren in #3008
• Support for Large Language Model (LLM) services by @berggren in #3019
• Implement user management (create, list, get) via API by @lo-chr in #3024
• Setup frontend unit tests with vitest by @Annoraaq in #3013
• Fix failing Plaso uploads after 6 months by @jkppr in #3017
• Fix error handling in the API client by @jkppr in #3006
• Add optional TLS verification by @tomchop in #3016
• Yeti analyzer fix: use session object by @tomchop in #3020
• Adjust query for Yeti indicators by @tomchop in #3009
• Mark events with indicator's relevant_tags (Yeti) by @tomchop in #3022
• Bump cryptography from 41.0.4 to 41.0.6 by @dependabot in #2998
• SQLalchemy upgrade - step one by @berggren in #2979
• Fix: get and use access token for Yeti by @tomchop in #3010
• Adding form validation to prevent names > 255 char. by @jkppr in #3026
• Update black formatting by @jkppr in #3031
• Timesketch API client: Adding type check to prevent error. by @jkppr in #3030
• Fix double escaping in sigma_util causing yaml.parser.ParserError by @lo-chr in #3028
• Move "old UI" button by @jkppr in #3033
• UI build 20240207 by @jkppr in #3035

New Contributors

• @lo-chr made their first contribution in #3028

Full Changelog: 2023120...2024020

20231206

What's Changed

• Left panel timeline management by @Annoraaq in #2999
• Extract Windows event logs messages attributes by @roshanmaskey in #2910
• API client: Return all field for analysis sessions by @tomchop in #2504
• Highlight DFIQ context card by @berggren in #2996
• Introduce (large) CSV import in e2e tests by @jaegeral in #2912
• "Add to Threat Intelligence" via context links by @jkppr in #2980
• Graph bug and layout fix by @berggren in #2994
• Feature extraction config for BITS and Terminal Services by @roshanmaskey in #2974
• Adjust default example text for yeti endpoint by @tomchop in #2963
• Adding a copy action to filter chips by @JohannesLks in #2990
• Update to the windows deployment script by @coloradosarge in #3000
• Adding and updating tooltips for icons by @jkppr in #2983
• Fix hidden text by @jkppr in #2965
• bug-fix for context links by @jkppr in #2962
• Update for upgrade documentation by @jkppr in #2967
• Removing old feature extractor analyzer by @jkppr in #2969
• Update for the context_links documentation by @jkppr in #2970
• Updating the feature extraction analyzer documentation by @jkppr in #2973
• [tests] Add jsonl e2e tests by @jaegeral in #2976
• Fix vue dependency issues with "v-calendar" by @jkppr in #2989
• Mute noisy info logging in the feature extraction analyzer by @jkppr in #2993
• New empty-state and left panel bugfix by @berggren in #2991
• Update the analyzer timeline picker by @jkppr in #3001
• UI build 20231206 by @jkppr in #3002

New Contributors

• @JohannesLks made their first contribution in #2990
• @coloradosarge made their first contribution in #3000

Full Changelog: 2023102...2023120

20231025

Note
Upgrading to this Timesketch version requires a database upgrade!
See https://timesketch.org/guides/admin/upgrade/ for more details.

What's Changed

• filter chip fixes by @jkppr in #2893
• Adding multi analyzer result support by @jkppr in #2894
• Fix CSV upload without timestamp_desc by @jkppr in #2896
• Bump cryptography from 41.0.3 to 41.0.4 by @dependabot in #2904
• Deprecate Sigma status CSV usage from code by @jaegeral in #2913
• Add intelligence command to the CLI client by @jaegeral in #2864
• UI build 2023-10-05 by @jkppr in #2926
• Fix missing plaso_formatters by @jkppr in #2933
• Refactor base layout by @berggren in #2929
• ui build 20231010 by @jkppr in #2934
• Fix #2908 tagger bug by @jkppr in #2935
• Update yeti analyzer by @tomchop in #2930
• Adjusting regular expressions for features extraction by @tomchop in #2932
• [Documentation] timesketch_client.TimesketchApi in api client documentation by @jaegeral in #2938
• Improvements to the Yeti analyzer by @tomchop in #2942
• Truncate timeline names in analyzer results by @jkppr in #2945
• API client method to delete Sigma rule by @jaegeral in #2924
• Fix missing sketchId in Search.vue by @jkppr in #2955
• Unfurl integration by @jkppr in #2897
• Copy saved search ID by @jkppr in #2956
• Support emojis in new UI by @NightAcrobat777 in #2951
• SSL/TLS support and authentication for SMTP by @fazledyn-or in #2940
• Instantiate side panel only once by @berggren in #2949
• Unit test to ensure invalid timestamp conversions do not occur by @bwhelan212 in #2954
• Add DFIQ context to SearchHistory by @berggren in #2957
• Sanitise HTML from Unfurl by @berggren in #2959
• Context link backwards compatibility & sanitation by @jkppr in #2958
• UI build 2023-10-25 by @jkppr in #2960

New Contributors

• @NightAcrobat777 made their first contribution in #2951
• @fazledyn-or made their first contribution in #2940
• @bwhelan212 made their first contribution in #2954

Full Changelog: 2023091...2023102

20230913

What's Changed

• [Analyzers] Spelling errors by @jaegeral in #2860
• correct paramters in cli attributes method by @jaegeral in #2863
• Update troubleshooting.md by @jaegeral in #2866
• adding timeline info to the tsctl by @jaegeral in #2870
• Feature extraction for TI data in "Windows-Bits-Client" events by @jkppr in #2873
• Update Date chip to support milliseconds by @sydp in #2867
• Allow API port to listen on localhost by @tomchop in #2875
• Loading indicator active analyzers by @Annoraaq in #2855
• OpenSearch 2.x support by @berggren in #2876
• ui build 20230831 by @jkppr in #2878
• Bump cryptography from 41.0.2 to 41.0.3 by @dependabot in #2858
• Add TTY check for providing missing config values by @ramo-j in #2850
• Don't exit with error if user chooses not to start timesketch by @pemontto in #2857
• Export query result to CSV by @berggren in #2882
• Run analyzers only once per timeline by @jkppr in #2883
• Support overriding/extending Plaso formatter definitions by @berggren in #2881
• New UI build (automated) by @berggren in #2884
• Tag list refactor & bug fixes by @jkppr in #2886
• Event attribute include / exclude filters by @jkppr in #2888
• refactor verbose analyzer output by @jkppr in #2885
• Analyzer Output UI update by @jkppr in #2887
• Adding tag filter chips to sigma rules by @jkppr in #2890
• Search History graph cleanup by @berggren in #2891
• UI build 20230913 by @jkppr in #2892

Full Changelog: 2023072...2023091

20230721

What's Changed

• fixes #2809 UI bug by @jkppr in #2810
• Timeline and Scenarios fixes + small UI fixes by @berggren in #2808
• Show selected event in context view by @berggren in #2811
• Consitent forms and cleaned up XML viewer by @berggren in #2812
• Remove ports from e2e-tests by @berggren in #2816
• Update Account Finder Analyzer by @jkppr in #2803
• Delete sketch and list archived sketches by @berggren in #2817
• Add json and tab output to CLI client by @jaegeral in #2818
• [CLI] Add output-format as cli wide argument by @jaegeral in #2819
• Update hashR analyzer by @jkppr in #2820
• [CLI] refactor to use central output-format by @jaegeral in #2821
• Support OpenSearch queries in DFIQ by @berggren in #2822
• Add Windows Lateral Movement DFIQ scenario by @berggren in #2823
• Adding hashR user documentation by @jkppr in #2824
• New UI build by @berggren in #2828
• Update tsdev.sh to add creation of api client and cli client by @jaegeral in #2830
• fix mkdocs warnings by @jkppr in #2832
• fix docs formatting by @jkppr in #2833
• Add a test case for conditions with multiple words in a Sigma rule by @jaegeral in #2835
• Always set active timelines by @berggren in #2838
• Preserve user defined filters by @berggren in #2840
• Support event list sorting (asc/desc) by @berggren in #2843
• Rework comments by @jkppr in #2845
• Upgrade to PyYAML 6.0.1 and NodeJS 18 by @berggren in #2853
• Bump cryptography from 41.0.0 to 41.0.2 by @dependabot in #2844
• Documentation updates for analyzers by @jkppr in #2851
• Add timesketch analyze results to the CLI client by @jaegeral in #2846
• Manage sketch attributes in the CLI client by @jaegeral in #2841
• New UI build and update version numbers by @berggren in #2854

Full Changelog: 2023062...2023072

20230628

What's Changed

• Update changelog by @berggren in #2768
• Scenarios model refactor by @berggren in #2672
• Ssh bruteforce analyzer by @roshanmaskey in #2769
• Add missing dependency for e2e container by @berggren in #2783
• 🐛 Handle None response from ip2geo by @pemontto in #2770
• Fix #2784 - pandas.read_csv arguments by @jkppr in #2785
• Add tzdata to all container builds by @berggren in #2788
• Fix for #2738 - Analyzer not in AnalyzerList by @jkppr in #2786
• Fixing #2393 - analysis of broken timelines by @jkppr in #2787
• Helm k8s by @wajihyassine in #2661
• Enable settings from environment (needs Flask 2.1+) by @bpereto in #2417
• Add 🐀 emoji for remote access tools by @pemontto in #2779
• Switch to Compose V2 by @koromodako in #2654
• Return user defined aggregation name when using the API client by @sydp in #2507
• Bump cryptography from 39.0.1 to 41.0.0 by @dependabot in #2778
• Bump pyjwt from 1.7.1 to 2.4.0 by @dependabot in #2192
• Update Helm README to refer to OSDFIR Infrastructure by @wajihyassine in #2790
• DFIQ support by @berggren in #2782
• Fix for importing small JSONL files by @berggren in #2793
• Restyle timeline chips by @Annoraaq in #2777
• Windows bruteforce analyzer by @roshanmaskey in #2792
• Automate verbose analyzer output metadata collection by @jkppr in #2798
• Update the event tags UI by @jkppr in #2805
• UI support for verbose analyzer output by @jkppr in #2797
• New UI build (automated) by @berggren in #2806

New Contributors

• @bpereto made their first contribution in #2417
• @koromodako made their first contribution in #2654

Full Changelog: 2023052...2023062

20230526

Version 20230526

What's Changed

• Minor fixes/updates for AggregateDialog by @sydp in #2726
• Implicit String Fix by @LX5321 in #2650
• 🐛 Fix invalid sigma YAML by @pemontto in #2757
• Ensure that upload path is valid by @berggren in #2763
• Update to Flask 2.3.x and dependencies by @berggren in #2764
• New UI build (auto generated) by @berggren in #2767

New Contributors

• @LX5321 made their first contribution in #2650

Full Changelog: 2023051...2023052