Wazuh v4.14.1

Manager

Added

• Added IAM role support for VPC flow logs in the AWS wodle. (#32009)


• Added support for static and temporary AWS credentials in the Amazon Security Lake subscriber. (#32514)

Changed

• Optimized wazuh-db startup by executing agent schema creation in a single transaction. (#32401)


• Improved vulnerabilities index upgrade with hash-based mapping validation, automatic safe reindex, and backup cleanup. (#32463)


• Improved C++ logging mechanism to avoid unnecessary heap allocations. (#32069)


• Improved IndexerConnector error handling and response parsing to provide structured logging of 4xx/5xx errors. (#32521)


• Reduced default verbosity of wazuh-authd when handling invalid connections. (#32525)


• Remoted now reads internal options at process startup. (#32697)

Fixed

• Fixed manager vulnerability scan not triggering due to incorrect syscollector event provider topic name. (#32045)


• Fixed IndexerConnector abuse control to prevent data loss on failed syncs. (#32787)


• Fixed user tag handling by adding 'user' as an alias for the 'dstuser' static field. (#32107)


• Fixed JSON validation issues in Analysisd and SCA components. (#32057)


• Fixed a bug in Vulnerability Scanner where the DB offset was updated even in error cases. (#32829)

Agent

Added

• Added support for Homebrew 2.0+ in IT Hygiene for macOS. (#32746)

Changed

• Changed how the fim_check_ignore function works in case of negative regex cases. (#31080)


• Changed how null values for hotfixes are handled in the Windows agent. (#31375)


• Improved service shutdown procedure. (#32874)

Fixed

• Fixed indefinite waiting in FIM whodata health check. (#32383)


• Fixed graceful shutdown in FIM. (#31241)


• SHA256 of commands is now verified on every execution. (#32049)


• Fixed duplicate <ca_store> configuration block during RPM package upgrades. (#32528)


• Fixed a bug that prevented overwriting <registry_limit> or <file_limit> options from remote configuration. (#31144)


• Fixed a bug in Logcollector that prevented following symlinks when resolving wildcarded files. (#29853)


• Unified detection logs for wildcarded files in Logcollector. (#31222)


• Fixed a bug in FIM that did not recognize Registry keys unless they were UTF-8. (#32027)


• Fixed a bug in Logcollector that ignored all files with <age> filter on Windows. (#32731)


• Reverted IT Hygiene package vendor format on Debian: now includes name and email again. (#32812)


• Fixed a bug in IT Hygiene that reported duplicated Edge browser extensions. (#32785)


• Fixed reload of the <labels> block via remote configuration. (#32838)


• Fixed Windows installer to deploy SCA policies for Windows 2022 instead of Windows Server 2025. (#32836)

Ruleset

Changed

• Reworked SCA Policy for Microsoft Windows 10 Enterprise. (#31449)


• Fixed bug in Windows SCA. (#31349)


• Fixed mistaken alert due to expected regex. (#31102)


• Fixed SCA checks in Oracle Linux 9. (#31886)


• Fixed bugs in Windows Server 2016 SCA. (#32509)


• Fixed bugs in PAM decoder. (#32523)


• Fixed MacOS Sequoia SCA scans with errors. (#32480)


• Windows Server 2016 SCA policy not configured correctly. (#32802)

Other

Changed

• Upgraded the starlette dependency to 0.47.2. (#31422)


• Upgraded Python embedded interpreter to 3.10.19. (#32782)


• Updated curl dependency to 8.12.1. (#32900)


• Updated LUA to version 5.4.6. (#32294)


• Updated libarchive to version 3.8.0. (#32294)