Wazuh v4.14.0

Manager

Added

• Added system users and groups to the inventory data. (#30848)


• Added browser extensions and services to the inventory data. (#31614)


• Added IPv6 support to Maltiverse integration. (#31731)

Fixed

• Fixed internal decoder RC startup. (#29663)


• Fixed queue stats RC over wazuh-analysisd. (#29673)


• Fixed race condition in the event queue. (#29672)


• Fixed regexCompile race condition. (#29699)


• Fixed malformed alerts in alerts.log when <group> contains newline characters. (#30653)


• Fixed and improved dpkg version comparison algorithm in Vulnerability Detector. (#31599)

Changed

• Improved databaseFeedManagerTesttool. (#30192)


• Adapted wazuh-maild to RFC5322 standard. (#30793)


• Enhanced the active response endpoint performance. (#31218)

Agent

Added

• Added support for parquet version 2 in AWS Wodle. (#30235)


• Added capability to do a hot configuration reload in Linux agents. (#30797)


• Added support for Amazon Inspector v2. (#31163)


• Added system users and groups to the inventory data. (#30369)


• Added browser extensions to the inventory data. (#805)


• Added services to the inventory data. (#807)


• Added missing AWS regions us-gov-west-1 and us-gov-east-1 to AWS wodle. (#31418)


• Included Windows kernel version information to IT Hygiene. (#32413)

Fixed

• Fixed errors with Azure Graph event fields. (#30831)


• Added the missing "provider" field to the whodata section in syscheckd JSON configuration. (#30877)


• Fixed journald disabled filters when both blocks have no filters. (#31700)


• Fixed whodata FIM compatibility with latest audit versions. (#30215)


• Fixed mismatch between MTU values in database and indexer for Windows agents. (#31875)

Changed

• Improved rootkit error messages to warnings due to future deprecation. (#31640)

RESTful API

Added

• Added syscollector users and groups endpoints. (#30913)


• Added syscollector services and browser_extension endpoints. (#31513)

Fixed

• Fixed secure headers. (#31046)


• Fixed the display of sensitive information for non-privileged users. (#31315)

Ruleset

Added

• Added SCA content for Rocky Linux 10. (#30745)


• Added SCA content for Debian 13. (#31747)

Fixed

• Fixed multiple Rocky Linux SCA checks generating incorrect results. (#29976)


• Fixed missing Check (2.3.7.6) in Windows Server 2019 v2.0.0. (#30173)


• Fixed camel casing in ownCloud ruleset header. (#30276)


• Fixed false positive in check 2.3.3.2 of macOS 13, 14, and 15 SCA. (#30489)


• Fixed bug in rule 92657. (#30529)


• Fixed field names in Office 365 rules. (#30528)


• Fixed action field in Fortigate rules. (#30515)


• Fixed Auditd EXECVE sibling Decoders. (#30612)


• Fixed problems with other Windows OS languages except English. (#31227)


• Reworked SCA Policy for Debian Linux 12. (#30717)


• Fixed missing comma in 0393-fortiauth_rules.xml. (#32025)


• Fixed Windows sca user account checks. (#32102)


• Fixed inaccuracies in Ubuntu 2404 sca policy. (#32106)


• Fixed incorrect service name in Ubuntu firewall service check. (#32143)

Other

Changed

• Updated packaging dependency to 25.0. (#31272)


• Updated requests to version 2.32.4. (#30536)


• Updated urllib3 to version 2.5.0 and protobuf to version 5.29.5. (#30624)


• Upgraded Python embedded interpreter to 3.10.18. (#30916)


• Updated OpenSSL to 3.0.15 and cpp-httplib to v0.25.0. (#31779)


• Updated SQLite dependency to version 3.50.4. (#29586)