Aanval ® - Release Notes

Aanval Release Notes

Aanval development and product release notes (public).

Current Release Details
Aanval v7.1 (Hero) Build 70144

Aanval is the industry's most comprehensive Snort, Suricata & syslog intrusion detection, correlation and threat management console.

Aanval v7 licenses are required to run this version of Aanval, a fee may be required.

Version 7 is fully compatible with all releases of version 6, please follow installation / upgrade instructions provided on the Aanval.com website for assistance.

** WARNING
** Do NOT attempt to update v2, v3 or v4 consoles to Aanval v7.

---
7.1 BUILD 70144

Bug fix: Live Monitor sorting
Update - Event Tagging

7.1 BUILD 70143

New: Time filters for 'Frequent Events'
New: Time filters for 'Frequent Offenders'
New: Time filters for 'Frequent Targets'
New: Time filters for 'Frequent Ports'
New: Time filters for 'Frequent Risk Levels'
New: Time filters for 'Frequent Sensors'
Bug Fixes

7.1 BUILD 70142

New: Live GeoLocation always displays all active sensors
New: Multiple event tagging and searching

7.1 BUILD 70141

Updated Live GeoLocation mapping

7.1 BUILD 70140

New: Converted GeoLocation by IP to new map system

7.1 BUILD 70139

Fixed display issue with 'My Reports'

7.1 BUILD 70138

Updated Live GeoLocation maps
New: Event counts on tag management
UI improvements
Bug fixes
New: Date sorting on Console Logs/Error Logs

7.1 BUILD 70137

Updated UI for select item renders
Updated UI for select page templates
New: Date sorting on 'Activity Logs' view
Fixed several non-critical bugs
Fixed many minor cosmetic bugs
'tag:' keyword search returns proper event count
New: 'My Reports' view - View reports without having to first select row
Security: Tag management - User's may only update their own tags
Live Event Correlation - Display user friendly message when returning no results
New: Tag Detail view - Event counter

7.1 BUILD 70136

Apostrophe / Single quote is now an allowed character for line item entities within 'Charts & Graphs' pages
Added message to 'Charts & Graphs' pages to indicate NULL a result set to the user
Updated item renders for 'Charts & Graphs'
Updated template layout for 'Charts & Graphs' pages that do not contain a map

7.1 BUILD 70135

Fixed issue with search causing certain queries to return database warnings

7.1 BUILD 70134

Fixed network management problem, where some systems were unable to add networks and / or scan them

7.1 BUILD 70133

Fixed delete: keyword bug, that prevented multi-event deletes on various systems

7.1 BUILD 70132

Fixed blank report problem for remaining consoles
Resolved license nag for existing SAS licenses

7.1 BUILD 70131

Aanval SAS and Aanval SAS Enterprise

Minor cosmetic updates for SAS product
Fixed blank report problem

7.1 BUILD 70130

This is the initial release of Aanval SAS (Situational Awareness System)

New: Offensive Reconnaissance system
New: Rogue Host Detection system
New: Console sensor system
New: Console events will now appear within the event timeline and be searchable
Added user notification message when browsing previous datastore
Added help details throughout console
Added id to Tag Management display
Added type filter to Device Management
Added automated network scanning to Network Management
Added recent X filter to main display
Added active sensor list to main display
Added click / drill-down ability to all graphs
Added Offensive Reconnaissance history to IP Summary display
Added nmap binary configuration options to Console Preferences
Updated Console Preferences display
Re-organized top navigation menu
Minor look / feel changes
Fixed IP address parsing for 32-bit systems (fix for blank searches)
Fixed several non-critical bugs
Fixed many minor cosmetic bugs

7.0 BUILD 70129

Added category / class details to snort event details
Added ability to view search results in text format
Added GID to snort event details
Added warning user message alert when BPU's are stopped
Added help link to main display for advanced search system
Fixed special character in user password bug during account updates
Fixed console status display reporting incorrect BPU identifiers

7.0 BUILD 70128

Fixed a bug that was improperly importing GID details from snort events
Fixed a bug which displayed Syslog as the module for Snort event details

7.0 BUILD 70127

Fixed datastore bug that caused some systems to continuously rotate datastores when auto-rotate by day was selected

7.0 BUILD 70126

Updated console layout framework to support mobile devices + it now looks goooood!

7.0 BUILD 70125

Added delete link to event details view
Added different template for event details originating from syslog
Added event sanitization module to clean results after n seconds old
Fixed syslog bug that may have prevented syslog payloads from indexing properly

7.0 BUILD 70124

Fixed syslog bug that prevented syslog file imports with specific naming conventions
Fixed syslog bug that corrupted multiple filters per field
Additional syslog enhancements and stability fixes

7.0 BUILD 70123

Fixed major bug that prevented events from being properly imported (object serialization)
This particular bug affected only certain installations of PHP, however it has been resolved
This is a recommended update for all users

7.0 BUILD 70122

Fixed bug that prevented background processors from importing events in PHP 5.3 and lower
Added preferences option for event import run
Added geo location maps to frequent offenders and targets
Replaced Google Maps with new internal mapping architecture
Live geo location now shows directional arrows for events
Live geo location now uses radius size to demonstrate number of attacks
Please stop and restart the BPU's once this upgrade is complete

7.0 BUILD 70121

Added new event validation feature to assist in identifying false positives in bulk
Added new device, service and network management feature to make Aanval architecture aware
Added new Situational Awareness display that takes network architecture into account
Updated console configuration display
Minor bug fixes, nothing of consequence
Minor display, changes

7.0 BUILD 70120

Fixed signature import bug that may have prevented some systems from importing signature sources
Fixed a user message bug that failed to broadcast some system messages
New Port Summary Display
New Signature Summary Display
Added various links for new summary displays throughout console
Minor additional changes and fixes

7.0 BUILD 70119

Fixed syslog import / processing bug that may have prevented some systems from normalizing syslog sourced data
New charting and graphing system
New Timeline Browser
New IP Summary Display
Updated Frequent X displays
Updated Reports

7.0 BUILD 70118

Fixed major case-sensitivity issue with several table names and table structures that may have caused some consoles to not install and / or operate correctly. This is a recommended update for all.

7.0 BUILD 70117

Sessions will no longer be used for BPU's
Session defaults for maxlifetime, divisor and probability are now set in conf/defaults.php
Maintenance for the removal of ._ files has been added

7.0 BUILD 70116

Added Frequent Risk Levels to Charts & Graphs
Added Console Status (lower right portion of console) to allow for support assistance and troubleshooting
Fixed SMT bug that prevented communication with most recent SMT release

7.0 BUILD 70115

Installer includes tests for required PHP modules

7.0 BUILD 70114

Tag system, action system and email bug fixes

7.0 BUILD 70113

Updated the installer / updater conf file to use debug settings

7.0 BUILD 70112

Fixed sensor selection lists showing disabled sensors

7.0 BUILD 70111

Added live event correlation to the main menu system

7.0 BUILD 70110

This is the initial public release of Aanval v7

It has been many months of hard work, however we are extremely pleased and happy to have v7 available for all customers and prospects.

The following is a partial list of changes and enhancements within this release in no particular order.

No more Adobe Flash!
100% HTML and Javascript
Of course, an all new look and feel (a throwback and very similar to v3)
New BPU system provides as much as 10x the performance of v6
New message queueing system for reports and searches
New template and renderer based system for potential customization
New user message notification bar
Scrolling event data notification bar
Google Maps Geo Location
Real-time events per second, per hour and day
Consistent event display renderers
Signature details are available within event detail display
BPU status indicators
BPU status page
In console status and error logs
New organization for user options and features
Search caching and history display
Collections has been removed and replaced by Tags
New Tag system allows default or custom tags to be added to events
New Frequent Tags display
New Frequent Sensors display
Added import event tracker reset options to snort configuration display
Reports are available in HTML, XML and Text
Console configuration and preferences has been greatly enhanced
New console maintenance display has been added to configuration display
General improvements in overall performance throughout the entire console
Various crashes and import tracking sync bugs have been fixed
Signature download bug fixes
Geo data download bug fixes
Version update bug fixes
Fixed bug that caused continuous polling of update servers
Blank report bug fixes
Invalid datastore bug fixes
Dozens of minor bug fixes

Many more updates, fixes and enhancements to be released over the next hours, days, weeks and months

This release of Aanval is based upon a very strong new framework developed in-house to aid in rapid development and release.

Thank you,

BUILD 70100
This is the initial pre-public release of Aanval v7

Aanval iPhone / iPad App

Aanval Mini Appliance

Ultra small, powerful, and simply awesome!