Skip to content

Releases: OpenBAS-Platform/openbas

Version 1.15.2

22 Apr 15:25
1bd9fc1
Compare
Choose a tag to compare

Bug Fixes:

  • #2984 Manual expectations don't show the name of the expectation
  • #2983 Manual validation scores are inconsistent in the screen animation > validations
  • #2981 Challenge maximum number of try doesn't work
  • #2980 Challenge score are not updated when expectation is validated
  • #2969 Crash on some instances where the nanoseconds of the creation date are not on 6 digits

Pull Requests:

  • Bump http-proxy-middleware from 3.0.3 to 3.0.5 in /openbas-front by @dependabot in #2988
  • [frontend] Manual validation scores are inconsistent in the screen animation > validations (#2983) by @RomuDeuxfois in #2993
  • [backend] Making the number of nanoseconds not fixed by @Dimfacion in #2970

Full Changelog: 1.15.1...1.15.2

Version 1.15.1

14 Apr 13:03
80c4082
Compare
Choose a tag to compare

Bug Fixes:

  • #2906 Issues with mapper when time is empty or when not complete (example 'M+')
  • #2902 Telemetry service.instance.creation date is not ISO compliant

Pull Requests:

New Contributors:

Full Changelog: 1.15.0...1.15.1

Version 1.15.0

02 Apr 13:19
a7f94cb
Compare
Choose a tag to compare

Hello dear community! The OpenBAS 1.15.0 is out ! Hope you will enjoy it! 🎉

🐶 Show prevention/detection alerts (EDR/SIEM)
Time to investigate ! In your inject results page, you can now see the list of alerts triggered by an inject and get redirected to the alert page of supported EDR and SIEM.

Find the related documentation:
https://docs.openbas.io/1.15.X/usage/injects/#viewing-execution-traces

Enhancements:

  • #2716 Adapt backend to support Outparsers in Payloads
  • #2652 Improve issue workflow when doing a PR on release/current
  • #564 Show prevention/detection alerts (EDR/SIEM)

Bug Fixes:

  • #2822 Text layout issue in endpoints list
  • #2820 Multiple layout issues in the payload command form
  • #2762 Upgrade react intl lib to fix issue
  • #2721 Show labels in filters for asset groups, asset, teams (atomic testings, simulations, scenarios)
  • #2526 In English, there is no space before "!" or "?"
  • #2521 Wrong size of search input and bottom margin with title in atomic testing overview
  • #2460 Behavior of lists with 1 item is not correct (missing bottom border)
  • #1890 Payload details form: validation error on File controle (Executable, FileDrop) prevents other fields validation

Pull Requests:

  • [frontend] Update dependency react-router to v7.4.0 (release/current) by @renovate in #2713
  • [frontend] Update typescript-eslint monorepo to v8.27.0 (release/current) by @renovate in #2714
  • Improv logout on local env by @RomuDeuxfois in #2662
  • [frontend] Improv UI (#2723, #2724) by @RomuDeuxfois in #2726
  • [frontend] Update dependency @types/react to v19.0.12 (release/current) by @renovate in #2732
  • [frontend] Update material-ui monorepo (release/current) by @renovate in #2733
  • [frontend] Update dependency i18n-auto-translation to v2 (release/current) by @renovate in #2734
  • [frontend] Add Windows link for "log on service" policy (#2699) by @damgouj in #2727
  • [frontend] Update dependency @types/node to v22.13.11 (release/current) by @renovate in #2738
  • [frontend] Update dependency swagger-typescript-api to v13.0.25 (release/current) by @renovate in #2746
  • [frontend] Update dependency react-intl to v7.1.8 (release/current) by @renovate in #2747
  • [frontend] Update eslint monorepo to v9.23.0 (release/current) by @renovate in #2743
  • [frontend] Update dependency zustand to v5.0.3 (release/current) by @renovate in #2744
  • [frontend] Update dependency vitest to v3 (release/current) by @renovate in #2745
  • Show labels in filters for asset groups, asset, teams (atomic testings, simulations, scenarios) by @RomuDeuxfois in #2737
  • Fix/auto translations by @johanah29 in #2739
  • [frontend] Fix error ui related to uppercase by @savacano28 in #2753
  • [tool] add gh actions to autoclose and autolink issues on release/cur… by @guillaumejparis in #2654
  • [frontend] Update dependency @types/node to v22.13.13 (release/current) by @renovate in #2759
  • [frontend] Update typescript-eslint monorepo to v8.28.0 (release/current) by @renovate in #2758
  • Behavior of lists with 1 item is not correct (missing bottom border) by @RomuDeuxfois in #2728
  • [frontend] refacto Payload form by @MarineLeM in #2755
  • Wrong size of search input and bottom margin with title in atomic testing overview by @RomuDeuxfois in #2731
  • Bump vite from 6.2.2 to 6.2.3 in /openbas-front by @dependabot in #2769
  • [backend] Upgrading spring-security-crypto by @Dimfacion in #2761
  • Upgrade react-intl lib by @RomuDeuxfois in #2763
  • [frontend] Update dependency moment-timezone to v0.5.48 (release/current) by @renovate in #2771
  • [frontend] Update dependency monocart-reporter to v2.9.17 (release/current) by @renovate in #2772
  • [frontend] Update dependency vite to v6.2.3 (release/current) by @renovate in #2774
  • [frontend] Update dependency swagger-typescript-api to v13.0.28 (release/current) by @renovate in #2773
  • [frontend/backend] Show expectations traces (#564) by @johanah29 in #2598
  • [frontend] Fix traduction for endpoint list by @savacano28 in #2828
  • [frontend] correct UI on payload form by @MarineLeM in #2832
  • [Backend] Fix trace status message without agent by @savacano28 in #2836
  • [frontend]Remove unecessary "?" and "!" in en.json -pt2 by @johanah29 in #2831
  • Fix release workflow by @Dimfacion in #2764

Full Changelog: 1.14.1...1.15.0

Version 1.14.1

24 Mar 13:58
dd8a5f7
Compare
Choose a tag to compare

Bug Fixes:

  • #2741 Missing new agent installers in OpenBAS docker image

Pull Requests:

  • Bump @babel/runtime from 7.25.9 to 7.26.10 in /openbas-front by @dependabot in #2711
  • Bump axios from 1.7.9 to 1.8.3 in /openbas-front by @dependabot in #2710
  • [backend] add agent installer curl in circleci config by @MarineLeM in #2740

Full Changelog: 1.14.0...1.14.1

Version 1.14.0

19 Mar 15:54
14ac664
Compare
Choose a tag to compare

Hello dear community! The OpenBAS 1.14.0 is out ! Hope you will enjoy it! 🎉

🦾 Ability to install OpenBAS Agent as a user

You asked for it, you got it ! OpenBAS agent logic has been upgraded to let you install the agent as your own account but also as a chosen user, giving you more capacity to execute payloads as system like before but also as session user. In addition to this, you can also now install multiple agent on one endpoint.

Find the related documentation: https://docs.openbas.io/latest/usage/openbas-agent/

🔎 Telemetry

In order to better understand how our platform is used, we are starting to monitor OpenBAS instances. All data collected is very high level, like number of instances running in the wild, number of users per instance and so on. Everything is anonymized. We do not and will not collect personal data and knowledge data.

Find the related documentation:

https://docs.openbas.io/latest/reference/deployment/telemetry/

📔 Documentation

The development and product teams have dedicated significant effort to creating thorough and comprehensive documentation to ensure clarity, ease of use, and seamless understanding for all you!

Here are all topics that have been tackled:

As always, your feedbacks are most welcome ! You can reach me or the Filigran team to let us know what would be a game changer for you and your team 😁

Enhancements:

  • #2070 Translation Automation
  • #1860 I can choose the level of privilege of my agent
  • #1829 Manage asset group expectations in the same way as team expectations

Bug Fixes:

  • #2672 CrowdStrike executor is broken in an instance, with a stack trace preventing it to run properly
  • #2614 Inject stay in pending
  • #2599 UI Payload Creation Stepper doesnt work
  • #2583 Missing FKs in join tables linked to Tags
  • #2575 Status of inject is still incorrect in some cases
  • #2573 Wrong order in the menu for atomic testing
  • #2568 In the endpoint view, agent logos are truncated
  • #2532 In the left menu, active marker is not working in assets / people / components
  • #2522 Wrong display of payload when using injector that does not require executor / neither payload
  • #2477 Injects in a report are not ordered chronologically
  • #2464 Theming options forms is not correct
  • #2417 Incorrect height / vertical alignement of the organization field (certainly due to the "+" button)
  • #2339 Use parent process name signature for Caldera Implant
  • #2316 When I create a technical inject in a simulation and I remove the expectation, expectations still there
  • #1667 Useless / not working bullet points in execution overview

Pull Requests:

  • [frontend] align last execution date on inject by @MarineLeM in #2582
  • [backend] clean trace from openTelemetry by @MarineLeM in #2581
  • [backend] add openbas.xtm.opencti.api_url by @MarineLeM in #2586
  • [frontend/backend] add metrics from opentelemetry by @MarineLeM in #2553
  • [frontend]sorting inject list in reports by execution date Issue/2477 by @heditar in #2554
  • [frontend] Fix ordre of the popover options by @savacano28 in #2584
  • [frontend] in left menu active marker on submenu if navbar is close by @MarineLeM in #2611
  • [frontend] Update dependency @stylistic/eslint-plugin to v4.2.0 (release/current) by @renovate in #2591
  • [frontend] Update typescript-eslint monorepo to v8.26.0 (release/current) by @renovate in #2596
  • [frontend] Update dependency @types/node to v22.13.9 (release/current) by @renovate in #2597
  • [frontend] Update Yarn to v4.7.0 (release/current) by @renovate in #2590
  • [frontend] Update fontsource monorepo to v5.2.5 (release/current) by @renovate in #2595
  • [backend] feature flag telemetry by @MarineLeM in #2620
  • [frontend] Update dependency typescript to v5.8.2 (release/current) by @renovate in #2594
  • [frontend] Update dependency axios to v1.8.1 (release/current) by @renovate in #2592
  • [frontend] Update dependency cronstrue to v2.56.0 (release/current) by @renovate in #2593
  • [tool] Improve & clean renovate config by @guillaumejparis in #2612
  • [backend] Fix warnings at backend start by @guillaumejparis in #2601
  • [frontend/backend] Display payload info tab only when we have a payload by @guillaumejparis in #2550
  • Change on the exception raised to bring clearer error by @Dimfacion in #2624
  • [backend] Add parent process name for caldera and cs detection by @savacano28 in #2508
  • Improve release workflow by @Dimfacion in #2438
  • [frontend] Update dependency @faker-js/faker to v9.6.0 (release/current) by @renovate in #2627
  • [frontend] Update dependency @playwright/test to v1.51.0 (release/current) by @renovate in #2628
  • [frontend] Update dependency ckeditor5 to v44.3.0 (release/current) by @renovate in #2629
  • [frontend] Show Default value for settings by @savacano28 in #2625
  • [frontend] Update dependency react-router to v7.3.0 (release/current) by @renovate in #2630
  • [backend] Add fk for jointure tables by @savacano28 in #2640
  • [backend] Update logback monorepo to v1.5.17 (release/current) by @renovate in #2632
  • [frontend] Update eslint monorepo to v9.22.0 (release/current) by @renovate in #2631
  • [frontend] Update dependency axios to v1.8.2 (release/current) by @renovate in #2633
  • [backend] avoid two threads to execute in same time implant callback by @MarineLeM in #2616
  • [frontend] Update dependency rxjs to v7.8.2 (release/current) by @renovate in #2634
  • [frontend] Update material-ui monorepo (release/current) by @renovate in #2635
  • [backend] Update dependency io.opentelemetry:opentelemetry-bom to v1.48.0 (release/current) by @renovate in #2626
  • [frontend] Translation automation (#2070) by @johanah29 in #2227
  • [backend] Update dependency io.swagger.core.v3:swagger-annotations-jakarta to v2.2.29 (release/current) by @renovate in #2645
  • [backend] Update dependency io.hypersistence:hypersistence-utils-hibernate-63 to v3.9.3 (release/current) by @renovate in #2644
  • [backend] Update dependency io.hypersistence:hypersistence-utils-hibernate-63 to v3.9.4 (release/current) by @renovate in #2647
  • [frontend] Update dependency eslint-import-resolver-oxc to v0.13.0 (release/current) - autoclosed by @renovate in #2646
  • [frontend] Update dependency @types/node to v22.13.10 (release/current) by @renovate in https://github.co...
Read more

Version 1.13.1

05 Mar 14:51
6800275
Compare
Choose a tag to compare

Bug Fixes:

  • #2605 Manual inject fails during execution
  • #2603 Not able to add expectations on injects

Full Changelog: 1.13.0...1.13.1

Version 1.13.0

04 Mar 09:47
c3b9846
Compare
Choose a tag to compare

Hello dear community! The OpenBAS 1.13.0 is out ! Hope you will enjoy it! 🎉

♻️ Ability to import/export injects

Reuse your content everywhere you want ! In addition to the import/export of scenario or simulation, you can now select any type of injects from a simulation to import it in another scenario/simulation, making any injects more flexible!

🎯 Filter injects by target

Having trouble remembering your setup ? Filter your inject by teams, asset or asset group and get a clear understanding on what inject will impact what target.

🔎 Nmap scan injector

Do you want to learn more about potential vulnerabilities of your assets ? Try our Nmap injector and get an overview of your open ports in our brand-new findings section of your inject results.

Enhancements:

  • #2566 Differenciate internal and external IP addresses in endpoints
  • #2425 Integrate Output contract and findings logic
  • #2291 Ability to import/export injects
  • #2233 Need to standardize our way of gathering our endpoints depending on the executors
  • #1958 Be able to filter inject tab by teams, asset and asset groups

Bug Fixes:

  • #2587 Dashboard page too large when the mitre matrix is large itself
  • #2567 CrowdStrike executor is not getting the right IP address
  • #2558 Inject upload button should be 8px away from display mode buttons
  • #2548 Regression export pdf report in Firefox
  • #2545 When using an external injector that targets assets, execution crashes
  • #2529 Inject creation form field is based on key rather than on type
  • #2514 Inconsistent compute of results from collectors
  • #2513 Inject bulk export: select all mode not functional
  • #2473 Exporting Scenario/Simulation/Inject does not export Payload files (documents)
  • #2445 Fix usage of geologica
  • #2221 RBAC controls do not permit users to access inject outputs
  • #2167 Inconsistency in the way we display the name and icon of an inject
  • #2151 Tanium seems to not deduplicate assets when it collects
  • #1942 Prerequisites commands ( check + command ) are counted as one command instead of two in Tracking total count
  • #1937 Execution date are not align in inject execution

Pull Requests:

  • When I create a technical inject in a simulation and I remove the expectation, expectations still there by @RomuDeuxfois in #2387
  • Improvment spacing on scenario and simulation by @RomuDeuxfois in #2422
  • remove duplicate code on inject form by @MarineLeM in #2442
  • [backend] Clean ExerciseDetails model & query by @RomuDeuxfois in #2443
  • [frontend/backend] Filter injects on teams, assets and asset groups by @impolitepanda in #2388
  • [frontend] Update react monorepo to v19 (major) - abandoned by @renovate in #2013
  • [frontend] remove legacy inject export button (#2291) by @antoinemzs in #2355
  • [frontend] Update material-ui monorepo (release/current) by @renovate in #2458
  • [frontend] Update dependency eslint to v9.20.1 (release/current) by @renovate in #2457
  • [backend] fix: Filters issue on not contains, empty and not empty by @impolitepanda in #2471
  • [tool] Update Node.js to v22.14.0 (release/current) by @renovate in #2456
  • [frontend] fix usage of geologica by @Dimfacion in #2446
  • [backend] Export injects endpoint (JSON) (#2291) by @antoinemzs in #2359
  • Adding pyroscope to ease debugging by @Dimfacion in #2368
  • [backend/frontend] Adapt code base to manage the installation of multiples agents - chunk 2 by @savacano28 in #2208
  • [frontend] Update remark (release/current) by @renovate in #2410
  • [backend] Add migration traces status by @savacano28 in #2474
  • [frontend] Update dependency pdfmake to v0.2.18 (release/current) by @renovate in #2407
  • [backend] Fix migration asset tags by @savacano28 in #2478
  • [frontend] Update dependency vite to v6.1.1 (release/current) by @renovate in #2494
  • [frontend] Update dependency zod to v3.24.2 (release/current) by @renovate in #2495
  • [frontend] Update dependency @xyflow/react to v12.4.3 (release/current) by @renovate in #2491
  • [frontend] Update dependency html-to-image to v1.11.13 (release/current) by @renovate in #2492
  • [frontend] Update dependency @vitest/eslint-plugin to v1.1.31 (release/current) by @renovate in #2490
  • [backend] Update dependency io.hypersistence:hypersistence-utils-hibernate-63 to v3.9.2 (release/current) by @renovate in #2489
  • [frontend] Update dependency react-router to v7.2.0 (release/current) by @renovate in #2487
  • [frontend] Update dependency globals to v15.15.0 (release/current) by @renovate in #2486
  • [frontend] Update dependency eslint-import-resolver-oxc to v0.12.0 (release/current) by @renovate in #2485
  • [backend] Update dependency io.pyroscope:agent to v0.18.0 (release/current) by @renovate in #2480
  • [frontend] Update dependency @faker-js/faker to v9.5.0 (release/current) by @renovate in #2482
  • [frontend] Update dependency @ckeditor/ckeditor5-react to v9.5.0 (release/current) by @renovate in #2481
  • [frontend] Update dependency uuid to v11.1.0 (release/current) by @renovate in #2488
  • [tool] Update eclipse-temurin Docker tag to v21.0.6_7-jre (release/current) by @renovate in #2500
  • [frontend] Update react monorepo (release/current) by @renovate in #2499
  • [frontend] Update material-ui monorepo (release/current) by @renovate in #2498
  • [frontend] Update dependency monocart-reporter to v2.9.15 (release/current) by @renovate in #2493
  • [backend/frontend] Add agents results expectations in the atomic testing overview by @savacano28 in #2462
  • [frontend] Update dependency jsdom to v26 (release/current) by @renovate in #2503
  • [frontend] Update fontsource monorepo to v5.1.1 (release/current) by @renovate in #2497
  • [frontend] Update dependency apexcharts to v4.5.0 (release/current) by @renovate in #2483
  • [frontend|backend] Align create and update injects card headers (#2167) by @johanah29 in #2454
  • [frontend] Fix UI atomic undefined injector contract by @savacano28 in #2512
  • Bugfix list by @RomuDeuxfois in #2465
  • [backend] Update dependency io.opentelemetry.semconv:opentelemetry-semconv to v1.30.0 (release/current) by @renovate in #2479
  • [frontend] Update dependency @stylistic/eslint-plugin to v4 (release/current) by @renovate in #2502
  • [backend] Add feature flag for UI agent expectations by @savacano28 in #2518
  • [backend] Import injects endpoint (#2291) by @antoinemzs in #2447
  • [backend/frontend] Fix update result expectation from collectors by @savacano28 in #2511
  • [...
Read more

Version 1.12.2

18 Feb 10:46
05f6009
Compare
Choose a tag to compare

Bug Fixes:

  • #2326 Long simulation page load time

Full Changelog: 1.12.1...1.12.2

Version 1.12.1

14 Feb 16:31
1b6ca07
Compare
Choose a tag to compare

Bug Fixes:

  • #2450 Left menu is broken when we have an error message

Pull Requests:

Full Changelog: 1.12.0...1.12.1

Version 1.12.0

12 Feb 15:08
092a5bc
Compare
Choose a tag to compare

Hello dear community!

The OpenBAS 1.12.0 is out ! Hope you will enjoy it! 🎉

🐦 OpenCTI x OpenBAS TTP placeholder

Let’s clarify your payload coverage ! When you generate a scenario from OpenCTI , we will now give you visibility on all TTPs that could not be covered by your payload library. This will take the shape of placeholders in your scenario that you can replace with custom payloads to complete it.
Find the related documentation here.

🔗 Assign asset groups on tagged scenario/simulation

Who doesn’t like to automate ? You can now define asset groups to apply by default on scenario and simulation with a defined tag. This allows simple asset group assignment for your OpenBAS scenario and also and foremost automated asset assignment for scenario created from OpenCTI.
Find the related documentation here.

🗒️ Execution payload traces for multi end points & multi agents

Want to review how your payloads are executing ? We’ve organized the payload traces by asset and agent to make it easier! In the "Execution Details" tab of a technical inject, you’ll find traces organized by agent, and agents grouped by endpoint. This allows you to easily track execution progress at both the agent and endpoint levels.
Each agent generates multiple traces corresponding to different execution steps, including:

  • Prerequisite checks (validation before execution)
  • Prerequisite retrieval (only if the check fails)
  • Attack command
  • Cleanup commands

We clarified and explained in details the 3 different statuses you can see the in the “Execution Details” tab:

  • Traces statuses: each execution step reports a status.
  • The agent status computation: when an agent completes execution, the server retrieves all traces and computes an agent status based on some rules.
  • The inject status: after all agents have completed their execution, the system calculates the inject status using the same logic applied to compute the agent status.

Find the related documentation here.

🙌 Expectation on manual injects

What if I want to log & evaluate events that can’t be captured in OpenBAS ? Now you can ! We improved our manual injects, you can now assign teams and expectations to them. For example, you can now create an inject for “a crisis cell has been put together” and validate the expectation that “the right protocol has been used”.
Find the related documentation here.

‼️ PostgreSQL

We’re updating the recommended PostgreSQL version to 17. This doesn’t mean it won’t work on PG16, but we will no longer support versions lower than the recommended one.
Find the related documentation here.

📔 Documentation

The development and product teams have dedicated significant effort to creating thorough and comprehensive documentation to ensure clarity, ease of use, and seamless understanding for all you! And it’s still an ongoing process 💪. For now, here are the main topics we tackled:

Enhancements:

  • #2434 Disable remove from asset group controls for assets included by filter
  • #2253 Add links to the doc for CrowdStrike agent and Tanium agent installation
  • #2217 Implement expectations results per agent level
  • #2168 Clarify crowdstrike collector name
  • #2123 Add info about the timeframe for the 4 top widget of the dashboard
  • #1998 Define and apply default assets for OCTI generated simulation
  • #1982 [implant/agent] Code Quality
  • #1981 [implant/agent] Fix warnings during compile
  • #1951 Ability to understand my payload traces for multi endpoints & multi agents
  • #1908 Ability to run 100 simulations at the same time
  • #1824 Align Feature Flag with the changes done on OCTI
  • #1774 Move to Postgresql 17
  • #1768 Add expectation on manual inject
  • #1489 [ Unit testing - simulation scope ] - import/export of a simulation (JSON)

Bug Fixes:

  • #2435 Duplicate documents when adding one that already exists
  • #2431 Team player count does not update on Teams list page when changing player roster
  • #2429 Error in imported scenario
  • #2372 Error when I try execute an inject with a executable file and this file is linked to other entities (exercises, injects)
  • #2351 Incorrect color in organizations and players selectors
  • #2350 Incorrect background colors in tags selector
  • #2349 Incorrect behaviour on field with on-the-fly creation (label is not correctly placed)
  • #2348 Spacing is not correct between papers on endpoint overview
  • #2328 Bottom bar bulk actions in Injects list view do not work reliably with sparse selection
  • #2325 Mail Functionality for Teams is not working
  • #2324 Error with MailGun
  • #2311 When I try to access the Payload info (atomic test) I get an internal error
  • #2308 Execution callback route authorize no message
  • #2299 Postges docker error
  • #2290 I didn't find the docker.compose.yml file when I cloned the repository.
  • #2289 Remove grey sections with 'coming soon' to be more align with what's actually available
  • #2255 Targets list in atomic testing with asset group is not accurate
  • #2250 Inject still in Missing Content after fill Assets or Asset Groups
  • #2220 File upload payloads executed by the default OpenBAS agent on Windows do not appear to function correctly
  • #2174 Bulk test only test injects on displayed page on the "test" tab of a scenario/simulation
  • #2173 In overview of simulation, spaces are not correct
  • #1993 Defender not detecting
  • #1946 Execution status & traces are not aligned
  • #1943 Display Tracking Ack Date in traces of inject execution
  • #1855 Sending a media pressure inject should require an article
  • #1843 Lessons learned space below header tabs is not correct
  • #1821 Tags design is broken
  • #1626 When adding a team to the definition page, the page is not automatically updated
  • #1609 Missing margin bottom in simulation overview

Pull Requests:

Read more