Attributed metadata history

3.2

The static trails now live in their own repository, stamparm/trails, and reach a deployment as one assembled file instead of shipping in the source tree. Everything else in this release is secondary to that, so read the upgrade note first. Upgrading from 3.1.x — do this A maltrail.conf written before 3.2 has no STATIC_TRAILS_URL, and without it the static trail set is not loaded at all. Add: STATIC_TRAILS_URL https://github.com/stamparm/trails/releases/latest/download/trails.csv.gz …or re-run install.sh, which writes it for you. Maltrail will not let this pass quietly. The updater prints a banner across the terminal, server --doctor fails with exit 1, and maltrail-sensor -T fails its preflight — so the systemd unit's ExecStartPre catches it before the sensor ever runs. Losing the trail set is indistinguishable from a quiet network, and that is not a thing to discover in a month. There is deliberately no silent fallback to a default URL. A deployment that fetches its detection content from an address the operator never configured is a worse answer than one that says what is missing. Why the split trails/static was 98.7% of every blob byte in this repository's history and 9,169 of 9,549 commits. Two consequences: git log, git blame and git bisect were useless on the code, and updating detection content meant pulling a new version of the software. The repository went from 9,578 commits and a 110 MiB pack to 353 commits and 3.3 MiB. Content history was not deleted — it moved, with authorship intact. What changes for a deployment Static trails fetched from STATIC_TRAILS_URL, cached next to TRAILS_FILE Update cost ~11 MB gzipped, or 65 bytes when the published digest says nothing changed Content freshness published up to 4×/day; new indicators reach you within hours instead of on your next git pull Pinning point STATIC_TRAILS_URL at a dated content-YYYYMMDD-HHMM release so a bad publish is not immediately global Offline / air-gapped trails-bootstrap.csv.gz ships with this release and install.sh seeds the cache from it, so a first start detects immediately even with no connectivity Integrity a payload that does not match its published sha256 is refused in favour of the cache Feeds unchanged — still fetched by your deployment directly from each publisher Custom trails unchanged, but CUSTOM_TRAILS_DIR no longer defaults inside the installation directory trails/feeds/ moved to feeds/. trails/static and trails/custom stopped pretending to be feed plugins — they only ever were so update_trails() could run one loop, which is why DISABLED_FEEDS static used to silently disable 1.6M trails. Also in this release Everything that accumulated since 3.1.1: Alerting: ALERT_WEBHOOK_URL posts events at or above a severity threshold, with throttling. Slack, Mattermost, Discord, a SIEM collector, or your own endpoint. Event index: a per-day SQLite sidecar. /counts is exact rather than estimated, and /hunt skips non-matching lines instead of reading every one. JA3/JA4 client fingerprints matched as trails, byte-identical to the Python implementation and pinned by generated vectors. Beaconing heuristic — timer-regular reconnects to one destination, rated suspicious, never malware, because uptime monitors beacon too. Trail confidence: how strongly sources agree, surfaced in /check and the trail drawer. server --doctor preflight, and both config parsers now flag an unknown option instead of ignoring a typo. Longest-match whitelist precedence — an exact static trail on a more specific name than its whitelisted ancestor now fires. 3,082 trails on shared platforms were loaded, counted, and could never match. Source citations survive the split: each release of the trail set carries a provenance sidecar, so the trail drawer still shows the report an indicator was extracted from. Fixes worth naming: UDP event intake was losing 24% at 10k events/s (a thread and an open() per datagram — now lossless to 20k/s); /hunt

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.