Attributed metadata history

v9.0.0

We'd like to thank Aaron J. Scantlin (@scantlina), @airshelley, Alexey Rubanik (@Rubanik-Alexei), Azil (@achill06), Bauti Peirone (@bautipeirone), Blair McCormick (@blairSmcc03), Craig Leres (@leres), Craig P (@detection-labs), @Cxiyuan, Dragon Roar (@lczllx), @eb-anssi, Eduardo Kohn (@eagle-head), Eldon Koyle (@ekoyle), @franky-m, Jan Grashöfer (@J-Gras), Javid Khan (@dxbjavid), Jie (Link) Zheng (@chillancezen), @jmestwa-coder, Julio César Suástegui (@juliosuas), Keith J. Jones (@keithjjones), Kevin Harrington (@ke5C2Fin), Maor Hamami (@mamaorha), Mario D (@mari0d), Matthias Vallentin (@mavam), Mohan Dhawan (@mdhawan, @Mohan-Dhawan), neil (@neilpang), Otto Fowler (@ottobackwards), Peter Cullen (@pbcullen), Seth Grover (@mmguero), Shubham Kumar (@chmodshubham), Simeon Miteff (@simeonmiteff), Smoot (@stevesmoot), Stefan Götz (@stefangoetzcorelight), Steven (@malvidin), Sujala Vasanthasena Nelavai (@sujalavnelavai), Swastik Bose (@VasuBhakt), @tim-cyb, Urval (@urvalkheni), @uwezkhan and Yacin Nadji (@ynadji) for their contributions to this release. In addition, we're grateful to Kara Zaffarano and Kyle Elliott of Trail of Bits in collaboration with OpenAI, AdaLogics in collaboration with Anthropic, and the Canadian Communications Security Establishment for their code-scanning efforts and resulting bug reports. Breaking Changes Expanding on the removal of Broker::listen_websocket() in Zeek 8.1, this release fully removes Broker's legacy embedded WebSocket server. The script layer no longer provides Broker::BrokerProtocol and the options Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy have likewise been removed. Use :zeek:see:Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead. In Zeek's core, the Broker manager's Listen() method now always uses Broker's native protocol and no longer accepts the optional BrokerProtocol argument. The BrokerProtocol enum has been removed. Calling the zeek::util::fmt() helper function from non-main threads will now emit a warning of the following form once: zeek::util::fmt() called off the main thread; use threading::BasicThread::Fmt() or std::format() In a debug build, Zeek will also abort. If you see above message, it is likely that an installed plugin spawned a thread and uses the API wrongly (likely input or logging threads). When deploying custom plugins, you should optimally test Zeek and all plugins separately with the thread and address sanitizers enabled (./configure --sanitizers=thread or ./configure --sanitizers=address). The ZeekJS plugin now requires std::format from C++20 which is not available in older distributions using GCC 12.x like Debian 12. If you want to use JavaScript support in Zeek, please update to a more recent distribution. Beginning with Zeek 9.0, the Zeek team is sunsetting our official support of FreeBSD. This is primarily because of our move to a new CI provider and the lack of good support for FreeBSD. We are moving FreeBSD support to the same model as OpenBSD where we will accept patches from external contributors if we break something, but not build and run the test suite on FreeBSD ourselves. This will simplify our maintenance a bit, as well as reduce the amount of time spent on CI jobs. New Functionality The zeek-packet-source-udp (https://github.com/zeek/zeek-packet-source-udp) plugin is now included and enabled by default on Linux and FreeBSD. Instead of reading raw packets from a network interface, this packet source turns Zeek into a UDP server to process UDP-based VXLAN or GENEVE mirror traffic directly: zeek -i udp::0.0.0.0:4789:vxlan The listening UDP socket is opened using the SO_REUSEPORT socket option. When scaling the number of Zeek workers, the kernel will balance packets among the individual UDP sockets based on the hash of the outermost UDP headers. This packet source comes with a few ConnKey implementations

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.