Attributed metadata history

v5.0.0-rc1

[v5.0.0] Manager Added Issue Comment #38260 Added HTTPS communication between Wazuh agents and the manager: a new HTTPS transport, protocol, and control plane (connection, configuration, statistics, task dispatch, remote upgrade, and event ingestion) replacing the legacy MQ/DGRAM-based agent-manager protocol end to end. #31295 Added cluster-by-default deployment model: all Wazuh Server installations now run as a cluster node, removing the distinction between clustered and non-clustered deployments. The cluster.disabled configuration option has been removed. #33269 Added stateless metadata enrichment in remoted, centralizing event metadata handling for stateless messages and removing the dependency on wazuh-db for that ingestion path. #33493 Added Engine enrichment support: IOC matching, GeoIP lookup, and event filters. #34477 Added Engine adaptation tier 2: raw archives handling, uncategorized event routing, input-level throttling, and internal metrics exposure. #35623 Added CVSS v4.0 support to the Vulnerability Scanner. #35771 Added Engine metrics collection, normalization, and indexing pipeline. #36000 Added new CVE 5.0 schema fields to the Vulnerability Detector content model. #35579 Added manager watermarks. #37052 Added byte-based capacity limits to wazuh-manager-remoted. #37706 Added default API role mappings for the indexer users wazuh-admin, wazuh-readonly and wazuh-demo. #38023 Added the POST /config HTTPS endpoint, which receives an agent's reported configuration and indexes it into wazuh-agent-config. #38024 Added the POST /stats HTTPS endpoint, which persists the statistics an agent reports as one document per agent in the wazuh-agent-stats index, replacing the previous report on every push. #38007 Added legacy remote_upgrade task delivery in remoted: a polling thread pushes pending Task Manager tasks to connected agents older than v5.0.0 over their existing session using the legacy six-step WPK push, gated on remoted's HTTPS verification_mode. #38157 Added installation-time variables to customize the default <remote> configuration on source, DEB, and RPM manager installations. #38553 Added the PUT /agents/scan/vulnerability endpoint to trigger an on-demand vulnerability scan for one agent, a list of agents, or all agents. #38589 Added recurring manager tasks to the Task Manager: the agent disconnection sweep, the deletion of long-disconnected agents, and manager log rotation now run as durable, retried tasks inside wazuh-manager-modulesd. Their resolved settings are reported by GET /manager/configuration/wmodules/wmodules. #38862 Added a warning logged by wazuh-manager-apid on every start for each API default user (wazuh, wazuh-wui) whose password is still the one shipped with the package, pointing at bin/rbac_control change-password. The API starts either way. #38992 Added the remote.https.ca_certificate option, naming the CA that signs the HTTPS agent listener certificate (default etc/certs/root-ca.pem), and the unauthenticated GET /cacerts endpoint that serves it: 200 with the PEM, 404 when the file is missing, 503 (ca_mismatch) when it does not sign the served certificate. wazuh-manager-remoted now evaluates its listener certificate at start and every 24 hours — a WARN under 30 days to expiry, an ERROR once expired or when the CA and the certificate diverge — and exposes remoted.cacerts.*, remoted.server.tls.cert_expiry_days and remoted.server.tls.ca_matches_leaf, projected by GET /cluster/{node_id}/daemons/stats. #38993 Added enrollment tokens: an operator mints a token on the master (wazuh-manager-authd --create-enrollment-token --address <host>, or POST /agents/enrollment-tokens with the new RBAC actions enrollment_token:create/read/delete) that names the manager, pins its CA and carries a one-time-issued credential; a new agent pastes it and enrolls over POST /enroll on port 1517 with a wazuh-enroll+jwt bearer whose kid is the token id, without

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.