<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="4455800f7e8142ed6fb11abfb921d49cc1d0d0f4e92d4d1c2fa8cd95f3fae03a" name="awp-agent" arch="aarch64">
  <version epoch="0" ver="2.10.0" rel="40174.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1778068800">- compliance: ship CIS Kubernetes Benchmark v2.0.0 PDF and Kubernetes SCA policies `atomic_k8s_worker_kubelet.yml` + `atomic_k8s_control_plane.yml`; trigger copies CIS Ubuntu policies and Kubernetes YAML into ruleset/sca
- k8s-mapping: add static-friendly Go helper (Kubernetes API → NDJSON atomic_ossec.k8s_mapping.v1) under src/awp-agent/k8s-mapping for future syscollector integration
- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.6" date="1778846400">- active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
- active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability
- RPM trigger: copy CentOS CIS SCA from modules/compliance/content/centos into ruleset/sca on CentOS hosts
- RPM trigger: remove Ubuntu SCA copy path (Debian/Ubuntu packages use debian postinst)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.10.0" date="1779105600">- compliance: Kubernetes SCA policies `cis_k8s_worker_kubelet.yml` and `cis_k8s_control_plane.yml` (CIS Kubernetes Benchmark v2.0.0 themes; kubeadm worker/control-plane heuristics); RPM trigger copies into `ruleset/sca/kubernetes` and removes legacy `atomic_k8s_*` names
- compliance: refresh `cis_rhel10_linux.yml` benchmark content
- RPM `%triggerin`: copy CentOS CIS policies from `modules/compliance/content/centos/&lt;major&gt;/` into `ruleset/sca` on CentOS hosts; drop Ubuntu-specific SCA install from RPM (Debian/Ubuntu use `.deb` postinst)</changelog>
</package>
<package pkgid="b584fbc67b47b176a3df55f3001cb76365db56993125d14f1590a9d15a11bdcc" name="awp-agent" arch="aarch64">
  <version epoch="0" ver="2.9.5" rel="40117.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.5.0" date="1745928000">- strip the compliance-scanner binary to reduce its size
- Fix for ubuntu postinstall to apply sca files
- Fix for clamav range, moved from 281xx to 481xx, this overlapped with RHEL9
- Add Rocky 9 benchmark
- Add command support to compliance-scanner
- Add summary result to compliance-scanner
- Add -failed to compliance-scanner, this will only show the failed results, otherwise tests that pass will be displayed with "passed"
- Update for ASL Issue#1284, this is to add remote upgrade support into the UI
- add Debian 12 benchmark
- postinst on deb systems target content adding based on OS version
- firewall module, only run on rhel/centos/rocky
- atomicorp-functions, add detection for u24
- Update ubuntu 14/16/18 CIS checks to detect the version of the OS before running
- Disable the Ubuntu 18 NX test, as this was dumping the entrie journalctl to the SCA's memory</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.0" date="1746705600">- compliance-scanner, add parallel scanning, file caching, and configurable max size limit scanning (8k default)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1776772800">- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
</package>
<package pkgid="4303ef8a14420f956b68400adb2d87d8fa6b3b0aa440f30b58c21262e01c16c8" name="awp-agent" arch="aarch64">
  <version epoch="0" ver="2.9.6" rel="40133.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.0" date="1746705600">- compliance-scanner, add parallel scanning, file caching, and configurable max size limit scanning (8k default)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1776772800">- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.6" date="1778846400">- active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
- active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability</changelog>
</package>
<package pkgid="fac3e8587bd2660f5b00e983e9ac0120ed938577e71171e353381ce271a7d7f8" name="ossec-hids" arch="aarch64">
  <version epoch="1" ver="4.11.0" rel="39897.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1776600000">- Bump Version to 4.11.0 to align with ossec-hids.spec and current release train.</changelog>
</package>
<package pkgid="693ae471025aae0938c2d68683726d20911067090d620946514bedeaa1438d78" name="ossec-hids" arch="aarch64">
  <version epoch="1" ver="4.11.1" rel="40087.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1776600000">- Bump Version to 4.11.0 to align with ossec-hids.spec and current release train.</changelog>
</package>
<package pkgid="a8c75cf055acd48352cb8dd0cc66c4d94d01a89c93a14dbe0e55568f7490dfcb" name="ossec-hids-agent" arch="aarch64">
  <version epoch="1" ver="4.11.0" rel="39897.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1776600000">- Bump Version to 4.11.0 to align with ossec-hids.spec and current release train.</changelog>
</package>
<package pkgid="f82b0de6af40f5a67556cf56b859154504924740b0ef228aec9848d07e64a1e3" name="ossec-hids-agent" arch="aarch64">
  <version epoch="1" ver="4.11.1" rel="40087.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1776600000">- Bump Version to 4.11.0 to align with ossec-hids.spec and current release train.</changelog>
</package>
</otherdata>