# changelog

author: Support <support@atomicorp.com> - 2.7.0
changelog:
  - firewall module, integration with the global whitelisting policy from the server
  - firewall module, add support for windows


author: Support <support@atomicorp.com> - 2.8.0
changelog:
  - active-response: add ipset-based active response script (awp-ipset.sh)
  - awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
  - compliance-scanner: add Rocky Linux 10 benchmark
  - compliance-scanner: add Rocky Linux 9 benchmark
  - compliance-scanner: add Rocky Linux 8 benchmark


author: Support <support@atomicorp.com> - 2.9.0
changelog:
  - AIX: Add support for AWPclamav in /opt/atomicorp
  - AIX: Fix sed compatibility using perl wrapper
  - AIX: Update malware-scanner path detection
  - Add Enterprise Linux 10 (el10) support
  - compliance-scanner: add Rocky Linux 10 benchmark


author: Support <support@atomicorp.com> - 2.9.2
changelog:
  - active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
  - retention: Update diff-retention-check.sh with date-based logging for rotation
  - atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
  - atomicorp-api: Add check_repository function to verify repo presence before updates
  - active-response: Normalize service names during restart (ossec-hids vs ossec-agent)


author: Support <support@atomicorp.com> - 2.9.3
changelog:
  - active-response: Fix premature service restart in atomicorp-api
  - retention: Add date-based logging for rotation in diff-retention-check.sh
  - clamav: Add /var/clamav and /var/lib/clamav as permanent excludes


author: Support <support@atomicorp.com> - 2.9.4
changelog:
  - active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
  - clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
  - retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509


author: Support <support@atomicorp.com> - 2.9.5
changelog:
  - compliance: ship CIS Kubernetes Benchmark v2.0.0 PDF and Kubernetes SCA policies `atomic_k8s_worker_kubelet.yml` + `atomic_k8s_control_plane.yml`; trigger copies CIS Ubuntu policies and Kubernetes YAML into ruleset/sca
  - k8s-mapping: add static-friendly Go helper (Kubernetes API → NDJSON atomic_ossec.k8s_mapping.v1) under src/awp-agent/k8s-mapping for future syscollector integration
  - active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts


author: Support <support@atomicorp.com> - 2.9.6
changelog:
  - active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
  - active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability
  - RPM trigger: copy CentOS CIS SCA from modules/compliance/content/centos into ruleset/sca on CentOS hosts
  - RPM trigger: remove Ubuntu SCA copy path (Debian/Ubuntu packages use debian postinst)


author: Support <support@atomicorp.com> - 2.10.0
changelog:
  - compliance: Kubernetes SCA policies `cis_k8s_worker_kubelet.yml` and `cis_k8s_control_plane.yml` (CIS Kubernetes Benchmark v2.0.0 themes; kubeadm worker/control-plane heuristics); RPM trigger copies into `ruleset/sca/kubernetes` and removes legacy `atomic_k8s_*` names
  - compliance: refresh `cis_rhel10_linux.yml` benchmark content
  - RPM `%triggerin`: copy CentOS CIS policies from `modules/compliance/content/centos/<major>/` into `ruleset/sca` on CentOS hosts; drop Ubuntu-specific SCA install from RPM (Debian/Ubuntu use `.deb` postinst)


author: Support <support@atomicorp.com> - 2.5.0
changelog:
  - strip the compliance-scanner binary to reduce its size
  - Fix for ubuntu postinstall to apply sca files
  - Fix for clamav range, moved from 281xx to 481xx, this overlapped with RHEL9
  - Add Rocky 9 benchmark
  - Add command support to compliance-scanner
  - Add summary result to compliance-scanner
  - Add -failed to compliance-scanner, this will only show the failed results, otherwise tests that pass will be displayed with "passed"
  - Update for ASL Issue#1284, this is to add remote upgrade support into the UI
  - add Debian 12 benchmark
  - postinst on deb systems target content adding based on OS version
  - firewall module, only run on rhel/centos/rocky
  - atomicorp-functions, add detection for u24
  - Update ubuntu 14/16/18 CIS checks to detect the version of the OS before running
  - Disable the Ubuntu 18 NX test, as this was dumping the entrie journalctl to the SCA's memory


author: Support <support@atomicorp.com> - 2.6.0
changelog:
  - compliance-scanner, add parallel scanning, file caching, and configurable max size limit scanning (8k default)


author: Support <support@atomicorp.com> - 2.9.5
changelog:
  - active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts


author: Support <support@atomicorp.com> - 2.9.6
changelog:
  - active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
  - active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability


author: Support <support@atomicorp.com> - 4.10.1-1
changelog:
  - ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
  - active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
  - Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
  - Renumber `ossec-hids-authd.service` to Source10.


