Version v26.08

Changes in version v26.08

Detect. Added detection by monitoring object.

Now you can set detection rules for a monitoring object.

Example:

{
  "rules": [
    {
      "id": 1,
      "rules": [
        "tcp inbound domain-a packets on 1000 >> log"
      ]
    }
  ]
}

When incoming traffic to the monitoring object, accounted for in domain a, exceeds 1000 TCP segments per second, this rule adds an event about the threshold being exceeded.

Detect. Added the "log" action for detection rules.

Added the log action that creates an event log entry when a detection rule is triggered.

Detect. Added the "ttl" modifier for detection rules.

Now, if a detection rule has the ttl modifier, the action does not stop immediately after traffic drops below the off threshold, but continues to work for a specified period of time.

Example:

{
  "rules": [
    {
      "id": 1,
      "rules": [
        "per-src packets 100 ttl 50 >> hpd"
      ]
    }
  ]
}

This rule will add to HPD the IP address from which more than 100 packets per second are received. This IP address will remain in HPD for another 50 seconds after the traffic rate drops below the threshold.

Detect. Added support for named IP address lists in detection rules.

Detection rules for protection policies and monitoring objects now support named IP address lists for the src and dst components.

Monitoring objects. Added support for named IP address lists in traffic definition rules.

Policy. Added support for named IP address lists in flow accounting rules.

Exporters. Added support for IPVersion in NetFlow v9 and v10.

Added correct processing of Flow messages containing both IPv4 and IPv6 source or destination addresses.