Version v26.07

Changes in version v26.07

Early Access UI. Added the early access UI.

Added the early access UI to preview new Collector functionality before it is supported in MITIGATOR.

Report. Added scanner reports.

Added API requests to retrieve IP addresses from which connections to unique dst_ip addresses or dst_ip + dst_port pairs exceeding a specified threshold were observed.

If necessary, you can exclude individual source IP addresses from the query results or ignore connections to individual destination IP addresses.

Report. Added attack reports.

Added the ability to set attack detection criteria for a selected time range by exceeding the incoming or dropped traffic threshold. The attack detection mechanism is similar to the MITIGATOR autodetection mechanism. Each five-second interval within the selected time range is evaluated. A trigger can be either exceeding the absolute rate value or a relative change in rate between intervals.

For each detected attack you can build a report on attacking addresses, get a list of all src_ip involved in the attack, or all src_ip + dst_ip pairs.

Report. Added TLS fingerprint reports.

Added top reports and graphs for TLS traffic. The reports and graphs display statistics on TLS ClientHello across various dimensions. You can build top reports by:

  • transport protocols;
  • JA3/JA4 fingerprints;
  • SNI values;
  • source IP addresses;
  • destination ports.

Available graphs:

  • number of TLS ClientHello messages;
  • number of unique src_ip in sessions;
  • number of unique dst_ip in sessions;
  • number of JA3/JA4 fingerprints;
  • destination ports.

Building graphs and tables for TLS traffic is available in the early access UI.

Report. Added geo information to the subnet top report.

Subnet top reports are now enriched with information about the country and the autonomous system the subnet belongs to. The country and AS are determined by the first IP address of the subnet.

Exporters. Added the ability to ignore flows with a zero egress interface as dropped.

Added an exporter setting that allows you not to classify a flow as dropped if a zero egress interface is set.

Named Lists. Added named prefix lists.

Added the ability to create, update, and delete named lists that can contain IPv4 and IPv6 addresses and prefixes.

When building top reports by IP addresses, for each IP address found in existing named lists, the matching list name is shown.

BGP. Added the ability to announce several prefix lists to a BGP neighbor simultaneously.
Podman. Added support for the Podman containerization platform.

Now Collector can be installed using Podman and the Podman Compose orchestration tool. The installation and maintenance guide has been updated.