Skip to main content

Changelog

Version 26.2.1​

2026-07-07

Fixed​

  • The updated RabbitMQ container image would sometimes prevent existing installations from starting correctly

Version 26.2.0​

2026-07-06

Added​

  • LDAPS-based access management
  • Added Brute Force attack detection capabilities

Changed​

  • Extended webshell detection modules

Fixed​

  • Fixed translations for ModSecurity rules involving multiple values

Version 26.1.0​

2026-04-09

Added​

  • New detection modules to highlight activity by malicious clients
  • New attack category: Privilege Escalation Attempt
  • Added detection modules for web shells
  • Seer Box now supports LDAP-based authentication systems
  • New detection modules for NoSQL injection attempts

Fixed​

  • PostgreSQL has been updated to the latest 15.x patch release

Version 25.4.0​

2026-01-29

Added​

  • A new user interface section allows to inspect all malicious transactions from a single view
  • Improved compatibility with air-gapped environments

Changed​

  • Extended detection capabilities, for SQL Injection and Code Injection attacks
  • The Protection section now provides dedicated pages for rule editing
  • The main plot on the dashboard now shows reference values directly on the Y-axis
  • Improved formatting for CSV data exported from the Alerts and HTTP Traffic views
  • GUI: filters are now preserved in case of a page refresh
  • When copying and pasting a log format for a traffic source or a firewall match, the newline characters are now removed instead of being replaced with whitespaces
  • Improved GUI expired session handler

Fixed​

  • Registries for one-shot reports related to lists of hosts are now correctly created
  • New traffic sources configured to use TCP listeners can now re-use ports associated with sources that have previously been deleted

Version 25.3.0​

2025-10-13

Fixed​

  • Blacklisting a large amount of IP addresses simultaneously won't cause a timeout anymore
  • Retention settings in the General section can now be modified and saved even if mail server parameters are missing
  • Improved read access times for intelligence and geolocation databases

Version 25.2.0​

2025-08-04

Added​

  • Data transfer between the Sentinel and Engine components can now rely on a secure channel with a high compression ratio. This allows for fully distributed deployments across untrusted networks with minimal impact on bandwidth usage
  • The PDF report generation engine has been replaced with a faster and more robust solution
  • Seer Box can now receive and display notification of rule match events with dedicated listener services and a new section on the graphical user interface

Changed​

  • The bot detection module has been extended to identify a wider range of potentially malicious sources
  • Detection of path traversal attack attempts has been improved
  • Trusted clients won't be scanned for potentially malicious input, if ground truth validation is active

Fixed​

  • PDF generation has been stabilized, preventing report creation errors
  • Restored trend statistics visualization on the GUI to cover the full range of the configured retention interval

Version 25.1.0​

2025-04-30

Added​

  • Added Rule Automation Policies for more fine-grained management of rule creation conditions
  • Added the IP Set feed for IP Tables firewall
  • Added a test configuration process for Mailer settings
  • Added Rule actions validation on Rules creation
  • Added button to clone existing Report Schedule
  • Seer Box Sentinel is now capable of logging events remotely in JSON format

Changed​

  • Enhanced efficiency and increased speed on retrieving trends data
  • Added new user permissions and improved existing ones

Fixed​

  • User session revocation is now triggered when user groups are updated
  • Disabled rules are correctly syncronized with firewalls
  • Improved Code Injection detection module for better accuracy

Version 24.4.1​

2025-03-14

Fixed​

  • Seer Box now supports using an HTTP proxy for outbound traffic by reading the HTTP_PROXY environment variable to determine proxy settings
  • Fixed conversion issues for applicative rules when upgrading from versions < 24.4
  • Improved validation on country codes
  • Minor fixes

Version 24.4.0​

2025-02-27

Added​

  • Enabled support for simultaneously sending rules to multiple firewalls/WAFs
  • Introduced a complete rule history in the Audit Log section
  • Added REST API support for importing and exporting rule backups
  • Added the ability to import external rule sets via REST API

Changed​

  • Enhanced SQL Injection and XSS detection modules for improved accuracy
  • Completely redesigned the Protection section, now structured into Application, Network, and Legitimate Rules categories
  • Significantly increased rule creation and management capabilities

Fixed​

  • Report scheduling now functions correctly
  • Improved Fake Bot detection module for better accuracy
  • Fixed incompatibility between Seer Box Reporter service and versions of podman > 4.9
  • Various minor bug fixes and optimizations

Version 24.3.2​

2024-11-14

Fixed​

  • Improved reliability of RabbitMQ connections
  • Improved efficiency when creating multiple reports simultaneously

Version 24.3.1​

2024-11-05

Fixed​

  • Improved reliability of RabbitMQ connection

Version 24.3.0​

2024-10-21

Added​

  • Added export of Alerts and HTTP traffic to CSV
  • Added Attack type field on Legitimate creation wizard
  • Added Protocol field on Traffic Source creation form

Changed​

  • Improved field options on Legitimate creation wizard

Fixed​

  • Improved SQL Injection detection module
  • Improved deobfuscation of control characters when scanning for injection attacks
  • Traffic source listener doesn't truncate transactions bigger than 4K bytes
  • Reports with Log4J JNDI Injection alerts are now correctly created
  • Search on Domain Group input field in Add to existing Domain Group action is now working properly
  • Improvements in overall system stability and resilience

Version 24.2.1​

2024-08-05

Added​

  • Added missing Expression filter on Protection - Rules page

Fixed​

  • SIEM Notification modules now include a Timezone reference
  • Improved Malicious Scanner and SQL Injection detection modules
  • Increased report generation timeout to handle longer processing times

Changed​

  • Time intervals for sending Telemetry data have been reduced

Version 24.2.0​

2024-07-02

Added​

  • New HTTP clients table on Alert details page to inspect attack sources
  • Updated CLI with new automation features, including license activation and rule management
  • New Attack trends chart on Dashboard
  • New telemetry module to enable shared threat intelligence
  • Hosts can be associated to an existent Domain Group from the Assets - Hosts page
  • New filter that allows to show/hide Hosts associated with a Domain Group on Assets - Hosts page
  • New targets on Custom Rule creation
  • Network rule automation can be enabled for specific Domain Groups, Hosts or attack types
  • Detection can be disabled for specific response codes or client IPs
  • Hosts not assciated with a Domain Group that are not seen by the software for a configurable amount of time will be deleted

Fixed​

  • Improved Path Traversal and Bruteforce detection modules
  • Improved concurrency and efficiency on main Seer Box Engine processes
  • The loading times of the Alert page have been drastically reduced
  • The loading times of the Metrics data have been drastically reduced
  • Oplon WAF rule translation

Version 24.1.2​

2024-05-15

Fixed​

  • Bug blocking sending of application rules to Oplon WAF
  • Bug preventing network rule syncronization after their expiration date
  • Wrong IP validation on Seer Box GUI input fields

Changed​

  • Generic Oplon firewall integration is now split in Oplon WAF and Oplon Firewall for IP blacklisting

Added​

  • Prevent alert detection for specific subset of status codes

Version 24.1.1​

2024-04-24

Fixed​

  • Bug blocking license validation process after license service disruption
  • Error while inserting User Agent data related to alerts
  • Minor fixes

Removed​

  • Redundant dependency on Seer Box GUI container image

Version 24.1.0​

2024-04-11

Added​

  • New Audit Logs section on Seer Box web interface
  • New Seer Box Sentinel component to enable distributed traffic monitoring
  • Built-in support for standard NCSA log formats
  • Alert will be automatically ignored after a configurable amount of time
  • New filters available on Alerts, Rules, Legitimates and HTTP Traffic pages
  • Sample configurations for Kubernetes-based deployments

Changed​

  • HAProxy log format now supports more fields, including HTTP request body
  • Docker-based deployments now support host directory bind mounts
  • Notifications destination now allows hostnames

Fixed​

  • Type mismatch exception on report creation
  • Bug preventing Seer Box Engine from restarting its listeners
  • Bug preventing Seer Box Engine to properly cache metrics and trends
  • PostgreSQL connections are now limited to allow reuse
  • no data warning on Dashboard traffic chart
  • Report generation on Docker-based deployments
  • Editing an existing SIEM Notification resets the log format to CEF