Changelog¶

This page includes IDSTower releases history & a highlight of Major features/enhancements added.

3.1.1 - (28-8-2026)

Changes:

BugFix: Fixed IDSTower appearing to lose its license when you opened a rule on a Standard license. Viewing a rule loads its change history, which needs a Professional or Enterprise license, and the refusal was reported with the same status the server uses for a license that is missing or expired. The web interface acts on that status by sending you to the activation page, so opening any rule on a Standard license replaced the page with Activate Your License and its “enter your license key to get started” prompt — as though the key you had just entered had been lost or rejected. Nothing was wrong with the license: it stayed stored, valid and in force throughout, and navigating anywhere else showed it intact. A license that does not cover a feature is now reported separately from a license that cannot be used, so it leaves you on the page you were on, where the rule’s change-history panel explains that the feature needs a Professional license. The same ejection affected the AWS Connector on a non-Enterprise license. Present since 3.1.0, which is when the web interface began redirecting on that status.
BugFix: Fixed a failed cluster operation reporting Ansible’s own warning output instead of what actually went wrong. Whenever a playbook failed and anything at all had been written to standard error, IDSTower discarded the per-task detail it had already received and showed that text instead, under a heading of “ansible-playbook exited with code 2”. Ansible’s deprecation warnings are the usual trigger, but an SSH banner, a sudo lecture or a locale warning does it just as well. The real reason — something like Error: conf-yaml-loader: failed to open file: /etc/suricata/instance-Bridge/suricata.yaml: No such file or directory — was never shown, and the only way to reach it was to silence the warnings so that standard error happened to come back empty. IDSTower now reads the playbook’s own output first and falls back to standard error only when there is nothing to read, which is what a genuine pre-execution failure looks like: a playbook that could not be found, an inventory error, invalid YAML. The same defect also stopped the onboarding take-over added in 3.1.0 from offering its existing-installation acknowledgement, since that outcome is only ever produced while reading the playbook output — whether a headline feature worked depended on whether Ansible had happened to print a warning first. Separately, the setting meant to suppress those deprecation warnings had never taken effect in any installation, Docker or package: it was conditional on an environment variable that nothing IDSTower ships ever sets.

Please Follow the Upgrade Guide from v3.1.0 to v3.1.1 to update IDSTower to this version.

3.1.0 - (12-8-2026)

Changes:

New Feature: Onboard an existing Suricata deployment - IDSTower can now take over Suricata hosts that already run Suricata, instead of only managing installations it performed itself. When creating a cluster you choose between a Fresh deployment (IDSTower installs and fully manages Suricata, as before) and an Existing deployment, where IDSTower connects over SSH, detects the Suricata instances already running on each host - their systemd services, configuration files, rules and log directories, monitored interfaces, binary path and version - and adopts them. A backup of the existing configuration is taken before anything is changed, and hosts can be added to an onboarded cluster later in the same way. On an onboarded cluster you also choose what IDSTower manages, through six independent management capabilities that can each be turned on or off: Health Monitoring (metrics, service status and resource usage), Rules Management (push IDS rules and IOCs to the hosts), Log Management (automated Suricata log cleanup by retention period and disk usage), Service Control (start, stop and restart Suricata services), Package Management (install, upgrade and manage software versions) and Configuration Management (own and deploy suricata.yaml). This makes it possible to monitor an existing deployment without letting IDSTower touch its configuration, or to manage rules and IOCs while leaving package upgrades to your own tooling - a cluster IDSTower installs itself is fully managed and has nothing to choose. Capabilities are selected when the cluster is created and can be changed afterwards from the Enabled Capabilities panel on the cluster’s Summary tab, so you can start with monitoring only and gradually migrate control of your Suricata hosts to IDSTower, one capability at a time; enabling Configuration Management on an already-onboarded cluster runs a guided take-over that associates configuration profiles with the existing instances.
New Feature: The license key is now stored in the database instead of appsettings.json - A fresh installation no longer needs a license key at install time: IDSTower starts without one and the first administrator to log in is taken to a license activation page. The key can also be set or updated from Settings → License, or provisioned non-interactively with the new --set-license-key command line option (useful for Docker and automated deployments). Setting LicenseKey in appsettings.json or through an environment variable is deprecated and logs a warning at startup, and the appsettings.json shipped with a new installation no longer contains the field; on upgrade, an existing key is copied from your appsettings.json into the database automatically, so no action is required.
New Feature: Configurable timeouts for cluster operations - Slow package installations and hung Ansible runs no longer block a cluster operation indefinitely. Three timeouts are configurable from the new Advanced tab in Settings (Cluster Operations section): a per-task package manager timeout, and separate process timeouts for quick and long-running operations. When an operation times out, the Ansible process tree is terminated and the output produced so far is written to the log so the failure can be diagnosed. Access to the Advanced settings tab is governed by two new RBAC permissions.
New Feature: Upgrade hosts that are not all on the same minor version - When upgrading a cluster to a .x version (for example Suricata 7.x), you can now tick Allow mixed minor versions to upgrade each host to the newest version its own repository offers, instead of requiring one version to be available on every host. The cluster summary also offers an accept installed version action for the case where all hosts were upgraded outside IDSTower (for example with a manual apt upgrade): it records the installed version as the cluster’s expected version without running a deployment.
New Feature: Automatic cleanup of expired IDS rule revisions - IDSTower now deletes rule revisions that have been Expired for a configurable period of time (6 months by default, enabled by default), keeping the rules database lean on installations with frequently-updating feeds. The cleanup runs daily, records deleted revisions in the rules change history, and can be configured or disabled from the settings -> Rules tab under the “Rules Cleanup” section. Deployed rulesets are not affected, since only Enabled rules are deployed.
New Feature: Protection against overwriting an existing Suricata installation - When you deploy a new cluster or add hosts to an existing one, IDSTower now checks whether Suricata is already installed on each host. If it finds one, it stops before changing anything on that host and tells you which host is affected, so you no longer risk accidentally replacing a working Suricata installation (for example when you mistype a hostname). If you did intend to replace it, tick the “Take over the existing Suricata installation” option that appears and click Next again to continue.
Improved: Full support for the Suricata threshold keyword when editing IDS rules, including the backoff and multiplier options and the newer tracking modes.
Improved: More reliable database upgrades — a database schema version is now recorded only once the whole upgrade for that version has succeeded. An IDSTower upgrade applies a schema change (SQL) followed by a data-migration step that adapts existing data to the new schema; previously the second step only ran as part of an automatic upgrade, so databases upgraded by applying the shipped SQL script manually skipped it, and a data-migration step that did not complete was logged but never re-attempted. Now a recorded version always means both parts finished: if the data migration has not run — including after a manual SQL upgrade — the database still shows the previous version, so the next start re-runs the outstanding step and only then records the new version. Re-applying the shipped SQL script is safe, and after a manual upgrade you should start IDSTower and let it complete the data migration rather than inserting the version row by hand.
Improved: Host deployment/validation errors reported in the UI now include the exact error output when an Ansible module crashes on the target host (MODULE FAILURE). Previously the error details (“See stdout/stderr for the exact error”) were only available in the backend logs; they are now shown in the expandable Stdout/Stderr sections of the error display, including failures that occur inside looped tasks.
Improved: More reliable loading indicators in the web UI — buttons and spinners can no longer get stuck in a loading state when an operation fails or the page is left mid-request. Rolled out first to the deployment templates management screen.
Improved: Suricata rules and threat-intelligence indicator updates now fall back to restarting the Suricata service when a zero-downtime ruleset reload is not possible because the instance’s unix-command socket is unavailable. Previously the updated rules were written to disk but not loaded into the running Suricata until its next restart. This mainly affects existing (non-IDSTower-managed) installations using distribution packages whose service unit cannot recreate the socket directory (/run/suricata) after a reboot; the fallback log message explains how to fix the socket to regain zero-downtime reloads. If a socket is available but the live reload itself fails (eg: an invalid ruleset), no restart is attempted and the previous ruleset keeps running.
Improved: Clicking Update on a threat-intelligence feed that is already being updated in the background (by the scheduled feeds update, or by another user) no longer looks like a failed update. Instead of a red error message, the feed now shows a notice explaining that an update is already running and that its results will appear once it finishes; the update in progress is unaffected. This is most visible right after adding a new feed, since the scheduler picks up a newly added feed within a minute.
Improved: Suricata network and port variables (HOME_NET, EXTERNAL_NET, the *_SERVERS groups and the port groups) are now stored as plain comma-separated values, with the grouping brackets [ ] that Suricata uses for lists kept in the configuration template instead of baked into the variable. The values read more cleanly in the cluster Configs tab, are easier to validate, and can be extended directly in the template (for example "[{{ Suricata_HOME_NET }},1.1.1.1]") without producing a stray bracket in the middle of the value. Existing clusters are unaffected until their configuration profile is upgraded, at which point any brackets stored in the value are moved into the template automatically.
BugFix: Fixed IDSTower logging The model for context "IDSTowerContext" has pending changes. Add a new migration before updating the database. as an error on every start when installed on a host running MariaDB 11.0 or newer from the distribution’s own repositories — Ubuntu 25.04 and later, and any future release shipping MariaDB 11+. The database driver misread the server version from the connection greeting (deriving 0.25.04 from 11.4.7-MariaDB-0ubuntu0.25.04.1), which made IDSTower treat a modern MariaDB as an ancient one: timestamp columns were expected without sub-second precision, so the schema appeared to differ from the shipped one, and queries were generated without using features the server supports. The installed database was never affected. IDSTower now reads the server version directly from the server instead of the connection greeting.
BugFix: Fixed cluster operations (configuration changes, start/restart) intermittently failing with a “Suricata Service instance … did not start” error and rolling back, when the periodic rules/IOC update running on the target host restarted a Suricata instance at the same moment. Those updates now pause for the duration of an IDSTower operation and take turns with each other, and IDSTower waits for an update that is already running before it starts working on the host. The IOC update is also no longer scheduled in the same minute as the rules update (it now runs at minute 2,7,12,… instead of 0,5,10,…), so the two no longer compete for the same host. Service start verification was also made resilient: instead of checking the service state once at a fixed moment, IDSTower now waits for the service to be running steadily, so a restart triggered by something else on the host no longer fails the operation, while a service that starts and then dies is still reported. The two files used to coordinate this (an operation marker and a content update lock) are documented in the README deployed to /etc/suricata/README.txt on each host, and the flock command (util-linux package) is now installed and validated on managed hosts.
BugFix: Rules and IOC threat-intelligence feeds now use the same failure circuit breaker as TAXII and MISP feeds: after 3 consecutive failed updates the feed is paused for 1 hour before being retried automatically, and a still-failing feed re-enters the pause after each retry (one attempt per hour instead of one per minute). The pause state and the recent download errors are available in the feeds API response, and disabling then re-enabling the feed clears the pause immediately. Previously a persistently failing rules feed was re-downloaded and fully re-imported every minute, causing sustained high CPU usage.
BugFix: Fixed the background task scheduler starting every scheduled task twice per occurrence (visible as duplicated “Running scheduled update for feed” log lines) and allowing long-running executions to overlap with the next occurrence. Combined with the feed update lock race this caused duplicate concurrent feed imports and sustained high CPU usage. Each scheduled task now runs exactly once per cron occurrence, and a run that outlasts its interval simply skips the missed occurrences instead of piling up.
BugFix: Fixed rule imports failing an entire batch (up to 1,000 rules) when another task inserted one of the batch’s rules at the same time (duplicate-rule conflict on the unique signature id/revision index) — for example two feeds carrying the same rule, or a manual feed update racing a scheduled one. The import now re-checks the batch against the database once and skips the rules that already exist, instead of discarding the whole batch.
BugFix: Fixed a database error in one threat-intelligence feed update cascading into failures of every subsequent feed in the same update pass: failed changes were left pending on the shared database session and were replayed by each following feed’s save, so a single failing feed (for example a duplicate-rule conflict) made all other feeds fail with the same error until the application was restarted. Failed changes are now discarded so every feed update starts from a clean state.
BugFix: Fixed rules imports crashing with an internal error (ArgumentNullException) when a database error occurred while saving a batch of rules — the crash masked the actual database error. Failed imports now abort cleanly and report the underlying database error in the logs and the API response.
BugFix: Fixed a race condition in the threat-intelligence feed update lock that could let two background tasks import the same feed at the same time, causing duplicate-rule database errors and repeated full re-imports of large rule feeds (high CPU usage). The per-feed lock is now atomic, and it is always released when a feed update fails unexpectedly (previously a failed update could leave the feed locked for up to an hour).
BugFix: Fixed an issue where deploying a configuration change could delete all Suricata instances (configuration directories, systemd units and logs) on a host whose instance configuration could not be resolved, for example after re-adding the same host under a different FQDN/IP. Configuration deployment now fails safely with a clear error message instead of deleting instances when the deployed configuration contains no instances for a host that has managed instances on disk.
BugFix: Fixed Suricata configuration deployment failing on AlmaLinux 8 because the rsync –mkpath option is not supported by rsync 3.1.3; the option is now only used on Red Hat family operating systems (RedHat, CentOS, AlmaLinux, Rocky, Fedora, Amazon, OracleLinux) with major version greater than 8.
BugFix: Fixed the cluster-creation wizard rejecting valid IPv6 addresses and CIDR ranges (eg: 2001:db8::/64) in the Home Network Ranges (HOME_NET) field. The field now accepts IPv4 and IPv6 addresses/CIDR ranges including ::-compressed IPv6, supports excluding a range with a leading ! and the special any value, and correctly rejects invalid IPv4 octets and out-of-range prefix lengths.
BugFix: Fixed the AWS Network Firewall export rule variables validation rejecting IPv6 addresses and CIDR ranges for IP Set variables, despite the error message stating IPv6 is supported.
BugFix: Fixed Suricata deployments and validations failing on Ubuntu hosts where the OISF Suricata PPA was already configured in the deb822 format — for example hosts where Suricata was previously installed manually with add-apt-repository on Ubuntu 24.04 or later. The resulting duplicate repository definitions (deb822 and legacy one-line format with different Signed-By values) made apt unable to read its sources at all (“Conflicting values set for option Signed-By”), leaving the host broken until fixed manually. IDSTower now manages the OISF Suricata repository in the modern deb822 format with a bundled OISF signing key that is scoped to that repository only (previously the key was globally trusted, and Ubuntu 25.04+ hosts needed keyserver access to fetch it). Conflicting or duplicate OISF repository definitions are removed before any apt operation, which automatically repairs hosts already left in the broken state. Hosts set up by earlier IDSTower versions are migrated to the new format the next time a repository-touching operation runs (host validation, deployment, or Suricata version upgrade) — no manual action is required.
BugFix: Fixed offline (Built-In / User-Custom packages repository) Suricata and Logshipper deployments reporting a misleading No package matching '/tmp/idstower/.../<some-dependency>.deb' is available error when the installation ran into a package problem. When the direct dpkg installation failed, the apt fallback passed the local .deb file paths as if they were package names — so it could never succeed and always failed with that message, hiding the real dpkg error (for example an unmet dependency). The fallback now installs the local package files correctly, and a failure reports the actual dpkg/apt error.
BugFix: Fixed cluster deployments failing on Debian/Ubuntu hosts with a No package matching 'cron' is available error (or the same message for rsync, lsof, iproute2, findutils or util-linux) when the host’s apt package index was empty — for example a container-based host, or any host where apt-get clean had been run and apt-get update had not. Unlike yum/dnf, apt never refreshes its index on its own, so IDSTower could not find packages that were in fact available from the host’s repositories. IDSTower now refreshes the apt cache before installing these prerequisites; the refresh is best-effort, so hosts installing from the Built-In or User-Custom packages repository without internet access are unaffected.
BugFix: Fixed deployments failing with No package matching 'epel-release' is available on Debian-derived hosts that IDSTower does not recognise by name (for example VyOS, Linux Mint, Devuan or Raspberry Pi OS), when the Suricata “official repository” option is used. Those hosts fall back to a generic set of steps that tried to enable the EPEL repository regardless of the package manager in use — EPEL only exists for Red Hat family systems, so on an apt-based host the step could never succeed and always stopped the deployment. EPEL is now only enabled on yum/dnf hosts.
BugFix: Fixed Suricata services failing to start with Failed to locate executable /sbin/suricata: No such file or directory (systemd status 203/EXEC) on Debian-derived hosts that IDSTower does not recognise by name (for example VyOS, Linux Mint, Devuan or Raspberry Pi OS). The path of the Suricata binary written into the generated service units — and used to validate the configuration — was derived from the host’s distribution name, and every distribution outside Ubuntu/Debian was assumed to use the Red Hat layout (/sbin/suricata), while those hosts install Suricata to /usr/bin/suricata. IDSTower now asks the host where its Suricata binary is instead of guessing from the distribution, and falls back to the layout matching the host’s package manager when Suricata is not installed yet.
BugFix: Fixed the creation/update timestamps of threat-intelligence feeds that were added before those timestamps existed never being filled in. A backfill has been running on every startup since the columns were introduced, but it wrote to the wrong object and silently left the affected feeds showing an empty date; those feeds now get their timestamps set on the first start after upgrading.
BugFix: Fixed the Suricata instances of a host being listed in an arbitrary order in the cluster’s Hosts tab (and everywhere else the API returns them). The order was whatever the database happened to return — on a host onboarded with several existing instances it matched neither the order the instances were detected in nor alphabetical order, and it could change from one page load to the next. Hosts and their instances are now always returned in creation order, so a host’s instance list stays in the same order it was first shown in and newly detected instances are appended at the end.

Please Follow the Upgrade Guide from v3.0.x to v3.1.0 to update IDSTower to this version.

3.0.2 - (8-3-2026)

Changes:

BugFix: Fixed a regression where IDSTower would fail to recognise that the Filebeat service started correctly due to a permission issue.

Please Follow the Upgrade Guide from v3.0.1 to v3.0.2 to update IDSTower to this version.

3.0.1 - (3-2-2026)

Changes:

BugFix: Fixed UI issue during configuration editing where periodic updates would reload the config data while on the Configs tab, causing unsaved changes to be discarded and template modals to close unexpectedly.
Improved: Enhanced template editing workflow UX:

Please Follow the Upgrade Guide from v3.0.0 to v3.0.1 to update IDSTower to this version.

3.0.0 - (31-1-2026)

Changes:

New Enterprise Feature: Multi-Instance Architecture - Hosts can now run multiple Suricata instances with isolated configurations, enabling advanced use-cases for high performance setups and multi-tenancy offering better resource utilization and flexibility.
New Feature: IDS Rules Deployment Templates - Introduced a configurable template-based system for managing IDS rule deployments across Clusters, Configuration Groups, Hosts, and Instances, allowing granular control over which rules are deployed where.
New Feature: Added display formatting, syntax highlighting, auto-completion and built-in docs to the IDS Rules editor.
New Feature: Better configuration files editing experience, with syntax highlighting, auto-completion and built-in descriptions of configuration options.
New Feature: Suricata 8 Support - Full compatibility with Suricata version 8.x (note: Suricata 8 is not supported on Ubuntu 20.04).
New Feature: Filebeat 9 Support - Full integration with Filebeat 9.x including updated repository management, delivered through a new Filebeat configuration profile (3.0.0): the Elasticsearch output gains a Use HTTPS/TLS setting, the Filebeat inputs read the per-instance Suricata log directories introduced by the multi-instance architecture, and the index template Filebeat loads into Elasticsearch is renamed from idstower-suricata to suricata.
New Feature: Feed Pagination Support - Added pagination support for TAXII and MISP API feeds with configurable page sizes, with the ability to configure how far back in time to retrieve events in the initial sync.
New Feature: Users can now change Clusters names after creation, via the Cluster page.
New Feature: Added the ability to delete the rule from the rule page.
New Feature: Added support for new operating systems: AlmaLinux 10, Rocky Linux 10, Oracle Linux 10, Ubuntu 25.04, and Debian 13 (Trixie).
New Feature: Configuration Profile Upgrade Warnings - Display warning banners when configuration profiles need upgrades, with one-click upgrade functionality.
New Feature: Critical Disk Usage Protection - Automatically manages log files when disk usage reaches 90% threshold to prevent disk full scenarios.
Improved: Now rule source code is kept in sync with the latest version from the feed, if the rule source code get modified manually by the user, the change will be reverted and the source code will be updated to the latest version from the feed, moreover the change is tracked in the rule’s history, we recommend users to use the Rules Transformation options to customize the rules instead of editing the rule source code directly, we made this change to ensure that rules are always up to date with the latest version from the feed, especially that some rules source code are updated without changing the rule revision number.
Improved: Updated ET Open Suricata ruleset to version 7, if you have an old installation, please update your Emerging Threats Open Ruleset to use: https://rules.emergingthreats.net/open/suricata-7/emerging-all.rules.tar.gz.
Improved: Better service version display - Shows unexpected service versions in cluster summary and improved version upgrade messaging.
Improved: Cross-distribution compatibility improvements with absolute socket paths ensuring consistent behavior across Debian, Ubuntu, RHEL, CentOS, and other distributions.
BugFix: Fixed various installation issues on Debian 13+, Ubuntu 25.04+, and RHEL 8/9/10.
BugFix: Fixed IDS rule parsing issue where rule options were missing closing parenthesis.
BugFix: Fixed an issue where deploying Suricata with custom packages could fail with dependency errors, the installer now refreshes the package cache before installing packages to ensure dependencies can be resolved correctly.
BugFix: Fixed an issue where the service would show “The unit file changed on disk” warning after deployment, preventing proper service reload/restart operations. The installer now runs systemctl daemon-reload after deploying the service file.
Deprecated: Support for Ubuntu 18.04 (Bionic Beaver) and Ubuntu 20.04 (Focal Fossa) and Debian 11 (Bullseye) has been removed, users must upgrade to Ubuntu 22.04 (Jammy Jellyfish) or later versions before upgrading to v3.0.0.

Note

Migration Notes for v3.0.0:

Multi-instance architecture: This is a major architectural change. The migration process will automatically convert hosts from single-instance to multi-instance architecture.
Dropped OS support: Ubuntu 18.04, Ubuntu 20.04 & Debian 11 (Bullseye) are no longer supported. Ensure your systems are running supported versions before upgrading.
Configuration profile upgrades: Configuration profiles needs to be upgraded after migration. IDSTower will display warnings for profiles requiring attention, and users can upgrade them with a single click.
Filebeat profile upgrade on existing ELK deployments: upgrading the Filebeat configuration profile requires two manual checks, without which Filebeat stops shipping logs — delete the superseded idstower-suricata index template from Elasticsearch, and review the new Use HTTPS/TLS setting (it defaults to yes, while the previous profile always used plain HTTP). See step 8 of the Upgrade Guide from v2.9.x to v3.0.1 guide.
Backup recommended: Always backup your database before upgrading.

Please Follow the Upgrade Guide from v2.9.x to v3.0.1 to update IDSTower to the latest version.

2.9.2 - (11-7-2025)

Changes:

Improved: Updated ThreatFox feed to support the newly introduced API key authentication requirements.
BugFix: Fixed a regression in IOCs alerting caused by Suricata 7.0.9 and newer versions introducing default limits for Datasets hashsizes, IDSTower now sets these limits in suricata.yaml:
```
datasets.defaults.memcap: 64mb
datasets.defaults.hashsize: 1048576
datasets.limits.single-hashsize: 2097152
datasets.limits.total-hashsizes: 62914560
```
Please add these lines in your suricata.yaml to fix this issue or follow the upgrade guide for more details.
BugFix: Fixed an issue with deploying Suricata to localhost (same host running IDSTower) that prevented Suricata configuration files being synchronized correctly and ultimately prevented Suricata from starting correctly.

Please Follow the Upgrade Guide from v2.9.1 to v2.9.2 to update IDSTower to the latest version.

2.9.1 - (25-1-2025)

Changes:

Improved: Increased the database operation timeout to 2 minutes (from 30 seconds) to prevent timeouts on large IDS Rules/IOCs exports.
New Feature: Allow users to set the database operation timeout via CommandTimeout option in the appsettings.json file or Environment Variables, please refer to the IDSTower Configuration Guide page for details.
Improved: Prevents logging of sensitive information in the docker image logs.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.9.0 to v2.9.1 to update IDSTower to the latest version.

2.9.0 - (18-1-2025)

Changes:

New Feature: Added support for custom base paths, allowing IDSTower to be served under a subdirectory (e.g., https://your-domain/idstower/), this feature is particularly useful when IDSTower is served behind a reverse proxy or when users wants to host multiple applications on the same domain.
New Professional Feature: Added option to disable authentication, this is useful for users who want to integrate IDSTower with their systems and manage authentication externally and don’t want to use IDSTower’s built-in authentication, this feature is available in IDSTower Professional/Enterprise Editions.
New Feature: Added ExternalUrl configuration option to support scenarios where the external URL differs from the hosting URL, particularly useful in containerized environments, or when IDSTower is served behind a reverse proxy.
New Feature: Added capability for users to reset SSH trust between IDSTower and Suricata hosts, helping resolve authentication issues if necessary.
Improved: Enhanced cluster key management by storing encrypted keys in the database, simplifying updates and migrations, because of this, IDSTower now requires uses to configure an EncryptionKey in the appsettings.json file or via Environment Variables when using the IDSTower Docker image.
BugFix: Fixed Suricata socket file detection in Debian systems.
BugFix: Fixed package installation sequence to ensure repository cache is updated before installing dependencies on Debian-based systems.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.8.1 to v2.9.0 to update IDSTower to the latest version.

2.8.1 - (9-12-2024)

Changes:

BugFix: This release fixes a regression in RBAC feature that prevented users from accessing the IDSTower GUI after upgrading from a previous version older than 2.8.0, if you wish to upgrade from v2.7.x, you can upgrade to this version directly without the need to upgrade to v2.8.0 first.
BugFix: Fixed a GUI bug that displayed incorrect warning messages that the user do not have permission to access the page, even if the user has the required permissions.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.8.0 to v2.8.1 to update IDSTower to the latest version.

2.8.0 - (1-12-2024)

Changes:

New Pro Feature: IDS Rules Changes History, IDSTower now tracks and records all changes made to IDS Rules, including the user who made the change, the date & time of the change, and the change itself, users can check the changes history in the IDS Rule Page, check out this example in our Demo instance: IDS Rule Changes History.
New Enterprise Feature: Role-Based Access Control (RBAC), IDSTower now supports Role-Based Access Control, you can now create custom roles with specific permissions, assign users to those roles, and control what users can do in IDSTower, to check it out, please visit it in our Demo instance: Role-Based Access Control.
Feature: Suricata & Filebeat version upgrade, You can now upgrade Suricata & Filebeat versions on existing clusters, IDSTower agents installed on Suricata hosts will automatically detect the new version and let you upgrade it via the GUI.
improvement: IDS Rules feeds now supports .zip & .tar formats beside .tar.gz, .tgz & text files.
improvement: You can now import rules from compressed files, including .zip, .tar.gz, .tgz, & .tar.
improvement: IDSTower now checks Database server version on startup and print proper error/warning messages if unsupported version is used.
improvement: Added support for Ubuntu 24.04 (Noble Numbat).
improvement: Added support for Oracle Linux 8 & 9.
improvement: IDSTower now show each host OS version, Kernel version & python version in the Cluster –> Hosts tab.
improvement: IDSTower now shows more hosts information in the Cluster –> Hosts tab, including the OS flavor, Kernel version, Python version, Suricata version and Filebeat version.
improvement: Users can now force remove unresponsive hosts from the cluster.
improvement: Users can now change the repository type of a cluster.
improvement: Users can now configure Interfaces containing dots in their names.
BugFix: Fixed a bug that prevented users from deploying Suricata to localhost (same host running IDSTower).
Dependency: IDSTower now requires MariaDB 10.6+.
Dependency: IDSTower now requires ansible-core 2.13+.
Deprecated: Removed support for Ubuntu 23.04 and Ubuntu 23.10 as they reached End-Of-Life.
Deprecated: Removed support for Debian 10.8 as it reached End-Of-Life.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.7.x to v2.8.0 to update IDSTower to the latest version.

2.7.2 - (27-7-2024)

Changes:

BugFix: This release fixes an issue with updating feeds from AWS-WAF protected sources, IDSTower now declares a user-agent to prevents those request from being blocked by AWS WAF.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.7.1 to v2.7.2 to update IDSTower to the latest version.

2.7.1 - (7-6-2024)

Changes:

Enhancements: Improved Built-in documentations clarity.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.7.0 to v2.7.1 to update IDSTower to the latest version.

2.7.0 - (1-6-2024)

Changes:

New Feature: Users can now customize deployed IDS Rules per cluster (eg: each cluster has a different IDS Rules), all from centralized Rules Management Interface, for more information, please visit Rules Management Documentations page.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.6.0 to v2.7.0 to update IDSTower to the latest version.

2.6.0 - (5-5-2024)

Changes:

New Pro Feature: users can now integrate IDSTower with other platforms using IDSTower REST API interface, the Current release offers comprehensive REST endpoints to control Indicators of Compromise (IOCs), along with Built-in Swagger based documentation and endpoints explorer, you can explore the API documentation by visiting our demo instance Built-in docs , more information available here.
New Feature: IDSTower now tracks IDS rules sources, this feature allows users to see the source of each rule, including the feed name, the date it was created by that source and the date it was last updated, for manually added rules, the user can specify the source.
New Feature: Added –validate-config cli option to IDSTower binary.
BugFix: Fixed a bug that presented user from updating the IOC status from the UI.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.5.x to v2.6.0 to update IDSTower to the latest version.

2.5.3 - (14-2-2024)

Changes:

New Feature: Users can now choose between Major Suricata/Filebeat versions when deploying a new cluster, note that Suricata 7 is not published on older OS versions.
New Feature: Added support for Ubuntu 23.04/23.10, Debian 10.8/11.4/12.1, CentOS 9 stream, Rocky Linux/AlmaLinux 8/9, also generic linux support was Added.
Improved: Improved how Built-in/User-Custom repositories packages are discoverd.
Improved: removed mariadb from being a dependency of the IDSTower RPM/DEB packages to allow users to use remote instances of mariadb if needed.
Improved: Error messages are now more descriptive.
Improved: The cluster installation process is now faster and more robust.
BugFix: on IDSTower package installation, only attempt to stop IDSTower service if it is running.
Deprecated: Removed support for RHEL7/CentOS7/AWS Linux 2.
Deprecated: Minimum supported MariaDB version is now 10.6, older version still works, however, we encourage users to upgrade to the LTS version.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.5.2 to v2.5.3 to update IDSTower to the latest version.

2.5.2 - (6-12-2023)

Changes:

New Feature: ARM64 architecture support.
Improved: Improved the speed of Bulk action on Rules & IOCs.
Improved: Improved the speed & memory usage on Rules & IOCs feeds import.
Improved: now you can set a custom config file path/name for IDSTower via the –config/-c command line argument.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.5.1 to v2.5.2 to update IDSTower to the latest version.

2.5.1 - (15-10-2023)

Changes:

BugFix: Fixed a simple regression in the IOCs Export UI.

Please Follow the Upgrade Guide from v2.5.0 to v2.5.1 to update IDSTower to the latest version.

2.5.0 - (14-10-2023)

Changes:

New Feature (Pro): Rules & IOCs exports: you can now export IDSTower-managed Rules & IOCs to other systems like Suricata, Suricata-Update, OpenSense…etc via a simple URLs.

You can export the data in various formats, including: text, STIX 2.1, Suricata DataSet, DataRep & IOCs as Suricata IDS Rules.

This feature also includes a comprehensive filtration system that allows you to export only the data you need, this feature is available in IDSTower Professional Edition
New Feature: Rewrote & improved IDSTower agents on Suricata hosts, now the agents are more robust, reliable & efficient, the agents also produce more logs to help with troubleshooting, run crontab -l on your Suricata hosts to see the new agents.
New Feature: Added a log deletion script that runs periodically to delete old Suricata events/logs, this helps with keeping the disk usage under control, run crontab -l on your Suricata hosts to see the new script, by default, this script will delete data to keep disk utilization under 50%.
Improved: IDSTower now automatically installs missing binaries from Suricata hosts, including cron, curl…etc.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.4.x to v2.5.0 to update IDSTower to the latest version.

2.4.1 - (4-9-2023)

Changes:

BugFix: Fixed a bug that prevented ET Open feed from importing rules with long metadata fields.

Please Follow the Upgrade Guide from v2.4.0 to v2.4.1 to update IDSTower to the latest version.

2.4.0 - (13-3-2023)

Changes:

New Feature: You are now able to add custom indicators of compromise (IOCs) feeds with support for various Threat Intelligence Feeds formats, including:
- MISP Feed: MISP feeds (Exported MISP events as json files).
- MISP API: MISP Instance API.
- TAXII/STIX 2.0/2.1: TAXII/STIX server, both version 2.0 and 2.1 are supported.
- Text: Text based feeds.
- CSV: CSV based feeds, this allows you to import IOCs from virtually any CSV formatted file.
- JSON: JSON based feeds, this allows you to import IOCs from virtually any JSON formatted file, this feature utilize JsonPath queries (JPath) to extract IOCs values from the feed’s JSON file.
IDSTower will periodically download IOCs from those feeds and push them to your Suricata Clusters automatically.
Improved: Rules and IOCs viewing and searching is significantly faster and uses less resources.
Improved: IDSTower now downloads, parses & imports feeds faster by utilizing all threads available in the system.
Improved: IDSTower can now be configured to ignore TLS errors for specific feeds where presented TLS certificate are invalid, this helps with feeds hosts using self-signed or expired certificate, including internal ones.
Improved: User can now trigger feeds update manually via Settings->Feeds .
Improved: expired IOCs are now deleted more efficiently.
Improved: IDSTower now verifies that IOCs types and structure are valid (eg: verify that an IOC with IP type is a valid IP address).
Improved: You can now use longer feeds urls.
Improved: Upgrades to new IDSTower versions is easier now after Introducing auto-migration of database schemas.
Various other enhancements and bug fixes.

Please Follow the Upgrade Guide from v2.3.x to v2.4.0 to update IDSTower to the latest version.

2.3.1 - (10-12-2022)

Changes:

Bugfix: This release fixes a regression that causes suricata process to crash under some conditions on Ubuntu hosts, this issue was caused by incompatibility between security hardening settings applied by IDSTower and suricata packages on Ubuntu, it is highly recommended to apply this update to ensure the stability of your suricata deployments.

Please Follow the Upgrade Guide from v2.3.0 to v2.3.1 to update IDSTower to the latest version.

2.3.0 - (1-12-2022)

Changes:

New Feature: Introducing configuration profiles feature, a quick & easy way to configure Suricata & Filebeat during cluster install based on tested configurations blueprints, in this release we added two configuration profiles to Suricata:
- IDS mode: configures suricata in IDS Mode.
- IDS + NSM mode: configures suricata in IDS Mode + NSM (enables the protocol transactions logs).
and two configuration profiles for the logshipper (filebeat):
- send events to ElasticSearch: configures filebeats to send suricata events to ElasticSearch Cluster and automatically setup ElasticSearch index template for Suricata.
- send events to Logstash: configures filebeats to send suricata events to Logstash hosts.
As always, you can fully control the configuration via the IDSTower UI, these new configuration are only available for newly clusters.

In the next coming releases of IDSTower we will allow current clusters to be upgraded to the new configuration profiles to allows easier management of configurations and new features.

Moreover, we will also release more configuration profiles covering suricata in IPS mode, filebeat to Kafka…etc, so stay tuned!
New Feature: Automatically cleanup & remove expired Indicators (IOCs) from database to free resources, this feature is enabled by default and removes the IOCs that expired 6 weeks ago, you can disabled this behavior or configure the period to keep the IOCs after expiry in IDSTower UI –> Settings –> Indicators page.
New Feature: control Suricata threshold.config, classification.config & reference.config from IDSTower UI.
New Feature: added support for Ubuntu 22 (Jammy Jellyfish).
Improved: Improved the heuristics algorithm used to set the Target Keyword value in transformed IDS rules.
Improved: Handle the misclassification of some of the published IOCs in ThreatFox Feed.
Improved: Allow more characters in network interfaces names.
Improved: Suricata hosts will now check for rules/IOCs updates more frequently (every 5 minutes).
Improved: Add a title for indicator value so it gets shown in full if displayed value is trimmed.
Improved: Search md5/hash attribute using VirusTotal instead of google.
Bugfix: On Configuration refresh/update, rules/IOCs files on Suricata hosts will be kept at their latest version.
Bugfix: When you upgrade IDStower package on Ubunut, appsettings.json won’t be overwritten.
Bugfix: Fixed a bug on UI where interface names will overflow each other when you attempt to change monitored interfaces.
Bugfix: When attempting to delete expired indicators and “all indicators” is selected, the backend sends error message asking to set type filter as if it is required.
Various other bug fixes and improvements.

Please Follow the Upgrade Guide from v2.2.0 to v2.3.0 to update IDSTower to the latest version.

2.2.0 - (3-6-2022)

Changes:

Enterprise Feature: Added an AWS Connector, which lets you setup periodic export of IDS Rules & Indicators to AWS Network Firewall as stateful rule groups, this means that you can now use IDSTower to Manage your AWS Network Firewall Suricata Compatible Rules, expect more connectors in the future!
Feature: Allow user to change monitored interfaces easily on Suricata hosts.
Feature: Rules Management UI now supports searching & filtering using Rules Tags.
Feature: Rule Action Override, users can now easily Override the rule action (eg: alert, drop…etc) without having to edit the rule source code, IDSTower will transform this when the rules are sent to Suricata Hosts or exported to AWS, you can also set the rule action for multiple rules at once (aka: bulk change) via the Rules Management UI->Rules Actions dropdown menu, moreover, you can enable/disable this behavior via Settings as the case with other Overrides.
Feature: Indicators Management UI now supports searching & Filtering Indicators by indicator type (eg: FQDN, IP…etc).
Improved: Importing/Parsing/Transforming IDS Rules are now faster by utilizing all available threads in the system.
Improved: Rule Category are carried over to new rule revisions automatically, categories the rules as you wish and IDSTower will assign the new revisions of the same rule into the same Category.
Improved: Rules & Indicators search performance has been improved by adding more indexes!
Bugfix: updated host heartbeat script to fix a bug that prevents heartbeats from being sent when monitoring more than one interface.
Bugfix: updated suricata.yaml template to correctly set cluster-id when monitoring more than one interface.
Various other bug fixes and improvements.

Please Follow the Upgrade Guide from v2.1.0 to v2.2.0 to update IDSTower to the latest version.

2.1.0 - (3-10-2021)

Changes:

Feature: Now you can add a custom IDS Rules Feed, with various authentication modes supported.
Feature: Now you can do bulk actions on all IDS Rules and IOCs in the IDSTower.
Feature: IDSTower is now available as an RPM and DEB packages, a repository is available for both.
Various other bug fixes and improvements.

Please make sure to do a config refresh after upgrading to this version to update IDS Hosts configuration files to the latest version, you can do this via Cluster->Hosts->Hosts Actions->All Hosts->Refresh stale config

2.0.2 - (10-8-2021)

Changes:

Feature: Https certificate setup, please follow this guide for Configuring https on IDSTower.
Feature: Added support for AWS Amazon Linux 2, now you can install IDSTower on AWS Amazon Linux 2 VMs.
BugFix: Fixed an issue with indicators update.
Various other bug fixes and improvements

2.0.1 - (14-7-2021)

Changes:

Feature: Addded the ability to do an all-in-one install, now you can deploy Suricata to the same Host running IDSTower.
BugFix: Fixed an issue with Ubuntu 18 with old ansible versions.
Various other bug fixes and improvements.

2.0.0 - (19-6-2021)

Changes:

Major release with new features & significant improvements.
Suricata now is auto-configured to alert on Indicators of compromise, including Malicious IPs, Domains & Hashes using IPRep & DataRep features of Suricata.
Out-of-the-box integration with 14 Threat Intelligence feeds (free & commercial) that covers both IDS Rules & indicators of compromise (IOCs), with total control on update frequency, assigned score & auto-expiry date.
Easy-To-Use Indicators Management Interface, with integrated references to investigation tools like VirusTotal, IpInfo & SecurityTrails.
Complete IOCs Life-Cycle Management, covering ingestion from feeds, scoring, auto-deployment & auto-expiry, with manual control when needed.
Rules & IOCs changes are automatically pushed to Suricata Hosts & Suricata service auto-reload rules when changes detected.
Full Control on Rules Transformation settings, you can now enable/disable specific Transformations.
Rules Transformation option to set Rule Target Keyword using Heuristics.
Rules Transformation option to replace $EXTERNAL_NET rule variable with “any” to expand rules detection to cover lateral movements in your network.
Rules Transformation options to add IDSTower Rule ID, IDSTower Rule URL, user added tags & other information to rules metadata keyword for more contextualized alerts!
Full Control on Indicators Alerting settings, Enable/Disable alerting on Malicious IPs, Domains & Files.
User Management Interface to add/remove/enable/disable users.
The Built-in Packages repository (for offline deployment) is now offered as a separate package to allow it to be independently updated.
Various other bug fixes and improvements.
To upgrade from version 1.0.x to this version, please follow Upgrade Guide from v1.0.x to v2.0.0

1.0.2 - (11-4-2021)

Changes:

Now you can force remove a cluster even when hosts are unresponsive.
Improved how UI handle redirection.
Various other bug fixes and improvements.

1.0.1 - (16-2-2021)

Changes:

Added support to deploy & manager Suricata in Ubuntu 18.04 (Bionic) and Ubuntu 20.04 (Focal).
Added all packages necessary to deploy Suricata to an offline cluster.
Various bug fixes and improvements.

1.0.0 - (29-1-2021)

Changes:

Initial public release.