4.3.0 Release

Features

  • Notification System

    Administrators can now send messages to all users. Users can also mark items to be notified when changes occur to them.

  • Favorites

    Users can now favorite items within SCOT which acts like a bookmark and allows for easy navigation back to favorited items.

  • Popularity

    Users can now upvote/downvote items in SCOT. This is currently an optional feature that can be hidden by the user.

  • Entity Pane Enhancements

    In the Entity Pane, users can now select multiple Entities for copy or bulk addition of class and tag attributes. Users can also view GeoIP locations on a map.

  • Internal References

    Users can now create an interal link to other sections of SCOT within Entries. By entering the phrase “SCOT-Event-123” into an entry, the flair engine will create an internal link to Event 123. This will work with Alertgroups, Events, Incidents, Dispatches, Intels, Reports, etc. Flair will also detect the URL https://yourhostname/#/intel/987 and rewrite that to a link to SCOT-Intel-987.

  • Core Entities Documented

    SCOT now has documentation on the Core Entities. If you create a regex that would be a useful additions to this set, let us know and we will add it.

Fixes

  • Matomo removed
  • Creating an alertgroup with tags via the API now works as expected
  • Bug in associating new entity classes with existing entities fixed
  • Flair engine can now replace images in Alertgroups with local copies
  • Dockerfile improvements for container creation
  • Improvements to local password lockout and recovery
  • Alertgroups with underscores in the subject now link to signatures/guides correctly
  • Fixed ordering of items in flair appearances pane