EventSentry Light full changelog

Bugfixes:
ADMonitor: Vastly improved performance for extremely large domains (100,000+ users)
Agent: Fixed issue where agent would not start up if the system temp directory was extremely large or contained a lot of files
Agent: Improved file checksum monitoring (FIM) when monitoring large amounts of files
Agent: Stability improvements
Collector: Various stability and scalability improvements
Management Console: Improved content filter editing in event log filters for custom event logs and added missing conditions
Management Console: Improved license dialog
Web Reports: Faster database server name resolution under Azure
Web Reports: Fixed CSV output with varied locale delimiters
Web Reports: Update Tomcat to 9.0.111

Features:
Web Reports: Added YouTube tile
Management Console: Added ability to sort Syslog filter list
Management Console: Added ability to drag & drop content filters
Bugfixes:
General: Security feature to only store local groups and packages now filters actions as well
General: TLS communication can be configured to utilize Windows-API, supporting FIPS mode if enabled in the OS
Agent: Fixed issue were filters with multiple summary schedules configured for the same time would not reliably work
Agent: /collectortest command line variable now supports multiple collectors
Agent: Auto-Update now only uses net.exe to (re)start the EventSentry service
Agent: Switched all hashing algorithms to use Windows-API, utilizing FIPS mode when configured in the OS. Note: Requires re-indexing of all files by agent when FIM or File Access Tracking is being used.
Network Services: Improved parsing of CEF Syslog messages
Collector: Fixed issue with handle leak when internal named pipe cannot be created
Collector: Fixed issue where "Trusted Host" setting would not always reliably work
Collector: Fixed issue with HTTP action not resolving certain variables and not logging activity to the action history log
Collector: Now detects a frozen network stack and performs an automatic service restart
Collector: Fixed several issues with the file action. Added better processing of variables, file locking and events auditing file activity.
Heartbeat Agent: Fixed incompatibility issue when security feature "Store only local groups ..." is enabled
Heartbeat Agent: Fixed issue where service would attempt to connect to the database even if configured to use the collector
Management Console: Show warning when database is not on the latest schema
Management Console: Several fixes and optimizations
Web Reports: Fixed frequency chart timezone calculation
Web Reports: Tomcat updated to v9.0.106

Bugfixes:
EventSentray: Fixed issue where clipboard alert dialog would not be shown and events 2000/2001 would not be written to event log under some circumstances
EventSentray: Fixed Internet Test dialog that would only show a scroll bar under some resolutions
Management Console: Various minor improvements to list control columns throughout the application
Collector: Improved stability of service shutdown routine
Web Reports: Update Tomcat to 9.0.104

Bugfixes:
Agent: Fixed regression bug where anomaly filtering would not properly work when not filtering on the collector
Heartbeat Agent: Fixed issue where event ids 11011 and 11012 would be logged despite host being in a maintenance schedule
Management Console: Fixed issue where sysmon and script files would be saved as hidden files
Management Console: Fixed help button in sysmon management dialog
Management Console: Fixed rare issue where app would crash on startup
Web Reports: 2FA, when enabled, is now required during every login

Features:
Inventory:
Local users and group inventory
Local file share inventory
Security:
Keyboard inventory and new keyboard detection
Built-In Sysmon configuration management and deployment
Server-side anomaly detection
Better threat detection with threat-scoring
Port-Knocking for collector client
Process spoof (Masquerade) detection
ADMonitor:
Identify compromised and reused passwords
Improved "Who" lookup mechanism
Include domain with group policy changes
Web Reports:
Process Activity
2FA email authentication
Dashboard tile improvements
PWA support
Syslog RegEx results formatter
Misc:
EventSentray (tray utility) now includes an Activity Monitor
Process action can be triggered on collector
Ability to disable disk space monitoring alert throttling
Search event message in built-in event viewer

Features:
Agent: Fixed issue where, due to a recent update in various version of Windows, the wrong event category would sometimes be displayed for some events
Web Reports: Java 17.0.14 and Tomcat 9.0.98

Bugfixes:
Management Console: Fixed issue where not all package types would be displayed when assigning packages under some circumstances
Management Console: Various stability improvements
Various bug fixes related to assigning packages
Installer: Fixed issue when setting up the EventSentry database on a Microsoft SQL Server
Collector: Security improvements
Heartbeat Agent: Stability Improvments

Bugfixes:
Agent: Fixed issue where agent would restart itself on some hosts due to an internal error in the event log engine
Management Console: Event Viewer: Fixed system32 link for EventSentry events

Bugfixes:
Management Console: Fixed regression bug that resulted in the built-in event viewer to not properly work

Features:
Management Console: Various minor usability improvement through the management console
Management Console: PostgreSQL Optimization dialog has been improved and includes disk speed test feature
Bugfixes:
Management Console: Fixed issue where event parameters configured for the process action would not persist
Agent: Fixed SQL error with permission inventory when not using the collector
Agent: Added preliminary detection for event formatting problems
Built-In database upgraded to PostgreSQL v14.13
pgAdmin upgraded to v8.10