Released 2024-11-04

Linux md5sum: fbe6230bb6004daf71d5ae66e18f4f05

Linux sha256sum: 4c9e1381a2dd6c5ff9b60edd4165c22ece17667204dc52d54d9ba82318c06161

Windows sha256sum: 9ceb526573a8efcf2f93ce7b30b2a8dacb44ccaadd90c8cbed01f14c0cae3b58

Packages

Enterprise users can now add software packages to be tracked and reported on. A package has a type: ‘antivirus','approved','backup','banned','cloud','firewall','ignored','license','other'. We have provided a starting list and use this with queries and widgets to provide reporting. As usual you can find them under menu → Manage → Packages. Why didn’t I name it “Software” - because we already use that name in the database for the installed software on a PC, so “Packages” it is.

SNMP Discovery Improvements

We have done a lot of work making SNMP discoveries more robust. This includes extra guard clauses in functions, robustness against SNMP devices that timeout and do not respond mid-discovery. We have added more models and data retrieval. We now retrieve and store the WAPs attached to a Cisco 9800 Wireless Access Controller as well as other items (see below for more details).

We now also support SNMPv3 contexts. Just add these into the credentials entry and they should ‘just work’.

General Discovery Improvements

We now support discovering and auditing a Windows machines using SSH.

There is a new feature flag in the config (feature_powershell_audit) that enables the powershell audit script for Windows in discoveries. A word of warning, this will generate change logs on devices because some items aren’t retrieved with the exact same name as the VBScript does. These items are:

Logs - overwrite
Tasks - name
Disk - size
Partition - size
Route - removed local routes
Software - more was added with powershell

I very much encourage you to try using the PowerShell in discovery as this will be the way forward. Please do try it (maybe on a single machine, or disable change logs and set delete non-current log, task, disk, partition, route & software in the config). Any help and bug reports will only result in a better product for you going forward

Windows AntiVirus and Firewall

We now retrieve the details of any installed AntiVirus and Firewall from Windows clients (Windows 10 & 11). Unfortunately Windows Server does not offer these for retrieval, so for those we rely on the Packages info (as above). If you find your widget on the Windows Security Dashboard is incorrect for Windows Servers AntiVirus / Firewall, this is likely why. Just add an entry to packages and it should report correctly. I don’t know the name (and more importantly, the name as per add/remove programs) of every AntiVirus and Firewall package on the market. We have supplied quite a few, but as stated, if your particular software isn’t on the list you can add it. Oh - and send us the exact name so we can add it as well!

Windows Security Dashboard

Our new dashboard uses traffic light style widgets. These are now an additional type of widget you can create. A traffic light widget uses one, two or three queries - one each for red, yellow and green. The idea of the Windows Security Dashboard is to get the entire screen green. If it’s green, you’re good to go!

GUI

We have revised the Read and Execute templates. We have moved the actions you can take on the individual entry to the center of the panel header. We have left those actions that apply to the collection as a whole on the right side. This separation should provide a bit more clarity on what the action button applies to.

Detailed Changes

Note - these are taken from the Git Log. you can see these at Github here - https://github.com/Opmantek/open-audit

Version	Type	Collection	Description
Enterprise	Improvement	All	Only call enterprise.bin when we have to. We now only call the enterprise binary when we need to to perform an enterprise function. This has helped improve responsiveness.
Enterprise	New Feature	Packages	Packages Feature (as above).
Professional	New Feature	Dashboards	Add new Windows Security Dashboard (as above).
Enterprise	New Feature	Dashboards	Traffic widgets (as above).
Community	Improvement	Configuration	Store server_os and server_platform in the database and update only when logging on, not for every request. This has helped improve responsiveness.
Community	Improvement	Devices	Enable new javascript based devicesCollection table population. This has helped improve responsiveness.
Enterprise	Improvement	Devices	Revise device count for licensing.
Community	Improvement	All	PHP Standard PSR12 standard on all Controllers, Models and Helpers. This has improved code quality and readability.
Enterprise	Improvement	Connections	Extra fields added to Connections.
Community	Improvement	All	When importing a CSV of items, add the ability to specify orgs.name or locations.name and lookup the correct ID for association.
Community	Improvement	All	For the read and execute templates, move the action buttons for the item into the center of the panel header and leave collection wide buttons (List, Create, Help, et al) on the right side. This has improved usability.
Community	Improvement	Discoveries	Retrieve the last time the native OS updater was run for Linux (RH, Debian) and Windows.
Community	Improvement	Discoveries	Enable audit_windows.vbs over SSH.
Community	Improvement	Discoveries	Initial support for Windows powershell audit over SSH in discoveries.
Enterprise	Improvement	Discoveries	Audit Windows AntiVirus and Firewall. Add support for Defender Firewall Rules in powershell audit, only when running as an agent.
Community	Improvement	Discoveries	Allow for a false passed to format_mac in snmp_helper.
Community	Improvement	Discoveries	Do not use SSH when discovering Extreme Networks devices. Add an Extreme Networks device to SNMP Model Helper.
Community	Improvement	Discoveries	Additional info for HP Procurve switches (os_version).
Community	Improvement	Discoveries	Additional info for Dell PowerConnect switches (serial, service_tag, os_version).
Community	Improvement	Discoveries	Support for Sophos firewall over SNMP (model, os_version).
Community	Improvement	Discoveries	Improve Cisco SNMP helper. Add attached access point retrieval for Cisco C9800 devices.
Community	Improvement	Discoveries	Added a couple of SNMP model helpers for Zebra printers and NetScout devices.
Community	Improvement	Discoveries	Allow for SNMPv3 context name and engine ID in credentials.
Community	Improvement	Discoveries	Major refactor of snmp_helper. Now include fallback command line SNMP requests if PHP requests fail (must be on Linux). Log with INFO i f the command line also fails. Log with DEBUG if the PHP request fails. Add extra logging.
Enterprise	Bug	Benchmarks	Enable selecting a Benchmark when creating a task.
Community	Improvement	Discoveries	Exclude from software, any software in a location with 'Daemon Containers' in it's path, because these are likely IOS apps from the associated iPhone, not MacOS apps.

Release Notes for Open-AudIT v5.6.0