UTMStack v11.4.0 improves dashboard reliability, alert handling, incident response controls, and overall security.

What's New

• Analyst users can now dispatch incident response actions.
• System incident response presets are now protected from accidental changes.

Improved

• Dashboards, charts, and visualizations load more reliably.
• Language settings are applied more consistently across the interface.
• PDF export and alert/log display are more secure.
• Audit logs are less noisy by excluding processes without user sessions.
• Overall security was strengthened for authentication, single sign-on, filtering, and data handling.

Fixed

• Fixed an issue where new alerts could be dropped.
• Fixed crashes or empty results in events-over-time and alerts-by-severity views.
• Fixed errors when working with asset groups.
• Fixed charts not rendering in some views.
• Fixed rule status not being preserved after a restart.
• Fixed dashboard gaps and map bucketing issues.
• Fixed incorrect error messages when trying to modify protected incident response presets.

Full Changelog: v11.3.0...v11.4.0

UTMStack v12.0.2 includes fixes that improve login reliability and correct the AWS integration experience.

Improved

• AWS integration now references CloudWatch instead of IAM User.

Fixed

• Fixed a login issue that could occur when no username was entered.

Full Changelog: v12.0.1...v12.0.2

UTMStack v12.0.1

This release improves installation and update reliability, especially on Debian and Ubuntu systems.

Fixed

• Installation on Debian and Ubuntu now completes more cleanly.
• Updates are less likely to fail when temporary files are stored in a different location.

Full Changelog: v12.0.0...v12.0.1

UTMStack v11.3.0

v11.3.0 is a reliability and data-model release. The headline change is a rename of the raw-event storage field (log → event) with a new utm.* namespace for charting, plus a set of fixes for disk protection, installer memory handling, and the alert/compliance UI. Upgrading does not reindex existing data, but customer-created filters, rules, and dashboards that use the old log.* bag must be updated (see Breaking).

Security

• CVE-2026-82042 (follow-up): the internal API-key filter now also allows the rule-flood-guard's three backend endpoints. Previously those calls 401'd silently, which disabled the flood guard's ability to auto-disable runaway rules. No action required.

Breaking

• Customer-owned content that references the log.* event bag must be migrated to event.* (or utm.* for charts). UTMStack v11.3.0 renames the raw per-vendor event bag from log to event. Every filter, rule, and dashboard shipped by UTMStack was migrated for you, and the Log Explorer / Alerts search UI still accepts legacy log.* filter values. Customer-created content is not migrated, and it stops working against new data:
  • Custom correlation rules — where / afterEvents / groupBy expressions referencing log.* no longer match any new event.
  • Custom filters — steps that read from (log.* sources) or write to (log.* targets) the old bag name no longer see the data.
  • Custom dashboards / charts / visualizations — queries and filters that reference log.* fields return empty on new indices.
  • How to migrate: rename raw bag fields log.<field> → event.<field>. For aggregations and charts, event.* is not aggregatable (it is stored as a flat field), so use the utm.* namespace or the promoted standard fields (action, severity, deviceTime, origin.*, target.*, tenantId), which are unchanged. Old pre-upgrade data keeps the log bag and is retained per its index lifecycle.

Added

• Geolocation coordinate maps on dashboards (Leaflet), with OpenStreetMap tiles. Six previously-broken compliance map charts are fixed.
• New operational dashboards: GCP, NetFlow, and pfSense.
• Compliance report PDF export is available from every compliance view (evaluation detail, report viewer, and results), not just the legacy screen.
• utm.* aggregatable field namespace for charts. Raw per-vendor fields moved to event.*; promoted, aggregatable fields live under utm.* (e.g. utm.action, utm.severity).

Changed

• Raw event field renamed log.* → event.* in the schema. New events store under event; old events keep log and are read with a dual-read pass, so no reindex and no data loss. Custom dashboards or saved filters that hard-code log.* paths must be updated to event.* (see upgrade notes below).
• Threat Intelligence page now opens threatwinds.com in a new tab instead of embedding galaxy.threatwinds.com in an iframe.
• Installer memory model: /utmstack/updates/memory-allocation.json is now the single authority for per-service memory. Normal updates never re-balance it. Use utmstack_installer --recalculate-memory to recompute and rewrite it. Fresh installs seed the file once.
• Emergency disk auto-delete: when OpenSearch's disk usage reaches 85%, the oldest raw-log indices are now actually deleted (down to 70%). Previously the delete loop only removed indices that had aged 30 days into the ISM delete state, so on fresh or high-volume installs it deleted nothing and the disk could still reach 100% and tip OpenSearch into flood-stage. Alerts, statistics, and system indices are never auto-deleted.

Fixed

• SOAR incident-response commands re-running forever — a command that dispatched but whose result callback never landed (backend restart, stream close) was re-sent every 30 seconds. One rule in the wild created ~39,000 duplicate firewall rules in a week. Commands now go to EXECUTING the moment they're dispatched, so the scheduler can't re-select them, and any EXECUTING row left over from a backend restart is reset to PENDING once at boot.
• Data Sources: applying a note (or editing an alias) removed the source from its group and silently dropped assetGroupId/assetGroupName from new alerts. Note and alias now use dedicated field-scoped endpoints that touch only that column.
• Alerts page opened by bare URL hung on "Loading…" — direct navigation to /data/alert/view without ?alertType=... never triggered the initial search. Now it loads, defaulting to the Alerts view (Status column, status tabs, Datasource Group filter) exactly like the menu link.
• Alerts "Row to filters" bricked the list — the default selection turned composite columns (Target, Adversary, Impact) and numeric columns (Echoes) into IS_ONE_OF filters with invalid (non-list) values, which the backend rejected with a 500; every later search on the page failed until a reload. Composite columns are now offered unchecked by default and every emitted value is normalized to a valid list; the backend additionally returns a 400 (not 500) for structurally invalid filters.
• Data Processing → Pipelines showed other vendors' numbers — the status job queried v11-statistics-* with a tokenized match on dataType, so firewall-sonicwall matched firewall-pfsense and similar, and read only a single 10-minute document's count. It now reads exact dataType.keyword for all of the module's data types, sums count over the last 24 h, resets to 0 when empty, and stops picking an arbitrary data type for multi-filter modules.
• Crypto-mining netflow rule false positives — the rule fired on any TCP flow to a mining-pool port, so one-way SYN+ACK probes (132 bytes) to dead IPs correlated into HIGH alerts. It now requires a completed TCP handshake and more than 10 KB transferred in the flow.
• Installer silently rebalanced memory on update when memory-allocation.json was missing/corrupt, overwriting the operator's distribution. A normal update now refuses to deploy a non-authoritative distribution instead of guessing; the file is written only on fresh install (one-time seed) or explicit --recalculate-memory.
• Installer memory profile (#2918): event-processor-manager capped at 4 GB (was 60 GB), backend raised to 8 GB, and the backend JVM given MaxRAMPercentage=75 so it stops OOMing on Log Explorer with large result sets. Run utmstack_installer --recalculate-memory on existing installs to apply.
• web-pdf floor: raised to 1250 MB so headless Chromium doesn't OOM on printPage at 16 GB hosts.
• 39 correlation rules (Palo Alto, Azure, AWS) were silently inactive because their technique field was blank and the backend rejects blank techniques on sync. Each is populated now; they load on boot.
• Compliance evidence columns came back empty after the event-bag rename — the stored-query remap covered compact JSON but not the spaced form the UI writes. Both forms are remapped now.
• Compliance PDF export hung on large reports — the web-pdf renderer was printing every row (up to 10k) and running out of memory, and the backend had no HTTP timeout. Exports are capped at 250 rows ("Showing first 250 of M rows") and the backend now times out at 120 s with a 504 instead of spinning forever.
• Coordinate maps on the overview and dashboards were blank — they bucketed on origin.ip.keyword, which doesn't exist on new (typed ip) indices, and the nginx CSP blocked the tile hosts. Maps now bucket on origin.ip (with a .keyword multi-field for old indices) and the CSP allows *.tile.openstreetmap.org / *.tile.thunderforest.com.
• User Auditor: reads both event-bag generations after the rename; the monthly back-fill no longer jumps ~29 days on the first run after the 1st; the OpenSearch client is built eagerly so the first scheduled scan doesn't NPE.
• Adversary View returned a 500 for alerts stored before the rename — pre-upgrade bags are read with a null guard now.
• NetFlow v9 byte-array ports were mangled (e.g. 22935 instead of the real port) and dataSource kept the :port suffix. The filter v3.2.0 + agent 11.1.5 decode correctly.
• Geolocation data refreshed to MaxMind GeoLite2 City 2026-10-20 + ASN 2026-10-22 (was 2024-08 builds). Notably, the old data mapped some 2a00:8c40:* (Fastly) IPv6 ranges to the US centroid; new data resolves them to Madrid/Canary, eliminating a class of "impossible travel" false alarms.
• Event processor / go-sdk: bumped to go-sdk v1.1.38 across all Go modules; the cel plugin's OpenSearch connection regression (silently killing every CEL-dependent rule) is fixed; text-search operators (contains, startsWith, regexMatch, …) now work on object/array fields by searching the raw JSON text.
• Backend boot crash caused by a snakeyaml 2.0 bump (NoSuchMethodError in Spring Boot 3.1.5's YAML loader) is reverted; snakeyaml stays at 1.33.
• Rule definition sync is limited to system rules, and the previous stored status is preserved across boots.
• Federation: user removal fixed.
• Nginx panel is force-reloaded after updates and the shared key is persisted, so the frontend no longer 401s after an update.
• Agent: spool cleanup enforces a 500-row batch bound and drops pending records past a hard disk cap (5× retention) so a stalled endpoint can't fill the disk.
• Log Explorer: event.* sub-fields are selectable as columns and filters; the filter picker lists them; the sort control is hidden for flattened bag fields (sorting them was a 400).
• Data Sources asset-group pagination SQL typo fixed (missing space before ORDER BY).

Upgrade notes

• No reindex, no data migration. Old v11-log-* indices keep their log field and are read alongside event by the backend; only new data uses event.
• **Custom log.*...

UTMStack v11.2.16 improves alert clarity and reduces unnecessary noise across several platforms, helping you focus on the security events that matter most.

Fixed

• Windows authentication alerts are clearer, and rules that previously did not fire now work as expected.
• FortiGate VPN brute-force alerts are grouped so you receive one alert per source address instead of many.
• Linux logging-service alerts are grouped to one alert per host.
• macOS no longer creates alerts from XProtect’s own rule loading.
• VMware ESXi alerts for three rules are grouped to one alert per host.
• Azure admission webhook alerts are grouped by cluster and identity.
• Office 365 alerts from nine rules no longer flood you with repeated notifications.

Full Changelog: v11.2.15...v11.2.16

UTMStack v12.0.0 brings major improvements to multi-tenant management, AI-assisted operations, automated response, and log exploration. This release adds new dashboards, incidents, compliance, and threat intelligence capabilities while improving performance and fixing common issues.

What's New

• Multi-tenant support with separate settings, users, alerts, integrations, and response flows for each tenant.
• Docked SOC-AI assistant that helps with dashboards, incidents, and response workflows.
• ThreatWinds AI provider available as a zero-config default.
• Resizable tables and columns across Log Explorer, alerts, pipelines, and SOAR.
• Redesigned incidents with a creation wizard, custom assignment, and notifications.
• New automated response (SOAR) capabilities, including an interactive console, execution history, additional action nodes, and clearer run statuses.
• AI-assisted dashboard creation and editing, with copy and dismiss options.
• Dashboard refresh intervals and auto-refresh.
• Log Explorer manual query mode with autocompletion and related-event filters.
• Adversary view with a relationship chart showing connections between adversaries, alerts, and victims.
• Threat intelligence fallback data and cleaner indicator matching.
• Compliance reports that can be signed, with multi-tenant support and clearer completion percentages.
• Local user creation and tenant admin provisioning.
• API key settings.
• Tenant branding options, including dark-mode icons and highlight toggles.
• Collapsible sidebar with icon-only mode and an overview toggle.
• Broadcast UI and grouped notifications.
• Data source log timeline and offline counts.
• New Windows, macOS, and Linux detections/rules.
• Linux user auditor.
• Agents can self-update and show clearer status; Linux agents can monitor audit files.
• New web endpoint for sending logs into UTMStack.
• Remote enable/disable for forwarder integrations.
• Playground to test filters and rules before saving.
• Rule flood guard that can automatically disable noisy correlation rules and notify you.

Improved

• Faster and more efficient log storage and querying.
• Tenant-specific integrations, catalogs, connector settings, SOAR flows, and audit data.
• Pipeline filter order is now fully customer-controlled.
• Alert rules support synchronized visual, code, and test modes, plus export and disable options.
• Web response actions support query parameters, default headers, and cache clearing.
• Agents reconnect more reliably and maintain stable connections.
• Clearer AI assistant messages, smoother chat scrolling, and better context handling.
• Improved UI consistency, dark-mode labels, and layout spacing.
• Better tenant filtering for agents, collectors, and incidents.
• Improved integrations guides, success messages, and certificate handling.
• Improved alert list details, including severity and related counts.
• Improved data source command output and loading behavior.
• Improved AD audit parsing and persistent disabled-user state.
• Improved forwarder behavior for web integrations.
• Improved threat intelligence correlation by removing empty values.
• Improved rule deduplication and grouping, with failures shown instead of hidden.
• Improved compliance control status tracking.
• Improved notification scoping so tenants only receive relevant alerts.
• Improved dashboard visualization management and chart options.
• Improved SOAR canvas layout and table scrolling.
• Improved Log Explorer colors, scrolling, and filters.
• Improved incident details drawer and assignment options.
• Improved tenant cards, terminated tenant handling, and event purge options.
• Improved branding section interactions.
• Improved overview playbooks card interactivity.
• Improved ingestion stats default time window.
• Improved generated secret state in integrations.
• Improved alert status change options.
• Improved event processing pipelines for multiple data types.
• Improved AI usage metering per tenant.
• Authorized cross-tenant incident access for managed service provider installations.

Fixed

• Scheduled jobs no longer show errors when no instances are configured.
• Manual execution status now displays correctly.
• Pipeline order is preserved after changes.
• Duplicate AD users no longer appear.
• Windows install command works correctly.
• macOS detection filters now map host and field values correctly, and unverifiable rules are removed.
• Correlation rules no longer disappear after updates.
• Web action nodes no longer include unwanted default headers.
• Empty alert field values no longer affect threat intelligence matching.
• Updates no longer wipe manual memory settings.
• Agent connections are less likely to drop when idle.
• SOAR flow creation drawer works correctly.
• Duplicated broadcast close button removed.
• Integration disable button behaves correctly when already disabled.
• Unused AWS log group field removed from AWS configuration.
• Missing GCP translation keys added.
• Custom integrations now receive data correctly.
• Alert status options are correct when changing status.
• Dashboard widget query bugs and missing edit action fixed.
• Adversary grouping and dark-mode labels fixed.
• SOC-AI chat no longer overlaps the interactive console.
• Log Explorer duplicated components, header scrolling, and select colors fixed.
• Data source loading indicator no longer remains after command output.
• Missing confirmation modal and language keys fixed.
• Billing, integrations, and AI configuration issues fixed.
• Web integrations are preserved during forwarder config sync.
• Agent and collector tenant filtering fixed.
• Compliance framework completion percentage fixed.
• Purge button colors fixed.
• Visit tenant text centered.
• SOAR table horizontal scroll and bulk edit fixed.
• Alert severity displayed.
• Generated integration secrets now show the correct lifetime.
• Dashboard auto-refresh option translated.
• Log Explorer filters on Linux systems fixed.
• Filter form now accepts added entries correctly.
• Rule flood guard thresholds and notifications are now scoped correctly per tenant, rule, and data source.
• Playground returns all matching alerts.

Full Changelog: v11.2.15...v12.0.0

UTMStack v11.2.15

This release makes security events easier to review and reduces unnecessary alert noise.

Improved

• Many integrations now show action results in a clearer, more consistent way.
• SonicWall botnet alerts are less likely to flood the alert view.

Fixed

• Fixed an issue where some alert details were not retrieved correctly.

Full Changelog: v11.2.14...v11.2.15

UTMStack v11.2.14 adds new detections for AWS and Microsoft 365, improves Windows administrator awareness monitoring, and includes many fixes that make log parsing, alert accuracy, and security controls more reliable.

What's New

• Added 18 new detection rules for AWS and Microsoft 365 to help identify monitoring gaps.
• Added new administrator awareness detections for Windows events.
• Added grouped administrator awareness alerts for Microsoft 365.
• Added broader syslog support, including CEF and LEEF formats.
• Added a local user creation option for administrators in the interface.
• The Windows agent now lets administrators choose event channels to collect, with changes applied without restarting.
• Added a new alerts view for reviewing security alerts.

Improved

• Improved alert grouping and deduplication for SonicWall, CrowdStrike, and Microsoft 365 password-spraying alerts.
• Improved final status and outcome reporting for SentinelOne, CrowdStrike, Suricata, Windows, Linux, Google Cloud, and Azure.
• Improved log parsing and field accuracy for many sources, including Cisco, Palo Alto, Fortinet, Sophos, Meraki, Mikrotik, pfSense, GitHub, Google, Kaspersky, Bitdefender, ESET, and IBM.
• Improved Microsoft 365 collection by starting all subscriptions, following pagination, and resuming from the last collected point.
• Improved platform stability and resource usage.

Fixed

• Fixed security issues, including patches for disclosed CVEs, stronger two-factor authentication controls, safer SAML handling, and reduced exposure of credentials and secrets.
• Fixed false positives and missing fields in detections for Suricata, Cisco, Palo Alto, Fortinet, Sophos, CrowdStrike, SentinelOne, Microsoft 365, AWS, Google, Azure, Linux, Windows, and other sources.
• Fixed email settings so sensitive values are masked and email-related mismatches are resolved.
• Fixed local user creation errors and password validation messages.
• Fixed agent credential handling so credentials are no longer exposed in registration responses or logs.
• Fixed alert and log parsing issues that could cause missing addresses, actions, outcomes, or incorrect severity.

Full Changelog: v11.2.13...v11.2.14

UTMStack v11.2.13 Release Notes

Welcome to UTMStack v11.2.13! This release brings important reliability improvements to our AI features, enhanced threat detection, and smarter alert management to keep your network safer and your workflow smoother.

What's New

• Added automatic protection to temporarily disable flooding correlation rules and notify you via the notification bell when rule flooding occurs.
• Added new phishing access blocked detection rules for Bitdefender.

Improved

• Updated and enhanced log filters and correlation rules for Bitdefender, Azure Event Hub, Windows Events, ADFS, Certificate Services, SID History, SMBv1, and SonicWall.
• Added log mapping for Google Cloud Platform (GCP) DNS and HTTP requests for better visibility.
• Standardized action results across filters to ensure consistent reporting.
• Optimized alert processing for faster and more reliable notifications.

Fixed

• Added a retry policy to SOC AI analysis to prevent failed requests and ensure you get your security insights seamlessly.
• Updated Anthropic model keys to ensure uninterrupted AI assistant functionality.
• Fixed an issue where rule flood protection thresholds were not properly scoped, improving overall system stability.

Full Changelog: v11.2.12...v11.2.13

Release Notes: UTMStack v11.2.12

This release focuses on improving the reliability of your security monitoring and incident response workflows. We have addressed key issues to ensure your alerts and automation processes run more smoothly.

Improved

• Enhanced the reliability and performance of SOAR automation workflows.

Fixed

• Resolved an issue that prevented some security incidents from triggering alerts correctly.
• Fixed a false positive in PowerShell monitoring to reduce unnecessary noise from benign system processes.
• Corrected a data processing error in Cisco Meraki logs to ensure accurate reporting.

Full Changelog: v11.2.11...v11.2.12