AXA 3.0.2 released

A new version of AXA is released, version 3.0.2. This release provides a performance enhancement and a bugfix.

• Remove default explicit setting of socket snd/rcv buffers resulting in network performance degradation.
• Fix MacOS compilation issue.

A source tarball is also available at https://dl.farsightsecurity.com/dist/axa/axa-3.0.2.tar.gz
SHA256: 53ad5ed7726e29c32adb818a77cd0d55e70ae8f131e3025473726b3683635965

AXA 3 released

A major new version of AXA is released. This is the Advanced Exchange Access Toolkit which provides a library and clients for accessing real-time data and services directly from the Security Information Exchange (SIE). AXA 3 contains many significant changes, including the ssh: and tls: authentication methods are removed. A summary of the changes follows:

• Authentication now uses an AXA-specific apikey: credential rather than former legacy authentication methods.
• Consistency with DNSDB formatting conventions has been improved. RRnames now include the formal trailing dot, and RRtypes are now capitalized, as has been the norm in DNSDB.
• sratool output is now in standard JSON Lines (JSONL) format only. If you relied on the prior non-standard presentation-like output format used by sratool for data collection or analysis, you will need to update your process to use the new format.
• The axa config file is now optional.
• The missed packet display now uses UTC time (instead of local time).
• Add sratunnel/radtunnel -K kickfile option to allow rotating new output files based on -C packet count, -T elapsed seconds, or -Z file size.
• Allow sratunnel/radtunnel -k (kickfile) to work with -i (interval).
• Add sratunnel/radtunnel -Z option to clamp an output file size.
• Add sratunnel/radtunnel -T option to stop output after elapsed seconds.
• Add sratunnel/radtunnel -I option to allow non-TLS (insecure mode) for apikey method.
• The -S certs option has been removed.
• Removes the axa_tsindextool utility.

A source tarball is also available at https://dl.farsightsecurity.com/dist/axa/axa-3.0.1.tar.gz
SHA256: ecd4a76903a1348764dbda30f0ae303a729875156ea3a76ea6b2c39354d8a649

AXA 2.2.2 released

A new version of AXA is released, version 2.2.2. This is the Advanced Exchange Access Toolkit which provides a library and clients for accessing real-time data and services directly from the Security Information Exchange (SIE). This release contains two bug fixes as seen when using the sratunnel pcap outputs.

• sratunnel: catch stop() recursion on flush error
• sratunnel: fix pcap out buffer space calculation

A source tarball is also available at https://dl.farsightsecurity.com/dist/axa/axa-2.2.2.tar.gz
SHA256: 7cba4ccf6bae1d972a614b4acb1cf43fb7635bfd9fe777a6831b528f0218bce3

axa 2.2.0 released

The Advanced Exchange Access (AXA) toolkit version 2.2.0 is released. This release introduces timestamp indexing and fixes a version-migration bug. In detail:

• Add timestamp indexing
• Fix negotiation of AXA protocol version upon successful connection

A source tarball may be found at https://dl.farsightsecurity.com/dist/axa/axa-2.2.0.tar.gz

SHA256: d309b64e3661c0f063f785f55eac5fa0a2de2ee87c70b61920b417459076f3fd

axa 2.1.0 released

The Advanced Exchange Access (AXA) toolkit version 2.1.0 is released. Changes include the addition of nmsg JSON support. In detail:

• Add strict permissions requirement for config file
• Update documentation to reflect apikey and port number changes
• Add nmsg json support to sratunnel/radtunnel
• Add and amend tests for config file permissions
• Update nmsg-msg8-module-sie dependency to nmsg-msg9-module-sie

A source tarball may be found at https://dl.farsightsecurity.com/dist/axa/axa-2.1.0.tar.gz

SHA256: 80ab8b0272c8d41ee09e96c4eb5334197caffd33ba9f6e4433789d471945bfea

axa 2.0.1 released

The Advanced Exchange Access (AXA) toolkit version 2.0.1 is released. The significant changes since 1.6.0 include:

• Update support of libedit <= 3.11 (forced wchar support)
• Deprecate use of self-signed certs
• Add SIGINFO (ctrl-t) information getter for sratunnel/radtunnel
• Add tools option to disable output buffering
• Remove mgmt
• Add stats (successor to mgmt)
• Add library versioning
• Add client-side hello allowing client to send system and dependency information
• Update various internal AXA protocol semantics for AXA Protocol 2
• Add 8601 timestamps to accounting messages

A source tarball download is at http://dl.farsightsecurity.com/dist/axa/axa-2.0.1.tar.gz
SHA 256 d23d7bfb6e36953d7524a60b1929641c73db7fc55bbb4914ae213187e733dfbc

axa 1.6.0 release

The Advanced Exchange Access (AXA) toolkit version 1.6.0 is released. The main changes since the last release are:

• Fix make check Clang compiler warnings
• Fix small bugs in apikey transport
• Fix sratool/radtool command completion bug
• Fix sratool/radtool overzealous help bug
• Fix make check when building without yajl
• Add axa_apikey_load_and_check_key()
• Update README (additional examples)
• Remove configure option to select compile-time list of available ciphers
• Make config file errors emitted according to axa_debug level
• Make nmsg file and udp output objects unbuffered

A source tarball download is at https://dl.farsightsecurity.com/dist/axa/axa-1.6.0.tar.gz
SHA256: b901731f70a63befd0b99e3ef922d48316df2a59212903f06133d0bde6006f28

axa 1.5.1 release

The Advanced Exchange Access (AXA) toolkit version 1.5.1 is released. This includes the libaxa C library, AXA command-line tools, and documentation. The significant changes since the previous public release are:

• Add apikey support
• Add per-user config file

A source tarball download is at https://dl.farsightsecurity.com/dist/axa/axa-1.5.1.tar.gz
SHA256: 63324acf6ca4276771edc674df9b14ea9ada44acb333cb77ec31bc8c819dd84b

axa 1.4.0

AXA 1.4.0 is a bug fix and documentation update release:

• Fix bug in sratunnel where pcap output could underflow a counter and crash
• Fix bug in sratool where 'get channels' would fail
• Fix bug in sratunnel where error messages would fail to emit
• Fix typos in manuals
• Fix non-portable doxygen version check
• Add missing files to EXTRA_DIST
• Update README (proper package versions, better install instructions)