GREYCORTEX has just released MENDEL 2.5. In this most recent version, we have made several additions to further improve performance, including a new detection method for forbidden services, faster pattern processing for IDS rules (requires Intel architecture), and HTTPS traffic decryption capabilities (with imported private key). The full changelog for MENDEL 2.5 is provided below.
Additional Features
- Added a new detection method for forbidden services
- Added faster pattern processing for IDS rules (requires Intel architecture)
- Added new traffic direction types for better filtering
- Added system self-reporting for additional functionality support
- Added HTTPS traffic decryption capabilities (with imported private key)
Improvements
- System components have been upgraded to their newest versions
- VoIP protocol parsers have been included for better performance
- Improved system hardening
- Improved query performance in the Flows tab
Bugs Fixed
- Fixed IDS stability problems
- Fixed IP address settings for new interfaces
- Fixed disabling parsing IDS rules and DPI
- Fixed issues with system log rotation, maintenance, and removal
- Fixed truncated application requests within flow data
- Fixed ICMP codes reporting in flow records
- Fixed the reporting service type in outlier analysis methods
- Fixed upgrade log downloading via the GUI
- Fixed false positive matching for countries
- Fixed issues in Incident Management
- Fixed displaying colored, blacklisted IP addresses on the Peers tab
- Fixed support for IPv6 filtering
- Fixed computation functionality in the Peers graph
- Fixed the computation of severity in the Toplists dashboard
- Fixed invalid filter value handling
- Fixed an issue with user rights in the reporting module
- Fixed autocomplete in Host filtering
- Fixed time limit for false positive application
- Fixed status monitor event information
- Fixed filtering by timestamp in event lightboxes
- Fixed filtering false positives in “Table by Service or Port”
User Note
To further improve performance, it is strongly suggested that users turn off unused ports.