CHANGELOG

# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

#################################################################
#                 Maltrail Changelog File                       #
#################################################################

[+] Added functionality
[-] Deleted functionality
[!] Bug fixing
[=] Minor update or changed functionality

#################################################################



- Version 3.1 -> 3.1.1 (11 Aug 2026)

[+] 'install.sh': one command sets up a working deployment - dependencies,
    a shallow clone, the prebuilt sensor, an unprivileged user, log and
    state directories, '/etc/maltrail.conf', systemd units and setcap.
    Re-running it upgrades. Run from inside a checkout you already have, it
    installs THAT tree and never touches its git state. Exercised in
    ubuntu, debian, fedora, opensuse and alpine containers on every commit,
    where the server is started and asked for '/ping'
[!] Release binaries are built against glibc 2.28 (in an AlmaLinux 8
    container) instead of the runner's 2.39, so they actually start on
    RHEL 8+, Debian 10+, Ubuntu 18.04+ and Leap 15.x. Before this they
    failed at exec with "GLIBC_2.39 not found" on most enterprise
    distributions. The release now refuses to publish a binary needing
    anything newer

[!] Python 3.6 works again. The whole 3.7 floor came down to ONE call -
    'str.isascii()' in core/update.py - which made the trail update die on
    every distribution whose stock 'python3' is 3.6 (RHEL 8, CentOS 7,
    openSUSE Leap 15 / SLE 15, Amazon Linux 2), leaving an empty trail set
    and a sensor that detected nothing. There is a 3.6 path now, the whole
    server suite and a full offline trail build run on 3.6.15 in CI, and the
    sensor's interpreter floor follows

[!] The Docker image adapts to the storage it is given instead of demanding uid
    10001 own it: 'docker/entrypoint.sh' picks the uid that can write the log
    and state directories (bind-mount owner, 'PUID'/'PGID', or the image's own
    user), then drops privileges before starting anything (#19596)
[!] 'cap_add: NET_RAW' had no effect on the sensor container: Docker grants a
    capability in the bounding set and leaves the ambient set empty for a
    non-root 'USER', so the capture socket failed with EPERM no matter what the
    compose file said. The entrypoint raises the ambient capabilities, and only
    for the sensor
[!] The sensor never updated its trails when started without an absolute '-c'
    path - a relative configuration file resolved the repository root to '',
    and chdir('') failed as 'unable to run python3.12: No such file or
    directory'. That is every Docker and tarball install: the sensor ran on
    with an empty trail set and detected nothing
[!] 'docker compose -f docker/docker-compose.yml up' failed outright: compose
    resolves relative bind-mount paths against the compose file's directory, so
    './maltrail.conf' meant 'docker/maltrail.conf', which does not exist


- Version 3.0.1 -> 3.1 (11 Aug 2026)

[+] The sensor matches TLS server certificates against the trail set by their
    SHA-1 fingerprint ('CHECK_TLS_CERTIFICATES', new 'CERT' trail type), fed by
    the new 'sslblcert' feed (~10,400 C2 certificates from abuse.ch SSLBL). A
    certificate outlives the address and domain in front of it, so it keeps
    matching after those rotate. Rated 'suspicious' rather than malware
[+] New '/check?q=<domain|ip|url>' server endpoint: answers whether one
    indicator is in the trail set and which key matched, reading through the
    memory-mapped trail store so it costs no memory. Custom trails require a
    session, since 'ENABLE_MASK_CUSTOM' already treats their names as private
[+] 'SYSLOG_SERVER' and 'LOGSTASH_SERVER' may each name several collectors,
    separated by commas, for redundant SIEM targets
[+] New 'torprojectnodes' feed: all running Tor relays from the Tor Project's
    own Onionoo API, not only exit nodes - a client connects to a guard relay
    and never to an exit, so outbound Tor use was previously invisible
[!] Both sensors now parse PPPoE-encapsulated IP. Traffic mirrored from a
    DSL/fibre uplink is PPPoE end to end, so a SPAN port carrying it was
    detected as nothing at all while the capture host's own traffic was fine
[!] 'retrieve_content' keeps cookies across a redirect, which restores three
    cybercrime-tracker feeds (~39,000 indicators) that a cookie-and-redirect
    challenge had silently reduced to zero
[!] Removed six feeds whose services were retired years ago (Palevo Tracker,
    Ransomware Tracker x3, ZeuS Tracker x2), and repointed 'feodotrackerip' at
    the CSV that abuse.ch still fills. A feed that yields nothing is now
    reported; that warning used to be suppressed for abuse.ch URLs, which is
    why all seven rotted unnoticed
[!] '/blacklist' is gated like '/fail2ban' ('BLACKLIST_ALLOWLIST', falling back
    to 'FAIL2BAN_ALLOWLIST'); an authenticated session also passes. It reads the
    event log and returned the flagged source IPs to anyone
[!] The Docker image health-checks the process it actually runs. Its default
    command is the server, but the healthcheck ran the sensor's preflight, so a
    server-only container reported itself unhealthy while serving correctly
[=] Docker: 'MALTRAIL_UID'/'MALTRAIL_GID' build args, and documentation for
    bind-mounted log directories, which keep the host's ownership and leave the
    unprivileged container unable to write the daily log
[=] 'sensor/tools/check.sh', 'parity.py' and 'bench_compare.py' report why they
    cannot run instead of failing obscurely: missing toolchain or capture
    bindings, an interpreter older than 3.7, and a benchmark whose reference
    sensor never started
[=] Multiple updates and optimizations for regular static trails and the whitelist

- Version 3.0 -> 3.0.1 (10 Aug 2026)

[!] The sensor now verifies that the Python driving the trail updater is 3.7+
    (core/update.py needs 'str.isascii()'), and prefers a newer 'python3.N' on
    PATH over an older default 'python3'. On distributions whose python3 is 3.6
    (openSUSE Leap 15, SLE 15) the trail set silently failed to build, leaving a
    sensor that detected NOTHING while '-T' reported the interpreter as present
    and the configuration test as passed
[!] '-T' fails, rather than passing with warnings, when the trail updater cannot
    run at all
[=] '-T' prints the command that fixes an unwritable or missing LOG_DIR, and
    names the interpreter and version it found
[=] 'sensor/tools/check.sh' checks for cargo/rustfmt/clippy/python3 before doing
    any work, names the package that provides each, and states that none of them
    are needed to build or run the sensor
[=] Documented prerequisites that were previously assumed: 'setcap'
    (libcap2-bin / libcap / libcap-progs), Python 3.7+, and that a distribution's
    packaged Rust 1.74 is sufficient, so 'rustup' should not be installed
    alongside it
[!] Fixed the quick-start command that created LOG_DIR: '-g "$USER"' assumed a
    group named after the user, which does not exist on every distribution

- Version 2.2 -> 3.0 (08 Aug 2026)

[+] The sensor is rewritten in Rust and becomes the sensor: 'sensor/', built with
    'cargo build --release'
[+] Sensor '-T' preflight validates configuration, trails, whitelist, log directory,
    capture filter and capabilities, and exits non-zero, so a broken deployment can be
    caught before it runs blind
[+] Prometheus metrics endpoint for the sensor ('STATS_ADDRESS'), exposing dropped
    packets, trail generation, per-worker counters and build info
[+] Trail reloads are atomic and happen without a restart, on SIGHUP or within a second
    of the trail file changing
[+] Event throttling is reworked into three selectable modes: burst-then-summarize
    (default), byte-exact legacy, and off
[=] The sensor captures with ONE worker by default and no longer derives its worker
    count from 'PROCESS_COUNT'. The kernel flow-hashes capture while the scan
    heuristics count per source, so the previous default of 16 ran every install with
    diluted heuristics to buy throughput a single worker already has; scaling out is
    now an explicit 'CAPTURE_FANOUT'/'CAPTURE_WORKERS' opt-in. Exact trail detection is
    identical at any worker count
[+] The sensor writes the condensed observable store ('USE_CONDENSED_STORAGE',
    'meta.sqlite') that feeds the server's novelty and retro-hunt views, in the same
    format core/meta.py produces and the server reads
[+] Differential parity harness: a generated fixture corpus plus one sampled from the
    operator's real trails.csv, replayed through both sensors, requiring byte-identical
    events and an identical condensed observable store ('sensor/tools/parity.py')
[+] 'sensor/tools/check.sh' runs the whole gate: formatting, lints, tests in both debug
    and release profiles, and both parity corpora
[+] systemd units run both the sensor and the server as an unprivileged user, with
    systemd-managed state/log directories, a read-only filesystem, and exactly
    CAP_NET_RAW + CAP_NET_ADMIN for the sensor
[-] Python 2 support is dropped; Python 3.7+ is required and 'thirdparty/' is removed
[-] Plugin support is removed from both sensors, along with 'plugins/'
[-] The sample SSL PEM is no longer shipped: a private key in a public repository is a
    private key everybody already has (see the 'openssl' hint in maltrail.conf)
[-] 'requirements.txt' is removed: the server is standard library only, and the old
    sensor's pcapy-ng dependency now lives in 'old/requirements.txt'
[=] The previous Python sensor moves to 'old/', kept as the reference implementation and
    as the oracle the parity harness replays against
[=] Runtime data files (whitelist, ua, worst_asns, cdn_ranges, bogon_ranges,
    ignore_events) move from 'misc/' to 'data/'; 'misc/' is no longer in the repository
[=] Sensor throughput: 865 ns/packet against 23,448 ns/packet for the old sensor on the
    same capture and the same trail set, and one worker per core rather than a single
    capture process feeding a shared-memory ring
[!] The sensor now refreshes trails on its own timer, as sensor.py always did; without it
    a long-running sensor detected against whatever trails.csv it started with
[!] Docker images build and run again, unprivileged, with the sensor enabled
[!] '--version' and other short-lived invocations no longer lose their output to
    os._exit() skipping stdio flushing
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 2.1 -> 2.2 (01 Aug 2026)

[+] Retro hunt over collected observables
[+] Searchable metadata collection ('USE_CONDENSED_STORAGE', 'meta.sqlite')
[+] Geomap in the reporting interface, and the heatmap returns in place of the calendar
[+] Events expand to show the source trail file they came from
[+] Fast in-C prefilter and heuristics engine: sliding-window/stealth/UDP scan detection,
    capture fanout and CPU affinity, per-heuristic muting (new capture paths opt-in)
[+] The sensor column returns to the table, detail drawer, filter and export, for
    multi-sensor deployments
[!] RIPE geo lookups get an air-gap circuit breaker, so an offline server no longer
    storms retries and spams the console
[!] Bug fixes (Issues #19558, #19559, #19561, #19562, #19564, #19565, #19581)
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 1.5 -> 2.1 (01 Jul 2026)

[+] New reporting interface
[+] '--smoke-test' and '--detect-test' self-checks
[+] Server caches '_counts'/'_statics', caps POST size and applies a request timeout
[=] Drastic reduction in trail RAM usage
[=] Dashboard is faster and more robust: 'complete()' rework, debounced resize, fixed
    handler leak, no more NaN charts
[!] Trail regexes were silently cleared during reloads
[!] Trail files were written and read non-atomically
[!] Logging concurrency and memory fixes
[!] CACHE_TYPE enum fix
[!] Offline PCAPs with oversized packets no longer break the sensor
[!] '/events' is served correctly when the client sends no Range header
[-] Defunct/obsolete feed removed
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 1.4 -> 1.5 (01 Jun 2026)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 1.3 -> 1.4 (01 May 2026)

[!] CIDR mask validation no longer relies on 'assert', which is stripped under optimized
    Python ('python -O')
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 1.2 -> 1.3 (01 Apr 2026)

[!] Charts size themselves from the browser window rather than the monitor
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 1.1 -> 1.2 (01 Mar 2026)

[+] FAIL2BAN_ALLOWLIST is implemented (Issue #19386)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 1.0 -> 1.1 (01 Feb 2026)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.88 -> 1.0 (01 Jan 2026)

[=] Multiple updates and optimizations for regular static trails and the whitelist
[=] Major version is updated
[=] Project historical data trimmed, ~ 420Mb freed


- Version 0.87 -> 0.88 (01 Dec 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.86 -> 0.87 (01 Nov 2025)

[=] "potential sql injection" heur is improved (Issue #19356)
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.85 -> 0.86 (01 Oct 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist

- Version 0.84 -> 0.85 (01 Sep 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist

- Version 0.83 -> 0.84 (01 Aug 2025)

[=] Multiple improvements for Maltrail in Docker (Issues #19323, #19325)
[=] Multiple updates and optimizations for regular static trails and the whitelist
[-] Removing defunct blacklist (Issue #19339)


- Version 0.82 -> 0.83 (01 Jul 2025)

[!] Fix the bug of self-stored XSS in aliases (Issue #19321)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.81 -> 0.82 (01 Jun 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.80 -> 0.81 (01 May 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.79 -> 0.80 (01 Apr 2025)

[!] Fix the bug of using a custom path configuration file (Issue #19304)
[=] Multiple updates and optimizations for regular static trails and the whitelist
[-] Removing defunct blacklist (Issue #19305)


- Version 0.78 -> 0.79 (01 Mar 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.77 -> 0.78 (01 Feb 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.76 -> 0.77 (01 Jan 2025)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.75 -> 0.76 (01 Dec 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.74 -> 0.75 (01 Nov 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.73 -> 0.74 (01 Oct 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.72 -> 0.73 (01 Sep 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.71 -> 0.72 (01 Aug 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.70 -> 0.71 (01 Jul 2024)

[=] Maltrail docker container run is improved (Issue #19260)
[=] php-inj detection is improved (Issue #19262)
[=] Python 3.12 compability is improved (Issue #19257)
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.69 -> 0.70 (01 Jun 2024)

[=] cruzit feed URL changed (Issue #19253)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.68 -> 0.69 (01 May 2024)

[+] Support of simpleton IPv6 bogon address handling was added
[=] Multiple updates and optimizations for regular static trails and the whitelist





- Version 0.68 -> 0.69 (01 May 2024)

[+] Support of simpleton IPv6 bogon address handling was added
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.67 -> 0.68 (01 Apr 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.66 -> 0.67 (01 Mar 2024)

[=] Handling usage of pcapy lib instead of pcapy-ng is improved (Issue #19242)
[=] Fixed /server.py and /sensor.py restart in docker container (Issue #19243)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.65 -> 0.66 (01 Feb 2024)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.64 -> 0.65 (01 Jan 2024)

[+] Customisable blacklists via BLACKLIST option in /maltrail.conf file (Issue #19230)
[=] Multiple updates and optimizations for regular static trails and the whitelist




- Version 0.63 -> 0.64 (01 Dec 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist




- Version 0.62 -> 0.63 (01 Nov 2023)

[=] FAIL2BAN_REGEX and REMOTE_SEVERITY_REGEX options were updated to handle "potential iot-malware download" heur (Issue #19207)
[=] Abuseipdb feed was updated (Issue #19208)
[=] "potential remote code execution" heur for CVE-2016-0545 detection is updated (Issue #19210)
[=] "potential remote code execution" heur is updated for MacOS process list tracking in HTTP POST-req (Issue #19214)
[=] Multiple updates and optimizations for regular static trails and the whitelist




- Version 0.61 -> 0.62 (01 Oct 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist
[=] Updates for mass_scanner and worst_asns trails




- Version 0.60 -> 0.61 (01 Sep 2023)

[!] Workaround to have working searx server (Issue #19199)
[=] Multiple updates and optimizations for regular static trails and the whitelist


- Version 0.59 -> 0.60 (01 Aug 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.58 -> 0.59 (01 Jul 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.57 -> 0.58 (01 Jun 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.56 -> 0.57 (01 May 2023)

[!] Fixed login page GUI issue for mobile devices (Issue #19153)
[!] Fixed incorrect parsing of ViriBack feed (Issue #19154)
[=] Added new descriptions in "Specific detections" Wiki chapter
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.55 -> 0.56 (01 Apr 2023)

[=] Minor update for /feeds/emergingthreatsdns.py (Issue #19147)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.54 -> 0.55 (01 Mar 2023)

[!] Fixed unauthenticated OS command injection vulnerability in http.py (Issue #19146)
[=] Minor update for _process_packet func in sensor (Issue #19129)
[=] Multiple updates and optimizations for regular static trails and the whitelist




- Version 0.53 -> 0.54 (01 Feb 2023)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.52 -> 0.53 (01 Jan 2023)

[-] Defunct 360-netlab feeds were deleted (Issue #19138)
[=] "potential data leakage" heur is improved
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.51 -> 0.52 (01 Dec 2022)

[=] "potential iot-malware download" heur is improved
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.50 -> 0.51 (01 Nov 2022)

[+] New Wiki pages are added
[!] Fixed deadlock of Docker output to stdout (Issue #19121)
[!] Definition of network interfaces is improved (Issue #19123)
[!] Fixed regex for /360bigviktor.py feed (Issue #19124)
[!] Fixed syscalls handling (Issue #19125)
[=] "potential remote code execution" heuristic is improved
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.49 -> 0.50 (01 Oct 2022)

[=] "potential remote code execution" heur for CVE-2022-30190 detection is updated
[=] "Maltrail detection nuances" wiki-page is updated
[=] "Trail classes" wiki-page is updated
[=] Multiple updates and optimizations for regular static trails and the whitelist

- Version 0.48 -> 0.49 (01 Sep 2022)

[!] Fixed row rendering in UI (Issue #19109)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.47 -> 0.48 (01 Aug 2022)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.46 -> 0.47 (01 Jul 2022)

[+] "potential ssti injection" heuristic is added (CVE-2022-26134)
[=] "potential data leak" heuristic is improved
[=] "Trail-classes" wiki page is updated
[=] /requirements.txt file is updated (pcapy-ng)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.45 -> 0.46 (01 Jun 2022)

[+] New Wiki page is added
[=] "potential remote code execution" heuristic is improved (CVE-2022-1388)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.44 -> 0.45 (01 May 2022)

[+] systemd-based realization for Maltrail sensor.py, server.py and ipset/iptables ban-list (dedicated repo) have added
[+] New Wiki pages are added
[=] "potential remote code execution" heuristic is improved (detection for Java-related RCE stuff)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.43 -> 0.44 (01 Apr 2022)

[=] "potential remote code execution" heuristic is improved
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.42 -> 0.43 (01 Mar 2022)

[=] "potential remote code execution" heuristic is improved
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.41 -> 0.42 (01 Feb 2022)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.40 -> 0.41 (01 Jan 2022)

[+] "potential remote code execution" heuristic is extended for log4j/log4shell (CVE-2021-44228) vulnerability detection
[+] "generic_log4shell.txt" and "hacked_log4j.txt" trails were added for log4j/log4shell (CVE-2021-44228) vulnerability static detection
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.39 -> 0.40 (01 Dec 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.38 -> 0.39 (01 Nov 2021)

[=] "potential directory traversal" heuristic is extended
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.37 -> 0.38 (03 Oct 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.36 -> 0.37 (02 Sep 2021)


[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.35 -> 0.36 (02 Aug 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.34 -> 0.35 (04 Jul 2021)

[+] Added the prototype of heur for potential web scanning attempts
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.33 -> 0.34 (10 Jun 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.32 -> 0.33 (10 Jun 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.31 -> 0.32 (10 May 2021)

[!] Fixed PR_END_OF_FILE_ERROR bug, when using HTTPS for Maltrail's server (Issue #16217)
[!] Fixed bug with TLSv1_2_METHOD (Issue #16250)
[+] Added displaying real IP behind Cloudflare's one (Issue #20)
[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.30 -> 0.31 (01 Apr 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.29 -> 0.30 (01 Mar 2021)

[=] Multiple updates and optimizations for regular static trails and the whitelist



- Version 0.28 -> 0.29 (01 Feb 2021)

[+] Two new UI features (hide threat and report false positive options)
[+] Auto-refresh for Maltrail web-page (/?refresh=N, where N in seconds. Issue #624)
[+] Maltrail demo pages are released: maltraildemo.github.io
[=] Multiple updates and optimizations for regular static trails and the whitelist
[=] Potential DNS changer heur is improved
[+] Implemented colorized console output
[=] Minor style revamp and improved look and feel on mobile phones
[-] Memory check is removed
[+] Added info for proper Maltrail citation (/CITATION.cff)
[=] Added starting and ending times to console output



- Version 0.27 -> 0.28 (01 Jan 2021)

[+] Implementing support for LOGSTASH_SERVER (Logs in JSON format)
[+] Implementing REMOTE_SEVERITY_REGEX (Issue #13251)
[=] Sensor is able to get started without server (Issue #6020)
[=] Multiple updates and optimizations for regular static trails and the whitelist