Merge branch 'master' into feature/edta-event-def-suggestions

Author: monrax

.github/dependabot.yml

@@ -15,7 +15,8 @@ updates:
         update-types: ["version-update:semver-patch"]
       - dependency-name: "com.amazonaws:aws-java-sdk-bom"
         update-types: ["version-update:semver-patch"]
-      # we want to manually update the opensearch-java client as long as it requires intensive testing
+      # we want to manually update the opensearch-java client and core as long as it requires intensive testing
+      - dependency-name: "org.opensearch:opensearch-core"
       - dependency-name: "org.opensearch.client:opensearch-java"
     groups:
       openrewrite:

.github/workflows/reviewbot.yml

@@ -28,7 +28,7 @@ jobs:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
       - name: Compile with Maven / Install dependencies
-        run: ./mvnw --fail-fast -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 compile
+        run: ./mvnw --fail-fast -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.test.skip -Dskip.datanode -Dcyclonedx.skip compile
       - name: Reviewbot
         uses: Graylog2/reviewbot@v1
         with:

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-Please follow [the instructions on graylog.org](https://www.graylog.org/get-involved/).
+Please follow the [instructions on the graylog-project repo](https://github.com/Graylog2/graylog-project).
 
 #### Code of Conduct
 

UPGRADING.md

@@ -24,3 +24,30 @@ After upgrading:
 |---------------------------------------------------------------------------|-------------|
 | `org.graylog2.contentpacks.facades.EntityWithExcerptFacade#resolveGrants` | removed     |
 
+## Sigma Rules Folded into Event Definitions
+
+Prior to 7.2, Sigma rules were first order entities that could be managed directly. Each rule was also
+backed by an Event Definition that controlled the execution scheduling and could also have some of its
+configuration managed directly. Sigma rules have now been folded into Event Definitions and the first
+order Sigma rule entity no longer exists. Sigma rule event definitions can now be created by either a
+file upload or configured Git repository import. The manual modification of Sigma rule source YAML is
+no longer supported. After a Sigma rule has been imported as an Event Definition, all management is now
+handled directly on the Event Definition. In support of this change, the `Security > Sigma Rules` menu option and its
+associated UI has been removed. Management of Sigma rule Git repositories has moved to `Alerts > Sigma Repos`.
+
+Sigma Correlation rules can no longer be directly imported or uploaded. For `event_count` and `value_count` types,
+the correlated rules can be imported and then the resulting event definitions can be modified to add aggregation
+information without needing to import another Sigma rule. For `temporal_ordered` types, an `Event Correlation` event
+definition can be created after the rules are imported to create the same temporal correlation.
+
+All previously imported Sigma rules, including correlation rules, will be migrated to the new Event Definition pattern
+on upgrade and work as they did before.
+
+The following REST API changes are a direct result of this rework:
+
+| Endpoint                                                                       | Description                                                                              |
+|--------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
+| `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/validate_zip` | Moved to `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/import/validate_zip` |
+| `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/import`       | Moved to `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/import/bulk/import`  |
+| `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/upload`       | Moved to `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/import/bulk/upload`  |
+| All other `/plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/...`     | Deleted                                                                                  |

changelog/unreleased/issue-13676.toml

@@ -0,0 +1,4 @@
+type = "fixed"
+message = "Apply static fields configured on a Forwarder input to forwarded messages."
+
+issues = ["Graylog2/graylog-plugin-enterprise#13676"]

changelog/unreleased/issue-14449.toml

@@ -0,0 +1,5 @@
+type = "f"
+message = "Fix Geo-Location Processor configuration failing to save when cloud storage is set to S3 or GCS."
+
+issues = ["14449"]
+pulls = ["26329"]

changelog/unreleased/issue-25416.toml

@@ -0,0 +1,5 @@
+type = "f"
+message = "Improve input startup failure messages on the Input Diagnosis page with actionable details including bind address, port, and exception-specific guidance."
+
+issues = ["25416"]
+pulls = ["25663"]

changelog/unreleased/issue-25648.toml

@@ -0,0 +1,5 @@
+type = "fixed"
+message = "Fix inconsistent collector instance counts (online exceeding total) while collectors are enrolling."
+
+issues = ["25648"]
+pulls = ["26109"]

changelog/unreleased/issue-26122.toml

@@ -0,0 +1,5 @@
+type = "f"
+message = "Fixed extractor listing breaking with a 500 error when a lookup table extractor references a lookup table that was deleted. Such extractors can now be listed, edited and deleted again."
+
+issues = ["26122"]
+pulls = ["26289"]

changelog/unreleased/pr-25783.toml

@@ -0,0 +1,5 @@
+type = "c"
+message = "Allow collectors to re-enroll with their existing keypair."
+
+issues = ["25717"]
+pulls = ["25783"]