Change Log

0.9.0 (Work in progress)

The following features are already implemented and included in the 0.9.0 release.

• ...

0.8.0 (Released)

The following features are already implemented and included in the 0.8.0 release.

• Used a production WSGI server instead of Flask
• Improved the performance of the core processes:
  • Static analysis of the docker images
  • Database population process
• Replaced ClamAV docker image geekduck/clamav by tiredofit/clamav
• Bug fixing

0.7.0 (Released)

The following features are already implemented and included in the 0.7.0 release.

• Added ClamAV as antivirus engine for detecting trojans, viruses, malware & other malicious threats thanks to ClamAV docker image: geekduck/clamav
• Replaced deepfenceio/deepfence_depcheck with 3grander/4depcheck.
• Supported Dagda integration with an external Falco (Dagda doesn't start its own Falco and it will read the output file generated by the external Falco).
• Dagda includes the gathering of real time events from docker daemon.
• Added new vulnerabilities to VulnDB - source OVAL definitions for Red Hat Enterprise Linux 3 and above:
  • RHBAs (Red Hat Bug Advisories)
  • RHSAs (Red Hat Security Advisories)
• Created a Continuous Delivery flow with Travis CI for publishing the Dagda docker image to Docker Hub: 3grander/dagda
• Bug fixing

0.6.0 (Released)

The following features are already implemented and included in the 0.6.0 release.

• Created a Dagda agent for performing static analysis in a remote way
• Modified the data model for improving the details about each CVE/BID/Exploit
• Product vulnerabilities within Dagda static analysis can be tagged as false positives
• SSL/TLS and basic authentication supported for MongoDB client
• Added Bandit to the Makefile as source code security analyzer of Dagda project
• Bug fixing

0.5.0 (Released)

The following features are already implemented and included in the 0.5.0 release.

• Added Falco for monitoring runtime docker containers to detect anomalous activities
• Created Dagda logger
• Bug fixing

0.4.0 (Released)

The following features are already implemented and included in the 0.4.0 release.

• Created a full REST API for Dagda server
• Improved the vulnerabilities database update process

0.3.0 (Released)

The following features are already implemented and included in the 0.3.0 release.

• Added OWASP dependency check + Retire.js for the docker images analysis thanks to Docker dependency checker: deepfenceio/deepfence_depcheck
• Included remote docker registries
• Created a single CLI
• Created the Dagda wiki

0.2.0 (Released)

The following features are already implemented and included in the 0.2.0 release.

• Minimized the false positives improving the accuracy of the matches between the information retrieved from the docker images and the stored information into the MongoDB
• Improved the user feedback for the long time running processes
• Improved the accuracy of the external vulnerabilities/exploits parser
• Created a quick starter with Docker
• Dagda project included in a CI environment
• Added tests for code coverage

0.1.0 (Released)

The following features are already implemented and included in the 0.1.0 release.

• Analyzes the installed software in the Operating System
• Analyzes both the docker images and the running containers
• Docker analysis history supported
• Multiple Linux base images supported
  • Red Hat/CentOS/Fedora
  • Debian/Ubuntu
  • OpenSUSE
  • Alpine
• Multiple vulnerabilities and exploits sources
  • CVEs
  • BugTraqs
  • Exploit-db
• CLI for querying your personal database which contains the vulnerabilities and the exploits from the imported sources