All of Devo is happy to present Devo Platform release 7.17. This December release comes with two goals! We added two new user-facing functionalities to the platform.  We also made important internal improvements that provide the platform with greater scalability, uniformity and maintainability.

Geo Availability

Table of Contents:

New Features

Data Search

 A new filter allows you to search for a keyword inside of the entire raw event. You can search for a keyword in any of the event fields and it is available in both view modes.

X.509 Certificates

A new column named “Expiration date” is now available. This makes it easier to see if the generated certificates are close to expiration. 

Improvements

Lookups

Some Lookups can remain in “Updating”  status for a long time, you can now refresh a lookup that is taking more than 1 hour to be updated. The lookup will then change back to "Available".

Data Search

Sensitivity Filter - We’ve removed the “Sensitivity” filter from the “Create field” and “Filter” tabs in the Operations over fields form. 

Regular Expressions - Functions that require any of its arguments to be regular expressions can now be “regexp” and “str” types.

Depreciated

LINQ Operation - MaxMind GeoIPv1 operations are now deprecated. We ask you to use MaxMind GeoIPv2 operations instead.

Bug Fixes

Activeboards

Empty Table Widgets - There was a case where the Table widget’s visual tab displayed an empty screen and generated console errors. This only occurred following a specific sequence of steps with a grouping query when it returned no events before the grouping clause. 

Ambiguous Table Widget entries - There was an issue with the Table widget displaying ambiguous values in the exported CSV file when the column values contain commas.

Alerts

XSS - It was possible to insert cross-site scripting in alert annotations. From now on, XSS aren’t allowed.

Roles

Permissions pop up - The pop-up info message for permissions displayed the text without proper margins.

Data Search

Copy Field Names - In List view, if you selected a whole event and copied it⸺regardless of the values for the “Show field names” and “Show null values” toggles⸺the field names were always missing and the null values were always shown. 

Selecting Events - In List view, with the “Show field names” toggle off, it wasn’t possible to select events. 

Copying Event - In List view, selecting and copying part of an event wouldn’t always result in the copied text matching the selected text.

Expanding Query Editor - If the Query editor was embedded, there were problems expanding it when clicking on it. This was notably problematic because the button to run the query is hidden until the editor is expanded.

Query Editor Reset - There was a problem with the Query editor resetting when the user clicked on the realtime button. 

Group By Error - When a user grouped a query by a non-existent field, the Query editor wouldn’t react. From now on an error will be displayed with the aforementioned field underlined in red. 

Extracting multiple fields - If you opened the JSON parser and selected a number of fields to be extracted, the parser would only extract the first selected field. ● When editing a breadcrumb that has nested operations, if said breadcrumb didn’t fit in the “Operations over columns” form, then the query editor wouldn’t open. 

Sub Filter Blank - There was a case where, if you ran a second filter you would get a blank screen. This was because the first filter was applied to a non-asterisk field. 

No Operation Called error - Existing Lookups were randomly failing in queries, with an error message “No operation called 

lu/<Lookup_name>/<Lookup_field>”.

Link to Release 7.17 Documentation page