Visit the Brim Data download page page to find the package for your platform.

• Update Zed to v1.18.0
• Update Brimcap to v1.18.0, which includes a new Zeek v7.0.0-brim1
• Introduce the Sessions tab in the left panel to persist Query Session histories (#3132)
• Update time display functionality to support local time zones and strftime directives (#3139)
• Fix an issue where the Zui window could not be dragged when Preview & Load was open (#3146)
• Fix a crash that would occur when attempting to create a pool with the same name as an existing pool (#3147)
• Fix an issue where top-level primitive Zed values were incorrectly wrapped in records in the Table view (#3145, #3150)

Visit the Brim Data download page page to find the package for your platform.

• Because Zui is dependent on the Zed project, GA Zui release major/minor version numbers are now synchronized to the corresponding Zed release
• Update Zed to v1.17.0
• Update Brimcap to v1.17.0
• The Correlations view has been moved to its own tab in the right panel separate from the Detail view (#3123)
• The Detail view (both when in the right panel and as a separate window) now uses a hierarchical display format similar to the main Inspector results view (#3127)
• Add Parquet as an available format for Export (#3122)
• Add an option in Settings to allow the Zed lake service launched by Zui to accept remote connections if desired (#3116)
• Fix an issue where the Export feature was not surfacing some failures (#3115)
• Fix an issue where the presence of null union values could cause a crash when displayed (#3118)
• Fix an issue where connections with small durations were shown as "Not available" in the Correlations view (#3119)
• Fix an issue where no notification was shown if the Packets button was clicked and there was no app installed to open the pcap slice (e.g., Wireshark) (#3114)

Visit the Brim Data download page page to find the package for your platform.

Highlights

For a walk through the highlights, see the June 2024 Release blog post.

Changes

• Update Zed to v1.16.0
• Update Brimcap to v1.8.0, which includes a new Zeek v6.2.0-brim2
• Zui macOS installers are now available for Apple silicon (ARM64) hardware (#3077, #3102)
• A new Windows code signing certificate is now in use, which will likely result in a period of Microsoft Defender SmartScreen warnings (#3050, #3055, #3057)
• The title of the section in Settings formerly called Brimcap Settings is now called Packet Captures (#3054)
• Zed queries are now parsed via a lake service endpoint, which adds red squiggly lines with tooltip details in the editor when errors are detected (#3076, #3085, #3087, #3094, #3104)
• Fix an issue where the Zed lake service launched by Zui was incorrectly open to remote connections (#3061, #3069, #3091, #3106)
• Add an option in Settings to point at local sets of additional Suricata rules (#3049)
• Add an option in Settings to specify a folder for storing extracted pcap slices (#3053)
• Add updated docs and a video for Packet Capture functionality (#3060)
• Fix an issue where populating the Brimcap YAML Config File option in Settings could cause a crash (#3044)
• Fix an issue where a parsing error displayed incorrect Zed code (#3065)
• Fix an issue where maximizing the Zui window could cause a crash on Linux (#3090)
• Fix an issue where Zui Insiders on Linux was not correctly detecting the availability of newer releases (#3084)
• Fix an issue where right-click Pivot to Values failed when clicking a Zed union value (#3099)
• Fix an issue where Zed union values were rendered blank in the Detail pane/window (#3103)

Visit the Brim Data download page page to find the package for your platform.

• Update Zed to v1.15.0
• Update Brimcap to v1.7.0, which includes a new Zeek v6.2.0-brim1
• For Zeek files events, the is_orig value is now used to determine the tx_host and rx_host values in the Correlation view (#3004)
• The Zed service launched by Zui now attempts to compact stored data every 5 minutes (#3006)
• Export Results has been enhanced to allow export to pools or the clipboard (paste buffer) (#2985, #3017)
• Improve syntax error presentation by using the /compile endpoint of the Zed service rather than the JS Zed query parser (#2972, #3034)
• Fix an issue where Zui's query editor would not load when running air-gapped (i.e., no Internet connection) (#3032)
• Fix an issue where issuing the query yield typeof({}) produced a stack trace (#2996)
• Fix an issue where issuing a new query while the stacked bar chart is loading triggered an error (#2996)
• Fix an issue in dark mode where font colors made text invisible during pool renames (#3028)
• Fix an issue where a large JSON object could not be loaded in Zui (#3026)
• Fix an issue where hitting the Back button too many times could cause the lost of session history (#3041)

Visit the Brim Data download page page to find the package for your platform.

• Update Zed to v1.13.0
• Update Brimcap to v1.6.0, which includes a new Zeek v6.0.3-brim1
• Update Electron dependency to 28.0.0 (#2934, #2953)
• Enhance the Zui Installation docs to describe the new feature to control when the app is updated to newer releases (#2950)
• Simplify how the termination of a spawned zed serve process is tied to the parent Zui process (#2956, #2957)
• Add a dark mode and new designs for pins, toolbars, detail/history panes, and saving queries (#2895)
• Adjust how Zui correlates new Zeek events in reaction to changes in Zeek's files events (#2981)
• Fix an issue where repository links in Zui Insiders had been incorrectly pointing to the regular Zui repo (#2935)
• Fix an issue where Zui incorrectly surfaced Brimcap errors as "Error: write EPIPE" or "Error: write EPIPE" instead of the detailed errors from pcap analyzers (#2955, #2991)
• Fix an issue where very long pool names caused the Load Data and Query Pool buttons to disappear (#2993)

Visit the Brim Data download page page to find the package for your platform.

• Update Zed to v1.12.0
• Update Brimcap to v1.5.5
• A new option in Settings now determines if checks for available Zui updates are performed at startup (default), at startup & daily, or manually (#2866)
• Add functionality to load data from the paste buffer (#2928)
• Add support for TSV load/export (#2916)
• Fix an issue with Chromium binaries being created in temporary storage (#2917)
• Fix an issue where the cursor position could become inaccurate while typing in the editor (#2922)

Visit the Brim Data download page page to find the package for your platform.

• Update Zed to v1.11.1

Visit the Brim Data download page page to find the package for your platform.

Preview & Load

It's now possible to preview and shape your data as you load it into a Zed lake with Zui. For details, check out the video at the Zui docs site.

image

Other Changes

• Update Zed to v1.11.0
• Update Brimcap to v1.5.3
• Zui has a new Preview & Load workflow that allows for shaping data as it's loaded in to a Zed lake (#2834, #2864)
• Fix an issue where editing the "month" portion of a time range pin caused a crash (#2854)
• Fix issues where null values were incorrectly rendered (#2875, #2876)
• Use monospace fonts in more places (#2877)
• Limit column width for large values and add grid lines in the table view (#2881)

Visit the Brim Data download page page to find the package for your platform.

• Due to malware false positives, Windows releases no longer include a full initial set of Suricata rules (as always, up-to-date rules will be downloaded on first Internet-connected launch of Zui) (#2858)

Visit the Brim Data download page page to find the package for your platform.

Monaco Editor

The big change in this release is that Zui now uses the Monaco editor. This gives Zui a monospace font and basic syntax highlighting for easier editing of your Zed programs!

image

Other Changes

• Update Zed to v1.10.0
• Update Brimcap to v1.5.2
• The Zui GitHub repo is now structured as a monorepo (#2818)
• Fix an issue where a community_id field was incorrectly being treated as a prerequisite to activating the Packets button (#2830)
• Zui now uses the Monaco editor, which provides a monospace font and minimal Zed syntax highlighting (#2824, #2836)
• Fix an issue where invoking the -version option on the bundled zed and brimcap binaries was producing incorrect output (#2841)
• Upgrade Electron dependency to 22.3.25 (#2848)