--------------------------------------

New Features for DEMARC 1.05-RC1 (partial list)

Home: http://demarc.org/
Email: info@demarc.org

--------------------------------------


[Frontend Console]
----------------------

+Optimized queries to significantly reduce page loadtime and allow 
 the DB to grow significantly larger without any increase in page loadtime.

+Graphing is now available for any search queries, or directly from the main
 page for the top signatures of the day.

+ARIN lookups have been fixed to not only work happily on BSD and Linux, but
 also includes a list of registries on which to try the query.

+Miniview can now be hidden when not needed or undocked, thereby further
 increasing page loadtime.

+Implemented caching on the unique events table, and removed caching from the 
 latest alerts from the 3 major categories on the Miniview. This has a net 
 effect of increasing speed of the main page, while keeping the most important
 stats in the Miniview as realtime updates.

+Added ability to delegate administrative responsibilities; Users can now have
 user level access, full administrative access, or a number of shades in between.

----------------------


[Client]
----------------------

+Runs as a true daemon.

+Supports multiple snort processes on the same machine.

+Optionally can set a timer to automatically download and
 implement the latest snort rules from either
 http://snort.sourcefire.com/ or http://www.whitehats.com/
 on a regular basis.

+Ability to bring up a new sensor by supplying a -I (install) flag to
 the client.

----------------------


[Integrity Checking]
----------------------

+Added the ability to check websites as well as files for changes.

+Added "IGNORE" class of rules which allow you to exclude files from
 being checked even if they're in a directory that's been set to be
 checked.

----------------------


[NIDS]
----------------------

+Added ability to search for which rulesets contain specific signatures
 straight from the event detail screen for that signature.

+Fixed ability to copy rulesets between SIDs.

-----------------------


[Host/Service Monitoring]
-----------------------

+Added built-in ability to check for DNS hijacking on any monitored
 remote service and notify via standard channels.

+Added process checking + optional automatic process regeneration.

+Added fully customizable log file monitor.

-----------------------


