Arkime 7

Shareable Layouts, Dashboards, Shark, Featherprint, PCAPNG, Expression Rules, Bug Fixes, and More

DRAFT: Arkime 7 has not been released yet, this page is a work in progress.

Highlights of Arkime 7:

  • All four apps are now Vuetify only, with ten built in themes plus a shareable custom theme saved per user
  • Icons switched from Font Awesome to Material Design Icons
  • New admin only View Config page showing the config each app is really running with
  • A "newer release available" check, controlled by checkForUpdates (off, manual or auto)
  • Capture: new xdp pcapReadMethod using AF_XDP sockets, multiple GeoIP vendors, and a [protocol-settings] section
  • Capture: rules can use search expressions with &&, ||, !, wildcards, regex, math and functions, and fields rules match faster on the same engine
  • Cont3xt and WISE: new MISP integration and source
  • Cont3xt and WISE: client certificate (mTLS) and private CA support for OpenSearch/Elasticsearch and for the urlapi, url, elasticsearch, arkime, misp, csv and json sections
  • Viewer: new Admin menu and admin editable banner, uPlot timeline, D3 world map, matrix heatmap SPI Graph
  • Releases now include a CycloneDX SBOM, and Alpine 3.24 and Amazon Linux 2027 packages

Learn how to upgrade to Arkime 7 now!

Breaking Changes

  • Node.js 24 is now required (>= 24.0.0 and < 25)
  • You must be on v6.5.0 or later to upgrade to v7.x
  • A db.pl upgrade is required
  • Session columns, info field configs and spiview layouts moved from the user record to the shareables index so they can be shared. db.pl upgrade copies existing ones over for you, or run db.pl <host:port> shareables-import all by hand. The originals are left in place so Arkime 6 keeps working.
  • Removed the /api/user/layouts/:type APIs, layouts are shareables now. /api/user/config/sessions no longer returns colConfigs or infoConfigs and /api/user/config/spiview no longer returns fieldConfigs
  • Removed the esAdminUsers setting. The ES admin page and the ES index/shard/task actions now require the dbAdmin role (superAdmin includes it, arkimeAdmin no longer grants it), eg db.pl <host:port> users-update '<userId glob>' --addRole dbAdmin. dbAdmin implies no other role, so pair it with arkimeUser, which viewer requires for any access
  • Removed the derived esAdminUser field from /api/user/current, check the user's roles for dbAdmin instead
  • ES admin moved to /esadmin, and /connections now redirects to SPI Graph
  • wiseService no longer generates a random config pin code, use --webcode <code> or each user's own TOTP code
  • Removed the simpleDEKEncoding setting, the DEK is now always encrypted with aes-256-gcm
  • Removed the userAutoCreateTmpl setting, use the [user-auto-create] section instead
  • Removed the demoMode setting. Roles do not replace it, so put a shared instance behind an external identity provider
  • More settings are validated at startup, so a value that used to be silently ignored now refuses to start. Booleans must be true or false (not 0, 1 or False), rotateIndex must be one capture accepts, freeSpaceG must be a number or a percentage, and the hunt/tshark limits, timeouts and ports must be numbers in range
  • The offlineFilenameRegex default now also matches .pcapng files (previously .pcap/.cap only)
  • Capture: the internal session type concept was removed, everything is now per mProtocol. arkime_mprotocol_register() takes flags instead of a session type, arkime_packet_set_dltsnap() was replaced by arkime_packet_set_interface(), and ARKIME_HTTP_PRIORITY_DROPABLE was renamed ARKIME_HTTP_PRIORITY_DROPPABLE. Custom parsers, readers and plugins must be updated and rebuilt
  • Capture: tcpSaveTimeout and tcpClosingTimeout now only apply to tcp, use the new [protocol-settings] section for the other mProtocols. tcpClosingTimeout previously also applied to sctp and to sessions closed by the closeNow rule action, so set eg sctp=closing:<seconds> if you had changed it from the default of 5
  • Capture: lldp, xid, isis, esis, igmp and pim used to record all their traffic as a single session per capture node, they now create a session per talker pair like every other protocol - by src/dst mac for the ethernet protocols and by src/dst ip for igmp and pim. Expect more, smaller sessions for these
  • Capture: the packet threads used maxPackets instead of maxPacketsInQueue when deciding the packet queue was 75% full, so session command processing was throttled once a thread had 7500 packets queued rather than 150000. Busy sensors that sat above the old threshold will now do more work per packet
  • Capture: the <node>.stoppedsessions file is now version 2 and records the mProtocol, version 1 files are ignored on upgrade
  • Capture: the _flipSrcDst rule op now also swaps the per-direction data (packets, bytes, databytes, payload8, mac, oui, dscp, ttl, tcp seq/state tracking and zero window counts), not just the ips and ports, so flipped sessions are saved self consistent
  • Capture: log: true on a fields rule now logs field (value) for each field that matched instead of field: value
  • Capture: geoLite2Country/geoLite2ASN were renamed geoFile/geoASNFile (the deprecated names are still accepted)
  • easybutton-build.sh no longer builds glib, curl, zstd, lua or libpcap, the OS packages are used everywhere. EL9 and EL10 also use the OS yara, libmaxminddb, nghttp2 and librdkafka, AL2023 uses the OS libmaxminddb and nghttp2. The rpm and deb packages now depend on those libraries instead of bundling static copies

View a detailed list of all the changes and download it now!

Shareable Layouts

Session column, info field and SPI View layouts can now be created, edited and shared from the Settings page. A new Shareables settings tab lets you rename, re-share or delete anything you have shared. db.pl upgrade migrates your existing layouts.

Arkime Dashboards

The Arkime tab is now a modular dashboard of configurable visualization widgets, including new sankey and connections widgets. Dashboards can be renamed, shared and reordered from the new Arkime Dashboards settings tab.

Shark and Session Detail

Session detail is now three tabs, Details, Packets and the new Shark tab, a tshark dissection panel (requires tshark 4.6.4 or later, see tsharkPath). Find in content has been added to session detail.

Featherprint

Passive device fingerprinting built from session metadata (ARP, DHCP, DNS/mDNS, NBNS, SSDP). Per-subnet monitors maintain device records, record a change history and raise alerts on new or changed devices. Any IP can also be fingerprinted on demand.

PCAPNG

Much improved pcapng support: files with multiple interfaces and link types can be read, written and downloaded as PCAPNG.

Expression Rules

Capture rules can now use an expression instead of fields or bpf, using a syntax similar to the Sessions search bar plus math and functions: &&, ||, ! and parentheses, lists, wildcards, regex, cidrs, comparisons, and functions like count(), lower(), isPrivate(), any() and bpf(). Expressions are compiled to bytecode when the rules file loads, mistakes are reported with the line and column, and log: true logs which conditions matched and their values. Existing fields and bpf rules keep working unchanged in the same version: 1 files, and fields rules now run on the same engine, matching up to 2x faster. See Rules Format for the details and the rules gallery for examples. 
  - name: "Odd TLS"
    when: "afterClassify"
    log: true
    expression: >
      protocols == tls
      && port.dst != [443, 8443]
      && !(ip.dst == [10.0.0.0/8, 192.168.0.0/16])
    ops:
      tags: "odd-tls"
Arkime Logo