Release Notes

This page lists the changes introduced in each Open-AudIT release. For download links and upgrade instructions, see the Installation section.

Open-AudIT 6.0.3 (Windows)

Released: 2026-05-14

We are releasing Open-AudIT 6.0.3 for Windows as a minor release for bugs and improvements.

The new items are installed user browser extensions (assuming you're auditing using Administrator for Windows or sudo/root for MacOS), and MS Entra for authentication.

We have also enabled a basic discovery scan that will be executed if Nmap is not detected.

Our Windows installer is now signed with our FirstWave certificate. Initial tests on Windows Server do not trigger a warning, however initial testing on Windows 11 do still trigger a warning. To get around this, we have submitted the file to Microsoft for review. It is unknown how long this will take to make its way to client machines (the updated "this file is OK" detail).

Open-AudIT 6.0.2

Released: 2026-01-23

This is an update release to address a few bugs found, improve a few items and just generally tidy up. We recommend you update ASAP.

The discovery code has received attention to make it more robust and withstand non-standard responses from devices.

Open-AudIT 6.0.1

Released: 2025-12-15

This is a bug fix release for the large 6.0.0 release.

The important bits are:

• Processing an audit result and/or completing a discovery will not trigger a vulnerabilities scan. Once an hour we scan all devices for vulnerabilities from your chosen vendor list. Then once per day we scan all devices for all vulnerabilities. This is scheduled for sometime in the early AM (morning). Check the tasks schedule to determine exactly when (we randomise it).
• Agents now delay for X minutes (settable) before executing and submitting their audit. X minutes means a delay of between 0 and X. By default this is 120 minutes. This reduces load on the server when a large number of agents check-in at the same time.

Open-AudIT 6.0.0

Released: 2025-11-30

This is the one you've all been waiting for. We are introducing quite a few new features, the most compelling of which is vulnerability detection. When a device is audited, during data processing Open-AudIT will compare the installed software to the current CVE listing. You will know — right on the default dashboard — if something has an outstanding vulnerability.

In our experience, 99% of these are rectified by upgrading the affected software to the latest version. But now you'll know just how many affected programs are on your estate.

Vulnerabilities

Open-AudIT reaches out to our server and downloads a list of vulnerability definitions. These are used each time device data is processed to return a list of affected items. On our side, we use the CVE feed from NIST, process the data, enrich it, then create a suitable SQL query for your use.

Your Open-AudIT install will require access to the internet. The Vulnerabilities feature can be disabled. The Help icon on the Vulnerabilities list page shows you exactly what data is sent to us — we send only license data, application data (name, version, platform, timezone), logged errors, and counts of device types and feature usage. UUID and Server fields are SHA-256 encoded. No networks, IP addresses, OS versions, or software names are sent.

News Feeds

News feeds let you keep up with various Open-AudIT items such as updated Windows version numbers in queries. Configuration item changes are sent with recommendations as one-click fixes — read the news item, click Enable, and you're done. Like Vulnerabilities, News requires internet access and can be disabled, and sends only non-sensitive data points.

Standards Reporting

FirstWave is ISO 27001 compliant. Standards Reporting brings that workflow into Open-AudIT — review and answer the questions once, then in subsequent years simply revise where required and extract to Excel (click Report in the GUI) for auditors.

New Languages

Open-AudIT now has built-in support for: Albanian, Arabic, Azerbaijani, Bulgarian, Chinese, Czech, Danish, Dutch, English, Esperanto, Estonian, German, Greek, Finnish, French, Irish, Hindi, Hungarian, Indonesian, Italian, Japanese, Korean, Lithuanian, Latvian, Malay, Norwegian, Persian, Portuguese (Brazil), Polish, Portuguese, Romanian, Russian, Slovak, Slovenian, Spanish, Swedish, Thai, Tagalog, Turkish, Ukrainian, Urdu and Vietnamese.

Translations were done via LibreTranslate. If you find anything that needs fixing, email us what is in the GUI, where, and what it should actually say and we'll include the correction and send you an updated translation file.

Certificate Management

Select a certificate found during an audit and mark it to make management (renewal, responsibility, et al) easier — and report on it. A typical use is a monthly report listing certificates expiring in the next 45 days and who needs to renew them.

Discoveries

The largest change is deprecation of the VBScript used to audit Windows. We now use a PowerShell script, which has all the property retrieval of the deprecated VBScript with the exception of local device group policies (to be added in time). We also return Cisco license info using show licenses via SSH, and Redhat subscription details, and audit Hyper-V hosts.

New Icons

We have changed from FontAwesome to Lucide icons. There are more available without a commercial license. We still love FontAwesome though.

Agents

We now have agents for MacOS and Linux. They are simple scripts that check in with the Open-AudIT server each day and (usually) audit and send the details. No remote access required if you don't want to enable it.

Benchmarks

New Benchmark definitions for Redhat 10 and Ubuntu 24.04 have been added.

Syslog in CEF Format

New configuration options to log certain events to syslog (on Linux) using the Common Event Framework format, consumable by Splunk and similar. All disabled by default. A typical CEF entry looks like:

CEF:0|FirstWave|Open-AudIT|6.0.0|5|Access|1|Info|collection=devices action=collection user=admin

Which corresponds to:

Cef:Version | Vendor | Product | Product Version | Event ID | Event | Severity Number | Severity Text | Details

Event IDs are: 1 — New Device, 2 — Component Added, 3 — Vulnerability Detected, 4 — Component Removed, 5 — Access. Events that do not change data are severity 1; events that change data are severity 5.

The available configuration items are feature_syslog_access, feature_syslog_components, feature_syslog_devices and feature_syslog_vulnerabilities.

Open-AudIT 5.6.5 (Linux)

Released: 2025-03-31

This is a minor release mostly to address a couple of bugs that appeared for Redhat users.

We also now retrieve arp tables when running a discovery and, if we then find an IP that we don't have a MAC address for, check the arp table records (only against arp tables generated by this discovery).

Various discovery improvements have been included.