09/23/2016 - 	Sagan 1.1.2. released.

		* Added "srcport" for "threshold" and "after".  
		* Fixes around "dstport" for threshold" and "after"
		* Fixed display of source/destination IP addresses in tools/sagan-peek.c
		* Change "artistic" style from "GNU" to "Linux".  This allows better formatting of source code on smaller screens.
		* New pthread mutex to address corruptions of mmap / files.
		* tools/sagan-peek.c now has command line option to specify mmap file location. Various other improvements.
		* Better error checking in src/processors/sagan-track-clients.c
		* New MD5, SHA1 and SHA256 in src/parsers/parse-hash.c
		* Minor Bluedot lookup fixes. 
		* Fixes for "after" and "threshold" when dealing with "usernames". (Username tracking).
		* Added "file" option for sagan.conf to reference a file to load.  For example, "var MYVAR file:/path/to/my/values.txt". 
		  For more information,  see https://github.com/beave/sagan/issues/75 

08/17/2016 -	Sagan 1.1.1 released.

		* Added meta_offset, meta_depth, meta_within and meta_distince Champ Clark (cclark@quadrantsec.com)
		* Major changes/restructuring to sagan-meta-content.c - Adam Hall (ahall@quadrantse.com)
		* Fix major memory issue when loading large sets of rules.  Related to meta_content! (Champ Clark)
		* Minor build fix when liblognorm is disabled - Champ Clark 
		* Minor stdbool.h issue & added PKG_PROG_PKG_CONFIG to configure.ac 
		* Remove old unneeded liblognorm headers. Champ Clark 
		* memset replacement of strlcpy,  minor clean up,  minor bug fixes. (Adam & Champ)

07/06/2016 -    Sagan 1.1.0 released.

		The Basics:
		-----------

		* Sagan now "remembers" where it left off between restarts/reboots/etc.
		* You can now create rules that focus on certain IP address or IP address ranges (ie - $EXTERNAL_NET/$HOME_NET).
		* Sagan can treat "old" Bluedot IP reputation threat Intel differently than "new" threat intel.
		* We added "qdee.pl",  a SDEE poll routine to the "extra" directory.
		* A lot of bugs were fixed 

		The Details:
		------------

		* Moved all "threshold", "after", "flowbits", and "client tracking" to mmap files.  This means that Sagan "remembers" between restarts where it "left off"! 
		* Introduced "tools/sagan-peek.c" which allows you to exmaine Sagan mmap files.  Useful in debugging or just "seeing" what Sagan is "tracking".
		* $EXTERNAL_NET and $HOME_NET now function as expected.  Previous versions of Sagan did not have any concept of $EXTERNAL_NET/$HOME_NET and were ignored.  Adam Hall @ Quadrant made Sagan "aware" of "traffic flow".  Values in a rule for source/destination are tested _after_ normalization.
		* Added "mdate" (modification date) and "cdate" (creation data) to Bluedot. This allows Sagan to not trigger "aged" Bluedot Threat Intel.  For example, do _not_ alert if an IP address is seen and the Intel is over X hours/days/months/years old.
		* Threholding based on 'dstport' merged,  thanks to Bruno Coudoin.  See:  https://github.com/beave/sagan/commit/44d6752acf27d61bcd57e35f930b0f6e11dadbc7
		* Added parsing for IPTables "SPT" and "DPT"t port for iptables, thanks to Bruno Coudoin.  https://github.com/beave/sagan/commit/9de9cffd224a44f93c80eca62e6ead617a4b97a6
		* Added "qdee" to the "extra" directory.  This allows Sagan to parse older style Cisco IDS output.  This polls using the SDEE protocol. See https://github.com/beave/sagan/commit/61c4a7dd611161697785c889630dd3c8333ec8b5
		* Removed support for libjsonc (json-c) and moved to libfastjson.

		The Bugs Fixed:
		---------------

		* Correct issue for when Sagan cannot open a file (-F/--file) due to permissions.
		* Removed unused "SigArgs" array.
		* Clean exit when Sagan cannot load Maxmind GeoIP2 data file.
		* Change "normalize: {type}" to "normalize;".  All normalization rules now come from one file.  This keeps Sagan in line with liblognorm development.
		* Sagan now "warns" the user if old style "normalize" is encountered. See: https://github.com/beave/sagan/commit/ba3de9e43bc8623b361e34ce06a2e7808e045f88 and https://github.com/rsyslog/liblognorm/issues/206
		* Fix json_object_object_get_e) compile time warnings. See: https://github.com/beave/sagan/commit/e9bdea5b7fa5b25c1d7e740a4c856c70a1046d1d
		* Minor ARM CPU fixes.
		* Various "meta_content" fixes.  When using "meta_content" with large amounts of search data would sometimes cause failures. 
		* Major bug fixes involving "client tracking".  Thanks to Adam Hall @ Quadrant Information Security!
		* Sagan now attempts to create the FIFO if it is not detected.  Thanks to Cabrol Perales.
		* A lot of smaller bug fixes.  See: https://github.com/beave/sagan/commits/master

11/19/2015 - 	Sagan 1.0.1 released.

		* Add unified2 "extra data" field to store the orignal syslog
		  source.
		* Added threshold by "username". 
		* Minor code clean up. 

10/23/2015 -    Sagan 1.0.0 released.


