v1.18.0

Visit the Brim Data download page page to find the package for your platform.

---

• Update Zed to v1.18.0
• Update Brimcap to v1.18.0, which includes a new Zeek v7.0.0-brim1
• Introduce the Sessions tab in the left panel to persist Query Session histories (#3132)
• Update time display functionality to support local time zones and strftime directives (#3139)
• Fix an issue where the Zui window could not be dragged when Preview & Load was open (#3146)
• Fix a crash that would occur when attempting to create a pool with the same name as an existing pool (#3147)
• Fix an issue where top-level primitive Zed values were incorrectly wrapped in records in the Table view (#3145, #3150)

v1.17.0

Visit the Brim Data download page page to find the package for your platform.

---

• Because Zui is dependent on the Zed project, GA Zui release major/minor version numbers are now synchronized to the corresponding Zed release
• Update Zed to v1.17.0
• Update Brimcap to v1.17.0
• The Correlations view has been moved to its own tab in the right panel separate from the Detail view (#3123)
• The Detail view (both when in the right panel and as a separate window) now uses a hierarchical display format similar to the main Inspector results view (#3127)
• Add Parquet as an available format for Export (#3122)
• Add an option in Settings to allow the Zed lake service launched by Zui to accept remote connections if desired (#3116)
• Fix an issue where the Export feature was not surfacing some failures (#3115)
• Fix an issue where the presence of null union values could cause a crash when displayed (#3118)
• Fix an issue where connections with small durations were shown as "Not available" in the Correlations view (#3119)
• Fix an issue where no notification was shown if the Packets button was clicked and there was no app installed to open the pcap slice (e.g., Wireshark) (#3114)

v1.8.0

Visit the Brim Data download page page to find the package for your platform.

---

Highlights

For a walk through the highlights, see the June 2024 Release blog post.

Changes

• Update Zed to v1.16.0
• Update Brimcap to v1.8.0, which includes a new Zeek v6.2.0-brim2
• Zui macOS installers are now available for Apple silicon (ARM64) hardware (#3077, #3102)
• A new Windows code signing certificate is now in use, which will likely result in a period of Microsoft Defender SmartScreen warnings (#3050, #3055, #3057)
• The title of the section in Settings formerly called Brimcap Settings is now called Packet Captures (#3054)
• Zed queries are now parsed via a lake service endpoint, which adds red squiggly lines with tooltip details in the editor when errors are detected (#3076, #3085, #3087, #3094, #3104)
• Fix an issue where the Zed lake service launched by Zui was incorrectly open to remote connections (#3061, #3069, #3091, #3106)
• Add an option in Settings to point at local sets of additional Suricata rules (#3049)
• Add an option in Settings to specify a folder for storing extracted pcap slices (#3053)
• Add updated docs and a video for Packet Capture functionality (#3060)
• Fix an issue where populating the Brimcap YAML Config File option in Settings could cause a crash (#3044)
• Fix an issue where a parsing error displayed incorrect Zed code (#3065)
• Fix an issue where maximizing the Zui window could cause a crash on Linux (#3090)
• Fix an issue where Zui Insiders on Linux was not correctly detecting the availability of newer releases (#3084)
• Fix an issue where right-click Pivot to Values failed when clicking a Zed union value (#3099)
• Fix an issue where Zed union values were rendered blank in the Detail pane/window (#3103)

v1.7.0

Visit the Brim Data download page page to find the package for your platform.

---

• Update Zed to v1.15.0
• Update Brimcap to v1.7.0, which includes a new Zeek v6.2.0-brim1
• For Zeek files events, the is_orig value is now used to determine the tx_host and rx_host values in the Correlation view (#3004)
• The Zed service launched by Zui now attempts to compact stored data every 5 minutes (#3006)
• Export Results has been enhanced to allow export to pools or the clipboard (paste buffer) (#2985, #3017)
• Improve syntax error presentation by using the /compile endpoint of the Zed service rather than the JS Zed query parser (#2972, #3034)
• Fix an issue where Zui's query editor would not load when running air-gapped (i.e., no Internet connection) (#3032)
• Fix an issue where issuing the query yield typeof({}) produced a stack trace (#2996)
• Fix an issue where issuing a new query while the stacked bar chart is loading triggered an error (#2996)
• Fix an issue in dark mode where font colors made text invisible during pool renames (#3028)
• Fix an issue where a large JSON object could not be loaded in Zui (#3026)
• Fix an issue where hitting the Back button too many times could cause the lost of session history (#3041)

v1.6.0

Visit the Brim Data download page page to find the package for your platform.

---

• Update Zed to v1.13.0
• Update Brimcap to v1.6.0, which includes a new Zeek v6.0.3-brim1
• Update Electron dependency to 28.0.0 (#2934, #2953)
• Enhance the Zui Installation docs to describe the new feature to control when the app is updated to newer releases (#2950)
• Simplify how the termination of a spawned zed serve process is tied to the parent Zui process (#2956, #2957)
• Add a dark mode and new designs for pins, toolbars, detail/history panes, and saving queries (#2895)
• Adjust how Zui correlates new Zeek events in reaction to changes in Zeek's files events (#2981)
• Fix an issue where repository links in Zui Insiders had been incorrectly pointing to the regular Zui repo (#2935)
• Fix an issue where Zui incorrectly surfaced Brimcap errors as "Error: write EPIPE" or "Error: write EPIPE" instead of the detailed errors from pcap analyzers (#2955, #2991)
• Fix an issue where very long pool names caused the Load Data and Query Pool buttons to disappear (#2993)

v1.5.0

Visit the Brim Data download page page to find the package for your platform.

---

• Update Zed to v1.12.0
• Update Brimcap to v1.5.5
• A new option in Settings now determines if checks for available Zui updates are performed at startup (default), at startup & daily, or manually (#2866)
• Add functionality to load data from the paste buffer (#2928)
• Add support for TSV load/export (#2916)
• Fix an issue with Chromium binaries being created in temporary storage (#2917)
• Fix an issue where the cursor position could become inaccurate while typing in the editor (#2922)

v1.4.1

Visit the Brim Data download page page to find the package for your platform.

---

• Update Zed to v1.11.1

v1.4.0

Visit the Brim Data download page page to find the package for your platform.

---

Preview & Load

It's now possible to preview and shape your data as you load it into a Zed lake with Zui. For details, check out the video at the Zui docs site.

Other Changes

• Update Zed to v1.11.0
• Update Brimcap to v1.5.3
• Zui has a new Preview & Load workflow that allows for shaping data as it's loaded in to a Zed lake (#2834, #2864)
• Fix an issue where editing the "month" portion of a time range pin caused a crash (#2854)
• Fix issues where null values were incorrectly rendered (#2875, #2876)
• Use monospace fonts in more places (#2877)
• Limit column width for large values and add grid lines in the table view (#2881)

v1.3.1

Visit the Brim Data download page page to find the package for your platform.

---

• Due to malware false positives, Windows releases no longer include a full initial set of Suricata rules (as always, up-to-date rules will be downloaded on first Internet-connected launch of Zui) (#2858)

v1.3.0

Visit the Brim Data download page page to find the package for your platform.

---

Monaco Editor

The big change in this release is that Zui now uses the Monaco editor. This gives Zui a monospace font and basic syntax highlighting for easier editing of your Zed programs!

Other Changes

• Update Zed to v1.10.0
• Update Brimcap to v1.5.2
• The Zui GitHub repo is now structured as a monorepo (#2818)
• Fix an issue where a community_id field was incorrectly being treated as a prerequisite to activating the Packets button (#2830)
• Zui now uses the Monaco editor, which provides a monospace font and minimal Zed syntax highlighting (#2824, #2836)
• Fix an issue where invoking the -version option on the bundled zed and brimcap binaries was producing incorrect output (#2841)
• Upgrade Electron dependency to 22.3.25 (#2848)