Release Notes


Gremlin Release Notes

Below you'll find notes describing what's new with the Gremlin suite of products. Get product announcements and release notes in your inbox by joining the Gremlin Announce group.


Host (daemon) & Client (CLI) [2.11.10]

  • Resolved an issue where an attack could not be started on a container using the CLI
  • Resolved an issue where the GREMLIN_CLIENT_TAGS environment variable was not being saved (only affecting clients as of 2.11.6)
  • Automatic tagging of all hosts running in the three major cloud providers of AWS, Azure, and GCP

Control Plane API

  • No updates

Web App

  • When running an attack against AWS instances, the attack details page has a link created automatically to the instance in the Cloudwatch metrics dashboard
  • Enter notes, observations, and a metrics link on the attack details page once an attack has completed
  • Enter a reason when When halting all or a single attack and view it in the attack details view


Host (daemon) & Client (CLI) [2.11.0]

  • Resource CPU Atttacks can now impact All cores and can consume a percentage of CPU capacity
  • Network DNS Attacks now cache the IP address of the Gremlin Control Plane to avoid the attack from halting prematurely
  • Proxy details are now hidden in the attack logs on successful calls

Control Plane API [1.6.47]

  • No updates

Web App

  • Resolved an issue where switching teams would not update the ALFI attacks view


Host (daemon) & Client (CLI) [2.9.0]

  • No updates

Control Plane API [1.6.27]

  • No updates

Web App

  • Resolved an issue where client certificates couldn't be deleted
  • Deleting the current team is no longer possible


Host (daemon) & Client (CLI) [2.8.30]

  • No updates

Control Plane API [1.6.25]

  • When creating a Blackhole attack, port 53 is whitelisted by default
  • Resolved an issue where the Shutdown attack would fail with a start delay of 2 or more minutes

Web App

  • Auto-add feature has been deprecated and removed


Host (daemon) & Client (CLI) [2.8.29]

  • Resolved an issue when the Time Travel attack is halted and the time was not reverted accurately on the host

Control Plane API [1.6.20]

  • Resolved an issue where logins would fail if a user was a member of 10 or more teams


Host (daemon) & Client (CLI) [2.8.28]

  • Syscheck has been deprecated and removed from the client

Control Plane API [1.6.17]

  • Resolved an issue where duplicate Company names were shown on login

Web App

  • No updatets


Host (daemon) & Client (CLI) [2.8.26]

  • Resolved an issue with the Disk attack, where the client will not crash when the disk reaches 100% capacity

Control Plane API [1.6.14]

  • Resolved an issue where an SSO login without an account would show an infinite spinner

Web App

  • No updatets


Host (daemon) & Client (CLI) [2.8.26]

  • Improved error messaging when running syscheck

Control Plane API [1.5.39]

  • No updates

Web App

  • Resolved an issue when re-running a Time Travel attack, where the time period to advance was not always accurate
  • Drop down menus in the Create Attack view are now searchable
  • Invited users who have not signed up can now be deleted
  • A notification is shown 7 days before a trial ends


Host (daemon) & Client (CLI) [2.8.21]

  • Resolved an issue when running syscheck on RHEL 6.7, which no longer relies on using top to minimize dependencies

Control Plane API [1.4.38]

  • When using containers with Datadog integration, container labels are now available

Web App

  • When configuring a memory attack, provide the amount of memory to consume in either MB or GB, but not both
  • Resolved an issue where at times the number of users within a company was reported incorrectly
  • Resolved an issue with re-running time trial attacks, where the time to advance the clock was not always accurate
  • Drop downs in the create attack view are now searchable
  • The Choose a Gremlin section of the create attack view has been updated to show the categories and attack types more clearly


Host (daemon) & Client (CLI) [2.8.17]

  • While a Time Travel Attack is underway, if an NTP server futher updates the clock, the attack will not make subsequent changes and when complete the clock will be reset to the accurate value
  • Installing with RPM no longer requires sudo

Control Plane API [1.3.25]

  • Registering client tags now clears existing tags instead of appending to existing tags
  • The use of TLS 1.0 for API access is no longer allowed, TLS 1.1/1.2 are fully supported
  • Increased the allowed skew between control plane and daemon clocks from 15 seconds to 1 minute

Web App

  • Client list now includes a tab for registered ALFI clients
  • Execution errors are now available in the Attack Details view


Host (daemon) & Client (CLI) [2.8.14]

  • Resolved an issue where syscheck on a container would hang if the NET_ADMIN capability wasn't present, a relevant error message is now returned

ALFI Java Client Library [0.5.1]

  • The GREMLIN_ALFI_IDENTIFIER is required (previously was optional) when authenticating your application with Gremlin

Control Plane API [1.3.21]

  • Creating an ALFI attack that overlaps with an existing attack will fail
  • Datadog integration now supports ALFI

Web App

  • Resolved an issue where hostnames and IP addresses were shown incorrectly when cloning an attack
  • When creating an ALFI attack, previously used Application Type values will be available and searchable
  • To simplify attack creation, advanced fields will be initially hidden


Host (daemon) & Client (CLI) [2.8.13]

  • Signature-based auth using certificates is the expected authentication method, supported for hosts and containers
  • Syscheck now works with Docker containers

ALFI Java Client Library [0.5.0]

  • Install with Maven now available
  • Client library modules available individually

    • alfi-core Core library required for all ALFI functionality
    • alfi-aws [Optional] AWS integration, providing coordinate discovery for AwsLambda and AwsEc2
    • alfi-apache-http-client [Optional] ALFI injection points for Apache HTTP Client
    • alfi-aws-dynamodb-client [Optional] ALFI injection points for DynamoDB
  • AWS Parameter Store can be used for configuration

Control Plane API [1.3.6]

  • Slack integration issue resolved which was causing a timeout on registration
  • ALFI issue resolved where adding a key to ApplicationCoordinates prevented registeration

Web App

  • Resolved an issue where an attack end time was not displayed accurately
  • Certificates available for download on the team settings page for signature-based auth
  • The ALFI attack details will auto refresh until the attack is complete