Over time, the Kismet endpoint API will change - while efforts are made to retain compatibility whenever possible, some changes will require breaking older implementations. These significant changes will be documented here.
To more cleanly support ELK, all location records now use
geopointformats. A geopoint is an array containing
2019-10advertised_ssid and probe_ssid as arrays
To more cleanly support ELK the advertised ssid and probed ssid components of dot11 devices are now serialized as vectors instead of maps. Previously these were serialized as maps with a key of the hash of the SSID and attributes (an essentialy meaningless number in the export). Now these are sent as an array of advertised or probed SSID objects.
2019-10ekjson and itjson
To more cleanly support ELK EKJSON format, the
ekjsonserialization now permutes the field names to transform all
_. This brings it in line with the ELK interpretation that a
.is a field separator. To access the old implemention, where the field names are unmodified, use the new
itjson(or ‘iterative json’) format; it will return results which are a vector of objects as an object per line, suitable for serialized parsing and processing.
Kismet now requires authentication on ALL endpoints, with the exclusion of