ThreatLens v2.3.0 — Privacy Controls, IOC Watchlist, and Security Hardening

[AbdaullahAG]

This release adds privacy controls and local IOC monitoring, alongside security improvements for input handling, provider integrations, and report generation.

Highlights

Privacy modes: Choose standard, passive, approved-provider-only, or local-cache-only investigations. Use --privacy-preview to review sanitized IOC values and their intended destinations before sending requests.

Local IOC watchlist: Add, list, remove, and scan IOCs with expiry support. Scans save snapshots and report changes in verdicts and key risk signals.

Independent history control: --no-history skips saving the current investigation and watchlist scan observations. --no-cache skips IOC-result and provider-feed caches.

Safer provider integrations: Validate IOC values and provider response fields, limit response sizes, require HTTPS, enforce host allow-lists, and block redirects.

Safer exports and reports: Redact configured secrets from reports and evidence packs, neutralize spreadsheet formulas, and limit SIEM request and response sizes.

Bounded file parsing: Validate CSV headers and IOC values, and enforce file, row, line, and IOC limits when processing logs and asset inventories.

Configuration change

Splunk and Elastic exports now require explicit destination host allow-lists. Add the exact destination hostname or IP to:

SPLUNK_ALLOWED_HOSTS

ELASTIC_ALLOWED_HOSTS

Use comma-separated exact hostnames or IP addresses. Wildcards are not accepted. Exporting to those destinations will remain disabled until the configured URL matches its allow-list.

Validation

The local validation run passed 185 tests with 67% total source coverage. Ruff, Bandit, the lockfile integrity check, and pip-audit also passed; pip-audit reported no known dependency vulnerabilities.

---

This discussion was created from the release ThreatLens v2.3.0 — Privacy Controls, IOC Watchlist, and Security Hardening.