ThreatLens v2.3.0 — Privacy Controls, IOC Watchlist, and Security Hardening

This release adds privacy controls and local IOC monitoring, alongside security improvements for input handling, provider integrations, and report generation.

Highlights

Privacy modes: Choose standard, passive, approved-provider-only, or local-cache-only investigations. Use --privacy-preview to review sanitized IOC values and their intended destinations before sending requests.

Local IOC watchlist: Add, list, remove, and scan IOCs with expiry support. Scans save snapshots and report changes in verdicts and key risk signals.

Independent history control: --no-history skips saving the current investigation and watchlist scan observations. --no-cache skips IOC-result and provider-feed caches.

Safer provider integrations: Validate IOC values and provider response fields, limit response sizes, require HTTPS, enforce host allow-lists, and block redirects.

Safer exports and reports: Redact configured secrets from reports and evidence packs, neutralize spreadsheet formulas, and limit SIEM request and response sizes.

Bounded file parsing: Validate CSV headers and IOC values, and enforce file, row, line, and IOC limits when processing logs and asset inventories.

Configuration change

Splunk and Elastic exports now require explicit destination host allow-lists. Add the exact destination hostname or IP to:

SPLUNK_ALLOWED_HOSTS

ELASTIC_ALLOWED_HOSTS

Use comma-separated exact hostnames or IP addresses. Wildcards are not accepted. Exporting to those destinations will remain disabled until the configured URL matches its allow-list.

Validation

The local validation run passed 185 tests with 67% total source coverage. Ruff, Bandit, the lockfile integrity check, and pip-audit also passed; pip-audit reported no known dependency vulnerabilities.

v2.2.0 — Vulnerability Triage, Log Parsing & SIEM Export

What's New

ThreatLens goes beyond IOC lookups into lightweight CVE triage, structured log ingestion, and SIEM export.

CVE Decision Cards

Checks every CVE against CISA KEV and FIRST.org EPSS alongside NVD's CVSS score, then produces a deterministic Patch / Isolate / Monitor / Not affected recommendation — with the reasoning behind it, not a black-box score. A KEV listing is a hard floor: it's never downgraded to "Monitor."

python main.py -c CVE-2021-44228 --apis nvd cisa_kev epss --decision-cards

Asset Inventory

Import a CSV of your hosts (--import-assets assets.csv) and the decision logic factors in whether an affected product is actually running anywhere, and whether that asset is internet-facing and business-critical.

New Log Formats

--file now auto-detects (or accepts --log-format) for:

• Zeek TSV logs (conn/dns/http/ssl/files.log)
• Suricata eve.json
• Sysmon (JSON-exported Windows Event Log)
• Generic JSONL

All streamed line-by-line — a single malformed line never aborts the scan.

SIEM Export (opt-in)

python main.py --file eve.json --log-format suricata --export splunk

Send results to Splunk (HEC), Elastic (_bulk), or Microsoft Sentinel — using the modern Logs Ingestion API, not the deprecated HTTP Data Collector API. Host allow-listed, TLS verified by default, retried with backoff, and one destination failing never blocks the others.

Evidence Packs

python main.py -i 45.33.32.156 --evidence-pack

Bundles an investigation's results (and decision cards/assets, if produced) into a ZIP with a manifest.json recording a SHA-256 hash of every file inside, for basic chain-of-custody.

---

Security

• All new inputs (CSV rows, log lines, CISA KEV feed entries) are validated with an allow-list approach; malformed rows are skipped, never fatal
• No new third-party dependencies — CSV import, log parsing, and evidence packing all use the Python standard library
• SIEM credentials are read only from config/keys.env, never logged, never written into evidence packs
• ruff and bandit both pass clean on the new code

Testing

155 passed, 1 skipped — up from 60. 95 new tests across enrichers, decision logic, asset import, log parsers, exporters, and evidence packs.

Upgrade Notes

No breaking changes. New settings in config/keys.env are all optional (CISA KEV/EPSS need no key; SIEM export is opt-in and inactive unless fully configured).

Full changelog: CHANGELOG.md

v2.1 — Secure & Reliable Core -

Release v2.1.0

This release focuses on security hardening, data validation, and core performance improvements.

Security and Validation

• Prevent Excel and CSV formula injection in generated reports.
• Enforce strict validation and sanitization for all IOC inputs.
• Prevent API key leakage in application logs.
• Reject untrusted HTTP redirects during API calls.
• Implement a dependency lockfile and integrate automated CI security checks.

Analysis and Reporting

• Introduce an explainable verdict system providing confidence scores.
• Fix incorrect 'Clean' verdicts by classifying ambiguous results as 'Unknown'.
• Implement SQLite caching to persist investigation data and reduce redundant requests.

Core Architecture

• Add API quota planning to manage request budgets efficiently.
• Enforce limits for file sizes, IOC counts, connection timeouts, and API retries.