v0.6.6

Valhuntir 0.6.6 is a fixes release with no new features. It also includes 0.6.5 and 0.6.5.1.

To update:

• On SIFT, run vhir update, then vhir setup client.
• On Windows, run vhir setup join-code on SIFT (if it fails the first time, run it again), then run the line it prints in PowerShell as Administrator.
• On a remote Codex install, run vhir setup client --client=codex in a terminal and accept the skeptic update.
• If you ingested Windows OpenSSH server logs before 0.6.5, ingest them again.

What changed in 0.6.6:

• Saved text reports now defang recorded IOCs that are http or https URLs, IPv4 addresses or domains. Other forms, such as IPv6 and email addresses, are written as recorded, and a few edge cases are still written live. Reports printed to the terminal, and the JSON from vhir report --full --save, keep IOCs live by design.
• Report saves on very large cases are much faster.
• record_finding refuses some malformed findings that 0.6.5 accepted, and says what to change. vhir approve takes IOC ids.
• Evtx ingest keeps the user SID, as winlog.user.identifier.