Skip to content

InCyter v0.0.9

Choose a tag to compare

View all tags
@FadyAzzi FadyAzzi released this 22 Oct 09:32
v0.0.9
16cc165
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

InCyter 0.0.9

A major update: a rebuilt Event Logs page with InCyter Intelligence, File & Hash and Malware Analysis working together, smarter InSentri setup, and more than 200 fixes and security hardening changes from a complete review of every part of InCyter.

Event Logs: InCyter Intelligence and a rebuilt Event Explorer

  • The attack story. Findings that share an account, an address or a computer are linked into one story, in the order it happened, with each stage named. Where it likely started shows the earliest serious event, and Look at these first ranks accounts and computers by what was found about them.
  • 16 new detections for what no single event shows: ransomware preparation, an account moving from computer to computer, signing in at two places at once, a new admin used straight away, account takeover, short-lived accounts and services, one password tried on many computers, the clock being changed, and more.
  • About forty more logs read when analysing a PC: firewall, code integrity, file sharing, SSH, PowerShell 7, USB, disk images, Forwarded Events and more, with new checks for each. Every check was run over normal, working PCs first, so only what normal use does not do raises a finding.
  • Logs from several computers at once, with one row per computer. Click a name to narrow the whole page to it.
  • Review each finding: mark it Reviewed, False positive or Escalate, with a note. Reviews are remembered across analyses.
  • A shorter, quicker page: the verdict and the findings first, everything else in one Details box. Similar findings are grouped, and you can group by attack stage, computer or account.
  • Timeline and log coverage: see the events behind each finding on a timeline, and spot gaps where a log recorded nothing.
  • Incident report: export the verdict, the story, every finding with its review and note, your bookmarked events and the timeline as one web page or PDF.
  • A rebuilt Event Explorer:
    • Every event, with no row limit, and repeats folded.
    • Undo and Redo (Ctrl+Z / Ctrl+Y), and filter chips you can remove one by one.
    • Search words such as account:, ip:, id:, computer: and hour:, with suggestions as you type.
    • Every event explained in plain words.
    • Group by account, computer, event ID, program or source.
    • Select several events, compare two side by side, bookmark and export.
    • Account and computer profiles, a weekday-by-hour sign-in map, and your own working hours for out-of-hours activity.
  • Save and reopen an investigation (Ctrl+S / Ctrl+O): bookmarks, notes, stages, filters and saved views come back exactly as you left them.
  • What's missing: the logging worth switching on, most useful first, with how to turn it on.

File & Hash and Malware Analysis lead to each other

  • File & Hash → Analyse offline opens the same file in Malware Analysis > File Analysis, worked out on your own computer.
  • File Analysis → Check online offers the same file to the services File & Hash shows. Each one says what it sends: most send only the hash, and a sandbox uploads the file and asks first.

InSentri, the built-in AI assistant

  • Guided setup: when you switch InSentri on, it now also offers GPU acceleration (when a supported graphics card is found) and large-document support, and starts any downloads for you.
  • Waits until it is ready: while a model, GPU acceleration or large-document support is downloading or installing, InSentri shows each one with its progress and unlocks by itself when everything is done.
  • GPU acceleration switches on by itself once it has installed.
  • "InSentri is off" now offers to take you straight to its settings.
  • Stop, Clear and file uploads work reliably, and downloaded models and GPU files are checked before they are used.

Major security and bug fixes

More than 200 fixes and security hardening changes. The most important:

  • Safer updates: each update's size and SHA-256 fingerprint are checked against the published release before it installs, and an update that does not match is not run. New in Settings > About: choose whether InCyter checks for updates when it starts (on by default).
  • Your keys and data stay private: API keys and passwords are kept out of InCyter's logs and out of what InSentri can read, and each key is only ever sent to the service it belongs to. Settings exports are protected with a passphrase, and imports show what will change before anything is applied.
  • Safer handling of files and links: files, archives, documents and emails are handled more defensively, including oversized and deliberately malformed ones. Lookups that contact a domain's own servers now say so.
  • Updated built-in components: Python 3.14.8 and OpenSSL 3.5.9, with the latest security fixes.
  • Works on brand-new PCs: online features (vulnerability lists, news, update checks and more) now work on a freshly installed Windows PC.
  • More accurate results, fewer false alarms:
    • Signed, legitimate programs no longer get warnings meant for malware, and verdicts say when a check could not be completed instead of reading clean.
    • Domain checks (DMARC, SPF, DKIM, MTA-STS) follow the published standards more closely.
    • Email authentication results are read correctly, and ordinary names are no longer mistaken for brand impersonation.
    • Event Logs counts duplicate logs once, keeps the newest events in big logs, and no longer raises common harmless activity as a finding.
  • Fixes across the app:
    • Lookups show an honest status when a service cannot be reached.
    • Email Analyser handles Outlook .msg attachments, large emails and look-alike domains correctly.
    • PDF export, installing, upgrading and uninstalling are more reliable.
    • Popups open on the right monitor and fit small screens, scrolling follows the mouse, and the interface is tidier throughout.

The full list is in CHANGELOG.txt below, and in InCyter under Full changelog.

Installing and updating

  • New install: download InCyterInstaller.exe below and run it. Everything InCyter needs is included; there is nothing else to install.
  • Updating from an earlier version: use Check for updates in InCyter, or run the new installer over the old one. Your settings, API keys, history and InSentri models are kept.
  • If you use GPU acceleration for InSentri: after updating, press Enable GPU acceleration once in Settings > InSentri. Until then InSentri runs on the CPU as normal.
  • Windows may show "Windows protected your PC" the first time you run the installer, because it is not yet signed with a code-signing certificate. Click More info, then Run anyway.
Assets 4
Loading