Skip to content

v0.5.0 — minimal hardened containers, offline packaging, CAR logic + per-OS validation

Choose a tag to compare

View all tags
@Get-Sybers Get-Sybers released this 28 Aug 02:37
v0.5.0
c2b7ae0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • dxdfir verify-car (get_sybers_dfir.carcheck) — the CAR-correctness promotion gate, ported to Python and extended to every major OS family: Windows (event logs / disk artefacts / memory), Linux/Unix (utmp/ssh/cron), macOS (utmpx/fseventsd), network. Asserts expected field values, round-trip fidelity, per-artefact identity, roll-up no-fabrication, and the Plaso-extraction guards. Proven 66/0 live.
  • Plaso loose-artefact sources (--loose-dir) — per-host /var/log copies, mobile dumps, triage output parsed as directory sources; how the non-image OS families reach the timeline.
  • Offline packaging (package-offline.sh / setup-offline.sh) — one manifest-verified air-gap bundle (images + CLI wheels + collections + repo + detection dependencies), set up with zero network, ending by proving the loaded hardened inventory.
  • Start-time image inventory guard (dxdfir verify-images) — refuses to process against anything but a known hardened dfir/* image; flags unexpected images in the namespace.

Changed

  • Container posture reworked to a minimal / attack-surface-reduction model — runtime images stripped to the tool (tool-as-ENTRYPOINT, no runtime ansible), shell/python only where the tool needs them; build-time ansible hardening kept (uid0→ansible locked, sudo/su + package managers/pip removed, setuid stripped, uid 2000). Every docker run adds --read-only --tmpfs /tmp --pids-limit 512 on top of --cap-drop ALL --security-opt no-new-privileges --network none. Stronger against container escape and a supply-chain-compromised tool; images shrank sharply.

Fixed

  • CAR-model logic (Fable audit vs pinned Volatility 2.28.0 / Plaso 20260720) — per-artefact extraction corrected for Plaso process/file, the rarer Security events (4697/4778/4779), Sysmon-23 hashes, svcscan Binary (Registry), amcache/BAM sourcing, plus identity/representation and provider guards.
  • The dxdfir CLI now declares the docker SDK (requests, docker) so a clean install and the offline bundle can deploy.

Full log: CHANGELOG.md.

Assets 2
Loading