Skip to content

History

Revisions

  • wiki: sync to v2.2.0 — fix rapid-exit score, cgroup v2 containment, roadmap completed sections

    @Mohhudib Mohhudib committed Jun 20, 2026
    9556306

  • wiki: add demo_forensic.py to Architecture component breakdown

    @adnanalshrouqi adnanalshrouqi committed Jun 18, 2026
    9e30fbc

  • wiki: add sim_writeoffset_only.py to Architecture simulations table

    @adnanalshrouqi adnanalshrouqi committed Jun 18, 2026
    ddc3d71

  • wiki: add dedicated GROQ_API_KEY, GROQ_BASE_URL, GROQ_MODEL vars to Configuration page

    @adnanalshrouqi adnanalshrouqi committed Jun 18, 2026
    0b76cf1

  • wiki: add demo_forensic.py forensic walkthrough reference to Detection Engine page

    @adnanalshrouqi adnanalshrouqi committed Jun 18, 2026
    4f0acd4

  • docs(detection-engine): add sim_all.py to attack simulation table

    @3xcv 3xcv committed Jun 13, 2026
    c81d258

  • docs(detection-engine): add sim_depth.py to attack simulation table

    @3xcv 3xcv committed Jun 13, 2026
    65bcdde

  • docs(architecture): add sim_all.py to simulations table

    @3xcv 3xcv committed Jun 13, 2026
    0527b28

  • docs(architecture): add sim_random.py to simulations table

    @3xcv 3xcv committed Jun 13, 2026
    2a801ee

  • docs(architecture): add sim_depth.py to simulations table

    @3xcv 3xcv committed Jun 13, 2026
    3549f01

  • docs(architecture): add sim_dfs.py to simulations table

    @3xcv 3xcv committed Jun 13, 2026
    4919472

  • docs(roadmap): fix #51 — tests/integration/ has 7 live test files, not empty Issue #51 incorrectly stated the integration folder was empty. It now contains 7 end-to-end test files covering canary detection, containment, Akira/LockBit pipelines, silent encryption, and autonomous agent runs.

    @3xcv 3xcv committed Jun 13, 2026
    81a7f82

  • docs(wiki): bump to v2.2.0; update all pages for speed gap fix, UI changes, and sim results - Home: version v2.1.0 → v2.2.0; add v2.1.1 and v2.2.0 to version history table - Detection-Engine: update behavioral scoring to 6 signals (Signal 6); update entropy verification description (score >= 70 bypass); expand simulation table to all 6 families with actual v2.2.0 test results - Installation-and-Setup: Terminal 4 now shows eBPF vs inotify variants; Terminal 5 Vite ready message corrected; log message corrected - Roadmap: v2.2.0 completed section added; v2.3.0 is now the next milestone - Known-Issues-and-Fixes: add LockBit/Qilin speed gap root cause + fix; add Celery update_host_risk race fix; add Docker port 3000 conflict fix - Project-Overview: eBPF description updated to mention Signal 6 and speed gap

    @MJohn117 MJohn117 committed Jun 8, 2026
    97ed0c0

  • wiki: v2.1.0 refresh — eBPF Phase 3, setup, roadmap, architecture, detection engine - Home.md: update to v2.1.0; add version history table; add project board and release links - Roadmap.md: restructure by milestone (v2.1.0/v2.2.0); add CI/eBPF Phase 3 completed items; separate Dependabot breaking PRs warning - Installation-and-Setup.md: add linux-headers to BCC install; add kernel version verification step; add eBPF Mode section; add troubleshooting table - Detection-Engine.md: add Attack Simulations section with usage commands and LockBit 5.0 4-metric validation table - Architecture.md: expand eBPF sensor capabilities to include proc_profile map details, family profiling, IGNORE_COMMS, Markov disabled note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed Jun 7, 2026
    0e9d460

  • docs(wiki): update eBPF section for 5-syscall + BPF LSM + 4-prefix canaries - Detection-Engine: expand Layer 6 eBPF with 5-syscall system (openat, vfs_write, unlink, rename, execve), proc_profile BPF map, behavioral scoring (5 signals 0-100), BPF LSM canary blocking (-EPERM), blocked_pids map, entropy verification, IGNORE_COMMS 40+ processes, run modes, Markov-disabled note, lsm=bpf activation instructions - Detection-Engine: update Layer 1 canary — 4 prefixes (AAA_, aaa_, ZZZ_, zzz_), CANARY_COUNT default 30, kernel-level inode blocking note - Configuration: CANARY_COUNT default 30; SENSOR_BACKEND description updated; add BPF LSM and Docker network sections; .env example updated - Architecture: add eBPF current capabilities note (5-syscall, LSM, Markov disabled); add Docker Network section with static IP table Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed Jun 5, 2026
    baec4c7

  • docs(wiki): update all pages for eBPF sensor, SIEM redesign, D3 graph - Architecture: React 19, eBPF+inotify dual-sensor diagram, new SIEM frontend components (TopBar, StatusBar, FacetRail, MetricsStrip, AlertsHistogram, AlertsTable, DetailFlyout, EventDetailModal, FileSystemGraph); added design system table; simulations table - Detection-Engine: add Layer 6 eBPF section (TRACEPOINT_PROBE, velocity burst, family profiling, BCC 0.35 requirements, SENSOR_BACKEND) - Configuration: add SENSOR_BACKEND and DRY_RUN optional variables; update .env example with commented eBPF/dry-run lines - Installation-and-Setup: add BCC install step; Node.js 22 prerequisite; renumber steps; add inotify fallback note - Known-Issues-and-Fixes: add problems 10-13 (CORS relative URL fix, duplicate processes after git pull, eBPF BCC not installed, npm ENOTEMPTY) - Roadmap: move Graph View to Completed (D3 done); add eBPF sensor, SIEM redesign, attack simulations, LockBit test suite to Completed; update dependency bump table; refresh Open items - Project-Overview: add eBPF sensor + SIEM dashboard to capabilities; update tech stack (D3 v7, BCC, Node.js 22, IBM Plex fonts) - Home: update tagline to mention eBPF and SIEM dashboard Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed Jun 5, 2026
    f50b798

  • docs(wiki): update tech stack to React 19 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed May 29, 2026
    32a618a

  • docs(wiki): update tech stack — add Vite 5 to Frontend row Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed May 29, 2026
    29150f4

  • docs(wiki): move CRA→Vite to Completed (PR #33 open) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed May 29, 2026
    9d3db38

  • docs(wiki): bring all 11 pages up to date with current project state - Home: added landing page link, updated page descriptions - Project-Overview: updated AI stack (Cerebras/NVIDIA/Groq), added extension detection - Installation-and-Setup: added setup.sh, fixed all startup commands - Configuration: fixed env var names (AI_API_KEY -> NVIDIA_API_KEY), added Cerebras, removed 3 fake vars - Detection-Engine: added Layer 4 extension detection, dpkg verification, entropy memory cap - Auto-Containment: added tree-aware detail (two-sweep, 48 files, UID-based iptables) - AI-Threat-Analyst: added multi-provider chain, PENDING state, 24h Redis cache - Roadmap: moved CI+Tests+Reports to Completed, updated In Progress to real open items - Known-Issues-and-Fixes: updated canary fix (3-layer prevention), added AI WebSocket fix, added auto-ack ID fix - Architecture: added FilesystemPage+ReportsPage, updated ai_analyst description, updated data flow - API-Reference: added new event types, date filters, with-events endpoint, ai_analysis_update message Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

    @Mohhudib Mohhudib committed May 29, 2026
    5ef490f

  • docs: add full project wiki — overview, architecture, detection engine, setup, API, issues, roadmap

    @Mohhudib Mohhudib committed Apr 26, 2026
    8630bdc

  • Initial Home page

    @Mohhudib Mohhudib committed Apr 26, 2026
    031263b