v2.1.0

v2.1.0

Installer, live demo, shareable views

Everything the collector gathers is unchanged since 2.0.0 — same event IDs, same
wire format, same database. This release is about getting the tool into people's
hands and making a finding easy to pass on.

MSI installer

ntlm-agent.msi is attached to every release from now on. Double-clicking opens
a wizard asking for the collector URL, an optional API key and the poll
interval; the same values are properties, so an unattended rollout uses the
identical package:

msiexec /i ntlm-agent.msi /qn COLLECTORURL=https://collector:8443

The package owns the payload and the service entry, so Windows Installer removes
both again on uninstall. config.json in ProgramData is deliberately not part of
the package, so an upgrade keeps existing settings.

On the API key: the wizard field is masked and the property is hidden, but a
key supplied to an installer can still end up in a verbose install log, and on an
msiexec command line it is visible in the process list. The agent README states
this plainly and recommends setting the key separately with
ntlm-agent.exe configure for unattended rollouts. Two attempts to close the
logging path failed, and rather than claim otherwise the limitation is
documented.

The MSI builds in its own workflow. If WiX ever breaks, the agent build and its
release stay green.

Live demo

[nobrac.github.io/NTLM-Analyzer](https://nobrac.github.io/NTLM-Analyzer/) serves
the real dashboard against synthetic data from a lab domain. GitHub Pages runs
no Python, so every reachable click state — 112 of them — is pre-computed at
build time and answered from a file. The charts, drill-downs, search, filters,
language toggle, event details and CSV download all work; only the time range
and machine picker are fixed, because they multiply with everything else.

Shareable views

Filter state now lives in the URL. Clicking a cause, a chart bar or a bar
segment produces a link that opens the same view for whoever you send it to, and
bookmarks work. Back and Forward move between filter steps; typing in the search
box does not flood the history.

This is the first time the page reads anything from the address bar, so
"reflected XSS is impossible" stopped being automatically true. Every parameter
is validated against what it is allowed to be rather than trusted — an unknown
range or an over-long value never reaches the query. Re-tested with five payload
classes across ten parameters: nothing executed, nothing raw in the DOM.

Smaller things

• Sortable tables everywhere, numeric and alphabetical
• Language is remembered across reloads
• Page title shows the share, so several open tabs are distinguishable
• Skip link as the first tab stop, live region announcing the result
  count after a drill-down
• Favicon and an application icon, embedded in the agent binary along with a
  version resource — ntlm-agent.exe now reports its version in the file
  properties like any other Windows program
• 4 px of horizontal scroll on phone-width viewports is gone

Fixed

• Table sorting glued a value and its badge together ("172" and "24" became
  17224) — only a leading number counts now
• Back left the site entirely, because only replaceState was used and there
  was no history entry to go back to
• The page title was set and then overwritten by the next render
• The icon and version resource failed silently when the resource compiler
  was missing; CI now asserts they are present

Upgrade notes

• Collector: replace the file, restart, hard-refresh with Ctrl+F5.
• Agent: optional. The binary only gains an icon and version info; behaviour
  is unchanged. Existing installs keep working.
• No database migration, wire protocol unchanged.