v0.8.5-beta

What's New in v0.8.5-beta

Added

• Per-Group Event Acknowledgement: Acknowledge individual event groups directly from the criterion drill-down, rather than acknowledging all events in bulk
  • New "Ack" button on each event group row in the drill-down table
  • Corresponding "Un-ack" button when showing acknowledged events
  • Acknowledged events are deleted from event_scores and re-scored by the pipeline when un-acknowledged
  • Related open findings are automatically transitioned to "acknowledged" status
• Show Acknowledged Events Toggle: Drill-down now hides acknowledged events by default, with a toggle to show them
• Finding Proof Events ("Show Events"): View the source events that contributed to an AI finding
  • "Show Events" / "Hide Events" toggle button on each finding card
  • Fetches events by key_event_ids stored on findings when they are created
• Active Issues Breakdown: The AI Findings banner now shows "X active issues (Y open, Z ack'd)"
• Findings Key Event IDs: AI findings now store references to the source events that triggered them
• CHANGELOG.md: Added full release history following Keep a Changelog format

Changed

• Event ack now deletes event_scores (enables proper re-scoring on un-ack)
• Effective scores exclude acknowledged events from max_event_score
• Re-evaluate always excludes acknowledged events from LLM context
• Grouped endpoint hides acknowledged events by default
• Docker healthchecks: --start-period=60s prevents false "unhealthy" status during startup
• Body limit increased to 50MB; Fluent Bit Workers=2, Mem_Buf_Limit=10MB

Fixed

• Catch-all source matching for wildcard patterns on missing fields
• Guardrail 2: false positive rejection when event refs have empty messages
• Guardrail 3: hallucinated refs no longer bypass error-severity check
• LLM adapter: empty string content crash (changed ?? to ||)
• LLM adapter: error-path usage now reports effective model with overrides
• Finding proof events no longer leak across findings (scoped state)
• Show/Hide Events toggle now works (was dead code before)
• Score bar clamped to 0-100% to prevent visual overflow
• useCallback dependency arrays: added missing showAcknowledged
• TypeScript types: EventDetail nullable fields, optional AckGroupResponse fields
• Event ID validation in by-ids endpoint

Deployment

cd /opt/SyslogCollectorAI && git pull && cd docker && docker compose build && docker compose up -d

Full changelog: CHANGELOG.md