Strata v0.10.0

What's Changed

• Incident mode, and anonymised AI prompts per asset by @0b3l1X-SolidGeeks in #58
• Connect to Muster: its incidents open on the map and run from there by @0b3l1X-SolidGeeks in #59
• ci: fail a pull request that starts before the latest release by @0b3l1X-SolidGeeks in #61
• Release 0.10.0: risk register, logs for the SIEM, steering dashboard by @0b3l1X-SolidGeeks in #62

Full Changelog: v0.9.0...v0.10.0

Strata v0.9.0

What's Changed

• Remove what was left of the IS Map 3D name by @0b3l1X-SolidGeeks in #52
• Release workflow: run by hand, pre-releases never latest by @0b3l1X-SolidGeeks in #53
• Single sign-on: OpenID Connect, trusted proxy headers, API tokens by @0b3l1X-SolidGeeks in #54
• ci, deps: Dependabot's updates in one change by @0b3l1X-SolidGeeks in #55
• API reference, 1.x compatibility policy, and the module guide by @0b3l1X-SolidGeeks in #56
• Release 0.9.0 by @0b3l1X-SolidGeeks in #57

Full Changelog: V0.8.0...v0.9.0

v0.8.0

Added

Connector modules: a connector is a folder with a manifest (strata-module.json: name, version, settings, file import, the permissions it needs) and its code, test() and run() returning proposals. The four built-in connectors are now modules too (server/connectors/builtin), and new ones need no change to Strata. Guide: MODULES.md.
Module store (Connectors › Module store, admin): lists the modules of a registry (MODULE_REGISTRY, by default docs/modules/index.json of this repository, published on the project site), with what each one reads; installs, updates and removes them in DATA_DIR/modules. Each package is checked against the SHA-256 the registry gives. MODULE_UPLOAD=true lets admins install a package file; MODULES_DIR holds modules provided by the machine's administrator; on NixOS, services.strata.modules.
Three modules in the store:
CSV inventory: assets of an IS from a spreadsheet saved as CSV, imported as a proposal by any contributor.
Nmap scan: an nmap -oX report; hosts that are up are matched by IP or name, get the system Nmap guessed (90% accuracy or more) and their open ports as listening ports of their applications; missing hosts are created with a type guessed from their ports. Open to contributors.
NetBox: devices, virtual machines, VLANs and prefixes (NetBox 3.x and 4.x, read-only token); NetBox sites go to an IS through rules; fills in what assets lack, never overwrites what was typed by hand.
The module store is checked on every pull request that changes it (scripts/check-registry.mjs, Modules workflow): each package downloads over HTTPS, matches its SHA-256, holds a manifest that agrees with its entry, and loads in the restricted module process. .github/CODEOWNERS asks a maintainer's review on the store, the modules and the connector code.
scripts/pack-module.mjs packs a module for the store (the same files always give the same bytes) and updates a registry index; strata-pack-module in the Nix package.
API: GET /api/modules, POST /api/modules/{id}/install, POST /api/modules/upload, DELETE /api/modules/{id}; POST /api/connectors/{id}/run takes {"file": {"name", "text"}, "overrides"} for any module that imports files.
Tests for the modules: the built-in ones against the simulator, what a module process can reach, time limit, store install, checksum, upload, removal; the NixOS VM test runs a provided module under the hardened service.
Changed

three.js 0.186 (from 0.128, April 2021): the 3D view loads three.js and its orbit controls as JavaScript modules, still served from public/vendor (no CDN, works offline). Colours and lighting are set to look as before, in day and night modes. Browsers need WebGL 2: Chrome or Edge 80+, Firefox 114+, Safari 15+. The vendored files are larger (2.1 MB, unminified: three.js no longer ships a minified build). Dependabot now updates three.js like the other dependencies.
Each connector test or run happens in a separate Node.js process with the permission model: it reads its module folder and the SDK only, cannot write files or start programs, gets none of the server's environment, its own settings only, and the map only if its manifest asks for it; it is stopped after CONNECTOR_TIMEOUT_MINUTES (30) and limited to 512 MB.
The Palo Alto configuration import is a generic file import: the same form for every module that imports files. Scripts posting {"xml", "fileName"} keep working.
scripts/connector-sim.mjs listens on 127.0.0.1 only, on SIM_PORT (8099 by default), and simulates NetBox too.
Upgrading

No data migration: connector settings and secrets are kept (the built-in connectors keep their ids), and so are scripts calling the connector API.
Users need a browser with WebGL 2 (see Changed).
To keep away from the module store, set MODULE_REGISTRY=off.

Strata v0.7.0

Release workflow: accept a release published from the GitHub web page…

Strata v0.6.0

What's Changed

• README: roadmap to 1.0 by @0b3l1X-SolidGeeks in #23
• Readable flows through interconnection equipment by @0b3l1X-SolidGeeks in #24
• Physical, application and business views; business impact of an asset by @0b3l1X-SolidGeeks in #28
• Architecture plan: firewall rules table by @0b3l1X-SolidGeeks in #26
• Architecture plan: filter by direction and by kind of flow by @0b3l1X-SolidGeeks in #27
• Asset form: IP from the VLAN range by @0b3l1X-SolidGeeks in #29
• Risk priorities: one score per asset and the remediation list in order by @0b3l1X-SolidGeeks in #30
• Release 0.6.0 by @0b3l1X-SolidGeeks in #31

Full Changelog: v0.5.5...v0.6.0

Strata v0.5.5

What's Changed

• Add the first-merge workflow by @0b3l1X-SolidGeeks in #5
• first-merge: call the reusable workflow from SolidGeeks/.github by @0b3l1X-SolidGeeks in #6
• README in English by @0b3l1X-SolidGeeks in #7
• Pin actions by SHA, add Dependabot, fix changelog links by @0b3l1X-SolidGeeks in #9
• CI builds and runs the Docker image; Dependabot ignores three.js by @0b3l1X-SolidGeeks in #12

New Contributors

• @0b3l1X-SolidGeeks made their first contribution in #5

Full Changelog: v0.5.4...v0.5.5

Strata v0.5.4

Full Changelog: v0.5.3...v0.5.4

Strata v0.5.3

Full Changelog: https://github.com/SolidGeeks/strata/commits/v0.5.3