Release intact-20260726 · TenrootOrg/IntactAI

Intact.AI — 2026-07-26

Cut from main. 392 commits since intact-20260615
(2026-06-17 → 2026-07-26). The headline is Case Analysis / Entity Fusion: a
cross-module, cross-host correlation engine built from scratch this cycle, plus a
second wave of upgrade hardening (Full-mode backend image, resumable two-phase
upgrades, CI-built packages) and a full frontend/backend decomposition.

Case Analysis & Entity Fusion (new)

A deterministic graph engine fusing every module's output — Velociraptor
collections/hunts/offline imports, AWS/Azure scans, CVE findings, TimeSketch
timelines — into one cross-host case graph with a report, attack-story synthesis,
and chat.

Ontology + mappers — per-module mappers, hash-identity bridge (same binary
across hash algorithms → one node), auth/Kerberos + lateral-movement
enrichment, Hayabusa detection linking.
Correlation — baseline subtraction (environment-normal noise suppression,
extended to all detections, not just SIGMA), corroboration, cross-host and
coordinated-activity findings, spawn chains, WMI persistence (T1546.003), and
fleet-relative host risk scoring (0–100, p95-based).
Identities tab — the same real-world person/account resolved across
endpoint, AWS and Azure. Norm clustering with an accuracy harness,
evidence-corroborated auto-merge, one row per logical relationship (was O(n²)
pairwise noise), confidence scores, same-name dedup with a "stale" hint.
Analyst confirm/decline persists across every re-fusion.
Reporting — a DFIR-grade rewrite, decoupled from the fuse step. The case is
now the only reporting surface (dead per-run LLM/report code removed from
AWS, Azure, agentic and memory). Adds an Attack Assessment prose synthesis,
a single flat timeline, one consolidated IOC appendix, and report_detail
(Auto/Explicit/Summary) controlling evidence volume per finding.
Masking: dynamic identity masking with a revert path, stable per-identity
numbering, identifier-boundary-aware matching, a complete pre-LLM audit log
(was truncated at 500 chars), a closed leak (AWS IAM principals reaching the
LLM unmasked), and a 233s → 3.6s mask-build fix that unblocked large cases.
Operator workflow — unified Timeline with reversible 4-state triage, Case
Analysis Log tab, chat over the fused graph, and a cross-case knowledge base
(Elasticsearch-backed, enrichment-only).
Fixes — a degenerate time window (start == end) silently dropped every
timestamped entity, leaving a graph with entities but zero relationships; the
offline-import hunt-id parser lost the id on multi-client imports and silently
skipped fusion; refusion now streams live per-phase % instead of a silent wait.

Decomposition

Frontend (Phase A–F): DaisyUI 4 + a de-neon professional dark theme, all 14
tabs extracted into partials/*.html, app.js (1,692 lines) split per-store, and
a local build replacing the CDN-loaded downloads page.
Backend (Phase G): six 1,100–2,000-line monoliths split into sub-packages —
the entire agentic/ package plus iris_service.py (1,971 lines).
Collect-only pivot: every module is now a collector; automation_type: agentic → velociraptor_collection.

Modules

AWS — off Prowler entirely to native CloudTrail detection via a pinned
SigmaHQ pack (aws_sigma). Custom SIGMA rule management for AWS and Azure;
the shared SigmaHQ clone moved off HEAD (unreproducible — two installs got
different rules on the same pin) onto a monthly release tag. Module IDs migrated
live, carrying enable flags forward.
IRIS — ships disabled by default; self-heal rotates its web TLS cert on
every bring-up; config.yaml is authoritative for the admin password.
VolWeb / Memory — the daphne OOM under YARA serialization is closed at the
source (worker recycling + arena cap) after three mem_limit bumps. Adds a
severity-ranked findings report, per-blueprint YARA scoping, plugin row cap
80 → 250, and drops YARA-Forge. YaraScan results now survive both a timeout and
an auto-purge.
Scheduler / clients — Collector and Hunt scheduling split apart, interval
units (days→years) anchored to a start date, every picker unified onto one
faceted ClientManager.
Velociraptor — label-targeted hunts, OS-aware collection (real Linux
support), artifact bundle baked into the image.

Upgrade pipeline

Full image-per-release backend (Wave F) — the backend runs from a baked
intact-backend:<release> image with zero code bind-mounts, swapped atomically
on upgrade instead of rebuilt from source on the box.
Waves A–E — host preflight, tusd version-pinning + recreate-on-bump,
floating image tags pinned, SIGMA content clone pinned.
Two-phase hardening (~10 iterations) — single-writer lock, restart handoff,
CA guard, package integrity, a source snapshot + compile gate before restart
(anti-brick), a resumable Phase 2, a boot watchdog, and a health gate that
checks the backend image, not just liveness.
CI builds the version-pinned release package, replacing on-box building.
Packages are diff-scoped (only modules changed since the previous release),
carry a byte-size manifest, and size the disk preflight from the real package.
Self-heal drift detection now compares a source content fingerprint (image IDs
aren't reproducible across separate builds).
Fixed: a run_command() deadlock on >64 KB of stdout; a catastrophic-regex spin
that could hang an upgrade indefinitely (+ a faulthandler SIGUSR1 hook); the
health gate counting run metadata as modules; and Stop cancelling the UI's
view of a run rather than the upgrade itself.

Workspaces

Strict per-case runs — every module run, TUS upload and memory-dump XHR is tagged
to the active workspace. Case Management and Case Analysis split into dedicated
surfaces with a System workspace carved out from real cases; launching a
system feature switches into it, and a module launched while System is active
auto-redirects to Default. Full workspace export/import. Purge no longer wipes
client installers or corrupts installer state, preserves cases, cleans
Velociraptor clients, and gains an orphaned-containerd-images category.

Security & install

Pre-commit secret guard blocking tokens before they enter git history; a shipped
Slack webhook scrubbed from the Velociraptor bundle; options.github_token for
authenticated API calls (60 → 5,000 req/hr). Tools inventory gated by
options.download_tools (off by default). change_ip is now force +
non-interactive, rotates the TLS cert in place, reloads every consumer, and runs
fully air-gapped. The test suite is consolidated into intact/tests/ behind one
runner (+74 tests, plus an API-validation contract suite);
docs/UPGRADE_CONTRACT.md is enforced by tests, not just documented; and CI
checks that tests/ never ships in a release tarball.

Version pins

versions:
  elk:            9.4.2       # unchanged
  iris:           v2.4.27     # unchanged
  plaso:          '20260512'  # unchanged
  portainer:      2.39.5      # was 2.39.1
  timesketch:     '20260630'  # was 20260611
  velociraptor:   '0.77.1'    # was 0.76.6
  aws_sigma:      '2026.04'   # replaces prowler: 5.28.1 (module migration)
  sigma_rules:    'r2026-07-01'   # NEW — pins the full SigmaHQ clone
  o365rc:         'latest'    # unchanged
  velociraptor_legacy: '0.7.1'    # unchanged
  volweb:         '3.16.0'    # unchanged
  backend:        '<release-name>'  # Full-mode (Wave F) — was a static 1.0.0

Source

intact-20260726

Navigation Menu

Repository navigation