intact-20260903

Intact.AI 2026-09-03

A clearer, more accurate incident report, faster Velociraptor collection, and fusion that stays stable on large cases.

New

• Phase-based incident report. Broad incidents are split into timeframes, each analysed on its own; narrow incidents get a detailed, focused report.
• Use your own Codex subscription for AI analysis.
• Fetch without re-collecting. Retrieve data Velociraptor already holds, including from stopped collections, without touching the endpoint.
• Automatic retention of Velociraptor monitoring data.

Improved

• More accurate reports. Every severe finding is covered, invented hashes are flagged, and command lines appear in full. Validated against 41 simulated attack scenarios.
• ATT&CK techniques are mapped for many more findings.
• Live progress. Case Analysis shows which analysis step is running and displays the report as soon as it is ready.
• Reports refresh automatically when new data arrives.
• Collections are lighter. Blueprints use at most 50% of an endpoint's CPU, and only data that analysis uses is retrieved.
• More detections reach the analyst, including memory YARA, webshells and MFT anti-forensics.
• Purge accurately reports and frees disk space. The branded PDF has cleaner typesetting.

Fixed

• Fusion could exhaust memory and take the appliance down on large cases.
• Detections could be lost on some Windows event records.
• A failed Velociraptor collection was treated as finished.
• An air-gapped upgrade using a package directory could silently run online.

Versions

All module versions are unchanged from 2026-08-25.

Known issues (fixed in the next release)

• Fusion can fail with unhashable type: 'list' on some combinations of collected data.
• A Codex subscription with no model selected is shown as "No AI model is selected".
• A failed Gemini model-list refresh can write the API key to the backend log. Rotate any Gemini key that was configured.