intact-20261008

Intact.AI 2026-10-08

Timeframe scopes with a report history, an Evidence tab, optional fast AI estimates (Jev), Volatile Memory rebuilt around kept images and a bundled symbol library, a second masking pass that hides names (Presidio), and a rules catalogue that sets what each detection is worth. Covers everything since 2026-09-15 and replaces 2026-10-05.

New

• Presidio name masking. A second masking pass hides person and company names the pattern masker cannot catch before anything is sent to the AI model. It runs in its own container, starts only while a report is being masked and stops when idle, and works air-gapped. It is on by default and has its own toggle under Mask. The case Log lists what each masker hid (name = Person1), and the report restores the real names.
• Masking is on by default for new cases.
• Scopes. Zoom into a suspicious timeframe and it is kept as its own scope, with its own report, hosts and identities. The whole case is always the widest scope.
• Report history. Every report written for a scope is kept, newest first, and can be viewed or exported again.
• Evidence tab. Attach screenshots, e-mails and logs (or paste a picture), with SHA-256, linked to Timeline events and hosts. Evidence appears in the report, the PDF and a new HTML export, and travels with case export/import. It is never sent to the AI model.
• Jev, optional fast estimates. With its own OpenRouter key, Jev suggests a verdict for unreviewed findings, rates each identity's likelihood of being compromised, scores timeframe cards, and flags report statements the evidence does not support. Every figure is marked "(Jev)" and nothing is decided for you.
• Identities. Mark a person Compromised or Not compromised, switch an account off or back on in place, and see each person's findings, hosts and local accounts.
• Risk tab. Explains what drives each host's score, shows host status, and shows whether Velociraptor has the host in Quarantine.
• Case details. Name, status, owner and description, edited in Case Management. A new case opens in a pop-up.
• Volatile Memory. Keep an acquired image and re-analyse it later, upload a dump resumably, pull another case's memory findings by workflow id, and see or upload symbol tables in a new Symbol tables tab.
• Every release ships the Volatility Windows symbol pack inside the VolWeb asset. An upgrade fetches it only when the pack differs, even when VolWeb itself does not change.
• Force regenerate for a report that looks stuck, Settings → Logs for each container's live log, and Timeline search.

Improved

• What a detection is worth is set in one rules catalogue (config/fusion_weighting.yaml), by pattern, not by product name:
  • Self-updating software is one low row, not dozens of high ones.
  • A versioned or installer copy of a program is not a renamed binary.
  • Web-history hits weigh what their category means.
  • People using their own servers every day are not lateral movement.
  • Real medium-severity SIGMA techniques now become findings, while noisy PowerShell heuristics are turned down.
• The AI narrative cannot rate a case higher than its evidence.
• Fusion. One bad row costs only that row, never the run. Large cases merge evidence much faster. The Log says which step it is on and how fast it is going.
• Timeline. One row per detection episode. A routine collapses to one row and the days that break it stand out. Same-name files are told apart by hash, phase tags are ATT&CK tactics, and rows can be ordered by severity or time.
• Reports. Every phase is written, with or without a model. Containment follows the Risk ranking. Analyst verdicts, identity decisions and Jev estimates reach the report and the chat. Excluded hosts are removed before analysis.
• Slow AI models are given time. Each report call may take up to 10 minutes and is retried once. A call that is unreachable or rejects the key stops further calls, and the report is written offline.
• Chat receives exactly the findings a question is about, and the model can fetch more on its own.
• Identities link a detection to its account by SID.
• Automatic fusion starts 5 seconds after new data lands, never mid-import.
• Memory analysis waits for every plugin VolWeb is still running, and keeps Volatility's symbol index on the volume.
• Velociraptor. A flow on an offline endpoint says so, and scripts/velo_tools.sh is idempotent and skips offline endpoints.
• Upgrades bring new modules. A box older than a module gets it from Online Upgrade, Prepare Package and Import Package with nothing to tick.
• Exports (PDF and HTML) share the application's design. codex login works in the terminal that ran the installer.

Fixed

• Evidence text could act as instructions to the case's AI model.
• An uploaded memory dump's file name was passed to a shell.
• Deleting a case could delete another case's evidence.
• A slow model's report was cut off after 5 minutes, and a paused virtual machine timed out a report call on resume.
• A failed overview discarded the phase analyses already written.
• Cancelling a memory run left VolWeb running, and a memory run gave up on plugins that were still running.
• The "Keep image" tick reset on every return to the Memory tab.
• upgrade.sh --velo-refresh wrote to a second server, so nothing it registered took effect.
• Stopping an upload did not stop the transfer.
• A run could take the id of a stored run.
• Saving Agentic settings started report generation.

Versions

New module: Presidio 2.2.364, with the spaCy en_core_web_lg model built in. Its asset is about 0.9 GB and is downloaded only when its version changes. Every other module is unchanged from 2026-09-15.

The VolWeb asset is about 1.4 GB because it carries the symbol pack.

Known issues

• Presidio can mistake technical words for names (for example SAM or Critical). The report restores them, but the model reads a placeholder in their place. Turn Presidio off for that case if it gets in the way.
• The bundled Volatility pack has no Windows 10 20H2+ or Windows 11 kernels. A connected appliance downloads them from Microsoft on first use. An air-gapped one needs them uploaded in Memory → Symbol tables.
• On Windows 11, Volatility's NetScan finds no connections and NetStat fails (an upstream limitation). Use the Velociraptor collection for that host's network activity.
• The bulk tool download (options.download_tools) does not verify pinned hashes and covers only part of the tools. Use scripts/velo_tools.sh for the rest.