Roadmap

Roadmap

High-level release milestones. Detailed changes are recorded in the CHANGELOG.

Release	Theme	Highlights
v0.1.0	Batch core	Event schema; auth.log, web access log and JSON parsers; YAML rule engine with windows and sequences; 13 built-in rules with runbooks and ATT&CK mappings; offline-first enrichment; incidents with transparent scoring; Markdown/HTML/JSON reports; log simulator; prohori demo
v0.2.0	Machine learning	Leakage-controlled models on UNSW-NB15 and CICIDS2017; SOC-relevant metrics; cross-dataset test; model card; log-derived anomaly detection; prohori score
v0.3.0	Data pipeline	Redpanda streaming, PostgreSQL warehouse, dbt models and tests, dashboard, Airflow jobs, lite mode in CI
v1.0.0	Analyst assistant and polish	Opt-in LLM incident analyst with retrieval, output validation and injection tests; threat model; performance notes

Out of scope

Prohori is not a production SIEM, EDR or IPS. It does not take automatic response actions, provide high availability or multi-tenancy, or include any offensive capability.