Skip to content

v0.4 - Analyst Workbench and Operator Configuration

Latest
Latest

Choose a tag to compare

View all tags
@aaronphifer aaronphifer released this 19 Aug 15:21
v0.4
c82554f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TriageWall v0.4 turns the dashboard into a fuller local-first analyst workbench and adds a guarded, versioned configuration lifecycle for Suricata and Wazuh deployments.

Highlights

  • Redesigned routed dashboard with overview, triage queue, behavioural signals, integrity posture, and source-aware investigation views.
  • Bounded recurrence, related-activity context, and queue-aware Previous/Next navigation for Suricata and Wazuh alerts.
  • Search by signature, exact source or destination IP, or historical asset hostname within a disclosed, stable 10,000-alert window and a three-second query budget.
  • Versioned operator configuration for prefilter policy and private asset inventory, including immutable drafts, validation, bounded preview, explicit activation, optimistic locking, last-known-good reload, rollback, and attributable audit history.
  • Alert-to-configuration handoff for drafting scoped Suricata rules or editing the inventory asset that owns an observed address.
  • A standard-library API-key generator for creating an attributable config:write key and Compose-safe .env entry.

Security and reliability

  • Configuration writes remain disabled by default and require an attributable API key carrying config:write.
  • Anonymous reads, dashboard feedback cookies, and demo mode cannot mutate configuration.
  • Activation and rollback remain explicit, acknowledgement-gated, atomic, generation-locked, parent-locked, and audited.
  • Browser lifecycle ownership prevents stale asynchronous responses from overwriting newer operator work.
  • Preview and search paths bound row count, elapsed time, and retained-alert work.

Before upgrading

  1. Take and verify a current database backup.
  2. Let the one-shot migrate and config-bootstrap services complete before starting the dashboard or ingest services.
  3. Existing retained alerts are not backfilled with synthetic byte-size metadata; previews stop safely at an older unsized row.
  4. Configuration writes are opt-in. Run python scripts/generate_api_key.py and enable TRIAGEWALL_CONFIG_WRITES_ENABLED=true only when needed.

See the v0.4 production evidence, operator documentation, and complete changelog for details.

Full comparison: v0.3...v0.4

Assets 2
Loading