v1.3.0 — Stability & Reliability

What's Changed

Stability release — fix crash-looping components, harden reliability, optimize resource usage. 27 files changed, 618 insertions, 242 deletions.

Fixed

• Wazuh Manager analysisd crash — Missing default ruleset directories caused zero rules to load, analysisd exited immediately
• Wazuh Dashboard crash-loop (35+ restarts) — OpenSearch hostname mismatch caused ECONNREFUSED
• Cortex OOMKilled — Memory limit increased from 512Mi to 768Mi
• rootcheck errors — Added missing rootkit database paths
• test-flow.sh — Fixed arithmetic bug, label mismatches, removed eval usage
• NetworkPolicy Prometheus ports — Added actual app metrics ports

Added

• Health probes on 5 services: OpenSearch, Redis, RabbitMQ, MinIO, Wazuh Agent
• CronJob guards on all 3 OpenCTI connectors (concurrencyPolicy: Forbid, deadlines, TTL)
• OpenSearch ISM policies — auto-delete: Wazuh alerts (30d), audit logs (14d), OpenCTI (90d)
• scripts/setup-ism.sh — ISM policy creation and verification
• MCP server retry logic with exponential backoff on 429/503/timeout
• Configurable MCP server settings via environment variables
• test-flow.sh API connectivity tests + verbose mode (-v)
• deploy-stack.sh post-deploy health check
• MIT License
• .github/ templates: bug report, feature request, PR template, security policy
• Full CHANGELOG.md with entries for all releases

Changed

• Wazuh Manager: 0 rules loaded → 8,549 built-in + 8 custom rules
• test-flow.sh: 33/33 checks passing across 8 sections
• MCP server packages bumped to 1.3.0

Security

• 0 npm vulnerabilities across all MCP servers
• Full security audit passed: secrets, RBAC, image pinning, input validation, NetworkPolicies

Full Changelog: v1.2.0...v1.3.0

v1.2.0 — Production-Ready SOC

What's Changed

Consolidated production-ready release with full SOC stack operational.

Core Stack

• Wazuh 4.14.3 — SIEM/XDR with Manager, Dashboard, and Agent DaemonSet
• OpenCTI 6.9.5 — Threat intelligence with MITRE ATT&CK, AlienVault OTX, AbuseIPDB, VirusTotal
• TheHive 5.4 + Cortex 3.1.8 — Incident response with automated analyzers
• Prometheus + Grafana — Full observability with custom Wazuh dashboards
• OpenSearch 2.19.1 — Shared search/index backend

MCP Servers

• 3 custom MCP servers, 21 total tools for Claude Code integration
• @matchbox/wazuh-mcp — 7 tools (alerts, agents, vulnerabilities, rules, decoders)
• @matchbox/thehive-mcp — 8 tools (cases, observables, analyzers, alerts)
• @matchbox/opencti-mcp — 6 tools (indicators, reports, attack patterns, enrichment)

Security & Compliance

• 23 NetworkPolicy rules across 5 namespaces (default-deny + explicit allow)
• TLS 1.2+ with ECDHE cipher suites on Traefik ingress
• All images pinned, no :latest tags
• Audited against ISO 27001:2022, NIST 800-53, OWASP Top 10 for LLMs

Infrastructure

• Lima VM (VZ framework, Rosetta 2, 10GB RAM, 4 CPUs)
• k3s with custom kubelet tuning
• 5 isolated namespaces: shared, wazuh, thehive, opencti, monitoring
• Traefik ingress with path-based routing under soc.homelab.local

Full Changelog: v1.1.0...v1.2.0

v1.1.0 — Security Hardening

What's Changed

Security hardening and compliance documentation release.

Added

• cert-manager ClusterIssuer for automated self-signed certificate generation
• NetworkPolicies with default-deny ingress across all 5 namespaces
• TLS 1.2+ enforcement on Traefik with ECDHE cipher suites
• Compliance documentation: ISO 27001, NIST 800-53, OWASP Top 10 for LLMs
• Security contexts on all containers
• MCP server hardening: request timeouts (10s), response truncation (50KB)

Changed

• Bumped @modelcontextprotocol/sdk to ^1.9.0
• Credentials moved from env vars to K8s Secrets

Full Changelog: v1.0.0...v1.1.0

v1.0.0 — Initial Release

MatchBox v1.0.0

Initial release — home Security Operations Center with MCP integration and interactive dashboard.

Added

• Full SOC stack: Wazuh 4.14.3, OpenCTI 6.9.5, TheHive 5.4, Cortex 3.1.8, Grafana on k3s
• Lima VM definition for Apple Silicon Macs (VZ framework, Rosetta 2)
• 3 custom MCP servers for Claude Code integration (21 total tools)
• Interactive HTML dashboard with 4 tabs (Overview, Architecture, Components, MCP Servers)
• Deployment, teardown, and test automation scripts
• Complete documentation: architecture docs, network diagrams, runbooks
• OpenSearch as shared search/index backend
• Redis, RabbitMQ, MinIO, NFS shared infrastructure
• 5 isolated Kubernetes namespaces
• Traefik ingress with path-based routing