AdversaryGraph v4.0.0

AdversaryGraph v4.0.0 Release Notes

AdversaryGraph v4.0.0 is the Malware Analysis platform release.

The primary focus is the fully operational integrated MalwareGraph module:
25+ API endpoints, a complete analyst workflow guide with 24 use cases,
an end-to-end test suite covering all proxy routes and the client library,
and a Knowledge Library for vendor and sector intelligence articles.

Added

Malware Analysis Module

• Full malware analysis workflow: sample submission (raw file or
  password-protected ZIP), first-analysis static triage, string extraction,
  file preview (strings/ASCII/hex), static unpack, dynamic/runtime unpack
  (policy-gated), obfuscation analysis, AI full analysis pipeline, decompilation
  metadata, analyst-guided debug sessions, AI-assisted debug workspaces, and
  service/job log access.
• 25 proxy API routes under /api/malwaregraph/ forwarding through
  MalwareGraphClient with full error-path handling (504 on timeout, 502 on
  connection error or invalid JSON, upstream 4xx/5xx passthrough).
• POST /api/malwaregraph/llm/complete — custom LLM prompt completion with
  provider validation (local|claude|openai|gemini|minimax), configurable
  system prompt, and model selection.
• POST /api/malwaregraph/analyses/{job_id}/save-unpacked — persist unpacked
  layers to MALWAREGRAPH_STORAGE_DIR with 404/500 error handling.
• Multi-target archive analysis: all extracted files are individually
  addressable via sample_ref parameter across every analysis endpoint.
• Dynamic Analysis page with AI feedback loop: prepare runtime session, load
  function workflow, step evidence, run AI review after each step, and preserve
  an iteration history of hypothesis, evidence gained, remaining validation
  gaps, next actions, and confidence.
• Rebuilt debugger workspace with IDA-style function navigation, step/run
  controls, per-function AI explanations, normal/suspicious/malicious tags,
  behavior tags, API hooks, referenced strings, disassembly, and full AI debug
  summary for the whole malware case.

Malware Analysis Guide

• Comprehensive analyst guide (docs/malware-analysis-guide.md) with 24
  fully documented use cases covering every module capability: submission,
  triage, strings, preview, unpack, obfuscation, AI pipeline, report, workflow
  graph, debug sessions and workspaces, decompilation, IOC/TTP pivots, custom
  LLM prompts, log monitoring, standalone mode, dynamic unpack, case
  management, provider enumeration, multi-target analysis, and detection
  engineering export.
• Full API endpoint reference table, configuration reference, error code
  troubleshooting guide, and accepted sample type list.

Publication Article

• Release article draft for Medium/1200km:
  docs/publication-drafts/adversarygraph-v4-malware-analysis.md.
• Covers the analyst problem, malware workbench, dynamic analysis, AI feedback
  loop, IDA-style AI debugger, Knowledge Library, architecture, installation,
  security model, and limitations.

Knowledge Library

• New knowledge_articles table with GIN-indexed JSONB tags, timezone-aware
  timestamps, and ON CONFLICT DO NOTHING idempotent seeder.
• 39 NVIDIA intelligence articles seeded from backend/app/data/knowledge/:
  14 CVE NVD JSONs, 8 PSIRT analysis markdowns, 3 GHSA JSONs, 4 threat actor
  profiles, 5 vendor reports, 3 research papers, 2 strategy documents.
• Knowledge Library API: GET /api/knowledge/articles (full-text search,
  category filter, tag filter, pagination), GET /api/knowledge/articles/{id},
  GET /api/knowledge/stats, POST /api/knowledge/seed.
• Knowledge Library frontend page with stats cards, category filter buttons,
  text search, article grid, and markdown-rendered article modal
  (react-markdown + remark-gfm).
• Deep-link from NVIDIA Sector Pack CVE IDs into Knowledge Library search.

NVIDIA Sector Packs

• Deep-links from the Pack Detail modal: MITRE ATT&CK technique IDs open the
  Navigator, threat actor names open APT Library search, IOC types link to IOC
  Library, CVE IDs link to Knowledge Library with pre-filled search query.
• Scroll fix on the Sector Packs page (flex-1 min-h-0 overflow-y-auto).

Sector Intel

• Vendors dropdown in the Client Context panel (same <details> pattern as
  Sectors/Regions/Technologies) containing a navigable link to NVIDIA Sector
  Packs.

Test Suite

• 22 unit tests for MalwareGraphClient: timeout→504, connect error→502,
  network error→502, invalid JSON→502, 4xx/5xx upstream passthrough, success
  paths (health, list, get, strings, obfuscation), API key header injection for
  protected vs unprotected routes, submit_analysis upload timeout/error/success.
• 35 integration tests for all /api/malwaregraph/ routes using the ASGI test
  client with MalwareGraphClient fully mocked: every route shape, LLM
  provider validation (422 on invalid provider/missing prompt), file upload
  validation (422 missing file), error propagation (502/504), save-unpacked
  404/500 handling, debug sessions, workspaces, decompilation.
• 10 standalone live tests (test_malwaregraph_standalone.py) that auto-skip
  when the MalwareGraph service is unreachable; exercise health, providers,
  list, submit, get, strings, file preview, service logs, and invalid submission
  validation against the real service at http://localhost:8100.
• Integration test bootstrap conftest.py redirecting LOG_DIR to
  /tmp/adversarygraph-test-logs for local development outside Docker.

Updated

• VERSION, backend/app/core/version.py (APP_VERSION), and
  frontend/package.json version bumped to 4.0.0.
• README release badge, current release line, Project Maturity Evidence,
  Malware Analysis Mode section, and Features table updated for v4.0.0.
• frontend/package.json dependencies: react-markdown ^9.0.1,
  remark-gfm ^4.0.0.
• .gitignore now includes !backend/app/data/ and !backend/app/data/**
  exceptions to allow seeder data files to be committed.

Safety

• Dynamic analysis remains disabled by default. Runtime unpack and runtime
  debug require both dynamic_analysis=true in the request and
  MALWAREGRAPH_ENABLE_DYNAMIC_DEBUG=true in the MalwareGraph service
  environment.
• The MalwareGraph service runs on the isolated malwaregraph_internal Docker
  network with no outbound internet from analysis jobs.
• AI analysis output is stored as untrusted analyst assistance and must be
  validated before operational, legal, or attribution use.

Validation

• 57 backend tests pass: pytest tests/unit/test_malwaregraph_client.py tests/integration/test_malwaregraph_routes.py tests/integration/test_malwaregraph_standalone.py (22 passed + 35 passed +
  10 skipped when standalone service is offline).
• Frontend production build completes successfully.
• Git whitespace checks pass.