Skip to content

Phantom v1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@ayman-m ayman-m released this 18 Oct 14:44
· 2 commits to main since this release
v1.1.0
5c4a3e6

Phantom v1.1.0: one company behind every generated log

Every log Phantom produces — Okta, Windows, firewalls, cloud — now describes the same fictitious company, so Cortex can group alerts from different sources into one case.

Organization

  • Phantom Lab ships built in: 50 people in seven departments, 75 hosts across a Riyadh HQ, a Jeddah branch, a DMZ and remote workers, plus one account in each of AWS, Azure and GCP. Browse it on the new Organization page, edit it, import your own, duplicate, export, restore an earlier version, or switch the active one.
  • The agent reads the organization before it generates, and can add people, hosts and networks from chat. The xlog workers, http-sender, wec-sender and cie-sender all draw from it live — a save or a switch needs no restart.
  • cie-sender ships in this release. It provisions the organization's people, admin/service/break-glass accounts and groups into a Cloud Identity Engine SCIM directory, giving Cortex XSIAM the directory context its Identity Analytics detectors need.
  • A Cortex setup panel lists the internal address ranges and domain suffix to enter in Network Configuration.

Data sources

  • delivery: wec is now a formal catalog option, with two new catalog entries for Windows identity-analytics detectors that syslog/CEF delivery cannot reach.
  • Edit guidance and Rollback are fixed for every agent-installed data source — a version-suffix mismatch between Cortex's own rule names and the catalog's had silently broken both.

Analytics Trigger Coverage

  • A new /help/architecture#analytics-coverage reference lists all 50 alert-triggering skills by data feed, with the exact detector, MITRE technique, and an evidence-based status for each — plus a Known Gaps section covering what still doesn't fire and why.

Fixes

  • Editing the Organization now rejects overlapping networks, forking uses the name you type, and version history shows each entry's real origin.
  • A tool call that failed inside the agent (not the model) is now reported and persisted as a failure instead of a silent success.
  • A failed one-shot job now shows a red "Failed" badge on the Jobs list.
  • A non-dict response from Cortex's API no longer crashes the XSIAM connector with a raw internal error.
  • Gemini 3.8 Flash is priced at its introductory rate ($0.75 / $3.75 per million tokens) through 2026-12-31.

Images are public under ghcr.io/ayman-m/*-oss at 1.1.0. Full details are in CHANGELOG.md.

Install or upgrade by running phantom-installer from the assets below (verify it against phantom-installer.sha256).

Assets 4
Loading