v3.2.0

What's Changed

• 3.2.0 by @dougburks in #56

Full Changelog: v3.1.0...v3.2.0

AI Summary and Playbook:

Per-row notes

A small note icon on each table row (Suricata alerts, DNS/HTTP/TLS/flow
events, Sigma alerts, file/YARA matches, imported log events) lets an
analyst attach a short annotation to that specific piece of evidence -
"false positive, known scanner", "escalated to IR ticket #4521" - separate
from the existing whole-analysis Notes field. The icon reuses the same
modal component as analysis-level notes, scoped to the clicked row instead.
Row-level notes are lost on reanalyze (which rebuilds the underlying database from
scratch) - intentional, and now surfaced explicitly: the reanalyze
confirmation dialog shows a bold "WARNING! You have one or more notes on a
table row and these will be destroyed" line and turns the Re-analyze button
red, but only when the analysis actually has row-level notes to lose.

Pivot menu: right-click-style Include/Exclude/Only/Hunt on any value

Clicking a value in a data table row, an expanded row's detail panel, or an
aggregation table now opens a pivot menu instead of immediately filtering or
expanding - Include (broaden the current search to also match this
value), Exclude (narrow it to hide this value), Only (start a new
search scoped to just this value, clearing every other filter), and Hunt
(a full-text search for this value across every field, replacing the whole
search - the one action that also clears any active search/filters
entirely). Each of Include/Exclude/Only carries a color-coded magnifying-
glass icon (green/red/blue) and an explanatory hover tooltip spelling out
exactly what clicking it will do with the real column/value substituted in.

The menu also offers Copy to Clipboard and one-click lookups against
Google, VirusTotal, Shodan, AbuseIPDB, urlscan.io, and CyberChef, plus
user-defined custom lookup sites (added/edited/removed from Settings,
with a {value} URL template) - all persisted per-browser, with strict
http/https-only URL validation on custom entries so a malicious saved
template can't execute as javascript:/data: when opened.

Because a click on a pivotable cell no longer expands the row, the menu also
carries an Expand Row entry (relabeled Collapse Row once the row is
already open) as a discoverable way back to the old behavior - the row's
timestamp cell still expands directly on click, as before.

This replaced the aggregation table's old single-click-to-filter behavior
entirely - clicking a value there now opens the same menu rather than
applying a filter immediately.

AI-generated rule summaries

Expanding a Suricata alert, Sigma alert, or YARA file match now shows an
AI Summary row right at the top of Alert Details/Sigma Rule/Rule - a
one-paragraph, plain-English explanation of what the rule actually detects,
fetched only on first expand and shown only if a summary actually comes
back. Unlike Playbook's investigation questions, there's no generic
fallback here: a summary for the wrong rule would be actively misleading,
so a miss just shows nothing. A single row can show more than one of these
(a file with multiple YARA matches gets one summary per match).

Same baked-in-only shape as Playbooks and for the same reason - summaries
are generated from Security Onion's securityonion-resources repository
(generated-summaries-published branch), gzip-compressed down to a few MB
total across all three detection engines, with no runtime refresh
mechanism. Manual installs get nothing by default, but can point
AI_SUMMARIES_DIR at their own locally-built index.

Security Onion Playbooks

Expanding a Suricata or Sigma alert now shows a Playbook section (after
Alert Details/Sigma Rule, before Notes) with plain-English investigation
guidance for that specific detection rule, or the generic baseline
guidance if no rule-specific playbook exists. It's fetched only on first
expand and shown only if a playbook actually comes back, so an install
with nothing baked in shows no trace of the feature at all. The (sometimes long)
questions list can be collapsed back down independently, while the
playbook's name and description stay visible either way.

Playbook data is baked into the Docker/Podman image from Security Onion's
own Playbooks repository (~15MB of gzip-compressed, English-only guidance -
the Elasticsearch/Sigma-syntax queries each question also carries aren't
portable to this app's SQLite store and are dropped entirely). Manual
installs get nothing by default, but can point PLAYBOOKS_DIR at their own
locally-built index. No runtime refresh mechanism - this is deliberately
baked-in-only, unlike the Suricata/YARA/Sigma rulesets, since guidance text
changes far less often than daily threat rulesets.

Suricata protocol-decode-alert noise

Fixed per-source suricata-update invocations not passing --disable-conf,
which let "Generic Protocol Command Decode" and similar protocol-anomaly
alerts leak into results even when those alerts were disabled via
disable.conf. A new opt-in
show_protocol_decode_alerts setting (Rules modal) makes this noise
explicitly opt-in rather than an accident of the fetch wiring. When
enabled, these alerts now get their own dedicated "Decoder Alerts" tab
(ordered right after Network Alerts/File Alerts, colored to match
Anomalies since it's closely related - if not identical - signal) instead
of diluting Network Alerts. Same columns and detail view as a regular
alert, just without a Playbook section (there's no investigation guidance
for something that isn't a real detection).

Smaller fixes and UI polish

• A reanalyze icon next to the notes icon in the analysis header re-runs
  the pipeline without leaving the page.
• Fixed an intermittent "Loading Sankey diagram..." that never resolved -
  the diagram now tracks its own fetch generation independently of the rest
  of the page, closing a bug class that had been patched piecemeal twice
  before for other unrelated actions.
• Stat cards now always show just the filtered count (e.g. 229,378), not
  the old 229,378 / 229,831 form that could overflow a card's border on a
  large analysis; a data type that a search/filter reduces to zero is dropped
  from the grid entirely instead of shown as disabled.
• The test-suite/dev-server port-8000 collision is gone for good - JSDOM
  tests now run against an isolated fake origin instead of the app's real
  port, so python3 socrates.py no longer needs to be stopped before
  running tests.

Fixed while preparing this release

• The Docker/Podman image would not have started - playbook_lookup.py
  was missing from the final stage's COPY line despite being imported
  unconditionally by socrates.py. The existing test meant to catch
  exactly this class of bug (a module added but never wired into the image)
  didn't, because it only checked whether the filename appeared anywhere
  in the Dockerfile, and playbook_lookup.py happened to already be named
  in three unrelated comments - the test now checks the actual COPY
  instruction's argument list specifically.
• The screenshot and demo-recording scripts (scripts/capture_screenshots.py,
  scripts/record_demo.py) predated the pivot menu and were clicking table
  rows and aggregation values directly, which now opens the pivot menu
  instead of expanding/filtering. Both scripts were updated to target the
  timestamp cell and the menu's Only/Include actions respectively.
• A double-escaping bug in the File Info detail panel's EXIF Metadata
  section could render a value containing &/</>/" as garbled,
  doubly-escaped HTML entities.