Skip to content

v0.29.0

Latest
Latest

Choose a tag to compare

View all tags
@hasamba hasamba released this 04 Jul 15:30
v0.29.0
bc6a51b

Added

  • Chainsaw importer: flat Sigma-mapping JSON — recognizes the flattened Chainsaw output shape (top-level verdict fields) from tools/Velociraptor artifacts that shell out to Chainsaw.
  • Severity-gated forensic timeline — Info telemetry now routes to the super-timeline only, configurable via DFIR_FORENSIC_MIN_SEVERITY + a per-case override.
  • IOC provenance — each IOC classed detection-linked vs telemetry-only, with a dashboard badge + filter.
  • Super-Timeline full message + Velociraptor deep-link — a [details ▶] toggle reveals the full event message, plus a ↗ Velociraptor link back to the originating hunt/flow (closes #8, closes #9).
  • Super-Timeline — a Timesketch-style complete record of every imported event (filter/label/promote to the forensic timeline) + a "Super-Timeline Triage" Velociraptor bundle.
  • External tool runner (Settings → Tools) — run local Hayabusa / Velociraptor CLI / Suricata / Snort / YARA against raw files and auto-ingest the output, with a per-import confirmation banner (closes #211).
  • Import external hunt/flow — pull results from a Velociraptor hunt/collection launched in the GUI by id or URL.
  • Custom tools (Settings → Tools) — add unlimited user-defined tools beyond the five built-ins, auto-routed by output/extension.
  • YARA CLI output importer (yara -s -m) — rule matches → file-match events + file/hash IOCs.
  • Velociraptor hunt expiry — hunts launch with a relative expiry (default 1 hour) instead of Velociraptor's week-long default, overridable per bundle/run.
  • Velociraptor hunt status polling — 30s background poll reflects live hunt state and auto-collects on completion (closes #210).
  • Plain syslog importer — deterministic RFC 5424/3164 parser, replacing AI log-triage for Linux/Unix syslog.
  • Kerberoasting / AS-REP roasting event verdict — RC4 TGS-REQ/AS-REQ to user accounts now grades Medium + T1558.003/.004.
  • AWS CloudTrail priv-esc actions — PassRole+Lambda CreateFunction (Medium) and STS GetSessionToken (Low, T1078.004) added to the severity table.
  • Kubernetes audit-log importer (k8sAuditImport.ts) — deterministic parser, severity derived from the (verb, resource) tuple.
  • osquery result-log importer (osqueryImport.ts) — deterministic differential/snapshot log parser, Info-by-default.
  • IOC list noise-reduction controls (dashboard) — three composable display-only filters (Hide FP/no-intel, Hide OS system paths, 🎯 Signal only), default on.
  • Exclude filter (dashboard) — chip-list control hides timeline/IOC/finding rows matching any exclude term (closes #216).
  • Velociraptor deep-link on the forensic timeline — mirrors the super-timeline's ↗ Velociraptor link.
  • Windows.EventLogs.Chainsaw added to the built-in Best Practice bundle.
  • Origins filter on the forensic timeline — filters by producing artifact, matching the super-timeline's Origins filter.
  • False-positive feedback loop — "Mark Legitimate" renamed "Mark False Positive" with structured reason + attribution, find-similar-items suggestion, one-click IOC whitelist promotion (closes #227).

Changed

  • Forensic + super-timeline row redesign — compact plain-weight title line; description/MITRE/related findings/raw message now collapse into one shared [details ▶] panel per row.
  • Super-timeline toolbar merged — the time-scope bar and the origins/hosts/tags/starred-only bar are now one row.
  • Forensic timeline severity filter drops "Info" — redundant since forensicGate already excludes Info server-side.
  • Forensic timeline pagination moved above the event rows.

Fixed

  • Correlated events could show a different tool's artifact as their origin — artifactName now always comes from the same event as the shown description.
  • Dashboard main filter now applies to the super-timeline (search term, exclude terms, time range).
  • IOC panel header always showed only the flagged count — now shows "N of M IOCs" when a filter narrows the list.
  • Super-timeline rows showing the tool/origin name twice — the duplicate leading prefix is now stripped.
  • Forensic timeline's Velociraptor deep-link never appeared — importVelociraptor now accepts veloUrl on the forensic-timeline-bound branch too.
  • "Import external hunt/flow" pasting a notebook URL silently imported unfiltered raw rows — now rejected with guidance to use the extension's "Push rows" button instead.
  • Duplicate clear (✕) icon in the filter / OCR search boxes — inputs switched from type="search" to type="text".
  • cleanIp accepted any colon-bearing free text as a "valid" IPv6 IOC — now validated against a real IPv6 shape.
  • Velociraptor "grpc: received message larger than max" — corrected fix (2nd pass) — the real setting is max_grpc_recv_size in the client's api_client.yaml, not a CLI flag or server config.
  • IOC list: duplicate rows and unstable order in the dashboard — now deduped by id + sorted deterministically; mergeDelta dedup is case-insensitive; npm run dedupe-iocs cleans up already-corrupted cases.
  • Velociraptor bundle-hunt collection surfaces per-artifact failures instead of silently dropping them.
  • Velociraptor DetectRaptor hits on .yms Sigma-rule files graded Info, not extracted as IOCs.
  • Combined access-log importer captures the HTTP Referer — no longer silently dropped.
  • Combined access-log importer captures the HTTP User-Agent — anomalous UAs now emitted as other IOCs.
  • .env config resolution unified across read/save (Chocolatey) — Settings → Save now writes to the exact .env the server loaded.
Assets 6
Loading