v0.32.0

Added

• Cross-tool command-line correlation — merges same process-creation events reported by different tools that share a command line, parent process, and host (closes #68).
• SSH brute-force-success detection — flags a successful login following a burst of failures from the same IP (T1110.001).
• Windows logon-type risk grading — grades risky logon types (external RDP, network-cleartext, runas /netonly) on 4624 events.
• Lookalike / typosquat domain detection — offline enrichment flags domains impersonating common brands (T1566/T1583.001).
• NTFS timestomp detection — flags MFT $SI/$FN timestamp mismatches indicating timestomping (T1070.006).
• IOC list pagination — client-side paging for the IOCs section, matching the timelines.
• AI-assisted content-tagger rules — describe a tagger rule in plain English; AI drafts, previews, and adds it.
• Right-click "Send to DFIR-Companion" — send selected text, a table, or a link from any page, not just recognized consoles.
• VolWeb adapter + manual tool override — extension auto-detects VolWeb and lets you force a different adapter per tab.
• Live progress for Velociraptor imports — large imports stream progress instead of blocking silently.
• Structured, deployable collection directives — one-click deploy and auto-detected satisfaction for "collect X from host Y" recommendations (investigation-guidance #8).
• Evidence Gaps dashboard panel + report section — structured, deployable collection directives for uncovered kill-chain phases (investigation-guidance #9).
• Zero-yield import warnings — flags large AI-triaged files that produced zero events (investigation-guidance #10).
• Second-look loop — bounded raw re-query against the full super-timeline plus one re-synthesis (investigation-guidance #11).
• Immediate false-positive cascade — synchronously re-evaluates dependent questions/next-steps/hypotheses when a finding is marked FP (investigation-guidance #12).
• Rabbit-hole detection — flags findings disconnected from the main evidence graph as possible rabbit holes (investigation-guidance #13).
• ACH-style hypotheses — tracks contradicting evidence, a discriminator, and hunt-exhaustion (investigation-guidance #14).
• Per-case prevalence baseline + FP-pattern propagation — rarity-biased event selection and one-click bulk-dismiss for recurring FP patterns (investigation-guidance #15).
• Content-based event tagger — Timesketch-style tags.yaml rule engine tags events, raises severity, and unions MITRE techniques.
• Composite IOC risk score — weighted critical/high/medium/low/benign tier per indicator (closes #63).
• KEV / tool-confirmed / unconfirmed-lead confidence badges — new corroboration signals on findings (closes #61).
• Synthesis coverage audit — shows how many in-window events a synthesis run considered vs. omitted (closes #62).
• Per-source noise/trust scores — weights sources by reliability in correlation and confidence scoring (closes #66).
• Learn from dismissed findings — repeated FP patterns lower (not zero) confidence on similar new activity (closes #65).
• On-demand hypothesis falsification review — focused for/against pass over open hypotheses (closes #71).
• DFIR_MAX_EVENTS — configurable event-ingestion cap, overriding the hardcoded 2000 default (closes #110).
• Case Statistics panel — per-case totals, source breakdown, and import velocity in Diagnostics (closes #36).
• Prompt regression / eval harness — CI-safe and real-provider golden-output testing for AI extraction/synthesis quality.

Changed

• CSV/log AI extraction now uses the text model, not the vision model — DFIR_AI_SYNTH_MODEL handles CSV/log/synthesis; DFIR_AI_MODEL is vision-only.
• Velociraptor timeline events now describe the action, not just a filename — MFT/USN/browser/shellbags/UserAssist/Shimcache/Amcache/Prefetch/LNK all render human-readable descriptions.
• Forensic Timeline redesign — bordered-card rows matching the Findings/IOCs styling.
• Second-opinion deltas now keyed by semantic content, not exact title — a stable semanticKey prevents reworded findings from showing as spurious new deltas (closes #69).

Fixed

• Work-log filter could drop real detections that merely named a tool — now honours a structured-field gate (closes #67).
• Large deterministic imports could peg the CPU for an hour — forensic-timeline dedup is now O(n) instead of O(n²).
• Large imports could fail with EPERM on state-file rename — atomic-write retry budget widened, tunable via DFIR_ATOMIC_WRITE_RETRIES.
• Evidence drop-folder auto-imports were invisible in the Jobs panel — now register a background job like manual imports.
• Tagger rules file wasn't created on first write — directory is now created on demand.
• Extension content script failed to load on every page — content.js/pageHook.js now build as isolated, non-module bundles.
• caseId wasn't validated on lock-status/unlock routes — closed the gap with the standard case-existence guard.
• Renaming a manually-added asset was lost in the asset-graph view.
• The enrich endpoint falsely reported acceptance when no providers were enabled.
• A partial dwell-window update could fail validation instead of merging.
• An empty {} JSON body on the generic push endpoint was imported instead of rejected.
• Notion push didn't normalize env-configured database/parent page IDs.
• Dashboard UI cleanups — fixed synthesis job/status races and a drag-order regression.