v0.36.0

Added

• YARA hits show the matched string; Amcache flags a spoofed binary name — tagged T1036.005 on a filename/compiled-name mismatch.
• Bundle hunt label filter is a picker, not free text — ticks against the cached client inventory instead of typing a label that could match nobody.
• The Geographic Map opens fullscreen.
• Every AI job names its model — pinned at queue time, so it survives a later Settings change.
• USB device history reaches the forensic timeline — new Best Practice artifact + tagger rule grades removable-media mounts Low (T1091/T1052.001). Applies to imports from here on.
• Custom.Windows.EventLogs.Network.Share.Access added to the Super-Timeline Triage bundle.
• A blocked bundle hunt now names the missing tool and where to upload it.
• Windows.EventLogs.CondensedAccountUsage added to the built-in Best Practice bundle.
• Every integration in Settings has a connection test — Timesketch, Notion, ClickUp, Velociraptor, MISP, YETI, OpenCTI, Jira and ServiceNow join DFIR-IRIS/Presidio.
• Every "Skip TLS verify" flag is in Essential settings, plus a new global DFIR_TLS_ALLOW_INSECURE_EXTERNAL opt-in.
• Setup wizard configures self-signed DFIR-IRIS and Timesketch.
• Firefox add-on versions submit to Mozilla automatically on a v* tag, alongside the Chrome Web Store.
• Every documented setting is visible in Settings — 48 .env-only fields now render, read-only where unwritable.
• Setup wizard configures Presidio and Telegram.
• Ransomware note / renamed-file detection (T1486) — extend the family list with DFIR_RANSOM_EXTS. (part of #700)
• Contextual YARA severity — cut High+Critical findings 74–86% across four evaluated intrusion scenarios, zero new false positives. (closes #700)
• Lateral movement, drive-by download and cloud-exfil detection — RDP (T1021.001), drive-by (T1189), cloud-exfil tooling (T1567.002). (part of #701)
• IOCs are classified as threat indicators or observations, broken out separately in the dashboard and reports. (part of #701)

Fixed

• Velociraptor's own detection content no longer reads as an intrusion — Sigma rule files, sample event logs and cdxml PowerShell modules demote to Info; High file-system findings fell 58→11 on a real collection.
• The same attacker action on two machines is now two events, not one — Windows events group by host, so lateral movement no longer collapses to one machine. (closes #659)
• A PowerShell script block yields its IOCs however it was collected — natively parsed EVTX rows now extract the same indicators as DetectRaptor's flattened shape. (closes #652)
• A long script block no longer hides its C2 table — the 4,000-character import cut now names what it removed.
• Velociraptor imports now yield bare C2 domains, not just URLs/IPs/hashes, from script blocks and command lines.
• IOC provenance no longer points at the wrong event — network addresses stay distinct through timeline merging. (closes #640, #643, #646, #649)
• The Geographic Map draws its world again — tiles are proxied through the companion instead of being blocked by CSP.
• The dashboard stops running yesterday's code after an update — scripts/stylesheets revalidate instead of caching 24h.
• Enrichment no longer stops at 100 IOCs and says nothing — the cap now bounds a batch, not the case, and chains up to DFIR_ENRICH_MAX_BATCHES.
• The Anonymization panel no longer reports a dead Presidio analyzer as on — opening the panel now probes it live.
• A Velociraptor collection can no longer start without a case — every route 404s an unknown case before launching.
• Essential settings no longer strands a lone field at a third of the line.
• A rejected Timesketch certificate now names the settings that fix it.
• The extension privacy policy says where evidence goes after the companion receives it, and stops calling the companion "local".
• The Firefox install instructions say what the add-on collects.
• The Firefox add-on can be submitted to AMO again — the manifest now carries data_collection_permissions.
• The capture extension keeps the team service token — every field saves as you leave it, not only on Start.
• A rejected token no longer reads as "companion offline".
• Exporting a case on Windows no longer fails as a security refusal.
• docker compose pull fetches the current release again — a gate now fails when any of the six version files disagree.
• Detection-noise suppression reaches three more importers (THOR, ThorZIP, native-Hayabusa) and closes an attacker-forgeable path-match gap. (part of #700)
• Bulk artifact imports no longer starve on the AI request budget — deterministic imports draw from their own rate limiter, DFIR_IMPORT_RATE_MAX. (part of #700)
• IOC extraction and "confirmed exfiltration" are more precise — octet-validated IPv4, fewer code-token false IOCs, an attributable-transfer requirement. (part of #700)
• A capped import now says how much evidence it dropped. (part of #701)

Changed

• The analyst walkthrough starts with the Velociraptor hunt bundles — Best Practice sweep and optional Super-Timeline Triage.
• AI requests now wait 15 minutes before giving up (was 3) — sized for CLI-backed providers (Claude Code, Codex).
• The Firefox add-on now requires Firefox 140 (was 128) — the first release with the data-collection consent screen.