Skip to content

v0.41.0

Latest

Choose a tag to compare

@hasamba hasamba released this 02 Oct 12:14
· 16 commits to master since this release

Added

  • Containment check on findings — Jev answers eleven narrow questions about a finding's cited evidence, a tested rule suggests containment steps, and ticked steps go to the Playbook with their attribution (closes #1925)
  • Missed-evidence grading style setting — DFIR_JEV_GRADING picks one-question (default) or experimental narrow-question grading, with the trade-off explained in Settings (relates to #1924)

Changed

  • Missed-evidence review confidence floor — the panel's confidence filter starts at 40% instead of 0 (part of #1924)

Fixed

  • Jev actions refresh conclusions — promoting Jev rows or attaching a remediation plan now marks the conclusions out of date (closes #1923)
  • Missed-evidence review respects the anonymizer — rows sent to Jev now pass through the case anonymizer (closes #1934)
  • Network connections stay separate — two connections from one program to different destinations no longer merge into one row, so a C2 connection is no longer hidden; re-import an affected case to recover lost rows (closes #1922)
  • Clearer filtered partial-load label — the Forensic Timeline label now says "of the first N loaded events … case holds M" when a filter is on (closes #1928)
  • Archive wait hardening — the archive wait ignores an invalid wait setting and checks less often while an import finishes (closes #1927)
  • Ingest-reservation guide for contributors — code comments now say which reservation a new import route needs (closes #1929)