You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Containment check on findings — Jev answers eleven narrow questions about a finding's cited evidence, a tested rule suggests containment steps, and ticked steps go to the Playbook with their attribution (closes #1925)
Missed-evidence grading style setting — DFIR_JEV_GRADING picks one-question (default) or experimental narrow-question grading, with the trade-off explained in Settings (relates to #1924)
Changed
Missed-evidence review confidence floor — the panel's confidence filter starts at 40% instead of 0 (part of #1924)
Fixed
Jev actions refresh conclusions — promoting Jev rows or attaching a remediation plan now marks the conclusions out of date (closes #1923)
Missed-evidence review respects the anonymizer — rows sent to Jev now pass through the case anonymizer (closes #1934)
Network connections stay separate — two connections from one program to different destinations no longer merge into one row, so a C2 connection is no longer hidden; re-import an affected case to recover lost rows (closes #1922)
Clearer filtered partial-load label — the Forensic Timeline label now says "of the first N loaded events … case holds M" when a filter is on (closes #1928)
Archive wait hardening — the archive wait ignores an invalid wait setting and checks less often while an import finishes (closes #1927)
Ingest-reservation guide for contributors — code comments now say which reservation a new import route needs (closes #1929)