v0.43.0

Added

• Zeek classic TSV import — Zeek's default #fields logs (conn, dns, http, files, ssl) import like Zeek JSON (closes #2094)
• Defender XDR advanced-hunting import — advanced-hunting exports import with hosts and accounts; replication from a non-DC and AD FS DKM LDAP reads are High (closes #2097)
• Sentinel Linux telemetry — Sentinel Syslog-wrapped auditd/AUOMS and Sysmon for Linux, plus VMConnection flows, import with full command lines (closes #2098)
• Log4Shell shape — a JVM LDAP/RMI lookup followed by the JVM spawning a shell is raised to High with T1190/T1203 (closes #2099)
• Synthesis checks before 'unknown' — synthesis reads the earliest attacker event's parent command line before calling initial access unknown, and checks a host's events before calling it not compromised (closes #2080)
• Persistence executed — a process that runs a Run/RunOnce value already in the case is raised (High for script and proxy hosts such as rundll32, Medium otherwise) with T1547.001 (closes #2082)
• PowerShell session seats — PowerShell rows record their session at import, and synthesis sends the other commands of a session that has a High row; re-import existing cases to gain it (closes #2078)
• Tagger rules for quiet tradecraft — alternate-data-stream execution is High; anti-VM WMI checks, AV-product and installed-software discovery are Medium, a deliberate exception to tag-only discovery; netapi32/advapi32 lookups gain T1082/T1033 (closes #2079)
• Safety-stop fallback for more AI steps — the default referee, Explain event and view summaries fall back to the fallback model on a safety stop and name the model that answered (part of #2083)
• Referee no-call deltas listed — after "follow the referee" the second-opinion panel lists each delta the referee made no call on, with accept and reject (closes #2081)
• JEV cap warning — a capped missed-evidence review shows how much of the archive it read and what a full read may cost, prominently when it found nothing (closes #2077)
• Safety stops on every API provider — Anthropic, OpenAI-compatible and Gemini refusals take the safety retries and fallback instead of a blind retry (part of #2083)
• Capture refused prompts — opt-in DFIR_AI_CAPTURE_SAFETY_STOPS saves a safety-stopped prompt into the case folder for replay (part of #2083)
• Packet captures documented — the manual explains importing .pcap/.pcapng through the Suricata tool and that raw flows stay in the super-timeline (closes #2095)

Fixed

• Defender start-up policy load — Defender's own engine changing its settings within 10 minutes of start-up, with no attacker tool on Defender, is capped to Medium; turning protection on is never tampering (closes #2084)
• Defender 5001/5007 in a start-up window — a writer-less Defender 5001/5007 row counts toward the start-up cap only beside a stamped engine write on the same host and window (part of #2104)
• Codex safety stops — a Codex refusal or usage-policy rejection is a safety stop, so it is captured and falls back instead of being retried (closes #2105)
• Log4Shell pass speed — the JNDI-injection pass indexes the timeline once instead of rescanning per pair, with identical results (closes #2102)
• Severity rank maps typed — every local severity rank map is checked by the compiler for all five severities (closes #2101)
• Sentinel timestamps — Sentinel/Log Analytics exports (SecurityEvent, OfficeActivity) are dated from TimeGenerated (closes #2096)
• Sysmon clock dispute — a Sysmon row whose UtcTime is over an hour from the record time is dated by the record time and flagged (closes #2089)
• Exfiltration chain tagging — renamed 7-Zip archiving and scripted FTP/BITS uploads are tagged, so the archive → upload pairing fires (closes #2090)
• Script-host child rule — script hosts spawning a shell no longer carry T1566.001, and Windows' own System32 scripts are excluded (closes #2091)
• Dismissed clusters stay dismissed — High rows under a dismissed process cluster fold onto that dismissal, and dismissed auto findings stay dismissed across re-synthesis (closes #2092)
• Second-opinion deltas — findings either model already dismissed no longer appear as added or removed (closes #2093)
• Deep pass falls back on a safety stop — a stopped deep-pass batch is read on the fallback model instead of being lost, and the second-opinion record names the model that actually wrote model A (closes #2076)
• Custody appendix paths escaped — an artifact path with a line break or backticks can no longer forge a heading or break its code span in the report (closes #2052)
• Word report links restricted — only absolute http, https and mailto links stay clickable; javascript:, file:, ms-msdt: and similar targets render as plain text (closes #2053)
• HTML report blocks share links — //host and \\host\share links and images no longer pass the report's link filter (closes #2072)
• Short host names redacted — the short name of every known full host name is masked in the redacted package and in text sent to the AI (closes #2056)
• Admin-share paths redacted — the server in \\HOST\C$-style paths is masked as a host, and share names are no longer learned as user names (closes #2073)
• Closed cases refuse imports — every per-format import route answers 423 for a closed or archived case (closes #2054)
• Closed cases refuse other ingest — Velociraptor bundle, external import and collect, tool runs, IRIS import and the manual drop-folder run refuse closed and archived cases (closes #2071)
• Server-path imports in chain of custody — a file imported by server path gets a custody record with its SHA-256 (closes #2055)
• Impossible syslog dates rejected — syslog, Cisco ASA and Apache dates such as Feb 31 or hour 24 are left unparsed instead of rolling into the next day (closes #2061)
• Hayabusa JSON recovers after a bad record — one unterminated record in a pretty-printed timeline no longer drops every record after it (closes #2064)
• Hayabusa bad timestamps left empty — an unparseable Hayabusa time is no longer used as the event time (closes #2063)
• Chainsaw bad timestamps left empty — an unreadable Chainsaw time falls back to the detection time or stays empty (closes #2074)
• THOR stray lines dropped — a null, array or empty JSON line no longer crashes the THOR import or becomes a phantom event (closes #2062)
• Cockpit story follows host merges — hosts confirmed as the same host count as one in the story, under the chosen name (closes #2066)
• Filter chip names what hides rows — a stage, anomaly or session filter that shows fewer rows says how many the severity floor, the ⊕ lens or the load cap holds back (closes #2065)
• Timeframe range checked first — saving a named timeframe with an empty or reversed From/To says so before asking for a name (closes #2067)
• Deep pass shows its time — a deep pass that just finished shows its timestamp without a reload (closes #2068)
• Codex model errors classified correctly — only a 4xx refusal of the model counts as a model error, so transient failures are retried (closes #2051)
• Bidi marker brackets guarded — the escape helper rejects empty or bidi-bearing brackets, and markers are documented as display-only (closes #2050)
• Manual event and IOC adds are fast — adding one event or IOC no longer loads and saves the whole case (closes #2060)
• Synthesis no longer blocks the server — the post-synthesis playbook and session-command passes no longer grow with the square of the case (closes #2058)
• Lighter loads for small exports — timeline gaps, swimlane, IOC blocklist, STIX and the interactive report skip unused provenance data (closes #2057)
• Tag list is analyst tags only — automatic tag labels now come with each timeline page, so the tag list stays small and dashboards reload it once per burst (closes #2059)
• Super-timeline search is prefiltered — a text search reads only candidate rows instead of every row in the window (closes #2069)
• Super-timeline paging is faster — label filters and facets are read from the tag table instead of loading every tag per page (closes #2070)