v0.44.0

Added

• Re-grade a case with current Sigma rules — preview then apply a re-grade of already-imported CloudTrail, Entra and web-log events; severity can go up or down, counts of raised / lowered / unchanged rows are shown, and Undo restores both timelines (closes #2206, closes #2220)
• Measure a Sigma release against the open case — before installing, preview how a staged release would re-grade this case; nothing is changed (closes #2209)
• Sigma rule exclusions — keep a rule on but skip a known-benign field value, with a reason; the exclusions are part of the provenance token shown in reports (closes #2218)
• Sigma coverage card — Hunt Workbench shows, per log source in the case, whether Sigma rules graded it, with a jump into the super-timeline (closes #2217)
• Dry-run a pasted Sigma rule — the Sigma paste card counts how many events in this case the rule would match and names every field the case cannot check (closes #2211)
• Sigma rules for web and proxy logs — SigmaHQ web server and proxy rules grade Apache, nginx and Squid access logs at import; unanswered requests only tag, so scanners do not flood the timeline (closes #2203)
• Sigma rule updates and settings — check, preview, install (or install from a file) and roll back SigmaHQ releases, choose rule statuses and the minimum level that raises severity, and switch single rules off; reports name the release that graded the case (closes #2204)
• Sigma rules at import — bundled SigmaHQ rules grade AWS CloudTrail and Entra ID sign-in / audit imports: high and critical rules raise the event, lower levels tag it (closes #2202)
• Custody at receipt with SHA-1 — every import is hashed (SHA-256 and SHA-1) into chain of custody before any parser runs, rejected files included; custody manifests are now version 2 (closes #2111)
• Presidio without the manual container — docker compose --profile presidio up -d starts the analyzer, and the manual documents a Python install for machines without Docker (closes #2197)
• More secrets redacted before AI — anonymization now one-way redacts vendor API keys, tokens, CLI password flags and secret-named fields (logtotal-sanitizer patterns) while hashes, SIDs and IPs stay readable (closes #2198)
• LOLBIN chains filter — an Evidence Chain toggle shows only LOLBIN processes started by an unusual launcher or graded Medium+, with their parents and children (closes #2113)

Fixed

• Undo keeps host renames in step — undoing or redoing an import that taught a host rename moves both timelines to the same host name (closes #2221)
• API keys redacted from enrichment errors — a key in a failed request URL no longer reaches the server log, case state or report (closes #2208)
• Malformed ZIP entries refused — the ZIP reader checks each entry's local header and data bounds and reports a corrupt archive (closes #2212)
• Sigma update preview on Windows — line endings no longer mark every rule as changed or change the rule-set content id (closes #2215)
• Mac-made Sigma release zips — __MACOSX, .DS_Store and ._* entries no longer break Install from file (closes #2214)
• Oversized Sigma zip refused early — a file over 32 MB is refused before the browser reads it (closes #2213)
• Re-run no longer goes dead — a held job's Re-run stays usable when the start is cancelled or refused (closes #2196)
• Sigma buttons in the public demo — rule Enable/Disable, Exclude and Install are disabled with a reason instead of failing (closes #2216)
• Presidio skips AI-written text — values found only in the case summary, attacker path or finding text the AI wrote no longer stop the next run; events and analyst notes are still scanned
• Presidio "not local" warning — the Settings and setup-wizard warning now checks only the URL's hostname, so a remote analyzer with localhost in its path or user name no longer passes as local (part of #2197)
• Re-run a held job — once the Presidio or duplicate-host gate clears, the held job row reads "was held — gate cleared" and offers Re-run for synthesis, deep pass and second opinion
• Geographic Map tiles at high zoom — the map basemap loads at every zoom level instead of going gray from zoom 10 (closes #2188)
• High-zoom tile tests — regression tests pin the tile-coordinate limits at every zoom level, so the gray-map bug cannot return unnoticed (closes #2190)
• Case-password guessing capped per client — one client gets at most 20 wrong case-password guesses a minute across all cases, on unlock and on evidence writes; correct passwords never use up the budget (closes #2184)
• Derived-note clip caps shared — the event-history check reads the same description caps the detection passes use, so changing a cap can no longer write false "changed after first recorded" entries (closes #2186)
• Locked queued captures shown — when queued screenshots wait for another, locked case, the extension badge turns amber and the popup names the locked case and asks for its password (closes #2185)
• Case lock gates imports — a locked case refuses imports without the case password; extension screenshots for a locked case wait in the queue for the password instead of being discarded; push keys still work (closes #2135)
• Changed-after-recorded marker — when a merge changes an event's description or severity, the event keeps a capped history shown on the timeline, in reports and as a CSV column (closes #2141)
• Re-import keeps tagger grades — re-importing the same file no longer drops a tagger-raised severity to Info and out of the forensic timeline; an MCP agent can still lower it (closes #2182)
• Whole-case import receipt names the archive — the custody received entry for a .dfircase or ZIP import records the real file name instead of a generic label (closes #2176)
• Notification targets guarded — webhook URLs and the email server host refuse cloud-metadata and link-local addresses, and webhook redirects are not followed; LAN targets keep working (closes #2146)
• Audit-export targets guarded — Splunk, Elastic and syslog destinations refuse cloud-metadata and link-local addresses, and redirects are not followed; LAN and loopback keep working (closes #2147)
• Velociraptor download pinned and verified — the "Download latest" button accepts only GitHub release hosts over https and checks GitHub's SHA-256 digest before making the file executable (closes #2133)
• Killercoda lab exposure — the lab now declares public-demo instead of the loopback-only value, and the intro warns that a pasted AI key is usable by anyone holding the live session link (closes #2137)
• Super-timeline keeps distinct records — rows sharing a time, description and host but with different source record ids are no longer folded into one (closes #2140)
• Graceful shutdown — SIGTERM/SIGINT now drain the server and flush logs within 5 s; docker stop no longer waits out the grace period and SIGKILLs (closes #2142)
• Analysis-run ledger and backups — documented that the ledger is never pruned and is not part of backup/restore, and pinned that with tests (closes #2143)
• Import resume holds the import lock — a concurrent import's rows are no longer credited to a resumed file's summary and run receipt (closes #2144)
• Evidence route vs case moves — an evidence link opened mid-move answers 404 instead of a false security 403; delete and restore wait for a running archive or export (closes #2145)
• Enrichment SSRF guard tested — tests pin the internal-address filter and that an indicator never becomes the host a provider connects to (closes #2148)
• Custody tail truncation detected — the chain head is pinned on every append, so a shortened custody log reports a head-regression break (closes #2150)
• Excluded-IOC references in findings — findings drop references to IOCs removed by the exclude list and keep a marker naming the removed value, also when a rule is added later (closes #2151)
• Analysis failure marker — written atomically, and a failed marker write no longer hides the error status from the analyst (closes #2152)
• AI pause cannot be undone — concurrent per-case AI control writes are serialized, so turning AI off is never overwritten (closes #2153)
• Backup trust boundary documented — SECURITY.md states that whoever can write the cases folder is trusted and why backups are not signed (closes #2154)
• Container hardening — no-new-privileges in the entrypoint, SUID bits stripped from the image, and compose drops all but five capabilities (closes #2155)
• GitHub Actions pinned to commits — third-party actions use commit SHAs, and only the release and chocolatey jobs get write permission (closes #2156)
• Pinned docs toolchain and verified downloads — mkdocs deps pinned, appimagetool and betterleaks checked against SHA-256 before use (closes #2157)
• Release checksums and signing disclosure — releases ship SHA256SUMS.txt, and the notes and docs say the EXE and AppImage are not code-signed (closes #2158)
• Read-only token for secret scans — both secret-scan workflows declare contents: read, enforced by a test for every workflow (closes #2159)
• Compose healthcheck honours the port — probes PORT/DFIR_PORT like the image healthcheck (closes #2160)
• Unauthenticated-remote startup warning — accepting a no-login remote opt-out logs a warning, and the startup line shows the real bind address (closes #2161)
• Corrupt IOC row no longer breaks imports — a stored IOC with a non-string value no longer makes every IOC-bearing import throw (closes #2162)
• SECURITY.md posture — scoped "no built-in authentication" to single-user mode and named team mode and the documented opt-outs (closes #2165)
• Public demo and network exposure documented — the manual explains the remote-bind refusal, container-loopback-proxy, public-demo and what demo mode blocks (closes #2166)
• Stored-password cost documented — SECURITY.md explains the scrypt cost for team-mode and case-lock passwords (closes #2167)
• Team-mode unauthenticated sweep — a test calls every route without a session and requires 401 outside a fixed public list (closes #2168)
• Backup tamper tests — restoreBackup's refusals of tampered manifests and sidecars are covered (closes #2169)
• Importer tests — direct tests for five importers and image-format detection, plus a malformed-input matrix over 18 parsers (closes #2170)
• Extension content-script tests — the page-message boundary, size cap and site-access wiring are covered (closes #2171)
• Stricter test assertions — rate-limit, push-route and timing-dependent tests now assert exact outcomes with deadlines (closes #2172)
• Encoded traversal test — the evidence route is tested against encoded, double-encoded and Unicode traversal payloads (closes #2173)
• Screenshots kept on a 429 — the extension retries captures throttled by the case-password lockout instead of discarding them (closes #2174)
• Screenshot event ids — a later capture window no longer overwrites an unrelated earlier timeline event (closes #2175)
• Backup restore in the activity log — a successful restore is recorded in the case activity log and the audit export (closes #2177)
• Corrupt IOC values repaired at load — a non-string stored IOC value is loaded as text instead of crashing views, reports and synthesis (closes #2178)
• Failed screenshot catch-up reported — a failed backfill writes the failure marker and AI error, so diagnostics count it (closes #2179)
• Case-open panels behind the busy gate — the 19 panels a case open fires queue behind the heavy-read gate and drop work for a departed analyst (closes #2121)
• Lighter loads for findings-only panels — compliance, handoff and intel retirement skip the forensic timeline they never read (closes #2127)
• Departed analysts stop indirect panel loads — host scope, host duplicates, second look, known unknowns and the TLS graph scan stop for a closed tab (closes #2128)
• One shared case read per case open — case-open panels share one full read and keep it for 5 idle minutes, cleared by any change (closes #2126)
• Whole-case imports in chain of custody — .dfircase and ZIP case imports record the archive's SHA-256, SHA-1 and size as a received entry on success (closes #2124)
• Super-timeline reads keep the case-open share — reading a settled super-timeline no longer counts as a change, so case-open panels share one load (closes #2129)
• IOC provenance reads keep the case-open share — provenance lookups on a built index no longer count as a change or wait behind imports (closes #2131)
• Spread-out busy retries — dashboard retries after a server-busy refusal back off and add random delay instead of retrying in lockstep (closes #2123)
• Hunt event budget keeps detections — the hunt-wide event cap counts only rows that stay in the forensic timeline, and once spent later artifacts still import their Medium-and-above rows instead of being skipped
• THOR repeats keep the highest grade — a THOR finding reported several times takes its most severe copy's grade, not the first one's
• Login redirect stays on the companion — a returnTo with a backslash, tab or newline can no longer send a signed-in analyst to another site (closes #2107)
• Sentinel Linux respects the event cap — a multi-host export is cut to the event cap by severity, so later High rows survive (closes #2108)
• Defender hunting keeps apostrophe values — AdditionalFields with an apostrophe or quote no longer vanish, so AD FS DKM and Domain Admins rules fire (closes #2109)
• Zeek TSV import uses less memory — large classic Zeek logs are read line by line instead of split whole before the row cap (closes #2110)
• Report tables keep backslash-pipe evidence in its cell — a value like alice\|x no longer shifts Markdown, HTML and DOCX table columns or drops the last cell, chain of custody included (closes #2117)
• Velociraptor "Download latest" works again — the downloader picks and unpacks the gzip-compressed binaries official releases now ship (closes #2118)
• Synthesis no longer freezes the server on large cases — finding grounding and the asset graph stop rescanning the whole timeline, and synthesis yields between steps (closes #2058)
• Small report panels open fast on large cases — gaps, swimlane, IOC blocklist, STIX and the interactive report reuse the case's filtered state until the case changes (closes #2057)
• Heavy reads cannot starve the server — whole-case reads run behind a bounded queue, a full queue answers "busy" at once, and requests the analyst abandoned never run (closes #1915)
• Graph, export and AI-summary panels share the busy gate — about twenty more whole-case reads queue behind it and stop for analysts who left (closes #2119)
• Dashboard state fetches share one read — concurrent state requests for the same case and page read the case once, never older than the last change (closes #2120)
• Broad super-timeline searches answer fast — a search matching more than 10,000 rows shows "10,000+" instead of counting every row (closes #2069)

---

Verifying downloads. Every release carries SHA256SUMS.txt. On Linux run
sha256sum -c SHA256SUMS.txt --ignore-missing in the download folder. On Windows run
Get-FileHash <file> -Algorithm SHA256 and compare the hash with the matching line in
SHA256SUMS.txt.

Signing status. The Windows EXE and the Linux AppImage are not code-signed, so Windows
SmartScreen warns on first run. The Firefox extension zip is unsigned until it is installed
from addons.mozilla.org. The Chrome extension is signed when installed from the Chrome Web Store.