Skip to content

v0.45.0

Latest
Latest

Choose a tag to compare

View all tags
@hasamba hasamba released this 05 Nov 08:49
· 108 commits to master since this release
v0.45.0
447e6a7

Added

  • Built-in HTTPS — on by default in team mode, from a private local CA with silent renewal; behind a plain-HTTP proxy set DFIR_HTTPS=off (closes #2285)
  • Per-case server sets — each case remembers its IRIS, Timesketch and Velociraptor servers (#2274)

Changed

  • Decision model picker — any OpenRouter decision model for the missed-evidence review and containment check; "Jev" is now "Decision model" (closes #2224)

Fixed

  • Writer lock across hosts — a lock left by another container or machine is judged by its heartbeat (closes #2287)
  • Settings values with # or quotes — read the same at restart and on Test / reconnect; re-save secrets that contain # (closes #2280)
  • "Run " keeps records added during the run — a drop file that changed while its tool ran stays eligible (closes #2283)
  • Stuck drop file — a file that cannot be moved out of drop/ is held back, not re-imported (closes #2281)
  • Cross-disk drop move — streams the file instead of reading it whole (closes #2270)
  • Outbound redirects — follow HTTP rules; a cross-server redirect that carries headers or a body is refused (closes #2269)
  • Outbound URL guard cleanup — unpinned helper and fetch type casts removed (closes #2271, closes #2268)
  • Team-mode Docker restart loop — a lock left by an unclean exit no longer blocks the next container (closes #2278)
  • Docker ./data mount — Settings, views, templates, tagger rules, notifications and logs survive a container recreate (#2277)
  • Docker ./auth mount — team accounts survive a container recreate (#2276)
  • Guarded downloads — Velociraptor, Sigma, KEV, webhooks and audit export no longer fail with invalid onRequestStart method (#2267)
  • Sigma re-grade guard — one re-grade per case at a time, sized by the import memory guard (closes #2227)
  • Undo error reporting — a failed rollback no longer hides the original error (closes #2228)
  • Decision-model review spend — a stopped review still records its cost (closes #2235)
  • Missed-evidence model per row — each row names the model that graded it (closes #2236)
  • Sigma "Filtered by status" pill — has its own colour (closes #2233)
  • Decision-model spend bound — documented and tested (closes #2242)
  • Headline-model tests — no longer depend on reply timing (closes #2243)
  • Sigma search listeners — reopening the tab no longer adds copies (closes #2232)
  • Import memory estimate — an uncapped caller is not cut to the event cap (closes #2234)
  • Decision-model headline — names the model that billed the most tokens (closes #2240)
  • Failed screenshot analysis — retried up to 3 times with backoff (closes #2248)
  • Screenshots stranded by a restart — analyzed after the next start (closes #2249)
  • AI catch-up safety — stops on pause and never moves the analysis point backwards (closes #2250)
  • Unreadable screenshot — skipped instead of failing its batch (closes #2251)
  • Corrupted capture log — a clear "needs repair" message; the extension keeps screenshots queued (closes #2252)
  • Capture sequence speed — numbering no longer re-reads the capture log (closes #2253)
  • Extension login errors — refused screenshots stay queued; other cases' queues are kept (closes #2254)
  • Extension capture throttle — triggers are rate-limited; the status badge stays accurate (closes #2255)
  • Extension queue write failure — reported instead of lost (closes #2256)
  • Extension popup — dead dedup field removed, 30 s timer minimum, no REC without a case (closes #2257)
  • Extension push feedback — AI-off pushes say "not analyzed"; an uncertain push is never re-sent (closes #2258)
  • Update rules without a case — works with no case open; team login needs a global admin (closes #2259)
  • Expired session on mobile and presentation pages — both go to the login page (closes #2260)
  • Manual fixes — presentation filter, preflight route and screenshot batching documented (closes #2261)
  • Small hygiene fixes — documentation and a slow test's time limit (closes #2262)
  • Kept screenshot backoff — re-sent with a growing wait (closes #2263)
  • Per-case Update rules permission — needs a global admin under team login (closes #2264)
  • Held screenshot status — the AI status shows screenshots waiting for a retry (closes #2265)
  • Archive during backup restore — waits for the restore to finish (closes #2247)

Verifying downloads. Every release carries SHA256SUMS.txt. On Linux run
sha256sum -c SHA256SUMS.txt --ignore-missing in the download folder. On Windows run
Get-FileHash <file> -Algorithm SHA256 and compare the hash with the matching line in
SHA256SUMS.txt.

Signing status. The Windows EXE and the Linux AppImage are not code-signed, so Windows
SmartScreen warns on first run. The Firefox extension zip is unsigned until it is installed
from addons.mozilla.org. The Chrome extension is signed when installed from the Chrome Web Store.

Assets 8
Loading