Winnow 0.3.0

First release since 0.2.0, and a large one: the analysis layer around the grid grew into most of what an investigation needs, and this cycle closed a round of hardening on top of it.

What's new since 0.2.0

Dashboards and analysis profiles. Build a board from the grid — right-click a value to count it, or use the guided widget editor — and click any number to open the rows behind it. Two profiles ship ready to apply: KAPE triage and ESXi / UAC triage, each a bundle of plugins, a watchlist and a board.

Plugins. A full host with five extension points (ingest formats, tabs, API routes, row actions, toolbar panels) and seven bundled examples, off until you turn them on: raw NTFS $MFT/$J parsing, ESXi and UAC log parsing, a pivot table, session bookends, a lateral-movement graph, a time histogram you drag to set the timeframe, and a Claude assistant that sees the schema and writes queries.

Sessions you can compare. Named snapshots of your tags and notes live in the case file and travel with it. Comparing two shows counts per table, and clicking a count opens exactly those rows in the grid, each marked with which session tagged it.

More evidence in one place. Merge same-shaped exports from a fleet into one view. Sweep an indicator across every registered case, query several at once, or read their timelines side by side. Import Plaso storage files, Excel workbooks, and ESXi or UAC bundles as zip/tar archives with nested archives expanded.

Reading the data. Derived columns from timestamps in any format, from regex capture, from nested JSON and XML, or looked up against another table. A stack view for rarest-first values, an IOC watchlist, Markdown case notes, a folder tree in the sidebar, and a SQL pane with saved query tabs.

Getting in and out. Double-click launchers for Linux, macOS and Windows, OS file associations, and in-place updates that never touch your cases, plugins or workspace.

Hardening in this release

• The SQL pane's read-only guarantee is now enforced by the database connection rather than by scanning the query text, which a comment could talk past.
• A filter naming a column the table does not have is refused instead of dropped. Dropping it showed more rows than asked for, under a filter that claimed to be applied.
• Undo after loading a session no longer replays against tag state that load replaced.
• The cross-case indicator sweep no longer skips a table whose header contains a quote, which silently reported zero hits.
• The server validates the Host header, so a web page cannot reach the API by re-pointing its own name at your machine. Use --allow-host if you front Winnow with a name.
• Opening a case refuses files that are not cases, rather than writing Winnow's tables into them.
• Plugins can no longer write to source or analyst tables.
• Switching cases no longer carries the previous case's notes, marks, jobs or filters into the next one.
• Several conditions that returned an internal error now report what actually happened and can be retried.

Upgrading

Case files from 0.2.0 open as they are; new tables are added on open. python update.py updates in place, or download the archive below. Needs Python 3.9+ and the four packages in requirements.txt.