Skip to content

v1.7.2 — Operability sprint: auto-ban, enrichment, CF fields, nginx UI

Choose a tag to compare

View all tags
@jmrGrav jmrGrav released this 15 Jun 21:48
· 73 commits to main since this release
v1.7.2
This tag was signed with the committer’s verified signature.
jmrGrav
GPG key ID: E34BC7955D46431A
Verified
Learn about vigilant mode.
e70a801
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Operability sprint. Fixes two root causes that had silenced AbuseIPDB reporting since June 13. Introduces live IP auto-banning via Cloudflare IP access rules, gated on local evidence corroboration and AbuseIPDB confidence=100. Adds AbuseIPDB enrichment in Forensic/Security Intelligence, CF named fields in Evidence Detail, and Nginx 4xx/5xx access log view.

Auto-ban (new)

  • Confidence-100 rule: requires local evidence (≥1 event in last 15min) AND AbuseIPDB score=100
  • Burst rule: >30 events in any 30s sub-window per IP
  • Full safety gate: trust registry, quota guard, 24h dedup
  • Enable live mode: set auto_ban_enabled=true in SQLite ui_settings table

Fixes

  • FIX-ABUSEIPDB-SILENCE: LeaseGuard gated on strict-HA profile only
  • FIX-CHECKPOINT: INSERT OR IGNORE for event checkpoint saves
  • FIX-PROVIDER-DIAGNOSTIC: HTTP 401/403 → AUTH_FAILED, 429 → RATE_LIMITED
  • FIX-CF-SUPPRESS: CF Custom Rule + Managed Rule blocks now scored correctly

Features

  • FEAT-AUTOBAN: Live CF IP access rule enforcement with 22 unit tests
  • FEAT-ABUSEIPDB-ENRICHMENT: AbuseIPDB /check in Forensic + Security Intelligence (Manual mode)
  • FEAT-EVIDENCE-CF-FIELDS: ray_id, ruleset_id, rule_id, http_method, edge_response_status, country_name, asn_description
  • FEAT-NGINX-ACCESS: /nginx-access page — Nginx 4xx/5xx log viewer
  • FEAT-PIPELINE-HEALTH: Suppressed breakdown by reason
  • FEAT-AI-EXPLAIN: AI Explain consumes AbuseIPDB enrichment + recent evidence records

Install

dpkg -i security-automation-go_1.7.2_amd64.deb
Assets 3
Loading