Repository navigation
HORUS v4.1.0 makes repeat case triage easier to review and PE comparisons easier to automate.
Highlights:
- Each case refresh records what changed in the current run: added, modified, restored, missing, removed by
--prune, and assessment-changed samples. Review thechangesarray andsummary.changesincase.json, the newchanges.csv, or the offline dashboard. - The feed covers the latest refresh, not a historical audit log. Use
--verifyto detect edits that preserve both file size and modification time. horus --diff a.exe b.exe --jsonprovides a machine-readable PE comparison. Incomplete or non-PE comparisons setanalysis_statustounknownand exit 3 instead of implying a complete PE comparison.- Malformed PE input handling and CLI mode validation are stricter.
- The established direct-file, case, and opt-in enrichment workflows remain available. Samples are never uploaded by HORUS.
The three binaries target Windows 10/11 x64. They are not Authenticode-signed; verify downloads with SHA256SUMS.txt and GitHub artifact attestations.