PCAP Hunter 2.0.0 turns the project into a more evidence-aware threat-hunting workbench while strengthening both the Streamlit and headless API workflows.
Highlights
- Dedicated MITRE ATT&CK Analysis workspace with ATT&CK 19.1 hypotheses, supporting evidence, coverage gaps, analyst dispositions, and Navigator 5.3.2 export metadata.
- Capture-quality telemetry for packet/flow scale, parser coverage, time window, detector availability, sampling limits, completed stages, and warnings.
- Validated streaming
.pcap/.pcapngupload intake with bounded file and batch limits, magic-byte checks, and rollback on rejection. - Integrations API results now include ATT&CK mappings and capture metrics; IOC feeds include related technique IDs.
- Deterministic evidence remains visible when the optional LLM report is skipped or unavailable.
- More reliable Docker LM Studio routing, HTTP payload carving, case re-save behavior, and UTC PDF timestamps.
Documentation
- Rewritten English and Traditional Chinese README content covering the version 2 workflow.
- Eleven screenshots captured from the real Docker-hosted Streamlit application against the bundled sample PCAP.
- Screenshot capture uses isolated data and pixel-level masking for IPv4, IPv6, API secrets, email addresses, and local user paths, followed by an OCR privacy audit.
Verification
- Host release gate: 1,006 passed, 22 skipped.
- Docker/Python 3.11 release gate: 1,006 passed, 22 skipped.
- Required pull-request and post-merge GitHub Actions checks passed.
Upgrade notes
- Existing case databases are upgraded in place with new ATT&CK and capture-metric columns.
- Rebuild the Docker image with
make docker-upafter pulling this release. - LM Studio defaults to port 1234; Docker routes the host service through
host.docker.internal.
Full details are in CHANGELOG.md.