v0.3.0

This release focuses on improving the reliability of long-running investigations and refining the investigation loop, drawing on architectural ideas from ARTEX.

Highlights

Investigation Harness

• Refined task planning, execution, and persistent state management, inspired by ARTEX.
• Improved handling of repeated queries, stalled investigations, missing evidence, and conflicting findings.
• Improved recovery from LLM connection failures and interruptions.
• Simplified context management by building working context directly from the investigation state in DuckDB.

Interface Simplification (Breaking Change)

• Removed the Web UI and HTTP API to reduce complexity and focus development on the investigation core.
• Introduced a dedicated Runtime and lightweight TUI as a foundation for interactive investigation control, including instructions and additional evidence during an investigation.
• Added background execution and case attachment through the CLI.

Evidence and Reporting

• Strengthened evidence verification and traceability.
• Simplified report generation by removing the separate LLM-driven investigation loop from the reporting process.
• Reports are generated from evidence-backed results in Markdown and HTML. Structured investigation data and supporting results are also available as JSON and CSV.
• Unverified LLM-generated narration is kept in investigation records rather than published reports.

Configuration and Rules

• Added FORENSIA.md for investigation policies and REPORT.md for customizable report specifications.
• Added Sigma rule acquisition, conversion, and validation through setup, with custom rules supported via --rules.
• Improved Registry evidence ingestion and handling of partially extracted artifacts.

Other Changes

• Updated artifact parsers:
  • evtx2es 1.13.0
  • mft2es 1.11.0
  • prefetch2es 2.7.1
  • reg2es 2.4.1
• Reorganized documentation, examples, and evaluation utilities.

Full Changelog: v0.2.2...v0.3.0

v0.2.2

A major update to the investigation engine, focused on reliability, auditability, and extensibility.

Highlights

• Redesigned the case-aware investigation loop with deterministic hypothesis selection, evidence sufficiency checks, and explicit blocked/untestable states
• Added hypothesis relationships, evidence coverage tracking, and resumable investigation tasks
• Added scoped memory retrieval and --knowledge support for organization-specific Markdown references
• Improved report generation, evidence provenance, gap tracking, and fallback behavior
• Added automatic rulepack selection based on available artifacts
• Moved more investigation policies, query templates, and report behavior into declarative YAML
• Reorganized the package into focused investigation, hypotheses, checking, prompts, evidence, and knowledge modules
• Added extension points and documentation for custom artifacts, rules, report blocks, and quality checks
• Fixed numerous report, timestamp, rule, UI, JSON, and LLM handling issues

Breaking changes

Internal module paths and package layout have changed significantly. Integrations importing internal forensia modules may need to update their imports.

Full Changelog: v0.1.2...v0.2.2

v0.1.2

Full Changelog: v0.1.1...v0.1.2

Initial-Release

Full Changelog: https://github.com/sumeshi/forensia/commits/v0.1.0