v0.3.0

This release focuses on improving the reliability of long-running investigations and refining the investigation loop, drawing on architectural ideas from ARTEX.

Highlights

Investigation Harness

• Refined task planning, execution, and persistent state management, inspired by ARTEX.
• Improved handling of repeated queries, stalled investigations, missing evidence, and conflicting findings.
• Improved recovery from LLM connection failures and interruptions.
• Simplified context management by building working context directly from the investigation state in DuckDB.

Interface Simplification (Breaking Change)

• Removed the Web UI and HTTP API to reduce complexity and focus development on the investigation core.
• Introduced a dedicated Runtime and lightweight TUI as a foundation for interactive investigation control, including instructions and additional evidence during an investigation.
• Added background execution and case attachment through the CLI.

Evidence and Reporting

• Strengthened evidence verification and traceability.
• Simplified report generation by removing the separate LLM-driven investigation loop from the reporting process.
• Reports are generated from evidence-backed results in Markdown and HTML. Structured investigation data and supporting results are also available as JSON and CSV.
• Unverified LLM-generated narration is kept in investigation records rather than published reports.

Configuration and Rules

• Added FORENSIA.md for investigation policies and REPORT.md for customizable report specifications.
• Added Sigma rule acquisition, conversion, and validation through setup, with custom rules supported via --rules.
• Improved Registry evidence ingestion and handling of partially extracted artifacts.

Other Changes

• Updated artifact parsers:
  • evtx2es 1.13.0
  • mft2es 1.11.0
  • prefetch2es 2.7.1
  • reg2es 2.4.1
• Reorganized documentation, examples, and evaluation utilities.

Full Changelog: v0.2.2...v0.3.0