v1.1.0

What's Changed

• docs: add installation guide + refresh docs post-v1.0.0 by @elakkuvan-r in #47
• feat: whisper.online agent-activity log source (op:logs → Wazuh) (#35) by @kakooch in #36
• docs: cover the agent-activity log source (keyed tier) by @elakkuvan-r in #48
• docs: clarify keyless enrichment vs keyed tiers + pricing by @elakkuvan-r in #49
• from develop to main by @elakkuvan-r in #50
• docs: stage wazuh/integrations submission package (enrichment connector) by @elakkuvan-r in #51
• chore: prepare v1.1.0 release by @elakkuvan-r in #52
• Release v1.1.0 by @elakkuvan-r in #53

New Contributors

• @kakooch made their first contribution in #36

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

• docs: add CONTRIBUTING.md by @elakkuvan-r in #6
• Add local Wazuh single-node dev stack with Traefik domain access by @elakkuvan-r in #7
• Add optional Wazuh agent overlay for live test data by @elakkuvan-r in #9
• docs: Whisper→Wazuh data/field mapping spec (#3) by @elakkuvan-r in #10
• docs: MVP acceptance criteria & test plan (#5) by @elakkuvan-r in #11
• feat: custom-whisper connector — scaffold + Whisper enrichment (#13, #14) by @elakkuvan-r in #23
• feat: persistent SQLite dedup cache (#15) by @elakkuvan-r in #24
• feat: analysisd socket write-back + whisper_rules.xml (#16) by @elakkuvan-r in #25
• feat: indexer template for data.whisper.* + null-stripping (#17) by @elakkuvan-r in #26
• feat: install.sh / uninstall.sh + dev targets + TLS/dedup fixes (#18) by @elakkuvan-r in #27
• fix: Whisper WAF User-Agent (enrichment now works live) + dev .env key passthrough by @elakkuvan-r in #28
• feat: Tier-1 enrichment expansion — prefix threat, confirmed-bad verdict, suspicious links (#29, #30) by @elakkuvan-r in #34
• feat: opt-in TLS-fingerprint (Cobalt Strike JARM) enrichment (#32) by @elakkuvan-r in #37
• feat: whisper-investigate — on-demand analyst investigation CLI (#33) by @elakkuvan-r in #38
• ci: lint + unit tests on PR (#21) by @elakkuvan-r in #39
• feat: dev-demo-enrich target + captured Tor-IP scenario doc (#19) by @elakkuvan-r in #40
• test: e2e acceptance runner TC-01..TC-22 against the live stack (#20) by @elakkuvan-r in #41
• docs: architecture overview with a solution diagram by @elakkuvan-r in #43
• fix: restore dev-acceptance target + TC-07 doc accuracy (QA findings) by @elakkuvan-r in #44
• feat: release packaging — versioned tarball + BYOK key UX (#42 ①) by @elakkuvan-r in #45
• feat: bootstrap installer + .deb/.rpm packages (#42 ②③) by @elakkuvan-r in #46

New Contributors

• @elakkuvan-r made their first contribution in #6

Full Changelog: https://github.com/whisper-sec/whisper-wazuh/commits/v1.0.0