Add Case Notifications page; document the two navigation templates
New page covering the per-case updates bell: what counts as an update, the
durable per-(user, case) read watermark, the 14-day lookback on first sight
of a case, the panel, the three endpoints and the upgrade path.
- Home: Pages table entry and a Notifications section under what's new
- API Reference: Notifications endpoints under Cases
- Development Guide: new gotcha — the header exists twice
(navigation.html for dashboard/manage, navigation_ext.html for case
pages) and both are live, so shared header UI belongs in a partial
included from both
- Changelog: entry for the bell
- Scripts Reference: fix a broken anchor to the post-migration login
failure section (GitHub strips the em-dash, leaving two hyphens
from the two spaces, not four)
Add MISP Cluster Publishing page; document module config drift fix
New page: MISP Cluster Publishing — the IrisMISPCluster module. Covers
why the trigger is an explicit button rather than a hook, the mapping of
each content type to the MISP structure that models it (narrative to
Event Report, linked notes to analyst Notes on their indicator,
ioc_description to the attribute comment, tags, campaign galaxy), and
why the full typed pair list is used rather than the 20-value display
cap.
Documents the redaction model in full: terms derived on every push from
every client name in the instance plus the cluster's case names, the
stoplist that preserves incident and sector vocabulary (sector language
is the shareable context the narrative prompt deliberately produces),
IOC values never being redacted because a lookalike domain is the
intelligence, and the honest limit — term matching is not named-entity
recognition, so possible_unredacted_names exists to surface what the
heuristics cannot derive.
Development Guide: two new gotchas.
- Module config schemas are frozen at first registration. Adding a
parameter never reached an existing install, and an incomplete stored
entry raised KeyError in is_mod_configured(), surfacing as a 500 on
/manage/modules/list and an opaque DataTables Ajax error with no clue
to the cause. Documents the boot-time reconciliation that now fixes
it, and the complete-entry rule for anyone hand-editing module_config.
- MISP analyst-data returns a misleading 403 for two undocumented shape
requirements: the body must be wrapped as {"Note": {...}}, and
distribution must be 0-3 because analyst data rejects "inherit event".
Home, MISP Integration, IOC Correlation, API Reference and Changelog
updated with the new page, the Push to MISP button and the misp-push
endpoint.
Document manual override of AI summary and cluster narrative
AI Features: new "Manual override" section covering the shared mechanics
- the three case_ai_artifact columns, display_content/is_edited, the
serializer's content vs ai_content split, the HTTP 409 regeneration guard
and why it lives in the endpoint rather than the browser, provenance and
revert, a per-surface comparison table, and a four-step recipe for
extending it to another cached AI surface without a migration.
IOC Correlation: "Correcting a narrative by hand" under the cluster
narrative section, plus a note in the STIX section that edits are
exported - a corrected title becomes campaign.name and corrected prose
becomes campaign.description, with the caveat that the v2 prompt's
entity-name prohibition constrains model output, not text an analyst
types. Corrected the CaseAiArtifact field-name note to mention
display_content.
Development Guide: new gotcha for response_api_error() - its second
positional is `data`, not a status code, and it always emits 400, so
several existing calls that pass 503 are really 400s carrying data:503.
Documents building the body via response() when another status is needed.
API Reference, endpoint tables and Home updated with the four new routes
and the discard_edit parameter.
Add initial wiki (11 pages)