IRIS-NG-v1.1.1: retarget from the never-tagged v1.1.0, document the advisories
v1.1.0 was staged on main but never tagged, so every reference to it as the
release a change shipped in was wrong. Retargeted across AI-Features,
Dependency-Policy, IOC-Correlation, Changelog and Kubernetes.
Changelog gains the two UI dependency advisories cleared in v1.1.1
(brace-expansion, socket.io-parser) and links the release.
Kubernetes: chart 0.5.1, appVersion IRIS-NG-v1.1.1, pull commands updated.
72e6cd0
Correlation scoring rewrite, AI troubleshooting, dependency policy
Changelog: adds IRIS-NG-v1.0.2, and IRIS-NG-v1.1.0 marked pending release.
Records that IRIS-NG-v1.0.3 was never released — the version was staged on
main but no tag, release or images were produced, so nothing shipped under
that number and its changes land in v1.1.0.
IOC Correlation: the scoring sections described algorithms that no longer
match the code, and the how-it-works step repeated a misconception the
control's own label encouraged — that "Min shared IOCs" counts cases an
indicator appears in. It counts indicators a case PAIR must share. Rewritten
to state that plainly, with the consequence spelled out: an indicator's fate
is decided by its neighbours, not by itself, so two indicators each present
in exactly two cases can be treated differently.
Decay and confidence rewritten to match what ships in v1.1.0 — tags scale
the half-life rather than the score, age comes from the most recent sighting,
TLP no longer participates, and confidence weighs rarity and credibility
rather than counting indicators. Flags that figures will read lower than
earlier releases, which is a real change analysts will notice.
AI Features: per-surface timeout table replacing the stale 60-90s note, plus
a Troubleshooting section covering the three failures that are hard to tell
apart — an unrecognised model identifier, a model declining security content,
and a timeout — since before v1.1.0 all three displayed the same JSON parse
error.
New Dependency Policy page: why PostgreSQL, jQuery, Node, marshmallow and the
report generator stack are held back, and how to verify a dependency change.
A green build is not evidence a Python upgrade worked; the pkg_resources case
is the reference example, where the image builds cleanly and the application
dies at startup.
266cd7c
IRIS-NG-v1.0.1: chart image tags follow appVersion
The chart attached to IRIS-NG-v1.0.0 was labelled appVersion IRIS-NG-v1.0.0 but
pinned the previous release's images, so installing from that asset deployed
v2.5.0-beta.1+iris-ng.7 without the Sponsor tab or IOC History. An ordering
trap, not a slip: a release's images do not exist until its tag has built, so
hardcoded pins can only be corrected after tagging.
Kubernetes page now documents that the chart does not pin, with a warning about
the v1.0.0 asset. Changelog gains the v1.0.1 row.
0c32cd7
Version scheme IRIS-NG-v1.0.0; document the Sponsor tab and IOC history
Changelog: version-scheme section rewritten for IRIS-NG-v<x.y.z>, stating
plainly that the string is not SemVer-parseable and that 1.0.0 sorts below
every prior release, and that the upstream compatibility range moved to
Settings -> System rather than disappearing. The older +iris-ng.<build> scheme
is kept as a note since those releases are still published. New v1.0.0 row.
Kubernetes: chart 0.3.1 / appVersion IRIS-NG-v1.0.0, image tags repointed to
the IRIS-NG-v1.0.0 images now that they exist, and the "+ becomes -" note
reframed as applying to the older scheme only.
Home: Sponsor tab and IOC history added to the feature list.
86db974
Kubernetes: deploy-tested on kind — add Test results, correct a wrong claim
Installed chart 0.2.0 on kind (Kubernetes 1.34, single node) with shipped
defaults: 5/5 pods Running, PVC bound, 95 tables with Alembic at head, HTTP 200
on /login locally and cross-pod, ai_worker bound to ai_queue at concurrency 1,
and pg_hba showing scram-sha-256 while the app authenticates — which is only
possible because the POSTGRES_PASSWORDD typo is fixed.
Also corrects the TLS-material section. It claimed empty cert Secrets leave pods
stuck in ContainerCreating; the live test showed that is wrong. Pods start and
the app serves fine, but the subPath mount produces an empty directory where the
CA file should be, so the breakage is silent rather than loud. Defaulting
certificates.enabled to false is still right, for a different reason.
Single-node only: node rescheduling, a real CSI driver and a cloud load balancer
are untested.
360d813
Kubernetes: chart 0.2.0 brought forward — rewrite the page around it
The two documented gaps are fixed in the chart, plus two more found while
working on it, so the page no longer reads as a list of things to work around.
- images, ai_worker and placeholder values are handled by the chart's defaults
- persistence section: the chart previously hardcoded a hostPath PV with
ReadWriteMany, which loses the database on reschedule and is unsupported by
most block-storage CSI drivers; now requests the cluster default StorageClass
- database auth: POSTGRES_HOST_AUTH_METHOD was hardcoded to trust
- new "What you must change" (hostname, secrets, size) and "Known gaps"
sections, including that the chart is not deploy-tested on a live cluster
8e6cf1b
Kubernetes: images are published now — three gaps become two
v2.5.0-beta.1+iris-ng.7 published iriswebapp_{app,db,nginx} to GHCR, so the
build-your-own-images prerequisite is gone. Replaces it with pull commands, a
values.yaml snippet pointing at the published images, and a note that the Docker
tag uses a dash where the version uses a plus.
1721573
Changelog: record the v2.5.0-beta.1+iris-ng.7 release and its published images
9b53ab2
Kubernetes: drop the paying-customer clause from the referral note
c191f01
Add Kubernetes page with DigitalOcean referral; link from Home and Getting Started
The Helm chart at deploy/kubernetes exists but is inherited from upstream and
is not deployable as committed. The page documents the three gaps rather than
implying a working one-command install:
- no images are published (the ghcr workflows fire only on a v*.*.* tag, and
no container packages currently exist), so users must build and push first
- values.yaml ships literal placeholders (<irisapp_image>, <host_name>, ...)
- the chart has no ai_worker, so AI summary and chat jobs enqueue and are
never consumed -- a silent failure, not an error
Also covers installing, persistence, sizing, and points at Docker Compose on a
single host as the tested path for evaluation. The DigitalOcean link is
disclosed as a referral link at both the wiki and README.
e06d3f6
Add Case Notifications page; document the two navigation templates
New page covering the per-case updates bell: what counts as an update, the
durable per-(user, case) read watermark, the 14-day lookback on first sight
of a case, the panel, the three endpoints and the upgrade path.
- Home: Pages table entry and a Notifications section under what's new
- API Reference: Notifications endpoints under Cases
- Development Guide: new gotcha — the header exists twice
(navigation.html for dashboard/manage, navigation_ext.html for case
pages) and both are live, so shared header UI belongs in a partial
included from both
- Changelog: entry for the bell
- Scripts Reference: fix a broken anchor to the post-migration login
failure section (GitHub strips the em-dash, leaving two hyphens
from the two spaces, not four)
6683787
Add MISP Cluster Publishing page; document module config drift fix
New page: MISP Cluster Publishing — the IrisMISPCluster module. Covers
why the trigger is an explicit button rather than a hook, the mapping of
each content type to the MISP structure that models it (narrative to
Event Report, linked notes to analyst Notes on their indicator,
ioc_description to the attribute comment, tags, campaign galaxy), and
why the full typed pair list is used rather than the 20-value display
cap.
Documents the redaction model in full: terms derived on every push from
every client name in the instance plus the cluster's case names, the
stoplist that preserves incident and sector vocabulary (sector language
is the shareable context the narrative prompt deliberately produces),
IOC values never being redacted because a lookalike domain is the
intelligence, and the honest limit — term matching is not named-entity
recognition, so possible_unredacted_names exists to surface what the
heuristics cannot derive.
Development Guide: two new gotchas.
- Module config schemas are frozen at first registration. Adding a
parameter never reached an existing install, and an incomplete stored
entry raised KeyError in is_mod_configured(), surfacing as a 500 on
/manage/modules/list and an opaque DataTables Ajax error with no clue
to the cause. Documents the boot-time reconciliation that now fixes
it, and the complete-entry rule for anyone hand-editing module_config.
- MISP analyst-data returns a misleading 403 for two undocumented shape
requirements: the body must be wrapped as {"Note": {...}}, and
distribution must be 0-3 because analyst data rejects "inherit event".
Home, MISP Integration, IOC Correlation, API Reference and Changelog
updated with the new page, the Push to MISP button and the misp-push
endpoint.
65d81bf
Document manual override of AI summary and cluster narrative
AI Features: new "Manual override" section covering the shared mechanics
- the three case_ai_artifact columns, display_content/is_edited, the
serializer's content vs ai_content split, the HTTP 409 regeneration guard
and why it lives in the endpoint rather than the browser, provenance and
revert, a per-surface comparison table, and a four-step recipe for
extending it to another cached AI surface without a migration.
IOC Correlation: "Correcting a narrative by hand" under the cluster
narrative section, plus a note in the STIX section that edits are
exported - a corrected title becomes campaign.name and corrected prose
becomes campaign.description, with the caveat that the v2 prompt's
entity-name prohibition constrains model output, not text an analyst
types. Corrected the CaseAiArtifact field-name note to mention
display_content.
Development Guide: new gotcha for response_api_error() - its second
positional is `data`, not a status code, and it always emits 400, so
several existing calls that pass 503 are really 400s carrying data:503.
Documents building the body via response() when another status is needed.
API Reference, endpoint tables and Home updated with the four new routes
and the discard_edit parameter.
2fdb651
Brand wiki as Community Edition; fix release table accuracy
Home: new "Community Edition" and "Contributing and support" sections
(LGPL-3.0, no feature gates, no license key or activation, no telemetry,
self-hosted); title and intro updated.
Getting Started: state up front that no registration, activation or
license key is required anywhere in the install.
Development Guide: new "Contributing" section — branch table (`main` is
the PR target; `develop` is retired with unrelated history), pre-PR
checklist covering the roadmap, CODESTYLE, the three-layer rule, ORM
CHECK constraints and deploy verification, plus security-issue routing.
Changelog: version scheme corrected to `+iris-ng.<build>` with a note
explaining the `iris-next` -> `iris-ng` rename and the skipped `.5`.
Added the `v2.5.0-beta.1+iris-ng.6` release. Rows for `iris-next.5`,
`.1` and `.0` relabelled as milestones — only four releases are actually
published, and listing unpublished builds as tagged releases was
misleading.
e4edc7d
Add Knowledge Map page; document setuptools/pkg_resources + rolldown window gotchas
- New Knowledge-Map page: the case Graph tab was undocumented. Covers the
four layers and their source tables, event vs direct edge kinds, the
three link tables feeding direct edges, API response shape, and the
three non-obvious behaviours (linked-only nodes, suppressed redundant
direct edges, IOC-centric Notes layer).
- Home: nav row + case-relationships bullet.
- Development Guide: window-exposure escape hatch for ui/src/pages files
that cannot move to ui/public (treeshake:false does not save uncalled
declarations under rolldown); new section on setuptools >= 83 --
pkg_resources removal only surfaces at app boot, so a green docker
build is not validation. Includes the 3-step acceptance bar.
- Scripts Reference: add seed_wayne_demo.py; expand
backfill_ioc_note_links.py with the PYTHONPATH and MSYS_NO_PATHCONV
requirements and the truncated-hash matching limit.
- Changelog: knowledge map, dependency sweep, setuptools shim.
ed818a9
Docs sync: fix Getting Started cert step, strip private Claude integration, add 3 pages
- Getting Started: add required generate_dev_certs.sh step + iris_helper.sh --init
one-shot; correct false "cert generated at container start" claim (certs are
host-generated and bind-mounted read-only); add nginx cert-perms troubleshooting.
- Remove Claude proxy sidecar + per-case Claude memory (not in the public repo):
AI-Features (sidecar/memory sections, backend row, timeout row), Architecture
(claudeProxy/ tree line), Getting Started (service row, port 7440, pointer).
Kept SYNTHESIZER_FAST_MODEL_MAP model routing (real public code).
- New pages: Analyst Time Tracking, Analyst Skills and Teams, Case Export / Import.
- Home: nav rows + at-a-glance links for the three new pages.
3246d54
[FIX] Correlation: fix duplicate AI cluster narrative section; merge entity-name prohibition into first section; consolidate STIX export docs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ddf478d
[ADD] wiki: STIX export + cluster narrative v2 + marshmallow empty-string gotcha + timeline dedup section
- IOC-Correlation.md: add STIX 2.1 export section (GET /clusters/<id>/stix), AI
narrative enrichment in STIX bundles, CaseAiArtifact field name gotcha
(art.content not art.artifact_content; generated_at not created_at), cluster
narrative prompt v2 entity-name prohibition; add STIX endpoint to the table
- AI-Features.md: update AI cluster narrative entry with prompt v2 constraint and
STIX safety note
- Development-Guide.md: add marshmallow Integer empty-string gotcha (convert "" to
null before JSON.stringify for nullable numeric fields in settings forms)
- Dual-Timeline.md: add Deduplication section (exact + near-dup, endpoints, FK
cleanup load-bearing rule, no-migration deploy)
3122767
[FIX] settings: 400 on save when integer fields blank
7bb156c
[FIX] correlation: add generated_at fix to 2026-07-19 changelog entry
59d17f3
[FIX] correlation: STIX narrative lookup bug (art.content) + clarify 2026-07-19 entries
749d111
Changelog: STIX narrative enrichment + cluster narrative prompt v2
0c82c9e
[IMP] Changelog: STIX 2.1 cluster export (2026-07-18)
b1f116a
Update wiki: sortable inventory, timeline sort, analytics page, User.user gotcha
12bb535
Merge branch 'master' of https://github.com/zach115th/iris-ng.wiki
a325f77
Changelog: add timeline date sort entry
f686766
Updated Evidence Inventory (markdown)
f019455
[ADD] wiki: Evidence-Inventory page + reasoning model, Vite 8, retention policy updates
New page: Evidence-Inventory.md — drive lifecycle, status donut chart, data retention
policy, barcode lookup, auto-link in evidence modal, wipe/rotate workflow, API endpoint
table, 6-touch pattern for new drive fields.
Updated pages:
- AI-Features.md: reasoning model support section (Gemma-4 channel format, DeepSeek/Qwen
<think> tags, _last_json_object fallback, max_tokens guidance for reasoning models)
- Development-Guide.md: Vite 8/rolldown 1.1.4 gotcha (import-free JS → ui/public/,
vite-plugin-static-copy >=3.3.0 for Vite 8)
- Changelog.md: iris-next.5 entry (status donut chart + data retention policy)
- Home.md: Evidence Inventory page link in table, Dashboard + Settings bullet updates
6b5acea
Updated Changelog (markdown)
8435839
Updated Getting Started (markdown)
d75ace6