Changelog¶

Version history for WitFoo products.

v1.1.2 (2026-08-13)¶

Maintenance release focused on event-time search correctness and a broad data-onboarding expansion. Drop-in upgrade from any 1.1.x; no configuration or schema changes. Full release notes.

Search timing¶

Artifacts are searched by event time — when a parser reads the event's own timestamp, timelines, windows and drill-downs use it, so telemetry arriving minutes or hours late (relayed Zeek/Corelight sensors, store-and-forward syslog, pull connectors) lands in the window where an analyst will look. Timestamps are sanity-bounded (≤30 days late, ≤1 hour skew); out-of-bounds values and pre-1.1.2 records fall back to arrival time
Fixed: timeline showed records but filters returned no rows for lagging sources (observed live on a relayed Corelight feed ~3.5h behind)
"Filter for" pivots use exact matching, mirroring the facet panel and running faster server-side

Data onboarding¶

Zeek / Corelight full extraction — ISO 8601 timestamps (Corelight default) previously fell to a generic classification with no client/server addresses; all timestamp forms now handled, log types routed by _path, Corelight extensions (L2 addresses, VLAN, app tags, shunt counters) captured
Cisco Secure Network Analytics (Stealthwatch) 7.x CEF alarms fully parsed as security signal; legacy format unchanged
Palo Alto PAN-OS SYSTEM logs (device telemetry, URL-database updates and other operational subtypes) recognized on current PAN-OS releases
Microsoft Graph: alerts from all Defender workloads (was Office 365 only) + Secure Score posture snapshots
VMware: vCenter SSO auth failures (expired/locked accounts), NSX-T DFW packet logs on ESXi 8, NSX network-operations agent, ESXi 8 system services, VxRail manager services, ESXi Envoy proxy
New sources: Lantronix (Uplogix) Local Manager, Cisco AP watchdog telemetry, HPE ProLiant Management Agent storage events

Pipeline reliability¶

Automated parser-coverage pipeline correctly recognizes already-handled formats; appliance-internal service chatter classified as diagnostics (never false security signal); advisory-scan and release-tag CI hardening

v1.1.1 (2026-08-10)¶

Maintenance release covering everything since 1.1.0 — appliance reliability, broader VMware and Azure onboarding coverage, reporter and demo-data corrections, the WitFoo Console deployment option, and a security pass. Drop-in upgrade from 1.1.0; ships alongside WFA 2.4.13. Full release notes.

Appliance reliability¶

Role changes complete cleanly — reconfiguring an appliance from one role to another (e.g. Conductor → All-in-One) previously left the old role's containers running and holding their ports, so the new role's web front end could not start ("port is already allocated"). The agent now reclaims the previous role's containers before starting the new stack and on each reconcile pass, matching only WitFoo's own container names so anything else on the host is untouched. Requires WFA 2.4.13
Shutdown attempts every container and reports all failures together, instead of abandoning the remainder at the first problem
Unused images and orphaned broker data reclaimed automatically after upgrades or re-identification
Support packages now capture the Conductor UI and both message brokers, and no longer include configuration secrets
All-in-One + Conductor appliances report pipeline health — that role previously emitted no pipeline metrics in status reports
Disk-capacity enforcement clamped to warnings while the measurement basis is corrected; alerts still fire
wfa user-reset heals an older-install schema difference

Data onboarding¶

Widened VMware ESXi / vCenter / NSX / vSAN and Dell VxRail coverage from live unrecognized-traffic analysis
New coverage for Arista flow control, Stealthbits Activity Monitor, and CalPrivate
Corrected stream and event classifications for the 2026-08 device batch
Azure / Microsoft connector resilience — Sentinel, Graph, Defender for Vulnerability Management and LimaCharlie now decode authentication token responses robustly
Log framing corruption fixed for newline-delimited TCP; byte-window framing corruption is now classified as a transport problem rather than an unknown device type

Deployment¶

WitFoo Console deployment option — selectable as a node role during appliance configuration, licensed as its own no-cost option

Reporter¶

Report generation and date-range queries no longer hit the short request timeout that returned errors or empty pages; generation is restricted to administrators
Demo cost-savings report no longer shows all zeros

Security¶

Report access enforces role permissions — the reporting endpoints checked authentication and organization but not the caller's role, so any signed-in organization member could read report snapshots and export CSV, including roles intended to have no reporting access. Every reporting route now requires the appropriate read or export permission, with an automated check preventing recurrence. Organization scoping was always enforced, so no cross-organization exposure was possible. Upgrade recommended
gRPC dependency updated to its patched release (high-severity advisory)
Container build no longer fetches a CLI tool over the network during the image build
All open code-scanning findings reviewed — fixed or documented with a specific justification, with residual items owned rather than untriaged

Monitoring¶

Fleet-outage detection no longer depends on the telemetry an outage suppresses; alert thresholds count unbroken failure streaks; probes blocked by an intermediary report as unverified rather than healthy
Approved device parsers propagate to customer-production images automatically

v1.1.0 (2026-07-14)¶

Feature release on the 1.0.0 GA line — from signal to evidence and decisive action. Sharper investigations, the new Certify compliance-certification capability, scheduled report delivery, broader data onboarding, and a hardened, verified multi-tenant foundation. A recommended, drop-in upgrade for all 1.0.x deployments. Watch the 1.1.0 tour.

Investigation¶

One-click CVE explanations — click any CVE in a report or on a host for a plain-language explanation (severity, description, weakness type), served offline from a committed CVE library with no internet calls
Exploitability-aware threat scoring — a live vulnerability on a host connected to an outside asset now raises incident suspicion and flags attacker and victim, with a new "Weak Edge" view (CVE × technique × attacker × victim) alongside Attack Chain
Verdict-first entity detail — the node/entity panel leads with a clear verdict ("Suspicious · 39% · Medium") then why-flagged / where-who / related / activity, values humanized, raw JSON and schema behind an Advanced disclosure
In-panel relationship pivoting — search all of an entity's relationships from its panel with a "Top relationships" shortlist (internal users first)
The true target of an attack is always visible — the internal host under attack is no longer missing from a work unit's evidence and graph; attacker→victim is correctly linked

Asset & Identity¶

Accurate internal-user classification — a user counts as internal/managed only when sourced from a real identity system (Entra ID, AD, Okta, Ping…); log noise and failed logins no longer inflate the count
Open-port visibility on assets — assets carry the observed network services (open ports), searchable and filterable from asset search
Full-scope range filtering — min/max filters for an asset's port, vulnerability, and product counts now narrow the entire dataset, not just the rows on screen

Compliance & Certify¶

Certify — audit certification packages (SOC 2 / ISO 27001 / CMMC) — build an audit submission inside WitFoo with guided questions, malware-scanned attachments, and live-data auto-population, exported as one integrity-hashed package (report + attachments + manifest) streamed on demand (Pro/Max tiers)
One Auditor, many frameworks — adds PCI DSS v4.0 and Essential Eight mappings beyond CIS Controls
ISO 27001 updated to the 2022 standard — built-in ISO 27001 moves to the current :2022 Annex A (93 controls)
Honest compliance-readiness score — partial control coverage now counts as partial, so the readiness percentage reflects reality

Reporting & Data¶

Scheduled report delivery — schedule reports and dashboards as offline PDFs delivered on a cadence to notification channels (email attaches the PDF; Slack and webhook get a link and summary)
Retention-ceiling visibility — the health dashboard charts the oldest record's age against the enforced retention limit, per data type

Integrations¶

LevelBlue / USM Anywhere ingest — pull LevelBlue (AlienVault) USM Anywhere alarms and events via one API credential per tenant, with no endpoint or agent changes
VMware NSX-T log coverage — recognizes and classifies NSX-T log sources that had been flooding the unknowns bucket
Accurate Integration Health — a raw log-server listener is no longer shown as an API-pull integration; only genuine integrations appear
Self-monitoring of ingestion quality — automated monitoring flags data-classification anomalies and opens a tracked issue on its own
vCenter Broker telemetry parser — added, queued for human sign-off before activation

Reliability & Demo¶

Dependable operations dashboard — the Conductor dashboard no longer hangs on endless spinners; it shows data fast, fills charts from the last known-good view, marks stale data, and offers Retry on failure
Realistic, story-driven demo — a coherent scenario around a believable regional-healthcare organization facing technique-mapped attacks replaces random demo noise

Trust & Quality¶

Tamper-proof cross-cluster threat intel — shared threat-intel messages between clusters are cryptographically sealed end to end (body, not just labels), rolled out to keep mixed-version clusters working during upgrades
Verified access-control enforcement — automated safeguards confirm every part of the platform enforces the correct permissions; remaining gaps were closed
New permissions reach upgraded customers — new permissions (Certify, graph, automation) converge to already-deployed environments on upgrade, with no admin hand-editing of roles
Quality & multi-tenant isolation hardening — a structured program closed test-suite blind spots (notably one-tenant-cannot-see-another isolation) plus coverage, mobile, accessibility, and resilience checks
Delivery-pipeline hardening — recurring release-process risks turned into automated guardrails (git-enforced pre-commit hooks, static guards, contract tests), with the release test suite rescoped to run reliably in CI while exhaustive validation continues on live lab and beta appliances

v1.0.0 (2026-06-30)¶

General-availability (GA) release. Builds on the 0.9.8 baseline with two new executive reports, a major step up in AI provider control and cost governance, a real collaboration layer, responsive mobile/tablet support, and a dedicated pre-1.0 full code review. Ships alongside WitFoo Management Console 1.9.0, Conductor 1.8.0, and WFA 2.4.2. Upgrade recommended.

Reporting & Compliance¶

Vulnerability Management report — hosts ranked by severity-weighted exposure, with host↔CVE drill-down, all server-paginated for large estates
Threat Model report — your security controls mapped against the MITRE ATT&CK matrix from real audit findings, with per-cell drill-down and an optional AI narrative
Reporter improvements — correct dark-theme charts, interactive drill-down and paging on the threat and vulnerability views, and a reorganized Reporter navigation

AI & Automation¶

AI Provider Enhancement — per-provider model catalogs with best-practice defaults and an economy tier; pre-save live model interrogation (your key is validated, never logged); and a best/economy AI profile that auto-routes each purpose to an appropriate model, preserving operator pins
Improved AI tooling — the assistant can use read-only platform tools to ground answers in your live data
MCP Authentication — optional per-organization bearer/API-key auth for the Model Context Protocol integration (default off; keys hashed at rest, shown once)
AI summary caching — on-demand summaries (including Auditor findings) cached per organization to cut cost and latency

Collaboration & Profile¶

User Profile — self-hosted avatar upload, self-service password and locale, presence and author cards, and one-click "message a user"
Chat Upgrade — file attachments, emoji reactions, and a more robust realtime connection
CyberGrid community — share Work Units and Work Collections to the community directory, a within- and cross-cluster User Directory, and a durable, self-healing directory-submission pipeline that reports its true status

Detection & Pipeline¶

Azure Email Security — Microsoft Defender for Office 365 phishing email and phishing-click signals now produce Work Units
VMware NSX-T parsing — NSX-T operational and degraded-service events classified and actionable instead of landing in unknown
Conductor visibility — per-agent up/down/health for Beats agents, expanded Integration Health detail, the Conductor link hidden on non-Conductor nodes, and corrected Cisco Umbrella configuration fields
Search & collections — Work Unit search on client IP across source and destination addresses; Work Collections on hostnames, URLs, file names, and file hashes; plus facet, Client-IP-search, and pagination fixes

Platform & Operations¶

Mobile & tablet support — responsive Analytics, Conductor, and Console UIs with drawer navigation and touch-friendly controls below desktop widths
Sign-in — the login page defaults to SAML single sign-on when enabled (local login always reachable); Azure/SAML SSO reliability fixes
Health dashboard — a Data Retention card showing the actually-enforced retention, a corrected host Total Memory gauge, and a per-node Cassandra health view
Improved automated monitoring — telemetry redacted at the source under a configurable policy (off/standard/strict); opt-in, PII-free cluster-problem reporting
Console node management — Analytics nodes managed from the Console with an accurate last-seen-based online/offline indicator

Infrastructure & Hardening¶

Pre-1.0 full code review — external-dependency and vulnerability verification, Cassandra optimization (including a 5.0.8 upgrade with a per-node health monitor), an adversarial re-review of the entire 0.9.8→1.0.0 change set, deeper test and docker-log coverage, documentation accuracy, and an expanded certification curriculum
Continued supply-chain and CI security-gate hardening (secret scanning, static analysis, dependency and image scanning, log-injection and SSRF call-site gates)

v0.9.8 (2026-06-23)¶

Operational-resilience, AI-cost, and pipeline-coverage release with broad security hardening. Ships alongside WitFoo Management Console 1.8.0, Conductor 1.7.0, and WFA 2.3.0. Upgrade recommended.

Security & Hardening¶

Resolved a class of log-injection and outbound-request (anti-rebinding / SSRF) hardening findings across the platform and the management console; outbound connections now validate the destination host before any credentials are attached
Tightened per-route access controls across the incident and configuration APIs, with a build-time guard that fails the pipeline on any newly ungated route
Stronger TLS/certificate validation on appliance-to-Conductor health checks
Refreshed dependency tree and supply-chain updates, plus new recurring-vulnerability prevention gates (secret scanning, app/image SAST, signed images and SBOMs) added to the build pipeline
Azure / SAML single sign-on reliability — assertion-replay handling bounded to the provider acceptance window and request-binding fixes, so a valid login is no longer falsely rejected as a replay

Operational Resilience¶

Compliance Readiness no longer strands at 0% after a redeploy — a snapshot guard preserves the last healthy compliance figure and a startup probe waits for data readiness before regenerating, so a restart can never serve a collapsed 0% snapshot
AI cost optimization — Anthropic prompt caching, a cheaper model tier for report and on-demand summaries, and demo-mode containment dramatically cut AI spend
Production Dashboards — Custom Dashboard widgets now show real production data or an explicit empty state, never placeholder sample data in a live tenant (sample data renders only in the editor preview or under demo mode)
Monorepo consolidation — one codebase with change-detected image builds for faster, more reliable releases and independent per-product versioning (no customer-visible behavior change)
WFA broker-startup deadlock resilience — a node can no longer get permanently wedged during service initialization; the startup gate is now bounded, observable, and self-creating of its broker objects

Conductor & Pipeline¶

Beats agent up/down/health tracking — a new Agents page in Conductor, up/down/stale transition alerting, and agent status forwarded to the Console node view
Pipeline self-heal — a parser present in the build but not yet enabled can no longer ship "dark"; absent first-party parsers auto-enable while respecting explicit operator disables (PARSER_RECONCILE)
Fleet-wide Parser Audit — RFC 5424-compliant severity enforced at a single chokepoint, a five-way detection-metadata cross-reference quality gate, 50 product-mapping corrections, and broader Microsoft Graph / Defender coverage
New Microsoft parsers and parsing fixes — Microsoft Defender Vulnerability Management, Azure security / Graph sign-ins, directory audits, and Defender incidents now parse instead of landing in unknown
New log auto-parsers — apt daily, Microsoft Identity Protection, and ModemManager
Resolved a Conductor-pipeline noise issue (idle Beats keep-alive connections) and a pipeline-wedge condition

Features & UX¶

Reliable, consistent faceted search — one unified filter sidebar across Signals, Nodes, Edges, Work Units, and Work Collections, with facet counts that match the result rows
Assign a Work Unit (or individual response tasks) to an AI Agent — full AI autonomy with live investigation progress: the AI sets the unit to Investigating, works the playbook step-by-step, and closes the ticket (human attestation is preserved — the AI never silently attests a task)
Reporter ROI corrected — ROI is now Total Protection Value ÷ Annual Security Spend (including insurance coverage), so zero-incident ROI is non-zero
AI Chat fixes — work-unit context now reaches the assistant, the chat pop-out works, and direct messages resolve member names and authenticate correctly
Human-friendly names everywhere — node Products and Frameworks show real names, the work-unit activity feed shows status labels and user names, and the "Configuration Auditor" is renamed Auditor
Signal Search from a node's detail view — pivot on a stable node id to find all of a node's signals, regardless of changing IPs
Auditor UX fixes — the filter list is reactive, the findings pager works, and the loading spinner renders inline in the correct place
Configuration Auditor connector fixes — Microsoft 365, Google Cloud, and OCI connectors now add and test successfully
Enhanced work-unit activity notes and per-task notes / evidence
Licensing improvements — licensing.witfoo.com reliability, Dev Mode hidden in non-development deployments, and CyberGrid licensing management
User Profile build-out — the account profile page is populated and integrated with chat

Console¶

Configuration Generator + wfa fetch — pre-build a customer node configuration and publish a one-time URL; the customer runs wfa fetch <url> for zero-touch provisioning (config encrypted at rest, single-use token, 72h TTL)
Deeper remote management of Analytics/Data nodes — start / stop / restart / upgrade / pull-images from the Console, with Cassandra data-node safety guards (destructive actions on a data-bearing node require explicit confirmation)
The Console now surfaces Beats agent status forwarded from connected appliances

Upgrade Notes¶

No database migration; no breaking API changes
New optional operator settings: PARSER_RECONCILE (parser self-reconcile policy) and BROKER_HEALTH_GATE_WARN_SECONDS (broker-health startup-gate warning threshold). WF_DEMO_MODE now also gates AI spend on demo deployments

Resolved issues¶

Issues #160, #207, #208, #209, #211, #212, #213, #214, #215, #216, #217, #218, #219, #220, #221, #222, #223, #224, #225, #226, #228, #229, #230, #231, #232, #238, #239, #244, #245, #246, #247, #249, #260, #265, #266, #267, #269, #283 (plus the #203 / #205 / #206 auto-parser additions).

Console 1.8.0 (2026-06-23)¶

Configuration Generator + wfa fetch — pre-built one-time node configuration for zero-touch provisioning (#244)
Remote node management — lifecycle and upgrade actions on connected Analytics/Data nodes with data-node safety guards (#160)
Beats agent status forwarded from appliances now shown on the node view (#269)

Conductor 1.7.0 (2026-06-23)¶

Beats agent tracking — Agents page, up/down/stale alerting, and Console forward (#269)
Pipeline self-heal — parsers can no longer ship dark; absent first-party parsers auto-enable (#245/#246)
Parser Audit — RFC 5424 severity, a metadata cross-reference quality gate, 50 mapping corrections, and broader Microsoft Graph / Defender coverage (#266)
New Microsoft parsers and parsing fixes (Defender Vulnerability Management, Azure sign-ins, directory audits, Defender incidents) and new auto-parsers (apt daily, Microsoft Identity Protection, ModemManager) (#203/#205/#206/#208/#245/#246/#247)
Idle Beats keep-alive connection noise fixed (#247)

WFA 2.3.0 (2026-06-23)¶

Service-init deadlock resilience — a node can't get permanently wedged at startup; the broker-health gate self-creates its broker objects, fails open on best-effort objects, and is bounded + observable (BROKER_HEALTH_GATE_WARN_SECONDS) (#283)
Bounded broker connect across broker-dependent services, so a broker outage self-heals instead of stranding a service dark (#267)
Console node-status forward now carries a bounded Beats agent summary (#269)
common v1.5.39; apt/rpm publishing restored

Conductor 1.5.0 (2026-02-22)¶

Notification System — Email, Slack, and webhook alerting with rule-based event routing, cooldown, and delivery history
LDAP Security Hardening — Injection fix (CWE-90), TLS 1.2+ enforcement, connection timeouts
Per-Exporter Predicate Filtering — Shared predicate engine with UI forms on all exporter settings
18 New Integrations — Tenable, Cortex XDR, Proofpoint, Netskope, Okta, LimaCharlie, Mimecast, Deep Instinct, Druva, Cisco Umbrella/Meraki/Duo/AMP, and more
6 Auto-Generated Parsers — GreyNoise, Kafka, WitFoo Console, WitFoo Intel, Nginx, Filebeat
Performance Benchmarks — Benchmarks across all pipeline services (Splunk HEC, STIX, JetStream, flow functions)
UI Improvements — Settings icons, Beacon Yellow arrows, favicon, improved defaults

Console 1.5.0 (2026-02-22)¶

Disconnected Network Support — Self-hosted IBM Plex fonts for air-gapped deployments
CI Quality Gates — Race detection, security scanning, release branch handling

v0.9.7 (2026-05-29)¶

Security-hardening and operational-resilience release. Consolidates the hardening work delivered across the 0.9.4–0.9.7 line into a single recommended upgrade.

Security & Hardening¶

Tenant isolation — active organization is derived from the verified session, never from client-supplied request parameters; SAML/LDAP user lookups are scoped per-organization
Conductor management UI reachable only through the authenticated reverse proxy; internal trust headers gated behind an IP allowlist (WF_TRUSTED_PROXIES)
Mandatory secret-key enforcement — JWT_SECRET and AUTH_CONFIG_ENCRYPTION_KEY fail closed instead of falling back to insecure defaults; stored credentials and AI-provider keys encrypted at rest under a consolidated XChaCha20-Poly1305 key
WebSocket authorization enforced before upgrade; origin checking tightened across real-time endpoints
Attachment and user-rendered content hardened against script-injection (XSS)
Input encoding and bounded query limits; log sanitization and on-disk path containment

Operational Resilience & Self-Healing¶

Startup-race sweep — service initialization moved to a level-triggered readiness model, eliminating a class of startup deadlocks
Container environment-drift self-heal — a running container missing a newly required environment variable after a WFA upgrade is recreated automatically within ~60 seconds
Missing-container self-heal — a configured-but-absent container is recreated automatically; image pulls fall back to a present local image during a brief registry outage

Conductor & Pipeline¶

New opt-in redaction pipeline tokenizes PII before export to downstream SIEMs (requires REDACTION_MASTER_KEY)
Conductor WebSocket/API TLS and header-auth fix for AIO+Conductor deployments
Tenable.io REST asset-inventory parser

Infrastructure¶

Go 1.26.3 and refreshed dependency tree — 22 CVEs closed
WFA bumped to v2.1.17
New build-discipline guardrails and three operator runbooks (build discipline, submodule pin management, environment-variable drift recovery)
Encryption/secret-key configuration reference added

Upgrade Notes¶

JWT_SECRET and AUTH_CONFIG_ENCRYPTION_KEY are required on the API and Incident Engine (WFA generates them automatically; standalone/Compose deployments use scripts/dev/generate-secrets.sh)
No database migration; no breaking API changes

WFA 2.1.17 (2026-05-29)¶

Container environment-drift self-heal and missing-container self-heal
Startup-race hardening across agent and pipeline services
Generated CA preserved across upgrades; SSL_CERT_FILE supplied to the reverse proxy for Conductor WebSocket TLS
Go 1.26.3, common v1.5.20, dependency CVE remediations

v0.9.3 (2026-03-12)¶

Features¶

SAML onboarding wizard with provider presets (Azure AD, Okta, OneLogin, PingIdentity)
SAML wizard ported to conductor-ui and console-ui
Microsoft Sentinel integration connector
SAML auth fallback with redirect loop detection
Te Reo Maori (mi) locale -- 7th supported language
AI language awareness for summaries and chat
Classification rules management page
Features settings page
SP key pair auto-generation for SAML
SAML configuration test endpoint

Bug Fixes¶

25 pre-release bug fixes (PR189) across AI, signals, playbooks, CyberGrid, and conductor
Work unit layout consolidated from 10 to 5 tabs
Production deployment hardening (HSTS, trusted proxies, security headers)

Infrastructure¶

Cassandra seeder consolidation (DDL/DML separation)
WFA v2.0.36 with dependency updates
89 i18n keys across 7 locales for SAML wizard

dev (Initial Release)¶

Initial documentation site created
Getting Started guide with architecture diagrams
User Guide for all 6 modules (Signals, Graph, Observer, Reporter, CyberGrid, Health)
Admin Guide with RBAC permissions reference
API Reference for 150+ endpoints
AI & MCP documentation
Deployment guide for Docker, WFA, and Conductor
Reference section with permissions, roles, and environment variables