feat: five-bucket app improvement pass (correctness, ATT&CK, HTTP analysis, API, CI) by ninedter · Pull Request #14 · ninedter/pcap-hunter

fix: cap zeek tables via config constant and warn on truncation

ninedter

committed

b2aa065

fix: correct stix hash-type/ipv6/ja3 in ioc feed via shared helper

ninedter

committed

e6466af

fix: enable wal + busy_timeout on cases.db to prevent lock errors

ninedter

committed

4ac42a2

fix: persist attack timeline to session state so pdf report includes it

ninedter

committed

e00c7c1

fix: filter internal/private domains out of osint enrichment to prevent leaks

ninedter

committed

479ad35

fix: route ioc_export stix through shared helper (sha-512, ipv6, ja3)

ninedter

committed

3d656f2

fix: dedupe ja3 attribution in attack mapper via authoritative lookup_ja3

ninedter

committed

ce80984

feat: build att&ck mapping in runner and persist to analyses.attack_json

ninedter

committed

9b82f0e

feat: thread att&ck mapping through ui and api caller paths

ninedter

committed

f88d223

feat: render att&ck mapping in dashboard via from_dict reconstruction

ninedter

committed

3918fa1

feat: add mitre att&ck section to pdf report

ninedter

committed

38da5b3

feat: derive feed mitre_techniques from analysis technique ids

ninedter

committed

c5dd19e

fix: populate mitre_techniques on ui-saved analyses for feed consistency

ninedter

committed

230e329

fix: soften https beacon penalty for highly-regular high-confidence flows

ninedter

committed

b452fd0

feat: add http analysis module (ua/creds/uri heuristics)

ninedter

committed

58f484b

feat: wire http analysis stage into pipeline runner

ninedter

committed

94d01c0

feat: add http cleartext-cred and suspicious-ua signals to correlation

ninedter

committed

e54f369

feat: render http analysis in raw data tab and persist via ui/api paths

ninedter

committed

92e88e3

fix: stash http_analysis and beacon_records on ui-saved analyses for restore parity

ninedter

committed

069931a

feat: add case crud api (list, patch, notes)

ninedter

committed

2ab7643

feat: add single-ioc exact-match lookup endpoint

ninedter

committed

1d4917f

feat: add cef ioc feed endpoint

ninedter

committed

dc60084

fix: escape crlf in cef output to prevent syslog log injection

ninedter

committed

c24aeb7

feat: add ssrf-safe completion webhook on job submit

ninedter

committed

d3ddd83

docs: document case crud, ioc lookup, cef feed, and completion webhooks

ninedter

committed

17703f3

test: de-flake stale-date usage tests and timezone regex for green ci

ninedter

committed

0121cb5

ci: enforce coverage floor and add pytest/coverage config

ninedter

committed

a37fb16

ci: add pip-audit job and dependabot config

ninedter

committed

c08e4b9

ci: build and test the docker image (with zeek) in ci

ninedter

committed

99b5155

feat: add synthetic demo pcap (dns/http/beacon) for first-run experience

ninedter

committed

8683880

chore: dockerignore-proof pcaps/demo.pcap against Docker build context excludes

ninedter

committed

49f8638

feat: add load-demo-capture button and point screenshots at demo pcap

ninedter

committed

49a1bbc

docs: refresh roadmap, add security/contributing, fix kaleido changelog note

ninedter

committed

b9e7763

fix: address final-review cross-task findings (batch intel, timeline restore, beacon fp, host-port)

ninedter

committed

e6c827f

style: apply ruff 0.15 formatting to test_webhook.py (ci format gate)

ninedter

committed

bce3ba6

Navigation Menu

feat: five-bucket app improvement pass (correctness, ATT&CK, HTTP analysis, API, CI) - #14

feat: five-bucket app improvement pass (correctness, ATT&CK, HTTP analysis, API, CI)#14
ninedter wants to merge 35 commits into
mainfrom
claude/app-improvement-review-e2fb60

Commits on Jul 13, 2026

fix: cap zeek tables via config constant and warn on truncation

fix: correct stix hash-type/ipv6/ja3 in ioc feed via shared helper

fix: enable wal + busy_timeout on cases.db to prevent lock errors

fix: persist attack timeline to session state so pdf report includes it

fix: filter internal/private domains out of osint enrichment to prevent leaks

fix: route ioc_export stix through shared helper (sha-512, ipv6, ja3)

fix: dedupe ja3 attribution in attack mapper via authoritative lookup_ja3

feat: build att&ck mapping in runner and persist to analyses.attack_json

feat: thread att&ck mapping through ui and api caller paths

feat: render att&ck mapping in dashboard via from_dict reconstruction

feat: add mitre att&ck section to pdf report

feat: derive feed mitre_techniques from analysis technique ids

fix: populate mitre_techniques on ui-saved analyses for feed consistency

fix: soften https beacon penalty for highly-regular high-confidence flows

feat: add http analysis module (ua/creds/uri heuristics)

feat: wire http analysis stage into pipeline runner

feat: add http cleartext-cred and suspicious-ua signals to correlation

feat: render http analysis in raw data tab and persist via ui/api paths

fix: stash http_analysis and beacon_records on ui-saved analyses for restore parity

feat: add case crud api (list, patch, notes)

feat: add single-ioc exact-match lookup endpoint

feat: add cef ioc feed endpoint

fix: escape crlf in cef output to prevent syslog log injection

feat: add ssrf-safe completion webhook on job submit

docs: document case crud, ioc lookup, cef feed, and completion webhooks

test: de-flake stale-date usage tests and timezone regex for green ci

ci: enforce coverage floor and add pytest/coverage config

ci: add pip-audit job and dependabot config

ci: build and test the docker image (with zeek) in ci

feat: add synthetic demo pcap (dns/http/beacon) for first-run experience

chore: dockerignore-proof pcaps/demo.pcap against Docker build context excludes

feat: add load-demo-capture button and point screenshots at demo pcap

docs: refresh roadmap, add security/contributing, fix kaleido changelog note

fix: address final-review cross-task findings (batch intel, timeline restore, beacon fp, host-port)

style: apply ruff 0.15 formatting to test_webhook.py (ci format gate)