Changelog

Intelligence

• Upgraded "Defender Disabled" claim from HIGH to CRITICAL severity — an unprotected endpoint is an active risk.
• New rule: Abnormal Process Handle Count (> 10,000 per-process) surfaces a "Resource Exhaustion" claim with HIGH severity.

Performance

• Replaced PowerShell-based handle counting with native GetProcessHandleCount Windows API — lower agent CPU usage and faster telemetry cycles.

Security Hardening

• Session fixation protection: any pre-login session is invalidated before issuing a new authenticated session.
• Audited all cookie attributes — HttpOnly, Secure, and SameSite=Strict confirmed on all session cookies.

Product

• New /changelog page (this page).
• Improved /pricing page with clear Personal and Enterprise tier comparison.

Intelligence

• EDR maturity sprint: process masquerading detection, suspicious path persistence signals, and scripting-after-remote-logon chain analysis.
• New service install detection rule (EventID 7045) flags unauthorised Windows service installations.
• Brute-force login claim threshold tuned from 15 to 10 failed attempts.

UX

• Data Wall redesign — cleaner grid layout with inline severity indicators.
• Witness detail page fully accessible from URL (deep-linkable).

Architecture

• Multi-tenant pool gateway: enterprise workspaces are now isolated by company pool name.
• Fixed Witnesses tab regression introduced in v0.4.23.

Agent

• Personal Witness API key management UI inside the Witness window.
• Tray "Set API Key" action opens the Identity panel directly.

Telemetry

• Telemetry v9: Agent Startup Self-Test (AGT-16) — the Witness validates cloud reachability, event log access, and FIM status at launch.
• Telemetry v8: File Integrity Monitoring stream added to Evidence panel.

Intelligence

• CEL-based rule engine replaces the static rule set — rules are now hot-reloadable via SPECTRA_RULES_FILE.
• Context-aware judgment: CPU anomalies are now correlated with I/O load and open connection counts before firing.

Foundation

• Cloud Brain architecture: all judgment logic centralised in judge_ai.go, agents are pure telemetry sensors.
• Retribution Protocol: automated mitigation actions (SCREENSHOT, KILL) triggered by cloud judgment.
• Personal and Enterprise editions separated at the host level — distinct cookies, dashboards, and session stores.
• SQLite persistence for endpoints, claims, sessions, and evidence.