Skip to content
Changelog

What changed.
What is proven.

What shipped, what was exercised, and where a production claim still needs evidence.

Read the docs Deployment options

Website, docs and CLI installer updated.

The landing, team, pricing and docs pages now describe the pentesting and SOC workflows, supported alert sources and deployment options.

  • Added a copyable, checksum-verifying CLI installation command and a safer inspect-first path.
  • Separated telemetry sources (Splunk, Elastic/ELK, AWS, Google Cloud, Sentinel, CrowdStrike, Wazuh) from code-review, ticketing, and notification integrations.

Deployed webhook normalization was exercised across four vendors.

A signed synthetic exercise sent Splunk, Elastic, CrowdStrike, and AWS GuardDuty payloads through the deployed intake. One attacker address converged into one correlation group; replays were rejected and future-dated events were quarantined.

  • 300-event sustained batch accepted without error or rate-limit rejection.
  • All synthetic events, sources, and correlation groups were removed after the exercise.
  • This is functional evidence only—not a scale, recovery, or provider-certification claim.

SOC control plane: cases, investigations, detections and supervised response.

Cases, evidence artifacts, investigations, context memory, detection engineering, supervised response, background jobs, inventory and integration controls now share one workspace.

  • Agent plans, hypotheses, evaluations, approvals, actions, and outcomes remain inspectable.
  • Unavailable integrations show as unavailable; nothing is simulated.
Evidence ledger

Want the exact release boundaries?

The production-readiness report is the source of truth for what has local, runtime, deployment, and scale evidence.

Request the readiness ledger