August 2026 — Automated SOC reporting with email delivery, WHOIS/RDAP enrichment for IoCs, and significant enrichment performance improvements.

• FEAT Automated SOC weekly reports — Comprehensive PDF reports auto-generated and emailed every Saturday covering the previous week's security activity. Sender no-reply@oreltechnologies.net with CC to the cybersecurity team
• FEAT Automated SOC monthly reports — Delivered on the 1st of every month covering the previous calendar month, sent to the tenant administrator with cybersecurity team CC'd
• FEAT Real ES data in reports — Reports now pull live alert telemetry from the tenant's Elasticsearch index (previous reports used sample data). Index existence filtering handles missing daily indices gracefully
• FEAT WHOIS / RDAP enrichment — New built-in integration (no API key required): domain WHOIS lookup (registrar, creation/expiry dates, registrant org, name servers) and IP RDAP lookup (network CIDR, org, ASN, abuse contact). Registration details appear in the IOC lookup and analyst dashboard enrichment panels

• CHANGE Enrichment timeout fix — Batch enrichment no longer aborts at 15s; enrichment calls now use 90s timeout (batch) and 60s (single lookup)
• CHANGE Cached enrichment results — Full lookup results cached for 2 hours; repeat enrichment of the same IoC returns instantly without re-querying external APIs
• CHANGE Private IP fast-path — Internal/private IPs (10.x, 192.168.x, 172.16.x, localhost) skip external lookups entirely — batch enrichment of internal traffic now completes in ~0.1s

July 2026 — Analysts can now enrich IP addresses directly from threat events on the Analyst Dashboard with one click. New batch endpoint for efficient multi-IoC enrichment.

• FEAT IoC Enrichment buttons on event details — Every source and destination IP in the threat event detail modal now has a TI button. Click it to instantly enrich the IP with VirusTotal, AbuseIPDB, AlienVault OTX, and Shodan data
• FEAT Enrich All IPs — One-click button to enrich both source and destination IPs of a threat event in parallel
• FEAT Compact enrichment cards — Results display inline in the event modal showing reputation badge, per-source verdicts, abuse confidence scores, VirusTotal detection ratios, and country info
• FEAT Batch enrichment API — New /api/threatintel/enrich-batch endpoint enriches up to 20 IoCs in parallel. New /api/threatintel/enrich-events endpoint extracts and enriches all unique IPs from a set of dashboard events

• CHANGE Compact enrichment widget — Lightweight reputation badge + per-source summary with close button, designed to not overwhelm the event detail modal

July 2026 — Comprehensive security hardening: credential removal from source code, bcrypt password migration, XSS fixes, rate limiting, race condition fixes, and environment-variable-only secrets.

• FIX Hardcoded credentials removed — SMTP password, Elasticsearch passwords, and dashboard user hashes moved to environment variables
• FIX BCrypt password hashing — All new passwords hashed with bcrypt. Existing SHA-256 hashes auto-upgrade on next login
• FIX XSS in Threat Map table — All alert fields now properly escaped with escHtml()
• FIX Rate limiting on login — Brute force protection before password verification
• FIX Admin-only client detail — Client ES password endpoint now requires site_admin/admin role
• FIX Error information leakage — Full ES response bodies and Python stack traces no longer leak to HTTP responses
• FIX Race condition fix — generate_case_id() and round_robin_next() made atomic with BEGIN IMMEDIATE
• FIX Silent error logging — Session tracking and password history failures now logged
• FIX JWT secret enforcement — Startup warning when JWT_SECRET env var not set in production

• CHANGE Consolidated escape helpers — escapeHtml() now delegates to escHtml(), eliminating duplicate XSS defense code
• CHANGE Dashboard users via env — DASHBOARD_USERS_HASHES env var replaces hardcoded user dict

July 2026 — Uvicorn worker fix, AI investigation improvements, release notes restoration, and global UI polish.

• FIX Uvicorn worker crash-loop — Resolved "Address already in use" error when using --workers 2; downgraded to single-worker mode for stable operation
• FIX AI chat data parsing — Fixed forEach is not a function error when ai_chat was stored as JSON string instead of array
• FIX Exec report undefined variables — Added missing medium/low variable declarations in generateExecReport()
• FIX Case detail modal IDs — Aligned static modal IDs between HTML and JS to prevent blank case detail panels
• FIX 7 missing modal overlays — Added ticket, case, correlated-alert, client, edit-user, create-user, and integration-config modal overlays
• FIX Profile modal restored — Added missing profileModal HTML to fix "cannot load profile" error

• CHANGE AI independent verdict — Threat intelligence now serves as context only, no pre-bias in AI investigation conclusions
• CHANGE 5 AI investigation enhancements — Correlated alerts feeding, severity cap fix, streaming with ES+RAG, auto-populated descriptions, enriched RAG context
• CHANGE Release Notes page restored — Version history and changelog now available in-app
• CHANGE Version alignment — Sidebar, system info, and backend version all aligned to v1.3.1
• CHANGE Platform status endpoint — New /api/platform/status exposes uptime, version, and auto-ingest health
• CHANGE Uptime & auto-ingest indicators — Settings page now shows service uptime and background ingest status

June 2026 — Collapsible navigation sidebar, Ticket Board data-load fix, UI stability improvements, and tenant operations.

• FEAT Collapsible Navbar — Navigation sidebar can now collapse for cleaner workspace and more screen real estate
• FEAT SSE Auth Overhaul — Server-Sent Events now authenticate via ?token= query param, ensuring secure real-time updates
• FEAT Tenant Isolation Hardening — Enforced multi-tenant isolation middleware across all routers for safer operations
• FEAT Integrations Tab-Based UI — Tabbed interface with connection status and improved configuration
• FEAT Loading Skeleton Animations — Shimmer placeholders streamline perceived page performance
• FEAT Enhanced PDF Reports — Extended reportlab-generated output with improved layout for executive review

• CHANGE Platform UI updated to v1.2 with focused navigation and ticket flow improvements
• CHANGE Tenant data handling refined across Dashboard, Servers, and Settings reload flows
• CHANGE Version, badge, and release notes metadata aligned to v1.2 references

• FIX Ticket Board empty-state fix — data grouping now handles grouped and ungrouped response formats
• FIX addRipple guard — prevents TypeError when click target is not an Element
• FIX Navigation handler stability — targeted cleanup for sidebar and collision-menu invocation
• FIX Nginx CSP coverage update to unblock carto tiles and external SheetJS exports in tenant mode
• FIX Tenant switcher and reload flow refinements for consistent client-side state

Alert correlation, improved threat intelligence, and expanded monitoring coverage.

• FEAT Alert correlation engine — groups related alerts into incidents
• FEAT OTX threat intelligence integration with pulse and passive DNS lookups
• FEAT FIM (File Integrity Monitoring) dashboard with event timeline
• FEAT Executive dashboard with SLA compliance metrics
• CHANGE Ticket board with drag-and-drop status workflow
• FIX Various UI and data loading optimizations across all modules

July 2026 — Foundational release with core SOC monitoring, alerting, and case management capabilities.