Infrastructure:
- Enable pg_stat_statements extension for query monitoring
- Increase Postgres max connections and shared buffers
- Bump RabbitMQ prefetchCount to 100
- Add curl/netstat/htop to dev Docker image
Database:
- Add indexes for findings and workflows
- Add workflow status constraint and is_purged column
- Index workflows by object_id for active workflows
Workflow tracking:
- Add WorkflowStatus enum
- Added finalize_workflow activity
- Generate instance IDs with name prefix pattern
(<name>.<instance>.<object_id>)
Workflow purging:
- Create WorkflowPurger to purge Dapr workflow data (kills perf over
time)
- added to file_enrichment/document_conversion
- New workflows column to track purge workflows
File linking:
- Optimize upserts to single query (perf)
Configuration:
- PII info in env.example
- Findings/alert filtering options when LLM functionality enabled
- Fixed race-condition for noseyparker/dotnet analysis findings + alerts when these containers insert findings _after_ the main file_enrichment workflow completes
- Changed layout of alerting settings display
- Move JWT from agents noseyparker subscription in file_enrichment
- Add new fields to published alert in publish_findings.py
- Store alerting settings in database, accessible from Settings.jsx page
- Have alerting apply alerting settings before publishing
- Move Arize Phoenix and Agents into `llm` docker compose profile
- Fixed decryption of v3 ABE keys via the CNG chromekey
- Schema mod w/ indexes for ABE mks
- New masterkeys now used to retroactively decrypt Local State keys
- added retry_decrypt_state_keys_for_masterkey for retroactive decryption
- Added more references
- Start of CNG Google Chromekey1/AES key decryption for v3 of ABE key
- Added cng file enrichment module
- Entropy can now be passed through for blob decryption
-Moved `file_linking` code from `file_enrichment` into a library
-Added windows dpapi_master_keys.yaml file link rule
-Started integrating `nemesis_dpapi` library into chromium parser code
Lee Chagolla-Christensen