cqrenet/aoc
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 31 Wiki Activity

31 Releases 41 Tags

RSS Feed
  • v1.7.4 5f7a98f21c
    Compare

    v1.7.4
    CI / lint-and-test (push) Successful in 28s
    Details
    Release / build-and-push (push) Successful in 1m30s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 12:57:06 +00:00 | 22 commits to main since this release

    v1.7.4 — Fix duplicate rules

    Fixes

    • Prevent duplicate default rules on multi-worker startup. Previously, multiple gunicorn workers could race and each insert the 10 default rules, resulting in 20+ duplicates.
    • Now uses replace_one(name, ..., upsert=True) so each rule is uniquely keyed by name and safely upserted even with concurrent workers.

    Full changelog since v1.7.3

    • fix: prevent duplicate default rules on multi-worker startup
    • chore: bump version to 1.7.4
    Downloads
  • v1.7.3 f812fda150
    Compare

    v1.7.3
    CI / lint-and-test (push) Successful in 44s
    Details
    Release / build-and-push (push) Successful in 1m40s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 12:48:17 +00:00 | 24 commits to main since this release

    v1.7.3 — Collapsible panels

    What's new

    • All panels are now collapsible — click any panel header to expand/collapse:
      • Source Health
      • Alerts
      • Alert Rules
      • Filters
      • Ask a question
      • Events
    • Chevron indicator rotates to show open/closed state
    • State persists to localStorage — your panel layout is remembered across sessions

    Full changelog since v1.7.2

    • feat: all panels are now collapsible
    • chore: bump version to 1.7.3
    Downloads
  • v1.7.2 e984899d4c
    Compare

    v1.7.2
    Release / build-and-push (push) Successful in 1m39s
    Details
    CI / lint-and-test (push) Successful in 43s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 12:43:13 +00:00 | 26 commits to main since this release

    v1.7.2 — Alert rules management UI

    What's new

    • Alert Rules panel in the UI — visible between Alerts and Filters sections
    • List all rules with severity badge, on/off toggle, and condition preview
    • Add Rule button opens a modal with form for:
      • Rule name
      • Severity (Low / Medium / High)
      • Alert message
      • Conditions builder (eq, neq, contains, in, after_hours)
    • Edit existing rules inline
    • Delete rules with confirmation
    • Toggle rules on/off without deleting

    Full changelog since v1.7.1

    • feat: alert rules management UI
    • chore: bump version to 1.7.2
    Downloads
  • v1.7.1 3e1416cd52
    Compare

    v1.7.1
    CI / lint-and-test (push) Successful in 31s
    Details
    Release / build-and-push (push) Successful in 1m32s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 12:21:46 +00:00 | 28 commits to main since this release

    v1.7.1 — Bug fixes

    Fixes

    • Alert panel is now always visible — previously hidden when no alerts existed, making it impossible to find. Now shows with an explanatory empty state.
    • Footer version display — normalized version string to prevent double 'v' (vv1.7.0).

    Full changelog since v1.7.0

    • fix: alert panel always visible, version display normalization
    • chore: bump version to 1.7.1
    Downloads
  • v1.7.0 0a16cf6870
    Compare

    v1.7.0
    CI / lint-and-test (push) Successful in 26s
    Details
    Release / build-and-push (push) Successful in 1m15s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 12:12:49 +00:00 | 30 commits to main since this release

    v1.7.0 — Admin Operations SIEM

    What's new

    • Alert notifications with retry logic: webhook, Slack, or Microsoft Teams formats
    • Alert deduplication: same rule + same actor within 15 minutes produces only one alert
    • 10 pre-built admin-ops rule templates seeded automatically on first startup:
      1. Failed Conditional Access
      2. After-Hours Admin Activity
      3. New Application Registration
      4. Admin Role Assignment
      5. License Change
      6. Bulk User Deletion
      7. Device Compliance Failure
      8. Exchange Transport Rule Change
      9. Service Principal Credential Added
      10. External Sharing Enabled
    • Alert dashboard in the UI with severity/status filters
    • Alert actions: Acknowledge, Resolve, False Positive, Reopen
    • Alert summary badge in the hero header showing open high/medium/low counts
    • New API endpoints: GET /api/alerts, PATCH /api/alerts/{id}/status, GET /api/alerts/summary
    • New env vars: ALERT_WEBHOOK_URL, ALERT_WEBHOOK_FORMAT (generic/slack/teams), ALERT_DEDUPE_MINUTES

    Design philosophy

    This is an admin operations alerting system, not a security SIEM. It focuses on things admins need to know about: policy changes, role assignments, license changes, compliance failures — not threat detection.

    Downloads
  • v1.6.4 5bda1dd616
    Compare

    v1.6.4
    CI / lint-and-test (push) Successful in 25s
    Details
    Release / build-and-push (push) Successful in 1m29s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 10:16:32 +00:00 | 33 commits to main since this release

    v1.6.4 — Single-click filters, all services default, page size 24

    What's new

    • Single-click service pills are back: click to filter ONLY for that service
    • All services shown by default — removed the default Exchange/SharePoint/Teams exclusion (privacy controls now handle this server-side)
    • Page size 24 — divisible by 3 for the 3-column event grid
    • Removed +/- button experiment — simpler is better

    Full changelog since v1.6.3

    • fix: revert to single-click service filter, show all services by default, page size 24
    • chore: bump version to 1.6.4
    Downloads
  • v1.6.3 aa62528862
    Compare

    v1.6.3
    CI / lint-and-test (push) Successful in 35s
    Details
    Release / build-and-push (push) Successful in 1m47s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 10:02:28 +00:00 | 35 commits to main since this release

    v1.6.3 — +/- pill filters

    What's new

    • Service pills now have +/− buttons instead of a single click:
      • + adds that service to the current filter (keeps your other selections)
      • − removes that service from the current filter
    • Result pills keep the toggle click behavior (works well as-is)
    • Small inline button styling with hover effects

    Full changelog since v1.6.2

    • feat: +/- buttons on service pills for additive/subtractive filtering
    • chore: bump version to 1.6.3
    Downloads
  • v1.6.2 ed7465f5cd
    Compare

    v1.6.2
    Release / build-and-push (push) Successful in 1m33s
    Details
    CI / lint-and-test (push) Successful in 33s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 09:53:21 +00:00 | 37 commits to main since this release

    v1.6.2 — Clickable pills, configurable page size, CQRE.NET branding

    What's new

    • Clickable service pills: Click any event's service/category pill to filter the entire list by that service. Click again to clear.
    • Clickable result pills: Click Success/Failure/etc. pills to filter by result. Toggle behavior.
    • Configurable page size: New DEFAULT_PAGE_SIZE env var (default 25). Frontend loads it from /api/config/features.
    • Footer branding: Changed from CQRE to CQRE.NET.
    • Smaller default: Page size dropped from 100 to 25 events for faster initial loads.

    Full changelog since v1.6.1

    • feat: clickable pills, configurable page size, CQRE.NET branding
    • chore: bump version to 1.6.2
    Downloads
  • v1.6.1 67f3c28e82
    Compare

    v1.6.1
    CI / lint-and-test (push) Successful in 32s
    Details
    Release / build-and-push (push) Successful in 1m30s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 09:31:57 +00:00 | 39 commits to main since this release

    v1.6.1 — UI polish

    What's new

    • Top navigation bar with brand, repository link, documentation link, and compact action buttons
    • User chip shows logged-in display name + email from Microsoft Entra
    • Footer with version badge, report-issue link, source code link, and documentation link
    • Cleaner hero — just title and tagline, buttons moved to topbar
    • Responsive stacking on mobile screens
    • CSS cache-buster bumped to v=9

    Full changelog since v1.6.0

    • style: UI polish — topbar, footer, user info, product feel
    • chore: bump version to 1.6.1
    Downloads
  • v1.6.0 f75f165911
    Compare

    v1.6.0
    Release / build-and-push (push) Successful in 1m24s
    Details
    CI / lint-and-test (push) Failing after 29s
    Details
    Stable

    tomas.kracmar released this 2026-04-22 07:55:21 +00:00 | 43 commits to main since this release

    v1.6.0 — Valkey caching + async queue for LLM scaling

    New features

    • Valkey caching for LLM responses (/api/ask and /api/events/{id}/explain)
      • Ask cache TTL: 1 hour
      • Explain cache TTL: 24 hours
    • Async queue (arq) for LLM requests to prevent timeouts at scale
      • POST /api/ask?async_mode=true returns a job_id immediately
      • GET /api/jobs/{job_id} polls for results
    • Valkey replaces Redis as the in-memory store (BSD-licensed fork)

    Infrastructure

    • New worker service in Docker Compose (runs arq jobs.WorkerSettings)
    • New redis/valkey service with healthchecks
    • REDIS_URL configuration setting

    API changes

    • AskRequest added async_mode: bool field
    • AskResponse added job_id: str | None field

    Dependencies

    • Added redis and arq
    Downloads