Changelog
Release history and version notes for Patronus SIEM.
2.0.0
March 2025
Latest
Major Release — React 18 + Python ASGI Rewrite
Architecture
- •Complete frontend rewrite from SimpleXML dashboards to React 18 single-page application with TypeScript and Tailwind CSS v4.
- •New Python ASGI backend (Starlette) replacing legacy REST handlers for all API endpoints.
- •RSBuild bundler for fast production builds with tree-shaking and code splitting.
- •Dark-native UI design with
bg-slate-900base theme across all views. - •Rich Recharts visualizations: BarChart, PieChart, AreaChart, RadialBarChart with custom tooltips throughout.
New Pages & Features
- •Hunt Library — browsable detection catalog with MITRE ATT&CK coverage mapping, enable/disable toggles, Run Now dispatch (works on disabled searches), inline MITRE technique editor, and search/filter by severity, status, tactic, or data source.
- •Shift Handoff Report — end-of-shift summary with configurable period (8h/12h/24h), incident activity timeline, severity breakdown, analyst workload, open incidents table, persistent shift notes with audit trail, and Print/Generate Report actions.
- •Threat Inspector — IOC investigation tool with search by IP/domain/file hash, known threats sidebar, feed summary, quick-start indicators, and correlated activity timelines.
- •Incident Report — comprehensive reporting with KPI summary, MTTR/resolution rate, trend charts (new vs resolved, cumulative open), distribution breakdowns (status, severity, type), and CSV/Print export.
- •System Health — three-tab performance dashboard (Overview, Data Models, Search Performance) with search activity charts, job status breakdown, CIM data model event volumes, and schedule conflict warnings.
- •Configuration Management — unified tabbed interface for Suppression Filters, SOC Analysts, Assets, Identities, Corp Subnets, Watchlist, Threat Feeds, and SLA Targets.
- •License Management — license status display, key update, activation/deactivation controls.
Modernized Pages
- •Risk Scoreboard — severity cards, dual-axis risk trend chart, watchlist with sparklines, top rules/scores tables, suppression filter badges, interactive filters.
- •Executive Summary — Security Posture Score composite gauge (resolution rate, response time, critical exposure, threat coverage), KPI cards with trends, risk score trend, SLA compliance gauges, incident pipeline, and threat map.
- •Incident Management — status pipeline, incidents over time stacked chart, analyst workload matrix, filterable/searchable incident table with expandable rows.
- •Incident Metrics — SLA tracking with MTTA/MTTR compliance gauges, compliance trends with target/threshold lines, incident outlook, analyst performance table.
- •MITRE ATT&CK Coverage — three viewing modes (Available/Enabled/Triggered), full Enterprise Matrix with technique heatmap, coverage statistics, and detection drill-down.
- •Network — traffic KPIs, dual-axis traffic timeline, interactive Sankey-style network relationship map with port/protocol color coding, zoom/pan controls.
- •Asset Deep Dive — enriched asset metadata, activity KPIs, CIM data model swimlane visualization, combined activity timeline, connection analysis.
- •Identity Deep Dive — enriched identity metadata, activity KPIs, CIM data model swimlane visualization, combined activity timeline, auth events, risk events.
- •Threat Intelligence Dashboard — indicator KPIs, feed health table with staleness tracking, auto-refresh, activity trends, source breakdown.
- •Vulnerability Management — severity cards, trend by severity, severity distribution pie chart, top affected hosts, CVSS score distribution, vulnerability age analysis.
Documentation
- •Workflows Guide — new comprehensive documentation page with step-by-step operational workflows for all 17 SIEM pages, organized by navigation category (Overview, Incidents, Detections, Threat Intelligence, Research, Configuration).
- •Each page includes “When to use” scenarios, numbered workflow steps, key interactions, and contextual tips with screenshots.
- •End-to-End Investigation Workflow documenting the recommended cross-page flow for SOC analysts from Executive Summary through incident resolution and shift handoff.
- •Sub-workflows for complex pages: Incident Management (daily triage, individual investigation, manual creation), Hunt Library (rule review, enable/disable, MITRE mapping), and Configuration (suppression, analysts, network, SLA).
- •Automated Test Suite — Playwright-based test plan with 83 automated assertions covering all page loads, navigation, UI elements, search functionality, charts, tables, filters, and interactive components. 100% pass rate.
API & Backend
- •New REST API endpoints for saved search management: toggle (enable/disable), dispatch (run now), and MITRE mapping updates.
- •Dispatch of disabled searches via temporary enable → dispatch → re-disable pattern.
- •Shift notes API with persistent KVStore storage, timestamps, and author tracking.
- •SLA target configuration API for MTTA/MTTR thresholds.
- •Fixed
ss_search_filtermacro to work correctly in pipe position (search NOT [...]).
1.8.3
October 2024
Bug Fixes
- •Fixed issue where incident status transitions were not properly validated.
- •Resolved race condition in concurrent KVStore writes during bulk incident updates.
- •Fixed MITRE ATT&CK technique mapping for sub-techniques not displaying correctly.
- •Corrected timezone handling in scheduled report generation.
Improvements
- •Improved search performance for large lookup tables (>100k rows).
- •Added retry logic for threat feed retrieval on network timeouts.
1.8.2
August 2024
New Features
- •Added license enforcement and activation system with online validation.
- •New license check-in mechanism for seat-based licensing.
- •Grace period support for expired licenses with degraded functionality warnings.
Bug Fixes
- •Fixed dashboard panels not refreshing after time range picker changes.
- •Resolved issue with suppression filters not applying to new detection rules.
1.8.1
May 2024
New Features
- •Added threat intelligence feed management with custom indicator support.
- •New file hash (MD5, SHA1, SHA256) threat indicators alongside IP and domain feeds.
- •Web activity and file activity sub-views in Threat Intelligence dashboard.
Improvements
- •Enhanced incident timeline with drill-down to contributing detection events.
- •Improved asset and identity correlation performance using accelerated data models.
- •Added bulk export capability for incident reports.
1.7.1
January 2024
New Features
- •Introduced corporate subnet management for internal network classification.
- •Added SOC analyst assignment sourced from the patronus_user Splunk role.
- •New watchlist system for tracking high-priority risk objects.
Improvements
- •Redesigned executive summary with KPI cards and trend indicators.
- •Improved scoreboard with real-time risk score aggregation.
Bug Fixes
- •Fixed incident count discrepancy between summary and detail views.
- •Resolved search timeout issues on environments with large event volumes.
1.5.7
September 2023
Improvements
- •Added MITRE ATT&CK technique tagging to detection rules.
- •Enhanced network research view with traffic flow visualization.
- •Improved suppression filter logic to support wildcard and CIDR matching.
Bug Fixes
- •Fixed vulnerability dashboard not rendering on Splunk 9.1+.
- •Corrected CSV lookup generation for asset and identity merges.
- •Resolved memory leak in long-running scheduled searches.
1.5.5
June 2023
Initial Public Release
- •Score-based incident generation with configurable risk thresholds.
- •Executive summary dashboard with high-level incident, risk, and threat metrics.
- •Incident management with note-taking and lifecycle tracking.
- •Threat hunting scoreboard with real-time risk activity views.
- •Asset and identity inventory management with lookup-based enrichment.
- •Detection rule scoreboard with risk scoring breakdown.
- •Network research view for traffic analysis.
- •Vulnerability tracking dashboard.
- •Configuration pages for setup validation and tuning.