Threat Research Has to Become Working Code
The October 19–26 intelligence cycle is complete, and this release turns the verified findings into changes to the tool itself. We paired the weekly collection with a source audit of the engine’s most important trust boundaries: how events arrive, how attachments are inspected, what leaves the machine, and how detections become responses.
The collection found 121 high-priority records across the wider ecosystem, including eight new entries in CISA’s exploited-vulnerability catalog. Those are research inputs, not 121 vulnerabilities in 1-SEC. The NVD collection reached its retrieval cap, so it is also incomplete. Every generated recommendation received a separate implementation decision before we described anything as shipped protection.
Protect the Event Stream That Drives Responses
Security automation depends on trustworthy input. The embedded event bus now requires a private per-instance credential, closing a route that let another local account bypass the REST API’s authentication. Normal collectors can discover the protected credential, and the optional Rust engine receives it without exposing it in command arguments. Restarting the engine preserves the credential so running collectors can reconnect.
Monitoring access also has a clearer boundary. Policy views, approval history and failed-notification records hide credentials and full webhook URLs. Internal delivery and retry data retain the real values they need. Files containing configuration or raw archives receive private permissions, including an explicit Windows access-control policy. These changes protect against other local accounts; integrations running as the engine’s own account remain trusted.
Keep Analysis Running Through Hostile Input
A security tool should not become unavailable because it inspects an unusual attachment. PDF tokenization now makes progress through malformed delimiters, and image metadata inspection has a shared work limit that stops cyclic EXIF references from multiplying the work. Regression cases also check that useful hidden-text inspection still happens after malformed input.
TCP syslog intake now limits active connections and expires peers that fail to complete a line in time. Password-spray checks avoid repeatedly scanning the same history for every source address. Correlation keeps a bounded set of recent evidence, and escalation notifications cannot recursively create new escalation chains or repeat destructive actions.
These are resource safeguards, not an unlimited-load promise. Under pressure, bounded trackers evict older evidence. Teams should still control network access to ingestion endpoints and size deployments for their traffic.
Safer Notifications and Less Data Sent to AI
Webhook delivery now uses the same destination checks for ordinary alerts, queued retries and approval notifications. The engine rejects redirects and internal or cloud-metadata destinations, including hostnames that resolve to them. It connects to the address it checked rather than resolving the hostname again afterward. Existing intranet webhook destinations will need a deliberate deployment design; this release enforces public destinations.
Optional AI analysis now sends only allowlisted event category and type, severity, and a minute-rounded timestamp. Raw logs, attachment bytes, event summaries, identifiers and arbitrary event details remain local. Both analysis stages have outbound-request regressions for that boundary. Less shared context can reduce the detail of an AI assessment, which is why local detectors and human investigation remain important.
Make Existing Detection Paths Count
The audit found places where the feature existed but its information did not reach the next stage. A zero-worker setting now selects a usable worker count. Processing an event in Go no longer suppresses a separate Rust finding, and the Rust result carries the source address and selected identity context needed by correlation and IP-response policies. Pattern matches do not gain authority to kill a process merely because they contain a process identifier.
For deployments that build and enable packet capture, captured events now use the format expected by the Go engine. A shared fixture verifies that an observed anomaly reaches Network Guardian alerting. IPv6 addresses are formatted correctly, and WebSocket flow tracking has a size limit. Release sidecar binaries remain portable builds; packet capture requires the appropriate feature build and capture privileges.
Service-account learning and token-exchange counters also now use the state their detectors depend on. Separately, configuration reload refuses partial activation and requires an engine restart. That replaces a misleading success response that could leave active policies or middleware using older settings.
Repeated Activity Must Still Count
A security tool needs to distinguish a repeated delivery from a new attempt. The follow-up in v0.4.28 fixes a filter that could mistake separate observations for the same event. Changed request bodies, full log content, nested details and source context now stay part of that decision. New event identities and timestamps stay distinct too.
That matters for attacks built from repetition. A regression sends six separate failed MFA attempts through the actual engine and confirms they reach the existing rate detector. Another confirms a malicious request body still reaches injection detection after an ordinary request with the same summary. Replaying the same observation is still filtered. Collectors must preserve its identity when retrying delivery; equal-looking activity from separate collectors is kept when it cannot safely be established as a replay.
Keep Inspection Moving and Make Its Limits Visible
Malformed entity markers and unfinished comments can make an inspector repeatedly search the same long input. Both engines now avoid that repeated work while preserving the previous decoding results. Tests cover long malformed inputs, mixed valid content and Unicode boundaries. Synthetic function benchmarks show much less work on those cases; they do not establish a whole-engine speedup.
For deployments using packet capture, source and SSH tracking now have explicit size limits, alongside the existing WebSocket limit. New activity continues to enter a full tracker by replacing the oldest stored history, and a packet anomaly reports the resulting loss of coverage. A regression fills the WebSocket tracker, introduces a new flow and confirms an invalid frame on that new flow is still detected.
A limit protects the tool’s resources, but it cannot preserve unlimited history. Sustained churn can still weaken stateful detection, and evicted flows lose their earlier context. These warnings help operators investigate capture placement and load. Inspection still needs relevant visible traffic; this update does not add encrypted SSH inspection or complete TCP reassembly.
Remove Unused Dependencies and Their Warnings
The earlier release carried five documented advisory exceptions in an optional post-quantum dependency chain. The follow-up traced those packages to their callers and found the sidecar did not use them. We removed that unused chain: nine packages are gone, and Rust dependency checks now pass with no advisory exceptions. Retained dependencies were not upgraded as part of this removal.
This is a smaller dependency footprint, not a new encryption provider. No active encryption, keys or stored data are migrated. The existing build flag remains accepted for compatibility, and the Go module’s crypto inventory, TLS and risk monitoring are unchanged.
Not Every Suggested Rule Makes Users Safer
We added support for script arrays that preserve line breaks, so existing supply-chain checks can inspect the supplied download-to-shell example. We also extended the existing bounded model-payload checks for additional legacy pickle execution references. The tool never unpickles or executes a model to inspect it, and a quiet heuristic result does not certify a model as safe.
Several proposals did not justify shipping a new blocking rule. Private network addresses are normal in internal deployments. Numeric variation in object IDs does not prove an authorization failure. Subnet arithmetic cannot establish geographic travel. Those suggestions were rejected with reasons.
SAML replay prevention needs a trusted signature and session verifier. Blocking a fetched agent tool needs an execution runner that enforces an admission decision. Killing a process for suspected slow exfiltration needs reliable process ownership and transfer evidence. Those integrations remain explicit follow-ups; telemetry alerts alone do not establish prevention.
Upgrade Both Engines and Keep the Limits Visible
Install v0.4.28 for the Go tool and the optional Rust sidecar. The CLI now announces available releases without silently replacing executable code; use the maintained installer and its signed checksums. Restart the engine after configuration changes, and keep collector access to the private event-bus credential restricted to trusted accounts. The service account must own its data directory; existing Kubernetes volumes that only grant group write access may need an administrator to correct ownership before startup.
The Go regression suite passes with race detection. Rust checks cover formatting, all-feature static analysis, portable runtime tests, the retained build-flag compatibility, and dependency review. No reachable Go vulnerability was found. The v0.4.28 dependency removal clears the five earlier Rust advisory exceptions; it does not introduce a replacement crypto provider.
This was a prioritized review of 110 of 229 tracked files, not an exhaustive audit. No production attack replay or live packet capture was performed, and local Windows testing cannot link packet-capture builds without Npcap. Remaining priorities include the unreviewed code, load measurements for broader detector state, and stronger verifier and runner integrations. Automated responses still depend on trusted telemetry, the selected policies, approvals, dry-run settings and operating-system permissions.