All notable changes to Pulse Intelligence will be documented here.
Provider API keys in Settings — admins can now set, rotate, and clear
enrichment/feed provider keys from /settings instead of .env. Keys are
encrypted at rest (AES-256-GCM under CREDENTIAL_ENC_KEY) in a new
ProviderCredential table, and a sync in-memory cache serves them to the
app and worker with DB-over-env precedence. Workers re-hydrate the cache on
their 5-minute schedule sync, so UI edits apply without a restart.
(VirusTotal, OTX, AbuseIPDB — including the multi-key comma list — Shodan,
GreyNoise, NVD.)
Indicator confidence locking — analysts can pin an indicator’s confidence
from the detail page (Confidence row). A pinned (locked) value is never
overwritten by recomputeIndicatorConfidence; until it’s unlocked, provider
scores are ignored for that indicator. Unlocking hands the value back to
the provider-max reconciliation. Lock/unlock and value changes are audited.
Backup/restore round-trip smoke test — npm run db:verify-backup dumps
DATABASE_URL, restores into a scratch database on the same server, and
diffs schema-only and data-only dumps (pg_dump) of source vs restored to
prove a backup restores to an identical database — not just matching row
counts. The scratch database and temp dump are removed in every exit path
(--keep leaves the scratch DB for inspection). The CI docker job now
seeds demo data and runs this against the compose stack on every PR, so a
platform/image that breaks pg_dump/pg_restore fails CI instead of a
restore. Pure URL helpers live under src/lib/backup/urls.ts (+tests).
Self-service password change — any signed-in user (not just admins) can
rotate their password from the key icon in the topbar. Current password must
verify (a hijacked session can’t repoint an account), the current session stays
alive, and every other session is revoked. Argon2id policy: 12–256 chars,
confirmation match. Disabled in demo mode. /account/password.
Containerized deployment — a multi-stage Dockerfile, docker-entrypoint.sh
(auto-applies prisma migrate deploy on boot), and a .dockerignore. The
docker compose --profile full up -d --build profile now runs app + worker +
Postgres + Redis together. The image ships the full node_modules so
operator scripts (attack:sync, cve:catchup, db:seed*, verify scripts)
run inside the container.
docker-compose.yml worker service now runs npm run worker (the
TypeScript entrypoint via tsx) instead of the nonexistent
node dist/worker.js; app gets a /api/health healthcheck; the container
no longer requires CREDENTIAL_ENC_KEY (a fresh install can add provider
keys through the UI after boot).postgresql-client, so operator backup/restore
tooling (db:backup, db:restore, db:verify-backup) runs inside the
deployed container, not just on the host./api/health, worker reports ready — against real Postgres + Redis
service containers.GreyNoise enrichment provider — Community tier works with no API key.
Classifies IPs as mass-scanner noise (Shodan crawlers, Censys bots) vs targeted/unknown.
RIOT detection surfaces known-good infrastructure (Google, Cloudflare) to prevent
false-positives. Commercial key upgrades to the full /v2/noise/quick endpoint.
Shodan enrichment provider — InternetDB works with no API key.
Surfaces open ports, CPEs, CVE list, hostnames, and Shodan tags for any public IP.
Optional SHODAN_API_KEY upgrades to the full /shodan/host/:ip endpoint with
org, ASN, country, ISP, CVSS-scored vulnerabilities, and full service banners.
Rich enrichment cards on indicator detail pages — replaces the bare table with provider-specific views: GreyNoise classification + RIOT badge; Shodan port chips, CVE list with CVSS, org/ASN/geo. Generic fallback card for other providers. All cards show verdict badge, score, and freshness (fresh/stale relative to expiresAt).
Copy-defanged button on indicator detail pages — one click copies the defanged
value (hxxps://evil[.]com) to clipboard for safe pasting into tickets and email.
Sigma rule generator — auto-generates ready-to-use Sigma detection rule bundles
from actor and campaign data. Downloaded .yml works directly with sigma-cli to
compile to Splunk SPL, Elastic EQL, Sentinel KQL, Chronicle YARA-L, and more.
Generates network IOC rules, file hash rules, host artifact rules, and TTP-based rules
for 9 ATT&CK techniques with false-positive filters. Download button added to actor
and campaign detail pages.
Endpoints: GET /api/sigma/actor/:id, GET /api/sigma/campaign/:id.
MITRE D3FEND countermeasures on ATT&CK technique detail pages — maps each technique to the defensive techniques (Harden, Detect, Isolate, Deceive, Evict) that counter it. Offline mapping covers ~50 high-priority techniques from CISA top-exploited and Mandiant M-Trends. Links to d3fend.mitre.org for the full graph. Zero network calls.
GET /api/v1/indicators/:id/context returns
everything the platform knows about an indicator in one authenticated call: enrichments
(with raw provider responses), actors, campaigns, reports, and an aggregate verdict.
Designed for SOAR playbook integration. Cache-Control: private, 60s..env.example updated with GREYNOISE_API_KEY and SHODAN_API_KEY documentation
including free-tier notes and registration URLs.Initial open-source release of Pulse Intelligence.