Versions are semantic. The downloads page always carries the current build with its signed manifest, and icdb update pulls the latest in place.
Changelog
Changelog
Every Intel Consortium release, newest first.
Inventory without a reachable scanner, and ICQL decimals.
- feature Canonical JSON inventory import, for networks no scanner can reach from where ICDB runs.
- fix ICQL accepts decimal literals, and the documented operator set now matches what the parser actually takes.
- fix A node type's declared properties are shown in the UI, and the NVD client is paced so feed polling stays inside the published rate limits.
- fix An empty community-schema catalog explains why it is empty and gives the admin a way through, instead of showing a blank list.
Asset inventory, CVE exposure, and the feeds behind them.
- feature Inventory and CVE exposure end to end: record the software you run, match it against known vulnerabilities, and see what is exposed.
- feature Vulnerability feeds from NVD and the CISA Known Exploited Vulnerabilities catalog, linked directly to the assets they affect.
- feature A CPE matching engine with exposure notifications, so a new CVE against software you already run reaches you rather than waiting to be searched for.
- feature Nessus scan import over the read API, plus an Intune inventory adapter — the Intune path is not yet validated against a live tenant.
- feature New base types for inventory: a `software_product` node, a `runs_software` edge, and a `domain` property on `system`.
- fix Every base node type is selectable in the schema editors.
- fix Edge-anchored `from`/`to` is honoured, so community schema edges can be created.
- fix Catalog sync time is stamped on every successful poll, not only on the ones that changed something.
Platform schemas were invisible to everyone.
- fix Platform schemas were hidden from every user regardless of permission. They are visible again.
A shared schema catalog, and consortium schemas that cross installs.
- feature A community schema catalog: schemas published by J3J sync into every install, and self-hosted admins can publish their own alongside them.
- feature Consortium schema sharing crosses installs, so a group can agree on one schema without each member re-typing it.
- feature Publish and withdraw schemas from the admin UI, with catalog provenance shown on every community schema and catalog-owned rows locked against local edits.
- feature Open consortia are joinable on every tier.
- change Self-hosted installs derive the public broker themselves instead of being pointed at it by hand.
- change The Docker compose file builds from the published release binary, so bringing ICDB up no longer depends on a container registry.
- change The catalog publish CLI is gone — the admin UI is the only path.
- security The admin API-key scope is reserved for platform administrators.
Insights at scale, and governance that actually holds.
- feature The insights list now filters, searches and counts facets in SQL, so large tenants stay responsive instead of loading the whole set into the browser.
- feature Review-required cluster governance is a real queue: proposed changes are held and applied on approval, rather than landing and being reverted.
- feature An insight badge in the graph is now a way into the insight itself.
- change Unknown fields in a JSON request body are rejected instead of silently dropped, so a typo in an API call fails loudly.
- fix Invite links are minted against your own instance rather than the vendor host.
- security Identity-key operations are scoped to the tenant that owns them, and cluster governance is enforced on the REST path as well as in the UI.
Sharing cascades, paginated lists, predictable licence expiry.
- feature Sharing an insight now cascades the nodes it references, so a recipient gets the supporting graph rather than a dangling report.
- feature New consortium contribution endpoint for reporting what your org has published into a group.
- feature Release archives ship a THIRD-PARTY-NOTICES file covering every bundled dependency.
- change Insight, campaign and automation-run lists are paginated, and the graph bulk-export endpoints are bounded.
- fix Re-polling an OTX feed no longer duplicates a pulse's insight.
- fix ICQL accepts a leading `from` before an explicit traversal, and chunks oversized IN clauses that previously failed on big result sets.
- change The threat-graph guides were rewritten for the current analysis-plane model.
Cluster governance, SQLite to Postgres, and Prometheus metrics.
- feature Cluster governance end to end: a tenant-global mode, per-user cluster owners, an approvals queue visible to the owning analyst, and a settings UI to drive it.
- feature `icdb migrate-db` copies a SQLite install into Postgres, including dirty or cyclic data that the old path choked on.
- feature Prometheus `/metrics` moved to a dedicated port (9000 by default) so an internet-facing deployment never exposes metrics on the app port.
- feature Per-request database accounting in the request log, for finding query hotspots without a profiler.
- feature Per-rule enrichment source multi-select for on-match automation.
- feature An ICQL cookbook of task-oriented query recipes, live-validated against the parser, with `try it` links on every snippet in the guides.
- fix The CSRF cookie keys off the browser-visible port rather than `--port`, fixing sign-in behind a proxy that remaps it.
- fix ICQL scope is enforced by statement kind rather than HTTP method, and boolean property matching works on SQLite as well as Postgres.
Ledger export, observed timestamps, and a logs view.
- feature Per-consortium audit-grade ledger export, with an Export button on the ledger panel — hand one group's proof to an auditor without revealing the others.
- feature First-observed and last-observed timestamps are now real columns: sortable in the explore UI, offered in ICQL autocomplete, and backfilled from existing data at boot.
- feature Settings → Logs brings feed ingest, tenant-scoped security events and automation run history into one place.
- feature Failed items in the notification bell can be expanded, dismissed and resubmitted.
- change Re-enrichment policy is configured in days instead of hours.
- fix Legacy `nbi` nodes carrying a loose `kind` property were swept onto the validated `indicator_type` field.
Finer-grained auto-enrichment controls.
- change Auto-enrich is now opt-in per source: choose which sources run automatically against new IOCs instead of one global switch.
- feature Tenant-authored enrichment plugins get their own auto-enrich opt-in toggle.
- feature On-device "Ask the docs" mode and content-aware guide search in the Ctrl+K palette.
- feature Autocomplete for auto.submit.<sandbox> sources in the query bar.
- fix Retry rate-limited sandbox submits so a bulk auto.submit finishes.
- feature Bulk sample pull: auto.pull_bytes.<source> fetches sample bytes for many nodes in one go.
- feature Copy multi-selected threat-graph nodes as an ICQL query or a plain property list.
- feature Scoring feedback plus queue and throughput status on the Signatures page.
Graph signatures, TTP drift, and AI ATT&CK classification.
- feature Graph signatures: a Weisfeiler-Leman sketch engine with Jaccard similarity scoring, a dedicated Signatures page, and per-cluster panels with staleness badges.
- feature AI MITRE ATT&CK classifier: turn free text into technique nodes and "uses" edges.
- feature TTP drift detection: flag when a cluster's tradecraft diverges from its own history.
- feature Consortium signature sharing with curated-only governance and signed provenance.
- feature Anchor mode now grows induced subgraphs (fan-outs and stars), not just linear paths.
Unified Settings, a live schema diagram, and the Campaign entity.
- change Consolidated the sidebar and merged everything into a single Settings hub (retired /workspace).
- feature Data-driven schema diagram from live introspection: fullscreen, with edge-routing modes.
- feature Revived the Campaign entity: CRUD, a detail page, and insight linking.
- fix Require org-admin to toggle the TLP:WHITE feed, audit cluster mutations, and fix a WebAuthn finish crash on buffered request bodies.
Timeline view, tiered enrichment, and Automations.
- feature Timeline view on the threat graph: a cluster × time matrix.
- feature Tier-3 enrichment sources plus CVE and ATT&CK-technique IOC kinds, and Censys domain lookups.
- feature Richer enrichment verdicts: a suspicious tier and distinct NO DATA / ERROR / CLEAN states, surfaced in the node drawer.
- change Renamed the Detections page to Automations and migrated the remaining enrichment sources to bundled Lua plugins.
- feature License delivery UI: download a signed license JWT, email it to the point of contact, and track its status.
Graph-canvas overhaul, sample detonation, and the enrichment + automation engine.
- feature Threat-graph canvas overhaul: drag-to-connect edges, multi-select bulk actions, keyboard anchor traversal, and auto-limiting of unbounded queries.
- feature Enrichment engine with auto-enrich on ingest and scheduled re-enrichment across bundled sources.
- feature ICQL automation: the auto.<action> { query } grammar, with run tracking and live progress in the notification bell.
- feature Sample handling: encrypted blob storage, upload/download, detonation via Hatching Triage, and sample pull from MalwareBazaar.
- feature Sandboxed plugin host: Lua and WASM enrichment plugins with resource bounds and a Custom Plugins UI.
- feature SIEM webhook connectors: Splunk, Microsoft Sentinel, CrowdStrike, Google SecOps, and QRadar.
- feature Notification bell with per-cluster Follow subscriptions, a ledger review tab, and creator-attribution disclosure.
AI skills, MCP server, TAXII/STIX, and cluster merge.
- feature AI skills (auto-link, enrich-indicator, triage-new-intel, draft-insight, and suggest-hunts) with staged-write review and per-skill approval policies.
- feature MCP server: expose AI skills and read queries as MCP tools over HTTP/SSE.
- feature TAXII 2.1 ingest and export with schema-aware STIX 2.1 import mapping.
- feature Cluster merge / unmerge / overlap with ownership enforcement.
- feature License management: records, revocation enforcement, and offline minting.
- security Encrypt per-tenant AI-provider API keys at rest.
The AI runtime, co-pilot, and the public contact endpoint.
- feature Per-tenant AI providers: settings and CRUD, an embedded aikit runtime, and a /runs history grid with detail pages.
- feature ICQL co-pilot and an SSE-streamed assistant in the editor, plus a URL-ingest tab.
- feature First AI skills (icql-copilot and ingest-osint-blog) with fetch_url and run_icql_query tools.
- feature Public /api/v1/contact endpoint powering the pid4.io forms.
Capability-based gating and dashboard rollups.
- change UI gating moved to a server-computed capability map, retiring scattered role checks at each call site.
- feature Campaign dashboard rollup and an impact field on Insights and Campaigns.
- change Reorganized navigation: Organization and Users moved under Settings; the Investigations feature was removed.
Milestone: licensing, capabilities, and analytics.
- feature Licensing system: Ed25519-verified license JWTs, per-tier feature gating, license-driven rate limits, and audit-log retention.
- feature Server-computed capability map behind every UI surface, an ic-license CLI, and an /admin/license page.
- feature First-boot setup wizard, graph-node provenance chips, and Share to Consortium from the threat graph.
- change Same-origin Plausible analytics proxy and error monitoring via Sentry / GlitchTip.
Milestone: the Integrations hub.
- feature Per-tenant OSINT feed configuration, unified under a single Integrations tab.
- feature Elastic Security webhook adapter for detection import.
- feature Run ICQL queries from the command palette; in-app feedback that attaches recent error logs.
Milestone: TLS + signed releases, the immudb ledger, and the dashboard overhaul.
- change The Go binary now terminates TLS itself (dropped Caddy), with a CloudFront edge in front.
- feature Signed release pipeline with a public artifact CDN and in-place icdb update, including Windows.
- feature Embedded in-process immudb: the tamper-evident ledger is on by default.
- feature Dashboard overhaul: hero metrics, a GitHub-style 365-day insights heatmap, the ⌘K command palette, and a light/dark toggle.
- feature Broker-backed public consortium directory with federated discovery; bounty payout reconciliation with drift alerting.
Milestone: self-update, the frontend embed, and Google sign-in.
- feature icdb update subcommand backed by an Ed25519-signed release manifest and a startup version check.
- feature The operator frontend is embedded in the single binary, with a CloudFront edge in front.
- feature Google OAuth sign-in.
Milestone: consortium federation, onboarding, and the hobbyist CLI.
- feature Ed25519-signed broker calls and self-attesting registration: the foundation for consortium federation.
- feature First-run onboarding tour and a redesigned hobbyist CLI (banner, reset-admin, help topics).
- feature Unified invite and membership flow with consortium invite share links.
- feature Hobbyist binaries check for and report newer releases on startup.