Skip to content

ROADMAP.md

Latest commit

 

History

History
23 lines (22 loc) · 3.72 KB

ROADMAP.md

File metadata and controls

23 lines (22 loc) · 3.72 KB
Raw

Roadmap

  • M0 Foundation — complete: OCI-native container, Docker/Podman deployment, non-root runtime, /data, health API and tests.
  • M1 Core Passive OSINT — complete: target detection, DNS, RDAP, IP classification, HTTP/TLS inspection and mail-domain analysis.
  • M2 Case & Pivot Engine — complete: cases, targets, artifacts, relationships, notes, provenance and pivots.
  • M3.1 Provider Framework — complete: explicit provider registry, safe server-side configuration, structured failures, provenance artifacts, one IPinfo adapter and automated qualification.
  • M3.2 Provider Expansion & Enrichment — complete: curated VirusTotal, AbuseIPDB, and Shodan adapters; hash targets; multi-provider enrichment; provenance-linked graph pivots; normalized rate-limit failures.
  • M3 Providers: future additions remain deliberately selective; usefulness without API keys remains a requirement.
  • M4.1 Local Artifact Analysis Foundation — complete: bounded streaming upload, content-addressed storage, hashes, baseline signatures, file targets and persistent local analysis.
  • M4.2 Safe Structured Content Analysis — complete: bounded ZIP/TAR/gzip recursion, child provenance, image/EXIF headers, PDF metadata and ZIP-office/ODF metadata.
  • M4.3 Executable & Binary Static Analysis — complete: bounded internal PE/ELF/Mach-O/Amiga Hunk parsers, strings, entropy, persistent indicator candidates and explicit graph promotion.
  • M4.4 Signatures, Rules & Similarity — complete: managed versioned YARA-compatible rules and known-hash sets, normalized local evidence, SimHash fingerprints, local comparison and explicit reanalysis.
  • M4.5 Local Antivirus Engine Framework + ClamAV — complete: explicit local AV registry, optional ClamAV INSTREAM adapter, normalized states/evidence, engine/database provenance and bounded local scan policy.
  • M5.1 Web UI Foundation & Case Workspace — complete: server-rendered case, target, file and evidence workspaces with local static assets and safe browser mutations.
  • M5.2 Interactive Analysis Workspace — complete: bounded relationship graph, provenance-aware timeline, target-centric navigation, and accessible no-JavaScript fallbacks.
  • M5.3 Case Export, Import & Reporting — complete: deterministic JSON, integrity-checked .osintcase bundles, safe ID-remapped import, redaction profiles, and printable evidence reports.
  • M5.4 Structured Intelligence Interoperability — complete: bounded STIX 2.1 export/import with conservative mappings and provenance-preserving diagnostics.
  • M5.5 TAXII/MISP interoperability — complete: bounded operator-configured TAXII retrieval and conservative MISP Event exchange with preview-before-import.
  • M6.0 Authentication/RBAC/Audit — complete: local users, secure sessions, instance-wide roles and bounded security audit events.
  • M6.1 Case Ownership, ACLs & Teams — complete: schema 9, explicit legacy adoption, user/team case grants, centralized role intersection, cross-user runtime qualification, migration/restart verification and documented security residuals.
  • M6.2 Security Hardening — complete: deterministic authorization-race coverage, real-browser security-flow qualification, centralized authorization regression review and documented residual risks.
  • M7 Release Engineering & Polish — complete: installation/upgrade guidance, backup/restore qualification, tag-driven release automation, deployment/distribution contracts and release-candidate closure.
  • M8 v1.0 Qualification — in progress: M8.0 final qualification plan is complete; M8.1 freezes and qualifies the exact 1.0.0 release-source candidate. The immutable v1.0.0 tag remains blocked on full CI plus manual mirror/registry pre-tag verification.