📌 Active planning has moved (2026-05-12)

This file is the historical record of major-version deliverables (v4 → v8 planned). Day-to-day planning, prioritization, and contributor-facing issue intake now live in the community-feedback-driven Now / Next / Later docs:

• docs/community-feedback/2026-05-12/AiSOC_ROADMAP.md — strategic narrative
• docs/community-feedback/2026-05-12/AiSOC_Community_Feedback_Synthesis.md — themes (F001–Fxxx)
• docs/community-feedback/2026-05-12/AiSOC_Proposed_Issues.md — 23 implementation tickets

Items in v7.1+ sections below that overlap with the new docs are flagged inline with → Now/Next/Later: [ID]. Where the new docs supersede a deferred item entirely, the entry here is left intact for traceability but reasoned about against the newer plan.

This document captures the planned direction for AiSOC across major versions. All v4 deliverables and items deferred beyond v4 are listed here.

A proof-first, security-first program to make every README claim gate-backed, close four existential agent-security holes, and build the ingest-time-graph + multi-model-router moat. Executed one phase per PR with a mandatory CI gate each. Committed status is the checklist below (per-session working detail is tracked locally in docs/audit/PROGRESS.md, which is gitignored per repo convention). Baseline audit: docs/audit/REALITY_REPORT.md and docs/audit/CLAIM_TO_GATE_MATRIX.md.

• Phase 0 — Reality audit (claim-to-gate matrix, ranked overclaims/untested-paths/circular-gates)
• Phase 1 — Four existential holes (prompt injection, memory poisoning, cross-store tenant isolation, data-exfiltration/redaction, cost DoS, vault)
• Phase 2 — Supply chain + truth (security.yml scanners, claim-gate ratchet, hard-fail insecure prod defaults, TRADEMARK, verifying-releases, license fix; continuation landed: per-image cosign signatures + CycloneDX SBOM attestations + SLSA provenance, all actions SHA-pinned)
• Phase 3 — Integration / E2E / chaos / DR (real-container spine test, backup-restore, chaos, upgrade, cross-store isolation live-replay; heavy-demo-stack Playwright E2E + demo-timing gate tracked as non-blocking 3.5+)
• Phase 4 — Real evals + detection content truth table (third-party-labeled corpus, hallucination/calibration/abstention, model matrix) — 4a/4b landed (de-circularised DAC candidate-rule gate + honest executable-vs-imported truth table); 4c+ live-agent eval / calibration / model matrix pending
• Phase 5 — Data spine correctness (versioned event-schema registry + dead-letter queue + source-event lineage in the fusion consumer; idempotency via AlertSink dedup + event-time watermarking; backfill/replay-from-offset tracked as 5b)
• Phase 6 — Performance + cost (fusion hot-path throughput harness with a generous regression-floor gate; deterministic storage $/TB cost model + drift gate; storage-consolidation ADR-0005)
• Phase 7 — Ingest-time graph + multi-model router — graph-at-ingest already shipped (v8 T1.1, services/ingest/internal/graph/); 7a landed: unified deterministic→ML→LLM router with tier attribution + the AISOC_DETERMINISTIC determinism contract (services/agents/app/routing/model_router.py, gated). 7b+ (posture collection, effective-permissions snapshot loader, bi-temporal valid_from/valid_to, fusion-time ContextBundle) tracked in docs/audit/PROGRESS.md
• Phase 8 — LLMOps (version+hash-pinned prompt registry with a CI drift gate; model pins + deterministic-terminated provider-fallback chains; content-addressed response cache; fail-closed structured-output validation)
• Phase 9 — Autonomy safety (dry-run-by-default policy, honest bounded rollback-capability contract replacing silent return True, mandatory post-action verification for unattended containment, break-glass HIGH-blast flag, autonomy scorecard — all gated at the policy layer; live-router wiring + durable approval-SLA timer table tracked as 9b)
• Phase 10 — Connector + content quality (runtime-contract conformance suite across all 69 connectors — gates the "live Test connection" capability that had NO gate + secret-field-marking; published conformance-matrix.md with a drift gate; detection lifecycle already gated by Phase 4a DAC + Phase 4b truth table. Live-vendor sandbox smoke + rate-limit/checkpoint durability tracked as 10b)
• Phase 11 — API / SDK / release engineering (pure-Python OpenAPI breaking-change detector scripts/openapi_diff.py + openapi-breaking.yml gate: PR spec vs base fails on removed endpoint/schema/field, type change, tightened request, or dropped enum value — closes the OpenAPI NO GATE row; per-language SDK generated-client contract-drift tracked as 11b)
• Phase 12 — Observability + governance (per-service SLOs in docs/operations/slos.yaml with a coverage gate; docs/operations/observability.md documenting the four golden signals + single OTel trace across the spine; GOVERNANCE.md + MAINTAINERS.md + DCO sign-off in CONTRIBUTING.md; governance-completeness gate — governance.yml)

Program status: all 13 hardening phases (0–12) are landed. Building on them, the Fully-Operational AI-SOC roadmap (Phases A1–E1) is now complete — it wired the three end-to-end paths the reality audit found unwired and pushed the platform to competitive parity + beyond:

• Phase A (SIEM foundation): A1 ClickHouse lake writer · A2 live detection-evaluation worker (825 executable rules on the stream) · A3 default-on one-command deploy (connectors + graph on) · A4 UEBA behavioral-model fusion.
• Phase B (SOAR foundation): B1 auto-triage worker (copilot default) · B2 credential resolver + decide()-governed live dispatch + 10 vendor adapters · B3 real rollback + post-action verification + durable approval-SLA timers · B4 Business Context Rules in the hot path.
• Phase C (parity differentiators): C1 Advanced Data Explorer · C2 Effective-Permissions live posture loader · C3 autopilot/copilot posture scorecard · C4 fuse-time attack-chain auto-grouping.
• Phase D (breadth): D1 eight connectors (QRadar/Exabeam/Securonix/Devo/Netskope/Windows-Sysmon/Zeek-Suricata/syslog-CEF) · D2 AI/LLM-usage audit connector + llm-* detections + hot/cold lake tiering · D3 live-vendor mock-server smoke.
• Phase E (prove it): E1 CI-gated benchmark scoreboard tied to a deterministic live-agent MITRE-accuracy run.

The claim-to-gate matrix stands at 33 GATED / 7 PARTIAL / 0 NO GATE — every product claim is now backed by a failing test and the ratchet (MAX_NO_GATE=0) forbids any regression. The 7 remaining PARTIAL rows are honest, named deferrals to phases outside the A–E scope. Per-session working detail is tracked locally in docs/audit/PROGRESS.md.

• Orchestrator (LangGraph state machine) in services/agents/app/investigator/
• ReconAgent, ForensicAgent, ResponderAgent (dry-run with analyst approval)
• ReportWriterAgent — streaming markdown + branded PDF
• Investigation & Report tabs in Case Workspace UI
• Eval harness: 20 synthetic incidents, ≥80% MITRE-tactic accuracy CI gate

• React Flow playbook editor with full node palette (Trigger, Condition, Action, Loop, Parallel, Human Approval, Wait, Notify)
• DAG playbook engine with retries, idempotency, blast-radius checks
• playbook.schema.json (JSON Schema 2020-12) for portability and CI linting
• Detection-as-Code: detections/ directory with Sigma + AiSOC YAML, GitHub Action deploy-on-merge
• 12 starter playbook templates
• Community playbook marketplace (static index v4.0; publishing flow v4.1)

• Plugin SDK in Python (packages/plugin-sdk-py/) and Go (packages/plugin-sdk-go/)
• plugin.yaml manifest spec (connector | enricher | responder | detection | widget)
• Plugin loader with OCI image support (oras pull) in api/actions/enrichment/connectors
• Public REST API v1 at /api/v1, OpenAPI 3.1 at docs/openapi.yaml
• GraphQL gateway (Strawberry) proxying REST
• Scoped API tokens (cases:read, playbooks:run, plugins:install)
• Auto-generated client SDKs: @aisoc/sdk (TypeScript), aisoc-sdk (Python/PyPI), github.com/beenuar/aisoc/sdk-go
• Docusaurus docs site at docs/site/, deployed to GitHub Pages
• Demo Lab: pnpm aisoc:lab one-command full-stack + Conti-style ransomware scenario
• 4 reference plugins: Okta connector, YARA enricher, Slack quarantine responder, MTTR sparkline widget

• OpenTelemetry traces: agents → actions → api → realtime (Jaeger/Tempo)
• API token scopes (foundation for SSO)
• docs/upgrade/MIGRATION.md for v3 → v4 upgrade path

• Plugin publishing flow (signed community submissions, Ed25519 verification, review endpoints)
• Plugin marketplace UI v2 (ratings, install counts, verified badges, category filter, sort)
• Detection catalog: browse and install community Sigma rules via UI
• Playbook community submissions and curation
• aisoc-cli — developer CLI for scaffold, validate, publish plugins and detections

• SAML 2.0 + OIDC authentication (Okta, Azure AD, Google Workspace)
• Multi-tenant row-level security (Postgres RLS + SQLAlchemy middleware)
• Granular RBAC with data-class and tenant scopes (require_permission() dependency)
• Full analyst audit log (append-only audit_log table + middleware + UI)

• SOC 2 Type II evidence collection dashboard + PDF export
• ISO 27001 control mapping
• NIST CSF / NIST 800-53 control coverage heatmap
• PCI-DSS, HIPAA, DORA module
• MTTD / MTTR / MTTC SLA tracking per tenant

• HA Helm chart with PodDisruptionBudgets and HorizontalPodAutoscalers
• Backup / restore CLI (scripts/backup.sh, scripts/restore.sh)
• Multi-region active-active topology guide (docs/operations/multi-region.md)
• Operator runbook generation from OTel traces (scripts/generate_runbook.py)

• Per-user, per-host, per-service behavioral baselines (Welford's algorithm)
• Anomaly risk scores feeding the fusion engine (z-score composite scoring)
• Peer-group analysis and deviation scoring
• Kafka integration: consumes security.events, publishes ueba.anomalies

• Token generation (AWS keys, URLs, DNS, file, DB credentials, custom types)
• First-touch alerting via HMAC-SHA256-signed webhooks
• Honeytoken lifecycle management UI (create, revoke, delete, trigger history)

• Atomic Red Team YAML loader and test sync API
• Caldera adversary emulation REST client integration
• ATT&CK coverage heatmap by tactic/technique with detection tracking
• Tabletop incident simulator with findings management UI

• MSSP / parent-tenant console — onboard child tenants, delegate cross-tenant actions, view rollup metrics
• Asset inventory + vuln-to-alert correlation — asset CRUD, vulnerability findings, blast-radius context
• Insider threat module — user risk profiles, behavioural indicators, peer-group deviation scoring
• L0–L4 auto-remediation maturity tiers — per-tenant autonomy gate with audit log and per-action whitelist

• Internal threat intelligence — IOC harvesting, threat actor profiles, STIX/TAXII feed subscriptions
• Cloud security posture management (CSPM/KSPM) — posture findings, drift tracking, suppress/resolve workflows
• Identity-centric correlation graph — identity node/edge graph, alert-to-identity linking, attack-path queries
• Auto-generated board reports — report templates, scheduled PDF/HTML artefacts, email/webhook delivery

• Dashboard metrics API — aggregated KPI endpoint powering frontend dashboard tiles
• Tailscale connector — audit log and policy-change events with cursor-based pagination
• AWS GuardDuty credential-exfiltration Sigma detection rule

A review of G2, Gartner Peer Insights, and customer feedback on AI SOC / SIEM / SOAR platforms drove this release.

• Master autonomous triage agent (auto_triage_agent.py) — classifies each alert as true_positive / false_positive / benign with confidence
• Phishing triage sub-agent (phishing_agent.py)
• Identity reasoning sub-agent (identity_agent.py)
• Cloud reasoning sub-agent (cloud_agent.py)
• Insider-threat reasoning sub-agent (insider_threat_agent.py)
• All five exposed via POST /api/v1/agents/triage

• /investigate — conversational, multi-turn investigation copilot
• /coverage-advisor — MITRE ATT&CK gap ranking by adversary prevalence
• /shifts — analyst shift-handoff dashboard
• /easm — External Attack Surface Management
• /mssp — MSSP executive dashboard
• /noise-tuning — per-rule false-positive rate and one-click tuning
• /analytics/team — analyst leaderboard, MTTR per analyst, dispositions accuracy

• shifts.py — shift-handoff CRUD
• stix_taxii.py — STIX 2.1 / TAXII 2.1 publishing
• compliance.py — automated compliance evidence (SOC 2, ISO 27001, NIST CSF, PCI-DSS, HIPAA, DORA)
• deployment.py — deployment / air-gap toggles

• SentinelOne (sentinelone.py)
• Cortex XDR (cortex_xdr.py)
• Wiz (wiz.py)
• Snyk (snyk.py)
• Zscaler (zscaler.py)
• Proofpoint (proofpoint.py)
• ServiceNow (servicenow.py)
• Jira (jira.py)
• 1Password (1password.py)
• Duo Security (duo_security.py)

• AI-generated incident reports — one-click "Export Report" generates PDF from the Investigation Ledger
• Air-gap deployment configuration — per-tenant toggles disable external feeds

All items below were shipped as part of the v1.0 buyer-value plan. Implemented and reviewed by Beenu Arora beenu@cyble.com.

• WCAG AA full accessibility pass (axe-core CI gate — apps/web/src/test/a11y.test.tsx)
• Light theme persisted in user profile (ThemeProvider.tsx + PATCH /api/v1/users/me/preferences)
• Saved views and custom drag-drop dashboard widgets per analyst (saved_views.py + DashboardView.tsx)
• AI-generated weekly executive digest — auto-emailed PDF (digest_pdf.py + weekly_digest_task.py)
• Slack native bot for alert triage without opening the UI (services/slack-bot/ — 61 tests)
• Threat actor attribution engine v0 (services/threatintel/app/actors/attribution.py)
• Air-gap / Ollama local-LLM mode (infra/compose/docker-compose.airgap.yml + apps/docs/docs/operations/air-gapped.md)
• BYOK per-tenant LLM credentials UI + API (llm_credentials.py + SettingsView.tsx)
• MSSP console — per-child-tenant KPI aggregation, SLA posture, parent_tenant_id hierarchy
• Team analytics view — analyst MTTR, leaderboard, shift workload (TeamAnalyticsView.tsx)
• Case auto-summary + PDF export (case_summary.py + case_summary_html.py)
• Investigation timeline (replayable) (InvestigationTimeline.tsx)
• Playbook gallery with 12 curated packs + GitHub PR integration for detection proposals
• Mobile responder console (React Native) — triage and acknowledge from phone (deferred to v8.0)
• Plugin publishing marketplace v3 (commercial plugins, revenue sharing) (deferred to v8.0)

Six-PR feature wave that closes #44 ("osctrl connector for fleet-wide osquery telemetry") and significantly extends osquery coverage end to end. All six PRs were implemented sequentially as part of the v7.0 release window and then patched through 7.0.1 → 7.0.3.

• PR1 — osctrl + FleetDM connectors (services/connectors/app/connectors/osctrl.py, fleetdm.py). Schema-driven setup, live Test connection round-trip, secrets encrypted via CredentialVault, polling on per-instance schedule, plus marketplace manifests at plugins/osctrl/plugin.yaml and plugins/fleetdm/plugin.yaml.
• PR2 — Native osquery detection schema migration — 16 osquery rules (detections/endpoint/osquery-*.yaml, IDs det-endpoint-281..296) migrated from _quarantine/ to the native schema, with positive/negative test fixtures (detections/fixtures/osquery_*.json) gated by the Detection Validation workflow.
• PR3 — Live-query playbook step (services/actions/app/clients/osctrl_client.py, fleetdm_client.py, osquery_allowlist.py, services/agents/app/playbook/steps/osquery_live_query.py). Allowlisted distributed queries pushed to single hosts or fleet-wide via osctrl/FleetDM with HMAC-signed ChatOps approval.
• PR4 — aisoc-osquery-tls FastAPI service + aisoc-direct agent connector (services/osquery-tls/, services/connectors/app/connectors/aisoc_direct.py). First-party self-hosted osquery TLS plugin, FleetDM-compatible config/log endpoints, direct-from-agent ingest path that bypasses third-party SaaS.
• PR5 — Osquery packs + FIM endpoint + FIM dashboard (services/osquery-tls/app/api/v1/endpoints/fim.py, apps/web/src/components/dashboard/FimDashboard.tsx). Bundled IR / OSquery-ATT&CK / FIM packs; ingests file_events and synthesises alerts on writes to /etc/passwd, /etc/shadow, sshd configs, sudoers, Windows registry hives. FIM-specific detection IDs det-endpoint-297..300.
• PR6 — AiSOC osquery extensions (services/osquery-extensions/tables/*.go). 5 custom Go-based virtual tables: aisoc_browser_extensions, aisoc_kernel_modules, aisoc_attck_persistence, aisoc_pending_actions, aisoc_alert_cache — ship richer endpoint visibility plus a bidirectional response channel.

• 42 CodeQL code-scanning alerts cleared (py/unused-global-variable, py/cyclic-import, py/empty-except, py/log-injection, py/clear-text-logging-sensitive-data, py/incomplete-url-substring-sanitization, py/stack-trace-exposure, py/call/wrong-arguments, py/unused-import, js/unused-local-variable).
• apps/web/next.config.js — Removed deprecated eslint.ignoreDuringBuilds key Next.js 16 no longer accepts; added turbopack.root for workspace package resolution.
• apps/web/src/app/layout.tsx — Added suppressHydrationWarning to <html> so the render-blocking themeBootstrapScript can write data-theme / data-theme-preference / style.colorScheme without React reporting an attribute mismatch.

• apps/web/package.json bumped to 7.0.2; sidebar shows v7.0.2 dynamically.
• apps/web/src/components/landing/Footer.tsx — Replaced hard-coded v6.1.0 with a dynamic import of package.json.
• README.md — Added osquery-tls (port 8090) and osquery-extensions to the services / Swagger / directory-tree / dev-surface tables.

• apps/web/src/components/layout/AppShell.tsx — Wrapped <DemoBanner /> in a new <ClientOnly> boundary so the banner (which reads NEXT_PUBLIC_DEMO_MODE) is never server-rendered. Eliminates React hydration error #418 caused by stale env-var inlining producing a structural tree mismatch (server saw <button> from Sidebar, client expected <div> from DemoBanner).
• apps/web/src/app/layout.tsx — Added preload: false to the JetBrains_Mono next/font/google config; eliminates "preloaded but not used within a few seconds" Chrome warnings without any visible FOUT.

Six new connectors, three documentation backfills, and a new ingest template closing the biggest cloud-security gap in the connector catalogue. Every Tier-1 cloud workload protection platform now has a first-class AiSOC integration, AWS gets three native data sources, and Kubernetes audit logs land via a dual-mode connector that works on both managed and air-gapped clusters.

• apps/docs/docs/connectors/wiz.md — Service-account creation, read:issues + read:vulnerabilities scopes, token rotation, normalised severity map, worked Wiz Issue → inbox event example.
• apps/docs/docs/connectors/aws-security-hub.md — IAM-role vs. static-key auth, securityhub:GetFindings permission, and the BLOCK_IP/ALLOW_IP capability documented end-to-end against services/actions/app/clients/aws_security_groups.py.
• apps/docs/docs/connectors/lacework.md — API-token flow, api_url regional variants, alert → event severity collapse.
• apps/docs/sidebars.ts — All three backfilled pages + the four new Track B–D pages registered under the Connectors category.

• PrismaCloudConnector (services/connectors/app/connectors/prisma_cloud.py) — Full CSPM/CWPP coverage. JWT auth via POST /login, paginated GET /alert/v1/alert with windowed time.from/time.to, severity collapse, compute_url override for self-hosted Compute Edition.
• OrcaConnector (services/connectors/app/connectors/orca.py) — https://api.orcasecurity.io/api/alerts with api_token auth, severity collapse with Orca-specific hazardous → high rule.
• Manifests at plugins/prisma-cloud/plugin.yaml and plugins/orca/plugin.yaml, docs at apps/docs/docs/connectors/{prisma-cloud,orca}.md, full test suites under services/connectors/tests/test_{prisma_cloud,orca}.py.

• AWSGuardDutyConnector (services/connectors/app/connectors/aws_guardduty.py) — boto3-based, supports IAM-role + static-key auth via _resolve_session, iterates detectors with list_findings + get_findings. Collapses GuardDuty's continuous numeric severity scale (0.1–10.0) into AiSOC's four-tier info|low|medium|high ladder.
• AWSCloudTrailConnector (services/connectors/app/connectors/aws_cloudtrail.py) — cloudtrail.lookup_events with a curated 21-event allow-list covering identity abuse, persistence, data-plane abuse, network exposure, and trail tampering. Allow-list overridable via the event_names field.
• AWSVPCFlowLogsConnector (services/connectors/app/connectors/aws_vpc_flow.py) — cloudwatch_logs.filter_log_events, v2 + v5 format parsing, RFC-5735-aware public-IP heuristic, default ?REJECT filter pattern, severity heuristic (public REJECT → medium, internal REJECT → low, ACCEPT → info).
• Manifests + docs + tests for all three connectors. 27 unit tests for AWSVPCFlowLogsConnector covering v2/v5 parsing and public-IP edge cases.

• KubernetesAuditConnector (services/connectors/app/connectors/kubernetes_audit.py) ships with two delivery modes selected via the mode config field: - webhook (recommended) — apiserver pushes audit events to AiSOC's new dedicated POST /v1/ingest/k8s-audit/{tenant_id} route, authenticated with a shared secret in the X-AiSOC-K8s-Token header (constant-time compared so a partial-prefix attacker can't shave bytes off via timing). Legacy /v1/inbox/{token} path with the k8s-audit template is kept as a fallback for control planes that cannot inject custom headers into the audit-webhook kubeconfig. - file_tail — AiSOC's connector pod tails a local audit.log using a byte-position cursor (atomically written via os.replace to a .aisoc-cursor sidecar) with rotation/truncation detection and a hard per-poll byte cap so a backlog can't blow up a single poll cycle.
• services/ingest/internal/handler/k8s_audit.go — Dedicated Go handler for the webhook route. Caps body size via K8S_AUDIT_MAX_BODY_BYTES (default 16 MiB), rejects oversized batches with 413 so the apiserver shrinks --audit-webhook-batch-max-size and retries, and publishes each EventList.items[] entry through the existing normalizer + Kafka publisher using connector_type: kubernetes_audit. The route is disabled (returns 503) until an operator sets K8S_AUDIT_SHARED_SECRET, so a fresh install never accidentally accepts unauthenticated audit traffic.
• kubernetes_audit normalizer profile (services/ingest/internal/normalizer/normalizer.go) — Maps auditID to external_id, verb to activity_name, user.username to actor.user.name, objectRef.{namespace,resource,name} to a composite target.resource.name, and translates the connector's string severity (critical|high|medium|low|info) into OCSF integer severities (5/4/3/2/1).
• k8s-audit inbox template (services/ingest/internal/normalizer/templates/k8s-audit.yaml) — maps apiserver Event payloads onto AiSOC's normalised event shape for the legacy inbox-token path; severity is derived in the connector's _classify_severity heuristic so the same logic applies to both delivery modes.
• Severity heuristic — exec/attach/portforward on Pod and create on ClusterRoleBinding → high; writes to Secret/ConfigMap/ ClusterRole/Role → medium; successful reads on sensitive resources → low; everything else → info.
• plugins/kubernetes-audit/plugin.yaml — 4-field config schema (mode, cluster_name, inbox_token, audit_log_path, cursor_path), category: cloud, capabilities pull_audit + pull_alerts.
• apps/docs/docs/connectors/kubernetes-audit.md — Sample AuditPolicy + sample AuditSink for both managed and self-hosted clusters.

• pnpm marketplace:sync — marketplace/index.json + apps/web/public/marketplace/index.json rebuilt; plugin count rose 43 → 49. Total: total=7104 detections=6993 playbooks=62 plugins=49 mitre_techniques=493.
• apps/web/package.json bumped to 7.1.0; sidebar and landing-page footer surface the new version dynamically.

Eight-commit feature wave broadening connector reach (Wazuh + auditd), making the response-action layer vendor-pluggable, replacing the NL→query template fallback with a deterministic translator, closing the threat-intel write loop to MISP, adding a blameless case post-mortem surface, and standing up a GCP Terraform skeleton equivalent to the existing AWS module.

• WazuhConnector (services/connectors/app/connectors/wazuh.py) — polls the Wazuh Indexer wazuh-alerts-* indices over HTTPX with basic-auth, paginates time-windowed queries, retries on 5xx with capped backoff, and normalises severity into the four-tier ladder. Marketplace manifest + per-connector docs + 24 unit tests.
• AuditdConnector (services/connectors/app/connectors/auditd.py) — file-tail of /var/log/audit/audit.log with multi-record reassembly by msg id, hex proctitle/argv decode, and (inode, byte_offset) cursor for log rotation. Ships with profiles/auditd/aisoc.rules opinionated auditctl ruleset whose -k keys map 1:1 to detection rules; 4 new detection rules pivot off auditd_key for sudoers / SSH / kernel-module / systemd tampering. 444-test full connectors suite green (excluding test_scheduler.py which needs the apscheduler dev dep).
• Connector registry now declares 78 first-party connectors; pnpm marketplace:sync rebuilt marketplace/index.json + apps/web/public/marketplace/index.json.

• aisoc plugin new <NAME> --type {enricher|connector|responder|detection|widget} replaces the old hard-coded plugin scaffold with per-type templates shipped inside the aisoc-cli wheel via importlib.resources. string.Template substitution for ${slug}, ${name}, ${author}; tests parameterised across all five plugin types asserting manifest validation and zero placeholder leakage. aisoc plugin scaffold retained as alias.

• Generic (vendor_id, capability) dispatcher (services/actions/app/live_actions/) — pluggable LiveActionExecutor ABC + module-level registry + dispatcher with structured logging and error translation. Unknown pairs return LiveActionResult(status=FAILED, error="executor_not_found") so the agent degrades gracefully. Adapters wrap CrowdStrike, Okta, AWS SG, Splunk so they show up as builtin descriptors.
• /api/v1/live-actions — discover, dispatch, dry-run. Honours dry_run + missing-credentials → SIMULATED, never PARTIAL.
• 45 new tests across models / registry / dispatcher / router / builtins (full actions suite: 99 passed).
• apps/docs/docs/concepts/live-actions.md + sidebar entry.

• Deterministic NL→ES|QL translator (services/agents/app/nl_query/) — IR + grammar validator + renderers for ES|QL / KQL / SPL. Replaces every # TODO: translate comment in services/api/app/api/v1/endpoints/nl_query.py. Optional enhance_with_llm (gpt-4o-mini) path with deterministic fallback so the air-gapped story keeps working.
• 50-pair NL→ES|QL eval set (services/agents/tests/eval_data/nl_query_eval.json) + test_nl_query_eval.py harness — 100% syntactic validity, 100% semantic match (50/50 perfect) against gold intents.

• Blameless case post-mortem — GET /api/v1/cases/{case_id}/postmortem?format=json|html. Pure builder + async DB orchestrator (services/api/app/services/case_postmortem.py) reusing the case_summary fetchers; HTML renderer with inline CSS, defensive escaping, no external assets. Tests assert XSS escaping, deterministic ordering, and explicit blamelessness (analyst handles must not surface in the narrative; assignee header line is explicitly allow-listed).
• STIX → MISP push (Stage 3 #20) — closes the threat-intel write loop. POST /stix/indicators and POST /stix/bundles accept ?push_to_misp=true and return a structured misp block on the same response. GET /stix/misp/health and POST /stix/misp/dry-run added for operator verification + air-gap audits. Pure mappers cover ipv4/ipv6, domain-name, url, email-addr, file:hashes (MD5/SHA-1/SHA-256/SHA-512) and file:name. Push failures are non-fatal: AiSOC store remains source of truth, MISP is best-effort. Reuses the existing enforce_airgap_for_url chokepoint. 76 new tests.

• infra/terraform/gcp/ — Cloud Run for api/web/ingest, Cloud SQL Postgres 16 + Memorystore Redis 7.2 on private IPs through a dedicated VPC + Serverless VPC Access connector, Secret Manager for every credential, Artifact Registry for images, one service account per Cloud Run service with least-privilege secretAccessor bindings. Skeleton points at the public GHCR demo images so a fresh apply works zero-config. apps/docs/docs/deployment/gcp.md + sidebar slot between kubernetes and env-vars.

• apps/docs/docs/operations/notifications.md — complete inventory of every notification surface in AiSOC (Web Push, Slack/Teams ChatOps, playbook notify_slack, create_ticket simulation, honeytoken first-touch webhooks, connector freshness alerts, on-call gating, suppression / quiet-hours, per-mechanism testing recipe).
• apps/docs/docs/plugins/lifecycle.md — operator's view of plugin states, trust modes (strict | warn | disabled), filesystem + OCI discovery, the full operator REST API with required permissions, configuration reference, upgrade/rollback semantics, and the structlog events worth alerting on.
• apps/docs/docs/integrations/misp-push.md — operator doc with config, endpoints, the STIX→MISP type table, failure modes, and the dry-run-as-air-gap-proof workflow.
• apps/docs/docs/operations/case-reports.md — covers both /summary and /postmortem with audience, output, automation, and runbook archive guidance. Cases summary breadcrumb now points operators at both endpoints.
• apps/docs/docs/connectors/{wazuh,auditd}.md + per-connector sidebar entries.
• apps/docs/docs/plugins/cli.md — documents the new aisoc plugin new --type surface.
• apps/docs/sidebars.ts — every new page registered in the correct category (Connectors, Plugin SDK, Operations, Integrations, Concepts, Deployment).

• ruff check services/ and ruff format --check services/ clean across the whole services/ tree (CI scope).
• Targeted lint fixes committed: E741 (ambiguous l), F402 (loop var shadowing dataclasses.field), E402 (post-sys.path import), E501 long-string refactors in case_postmortem_html.py, test_misp_push.py, and auditd.py.

• Mobile responder console (React Native) — triage and acknowledge from phone
• Plugin publishing marketplace v3 (commercial plugins, revenue sharing)
• MSSP RBAC enforcement on /api/v1/actors/* endpoints (threat attribution)
• Automated IOC sharing to community MISP instances via STIX/TAXII push → shipped in v7.2.0
• NL→query: "show me failed logins from new ASNs last 24h" → ES|QL / KQL → shipped in v7.2.0 (deterministic translator + 50-pair eval set)
• AI-generated threat intelligence briefings from public feeds
• Embedded red-team scoring (ATT&CK coverage %) as a live dashboard widget
• SLA breach predictor (ML model on historical MTTR data)
• Incident cost estimator (breach impact calculator)
• SOC-in-a-box one-click cloud deploy (Terraform module for AWS / GCP) → GCP module shipped in v7.2.0 (AWS already shipped)
• Automated retro/blameless post-mortem drafting from case timeline → shipped in v7.2.0 (ideas backlog item promoted)

• "Explain this alert" button using LLM with enrichment context
• Browser-extension recorder for analyst playbook capture
• Voice-driven incident commander (TTS / STT for hands-free triage)
• Automated retro/blameless post-mortem drafting from case timeline