SO-CRATES

No entries match these filters. Clear filters

1. docs update Oct 30, 2026 · issue 125

   SO-CRATES adds right-click context actions on log values to include, exclude, hunt, or correlate by community IDcommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Pivot instantly from a suspicious log entry to all related events sharing the same community ID — without writing a query.
   📍In the log view, right-click any field value and choose Hunt or Correlate to filter or cross-reference every log sharing its community ID.
2. v4.3.0 Sep 28, 2026 · issue 089

   SO-CRATES v4.3.0 ships a bundled, air-gapped CyberChef with full-payload pivoting, bidirectional stream support, and Suricata-extracted file analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.3.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v4.3.0

   └──▷ HOW TO FIND IT
   Analyse a full bidirectional TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. payload — shellcode, compressed data, XOR-keyed content — in an air-gapped CyberChef without it appearing in browser history.
   📍In the stream detail view, open the Payload panel, then click Send to CyberChef and choose Both, Source, or Dest to load the exact bytes into the bundled CyberChef instance.
   Decode a suspicious base64 blob or header value spotted in an ASCII transcript without leaving the SO-CRATES UI.
   📍Select the text (e.g. a base64 blob) in the ASCII transcript, then choose CyberChef from the pivot menu that appears — CyberChef opens with the selected text and, for small values, applies the Magic operation automatically.
   Inspect a file Suricata carved from traffic — PE, archive, document — directly in CyberChef for offline triage.
   📍Navigate to the alert or flow's File Info panel and click the Send to CyberChef button next to the extracted file to load its bytes into the bundled CyberChef instance.
   • Bundles CyberChef (~48 MB added to container image) so the pivot menu's CyberChef lookup works with no internet access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Send to CyberChef from a stream's Payload panel, sending exact bytes in Both directions, or just the Source or Dest side — XOR keys, compressed data, and shellcode arrive intact.
   • Adds a Send to CyberChef button in File Info for files Suricata extracted from traffic.
   • Enables pivot-menu access to CyberChef (and other lookups) by selecting any text in an ASCII transcript — base64 blobs, headers, or partial values.
   • Applies CyberChef's Magic operation automatically to small payloads, now including values sent from the pivot menu, to suggest decodings.

   +1 more show less

   • Syncs CyberChef's light/dark theme to match the user's chosen SO-CRATES theme unless a CyberChef theme has been set manually.
   • Bundles CyberChef (~48 MB added to container image) so the pivot menu's CyberChef lookup works with no internet access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Send to CyberChef from a stream's Payload panel, sending exact bytes in Both directions, or just the Source or Dest side — XOR keys, compressed data, and shellcode arrive intact.
   • Adds a Send to CyberChef button in File Info for files Suricata extracted from traffic.
   • Enables pivot-menu access to CyberChef (and other lookups) by selecting any text in an ASCII transcript — base64 blobs, headers, or partial values.
   • Syncs CyberChef's light/dark theme to match the user's chosen SO-CRATES theme unless a CyberChef theme has been set manually.

   1 more in Everything

3. v4.2.0 Sep 21, 2026 · issue 082

   SO-CRATES v4.2.0 adds ALLOWED_HOSTS env var for reverse-proxy deployments and tightens JSON API content-type enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.2.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v4.2.0

   └──▷ TRY IT
   Run SO-CRATES behind a Killercoda (or other cloud/reverse-proxy) hostname so the host validation passes.
   copy

   $ docker run -e ALLOWED_HOSTS='*.killercoda.com' so-crates

   • Adds ALLOWED_HOSTS environment variable (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ -e ALLOWED_HOSTS='*.killercoda.com') to support serving SO-CRATES behind a reverse proxy or cloud hostname; browsing via IP or localhost requires no change.
   • Requires scripts calling the JSON API to send Content-Type: application/json; requests omitting this header will now fail.
   • Docker/Podman compose files now publish the port on localhost only by default; change the port mapping to "8000:8000" to allow other hosts on the network.
   • Adds ALLOWED_HOSTS environment variable (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ -e ALLOWED_HOSTS='*.killercoda.com') to support serving SO-CRATES behind a reverse proxy or cloud hostname; browsing via IP or localhost requires no change.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Serving SO-CRATES behind a reverse proxy or cloud hostname now requires setting the ALLOWED_HOSTS environment variable (e.g. -e ALLOWED_HOSTS='*.killercoda.com'); omitting it will produce an error.
   • !Docker/Podman compose files now bind the port to localhost only; setups relying on other machines reaching SO-CRATES on the network must change the port mapping to "8000:8000".
   • !Scripts calling the JSON API must now send Content-Type: application/json; requests without this header will break.
4. v4.1.0 Aug 25, 2026 · issue 059

   SO-CRATES v4.1.0 adds DNS tunneling/DGA heuristics, community IDcommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources. correlation, JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port./JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprinting, and paginated aggregation tables.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v4.1.0

   ⤢
   • Adds a DNS Heuristics tab that aggregates every DNS query by registrable domain and scores each 0–100 across five signals: high-entropy subdomain prefix (tunneling shape), high-entropy/low-vowel-ratio registrable domain (DGA shape), 15+ distinct subdomains under the same parent (fan-out), unusually long query name or label, and TXT/NULL record types; known CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. suffixes are allowlisted before scoring to reduce noise.
   • Force-enables Suricata's community_id field on every analysis (off by default in Suricata) so flow/alert records can correlate against Zeek and other community-id-aware tools without manual configuration.
   • Adds a Correlate entry to the pivot menu that searches all logs across a capture sharing the same community_id flow — network protocol events and alerts alike — when clicking any field on a row that carries a community ID.
   • Force-enables JA3, JA3S, and JA4 TLS client/server fingerprinting on every analysis (previously silently absent from tls events unless an active rule's signature keyword happened to require them); all three now appear as their own rows in a TLS row's detail panel when present.
   • Adds full keyboard navigation to Aggregation Tables: Left/Right jumps between tables, Down walks rows and crosses into the next visual row of tables or the Data Table, and Enter activates Prev/Next pagination without losing focus.

   5 details in Everything

5. v4.0.0 Aug 19, 2026 · issue 059

   SO-CRATES v4.0.0 adds alert acknowledgment, full keyboard navigation, a command palette, and multi-file ZIP analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.0.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v4.0.0

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Silence a noisy Suricata signature firing hundreds of times so it no longer clutters any view during the current analysis.
   📍In the analysis view, right-click (or open the pivot menu) on any Network Alert or Sigma Alert row › select Acknowledge all instances of this alert. All matching rows are removed from Network Alerts, All Events, the Sankey diagram, and all counts immediately. To review or undo, open the Acknowledged Alerts stat-card tab and select Un-acknowledge this alert.
   Quickly switch to a specific theme or jump to a feature without leaving the keyboard.
   📍Type mp3 (outside any text field) to open the command palette pre-filled with mp3, then press Enter to switch to the MP3 Player theme. Type re-analyze and press Enter to re-run the current analysis.
   Analyze every pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. in a multi-file incident ZIP (e.g. from malware-traffic-analysis.net) in one upload instead of manually extracting and uploading each file.
   📍On the main screen, upload a .zip file containing multiple pcaps. SO-CRATES analyzes each supported file independently in parallel; a toast notification links to Previous Analyses where each result appears separately.
   • Adds Acknowledge this alert and Acknowledge all instances of this alert options in the pivot menu on Network Alert and Sigma Alert rows, immediately removing acknowledged rows from all views (Network Alerts, Sigma Alerts, All Events, Sankey diagram, and counts); acknowledged alerts appear in a new Acknowledged Alerts stat-card tab with per-type sub-sections and Un-acknowledge this alert support.
   • Adds full keyboard navigation across the entire app: arrow keys move between stat-card tabs and data-table rows, Enter activates highlights (opens samples, expands/collapses rows), and Escape closes modals/menus one layer at a time before leaving an analysis.
   • Adds a command palette — triggered by typing any letter or digit outside a text field — supporting mid-word substring matching and ranked results for themes, stat-card tabs, and named shortcuts including help, about, themes, rules, settings, notes, delete, re-analyze, search, clear, sankey, aggregation, advanced features, documentation, security onion, github repo, pcap samples, log samples, binary samples, upload, import, previous analyses, copy md5 hash to clipboard, and rename analysis.
   • ZIP uploads containing multiple supported files now analyze every file independently in parallel (each pcap, log, or binary gets its own analysis) instead of silently dropping all but the first; byte-identical duplicates within the same ZIP are analyzed only once.
   • Adds a new MP3 Player fun theme (cheat code mp3) with brushed-metal chrome grays, LCD-green readout, and a bouncing spectrum-analyzer background.

   +5 more show less

   • Moves Re-analyze and Delete controls off the Previous Analyses list onto the analysis page header, and relocates Delete All into a new Danger Zone section in Settings.
   • Adds the Themes modal its own arrow-key grid navigation with live-preview on every move, jumping relative to the currently active theme rather than always restarting from a corner.
   • Adds keyboard reach to Sankey Diagram and Aggregation Tables section headers (expand/collapse with Enter), aggregation table values, filter bar chips, and expanded-row detail panel elements (Add Note, ASCII Transcript, Hexdump, Download PCAP, Expand All/Collapse All, individual packets).
   • Sguil theme moves from Fun Themes to Light Themes (retaining cheat code sguil); Daylight theme is removed (existing users fall back to White).
   • Ambient theme backgrounds updated: Breadbin Blue and CGA gain demoscene-style plasma fields; CGA's is additionally quantizedquantizedStoring a model's weights at lower numeric precision, such as 8 or 4 bits instead of 16, so it needs less memory and runs faster. It trades a small amount of accuracy for fitting on smaller hardware. through a Bayer dither to the 4-color CGA palette; Amber CRT now prints boot-log-style lines at randomized intervals.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The t key no longer cycles themes; theme-cycling moved to </> keys, and theme switching is now handled through the command palette or Themes modal.
   • !The Daylight theme is removed; users previously on Daylight are switched to White.
   • !Re-analyze and Delete are no longer accessible from the Previous Analyses list on the welcome screen; they are now located on the analysis page header.
6. v3.2.0 Aug 11, 2026 · issue 059

   SO-CRATES v3.2.0 adds per-row evidence annotations, a pivot menu with custom lookups, AI rule summaries, and Security Onion Playbooks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.2.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v3.2.0

   ⤢
   └──▷ TRY IT
   Point a manual (non-Docker) SO-CRATES install at a locally-built AI summaries index so Suricata, Sigma, and YARA expansions show plain-English rule explanations.
   copy

   $ AI_SUMMARIES_DIR=/opt/so-crates/summaries python3 socrates.py

   Point a manual install at a locally-built Playbooks index so Suricata and Sigma alert expansions show investigation guidance.
   copy

   $ PLAYBOOKS_DIR=/opt/so-crates/playbooks python3 socrates.py

   Add a custom threat-intel lookup site so any pivot menu can open a value directly in your internal enrichment portal.
   📍In Settings, under Custom Lookup Sites, click Add and enter a name and URL using the {value} template — e.g. https://intel.corp/search?q={value} — then click Save. The entry is validated for http/https only and persisted per-browser.
   • Adds AI_SUMMARIES_DIR environment variable for manual installs to point at a locally-built AI summary index for Suricata, Sigma, and YARA rule explanations.
   • Adds PLAYBOOKS_DIR environment variable for manual installs to point at a locally-built Security Onion Playbooks index for Suricata and Sigma alert investigation guidance.
   • Adds show_protocol_decode_alerts setting (Rules modal) to make protocol-decode alert noise explicitly opt-in, with a dedicated Decoder Alerts tab when enabled.
   • New per-row note icon on Suricata alerts, DNS/HTTP/TLS/flow events, Sigma alerts, file/YARA matches, and imported log events lets analysts attach short annotations to individual evidence rows — separate from the whole-analysis Notes field.
   • New pivot menu on any table cell value offers Include, Exclude, Only, and Hunt filter actions, plus Copy to Clipboard and one-click lookups against Google, VirusTotal, Shodan, AbuseIPDB, urlscan.io, and CyberChef.

   +5 more show less

   • Pivot menu supports user-defined custom lookup sites (added/edited/removed in Settings) with a {value} URL template, persisted per-browser with strict http/https-only URL validation.
   • Expanding a Suricata alert, Sigma alert, or YARA file match now shows an AI Summary — a plain-English explanation of what the rule detects, sourced from Security Onion's securityonion-resources repository (generated-summaries-published branch).
   • Expanding a Suricata or Sigma alert now shows a Playbook section with plain-English investigation guidance sourced from Security Onion's Playbooks repository, baked into the Docker/Podman image.
   • Reanalyze confirmation dialog now displays a bold warning and turns the Re-analyze button red when the analysis has unsaved row-level notes that would be destroyed.
   • A reanalyze icon in the analysis header re-runs the pipeline without leaving the page.

   10 details in Everything

7. v3.1.0 Aug 4, 2026 · issue 059

   SO-CRATES v3.1.0 adds in-UI rule management, analysis notes, inline renaming, MD5 copy, and 24-hour YARA/Sigma auto-refresh.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   ⤢ ⤢ ⤢ ⤢
   └──▷ TRY IT
   Check whether all three rule engines have rules loaded before relying on detections, and surface the Rules modal link if any engine reports zero rules.
   copy

   $ curl -s http://localhost:8000/api/rules-info | python3 -m json.tool

   • New POST /api/analysis-notes endpoint stores freeform analyst notes (e.g. 'suspected GuLoader, C2 at x.top') as notes.txt per analysis; supports multi-line text and empty submission to clear.
   • New POST /api/rename-analysis endpoint lets analysts rename an analysis display name inline; original filename preserved in .meta's original field.
   • GET /api/analyses now includes a date_range field ({"min": ..., "max": ...}, both null while still processing) per analysis, used for hover tooltips to distinguish same-named analyses.
   • New Rules modal (accessible from the gear menu) shows each ruleset's current rule count, last-updated timestamp, and per-ruleset Update and Update All buttons — rule updates no longer block server startup.
   • Rules modal surfaces upstream sources with links: Suricata to Emerging Threats Open, YARA to YARA Forge, Sigma to SigmaHQSigmaHQAn open community repository on GitHub that maintains the Sigma generic signature format and its growing library of detection rules, giving cyber tools a vendor-neutral rule set they can convert to any SIEM query language., so analysts can inspect what they are pulling before updating.

   +8 more show less

   • Ruleset updated dates in the Rules modal are highlighted in warning color when more than 30 days old or never successfully updated, making staleness visible at a glance across all four rulesets (Suricata, YARA, Sigma Windows, Sigma Linux).
   • Rule update progress in the modal shows a spinner and elapsed-time counter (Updating… 45s) with an on-demand View Log / Hide Log toggle for the raw update log, polled via /api/rule-update-status.
   • A one-time sticky toast appears on first load when /api/rules-info shows no rules for all three engines, with a direct Open Rules link to the Rules modal.
   • Clicking the MD5 hash in the analysis header copies it to the clipboard, with a toast confirming success or a clear error when navigator.clipboard is unavailable.
   • YARA and Sigma cached rule files now refresh automatically if older than 24 hours and the network is reachable, falling back to the stale copy on failure; a single shared reachability probe replaces per-engine timeouts, capping startup delay at ~5s instead of ~15s.
   • Notes icon in the analysis header and Previous Analyses list rows is muted when no notes exist and accent-colored once notes are present, letting analysts spot annotated analyses without opening them.
   • New Themes interface includes optional OhMyDebn theme sync.
   • New Notes interface and new Rules interface added to the UI.

   13 details in Everything

8. v3.0.0 Jul 28, 2026 · release notes

   SO-CRATES v3.0.0 adds ENABLE_ARP_LOGGING, configurable upload/query limits, and server-side aggregation APIs for new protocol support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ USE IT
   Enable ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. logging for multi-host captures by setting the environment variable at startup.
   shell copy

   docker run -e ENABLE_ARP_LOGGING=1 ... so-crates:latest

   Fetch aggregation data for an analysis via the new API endpoint.
   copy

   $ curl https://so-crates.example.com/api/aggregation-data?analysis_id=abc123

   Fetch Sankey diagram data for an analysis via the new API endpoint.
   copy

   $ curl https://so-crates.example.com/api/sankey-data?analysis_id=abc123

   • Add support for decoding ARP via the new ENABLE_ARP_LOGGING environment variable
   • Add full column, filtering, and aggregation support for enip, ntp, websocket, pop3, mdns, and ldap protocols
   • Move aggregation table and Sankey diagram computation to server-side APIs (GET /api/aggregation-data, GET /api/sankey-data)

   3 details in Everything

9. v2.1.0 Jul 20, 2026 · release notes

   SO-CRATES v2.1.0 adds Modbus, DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches., and PostgreSQL protocol support in Suricata configs plus Matte Black and Sguil themes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.0 https://github.com/dougburks/so-crates.git
   # already have the repo? check out this version:
   $ git checkout v2.1.0

   • Update Suricata config to include support for Modbus, DNP3, and PostgreSQL protocols
   • Add Matte Black theme
   • Add Sguil theme

   3 details in Everything

10. v2.0.0 Jul 13, 2026 · release notes

    SO-CRATES v2.0 adds Hacker Mode analysis view and a UI button to delete all previous analyses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/dougburks/so-crates.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    └──▷ HOW TO FIND IT
    Switch the SO-CRATES interface to Hacker Mode to analyze captured traffic or system logs with a specialized view.
    📍In the main screen, select Hacker Mode to begin pcap, log, or file analysis.
    • Adds Hacker Mode to the main screen for pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., log, and file analysis.

    1 detail in Everything

11. v1.1.0 Jun 22, 2026 · release notes

    SO-CRATES v1.1.0 adds a light mode UI option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/dougburks/so-crates.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ HOW TO FIND IT
    Toggle light mode via the UI settings menu.
    📍In the SO-CRATES web interface, navigate to Settings and select light mode.
12. v1.0.0 Jun 9, 2026 · release notes

    SO-CRATES v1.0.0 adds log analysis capabilities with a new welcome screen and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream viewing options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/dougburks/so-crates.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    • log is added as a supported source type for analysis.

    1 detail in Everything