SO-CRATES — The Cyber Toolchain

SO-CRATES v4.3.0

Mon, 28 Sep 2026 14:59:30 GMT

SO-CRATES v4.3.0 ships a bundled, air-gapped CyberChef with full-payload pivoting, bidirectional stream support, and Suricata-extracted file analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Bundles CyberChef (~48 MB added to container image) so the pivot menu's CyberChef lookup works with no internet access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Send to CyberChef' from a stream's Payload panel, sending exact bytes in Both directions, or just the Source or Dest side — XOR keys, compressed data, and shellcode arrive intact. • Adds a 'Send to CyberChef' button in File Info for files Suricata extracted from traffic. • Enables pivot-menu access to CyberChef (and other lookups) by selecting any text in an ASCII transcript — base64 blobs, headers, or partial values. • Applies CyberChef's Magic operation automatically to small payloads, now including values sent from the pivot menu, to suggest decodings. • Syncs CyberChef's light/dark theme to match the user's chosen SO-CRATES theme unless a CyberChef theme has been set manually. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v4.2.0

Mon, 21 Sep 2026 17:06:13 GMT

SO-CRATES v4.2.0 adds `ALLOWED_HOSTS` env var for reverse-proxy deployments and tightens JSON API content-type enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ALLOWED_HOSTS` environment variable (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ `-e ALLOWED_HOSTS='*.killercoda.com'`) to support serving SO-CRATES behind a reverse proxy or cloud hostname; browsing via IP or localhost requires no change. • Requires scripts calling the JSON API to send `Content-Type: application/json`; requests omitting this header will now fail. • Docker/Podman compose files now publish the port on localhost only by default; change the port mapping to `"8000:8000"` to allow other hosts on the network. Breaking changes: • Serving SO-CRATES behind a reverse proxy or cloud hostname now requires setting the `ALLOWED_HOSTS` environment variable (e.g. `-e ALLOWED_HOSTS='*.killercoda.com'`); omitting it will produce an error. • Docker/Podman compose files now bind the port to localhost only; setups relying on other machines reaching SO-CRATES on the network must change the port mapping to `"8000:8000"`. • Scripts calling the JSON API must now send `Content-Type: application/json`; requests without this header will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v4.1.0

Tue, 25 Aug 2026 10:43:06 GMT

SO-CRATES v4.1.0 adds DNS tunneling/DGA heuristics, community ID correlation, JA3/JA4 TLS fingerprinting, and paginated aggregation tables. • Adds a **DNS Heuristics** tab that aggregates every DNS query by registrable domain and scores each 0–100 across five signals: high-entropy subdomain prefix (tunneling shape), high-entropy/low-vowel-ratio registrable domain (DGA shape), 15+ distinct subdomains under the same parent (fan-out), unusually long query name or label, and TXT/NULL record types; known CDN suffixes are allowlisted before scoring to reduce noise. • Force-enables Suricata's `community_id` field on every analysis (off by default in Suricata) so flow/alert records can correlate against Zeek and other community-id-aware tools without manual configuration. • Adds a **Correlate** entry to the pivot menu that searches all logs across a capture sharing the same `community_id` flow — network protocol events and alerts alike — when clicking any field on a row that carries a community ID. • Force-enables JA3, JA3S, and JA4 TLS client/server fingerprinting on every analysis (previously silently absent from `tls` events unless an active rule's signature keyword happened to require them); all three now appear as their own rows in a TLS row's detail panel when present. • Adds full keyboard navigation to Aggregation Tables: Left/Right jumps between tables, Down walks rows and crosses into the next visual row of tables or the Data Table, and Enter activates Prev/Next pagination without losing focus. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v4.0.0

Wed, 19 Aug 2026 11:59:26 GMT

SO-CRATES v4.0.0 adds alert acknowledgment, full keyboard navigation, a command palette, and multi-file ZIP analysis. • Adds 'Acknowledge this alert' and 'Acknowledge all instances of this alert' options in the pivot menu on Network Alert and Sigma Alert rows, immediately removing acknowledged rows from all views (Network Alerts, Sigma Alerts, All Events, Sankey diagram, and counts); acknowledged alerts appear in a new 'Acknowledged Alerts' stat-card tab with per-type sub-sections and 'Un-acknowledge this alert' support. • Adds full keyboard navigation across the entire app: arrow keys move between stat-card tabs and data-table rows, Enter activates highlights (opens samples, expands/collapses rows), and Escape closes modals/menus one layer at a time before leaving an analysis. • Adds a command palette — triggered by typing any letter or digit outside a text field — supporting mid-word substring matching and ranked results for themes, stat-card tabs, and named shortcuts including `help`, `about`, `themes`, `rules`, `settings`, `notes`, `delete`, `re-analyze`, `search`, `clear`, `sankey`, `aggregation`, `advanced features`, `documentation`, `security onion`, `github repo`, `pcap samples`, `log samples`, `binary samples`, `upload`, `import`, `previous analyses`, `copy md5 hash to clipboard`, and `rename analysis`. • ZIP uploads containing multiple supported files now analyze every file independently in parallel (each pcap, log, or binary gets its own analysis) instead of silently dropping all but the first; byte-identical duplicates within the same ZIP are analyzed only once. • Adds a new 'MP3 Player' fun theme (cheat code `mp3`) with brushed-metal chrome grays, LCD-green readout, and a bouncing spectrum-analyzer background. • Moves Re-analyze and Delete controls off the Previous Analyses list onto the analysis page header, and relocates Delete All into a new Danger Zone section in Settings. • Adds the Themes modal its own arrow-key grid navigation with live-preview on every move, jumping relative to the currently active theme rather than always restarting from a corner. • Adds keyboard reach to Sankey Diagram and Aggregation Tables section headers (expand/collapse with Enter), aggregation table values, filter bar chips, and expanded-row detail panel elements (Add Note, ASCII Transcript, Hexdump, Download PCAP, Expand All/Collapse All, individual packets). • Sguil theme moves from Fun Themes to Light Themes (retaining cheat code `sguil`); Daylight theme is removed (existing users fall back to White). • Ambient theme backgrounds updated: Breadbin Blue and CGA gain demoscene-style plasma fields; CGA's is additionally quantized through a Bayer dither to the 4-color CGA palette; Amber CRT now prints boot-log-style lines at randomized intervals. Breaking changes: • The `t` key no longer cycles themes; theme-cycling moved to `<`/`>` keys, and theme switching is now handled through the command palette or Themes modal. • The Daylight theme is removed; users previously on Daylight are switched to White. • Re-analyze and Delete are no longer accessible from the Previous Analyses list on the welcome screen; they are now located on the analysis page header. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v3.2.0

Tue, 11 Aug 2026 10:03:52 GMT

SO-CRATES v3.2.0 adds per-row evidence annotations, a pivot menu with custom lookups, AI rule summaries, and Security Onion Playbooks. • Adds `AI_SUMMARIES_DIR` environment variable for manual installs to point at a locally-built AI summary index for Suricata, Sigma, and YARA rule explanations. • Adds `PLAYBOOKS_DIR` environment variable for manual installs to point at a locally-built Security Onion Playbooks index for Suricata and Sigma alert investigation guidance. • Adds `show_protocol_decode_alerts` setting (Rules modal) to make protocol-decode alert noise explicitly opt-in, with a dedicated 'Decoder Alerts' tab when enabled. • New per-row note icon on Suricata alerts, DNS/HTTP/TLS/flow events, Sigma alerts, file/YARA matches, and imported log events lets analysts attach short annotations to individual evidence rows — separate from the whole-analysis Notes field. • New pivot menu on any table cell value offers Include, Exclude, Only, and Hunt filter actions, plus Copy to Clipboard and one-click lookups against Google, VirusTotal, Shodan, AbuseIPDB, urlscan.io, and CyberChef. • Pivot menu supports user-defined custom lookup sites (added/edited/removed in Settings) with a `{value}` URL template, persisted per-browser with strict http/https-only URL validation. • Expanding a Suricata alert, Sigma alert, or YARA file match now shows an AI Summary — a plain-English explanation of what the rule detects, sourced from Security Onion's `securityonion-resources` repository (`generated-summaries-published` branch). • Expanding a Suricata or Sigma alert now shows a Playbook section with plain-English investigation guidance sourced from Security Onion's Playbooks repository, baked into the Docker/Podman image. • Reanalyze confirmation dialog now displays a bold warning and turns the Re-analyze button red when the analysis has unsaved row-level notes that would be destroyed. • A reanalyze icon in the analysis header re-runs the pipeline without leaving the page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v3.1.0

Tue, 04 Aug 2026 11:28:36 GMT

SO-CRATES v3.1.0 adds in-UI rule management, analysis notes, inline renaming, MD5 copy, and 24-hour YARA/Sigma auto-refresh. • New `POST /api/analysis-notes` endpoint stores freeform analyst notes (e.g. 'suspected GuLoader, C2 at x.top') as `notes.txt` per analysis; supports multi-line text and empty submission to clear. • New `POST /api/rename-analysis` endpoint lets analysts rename an analysis display name inline; original filename preserved in `.meta`'s `original` field. • `GET /api/analyses` now includes a `date_range` field (`{"min": ..., "max": ...}`, both `null` while still processing) per analysis, used for hover tooltips to distinguish same-named analyses. • New Rules modal (accessible from the gear menu) shows each ruleset's current rule count, last-updated timestamp, and per-ruleset 'Update' and 'Update All' buttons — rule updates no longer block server startup. • Rules modal surfaces upstream sources with links: Suricata to Emerging Threats Open, YARA to YARA Forge, Sigma to SigmaHQ, so analysts can inspect what they are pulling before updating. • Ruleset 'updated' dates in the Rules modal are highlighted in warning color when more than 30 days old or never successfully updated, making staleness visible at a glance across all four rulesets (Suricata, YARA, Sigma Windows, Sigma Linux). • Rule update progress in the modal shows a spinner and elapsed-time counter (`Updating… 45s`) with an on-demand 'View Log' / 'Hide Log' toggle for the raw update log, polled via `/api/rule-update-status`. • A one-time sticky toast appears on first load when `/api/rules-info` shows no rules for all three engines, with a direct 'Open Rules' link to the Rules modal. • Clicking the MD5 hash in the analysis header copies it to the clipboard, with a toast confirming success or a clear error when `navigator.clipboard` is unavailable. • YARA and Sigma cached rule files now refresh automatically if older than 24 hours and the network is reachable, falling back to the stale copy on failure; a single shared reachability probe replaces per-engine timeouts, capping startup delay at ~5s instead of ~15s. • Notes icon in the analysis header and Previous Analyses list rows is muted when no notes exist and accent-colored once notes are present, letting analysts spot annotated analyses without opening them. • New Themes interface includes optional OhMyDebn theme sync. • New Notes interface and new Rules interface added to the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates

SO-CRATES v1.1.0

Mon, 22 Jun 2026 11:44:14 GMT

SO-CRATES v1.1.0 adds a light mode UI option • Adds `light mode` option to the web interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/so-crates