Skip to Content
V4.8.0Release Notes

Release Notes

Operator-relevant highlights per release, newest first. Patch releases and internal changes are omitted; the complete per-release archive is in the Changelog.

4.8.0

  • New platforms: Juniper SRX firewalls (Junos CLI over SSH) as a first-class device type with policies, NAT, objects resolved inline, export and change attribution; Junos OS routers; and VyOS routers over HTTPS API or SSH. The Add Device form is now driven by a platform catalog with per-platform transport selection. See Device Onboarding.
  • Topology: hierarchical tiered network view with drag-to-pan, wheel zoom and per-node detail sheets; Palo Alto and FTD firewalls correlate onto the map; SD-WAN branch routers connect to their hubs. The ACI capacity heatmap moved from Topology to the APIC panel, with contract drill-downs and leaf detail sheets.
  • APIC: Fabric tab rebuilt as the Fabric View; a Contract Flow page on the contract detail view.
  • Cisco ISE: Policy Matrix redesigned as a heatmap with parsed SGACL chips and SGT-bound subnets; ISE is now a first-class Policy Analyzer vendor.
  • Switch / router panels: chassis faceplate on Interfaces, endpoint heatmap on Endpoints, stack-member grouping.
  • Policy Analyzer: interactive segregation baseline builder; standardized firewall change cards and NAT views across Palo Alto, FMC, FortiGate and SRX.
  • RBAC: export controls hidden without the export permission; device audit-log tabs gated behind debug.access.

4.7.0

  • Policy Analyzer (new page): multi-vendor firewall policy analysis for Palo Alto, Cisco FMC, FTD, FortiGate and Cisco ACI. Per-rule risk scoring against zone trust/criticality ratings, anomaly detection (shadowed, redundant, overly permissive; actionable vs advisory), optimizer recommendations with vendor-native config candidates, an AlgoSec-style zone-pair segregation matrix, YAML policy-as-code compliance packs with per-framework reports, a clickable policy graph, and export on every tab.
  • Filters: backend-driven field catalogs with real operators (eq / ne / in / contains / gt / lt) across Endpoints, Routes, ACLs, Contracts, Changes and Memories.
  • AI memory: operator-tunable retention, rejection tombstones, and decline context fed back to the review council.

4.6.x

  • AI assistant (v0): a conversational floating widget over the synced network data, gated by the ai.chat permission, with token accounting and memory-from-chat.
  • AI operations: durable analysis pool with per-provider hourly rate limits, self-managing memory (confidence decay, self-audit, review council), and Prometheus metrics for the agent loop.
  • Integrations: Syslog (SIEM) notification channel and source-aware log forwarding; Integrations promoted to a standalone page. See Integrations.
  • Deployment: DEVICE_ENCRYPTION_KEY is auto-generated and persisted when not provided (4.6.1). See Deployment.

4.5.0

  • AI analysis: bring-your-own-model AI providers (local Ollama, OpenAI-compatible, Claude, Amazon Bedrock), an Analyze-with-AI action on change cards, an agentic tool-use loop that reads the synced data, and AI Memories with an admin review queue.
  • Detection Rules (new page): a rule engine over the change stream with save-time validation and dry-run, severity stamping, notification actions, per-rule AI prompts and structured AI verdicts. Gated by rules.manage.

4.4.0

  • Device terminal: a read-only live SSH terminal on router and switch panels (xterm.js) with tab completion and a pop-out floating window. Gated by device.terminal.
  • Forensics: one-click evidence collection into a zip bundle with per-file and overall SHA-256 manifests. Gated by device.forensics.
  • High availability: active/standby clustering with heartbeats, promote/demote and a Settings tab. Gated by cluster.manage. See Settings.
  • Integrations: Slack, Discord, Microsoft Teams, Jira, TheHive and generic webhooks over a unified event bus.
  • Sync: snapshot retention became time-based (days, default 180) instead of a count.

4.3.0

  • Directory sign-in: authenticate users against an already-integrated Active Directory device over LDAP, with ordered AD-group-to-role mappings.
  • Logging: database persist-level and retention controls, queryable log history with a Live/History toggle, and on-demand DEBUG capture.

4.2.0

  • Outbound Proxy: route device and notification traffic through SOCKS5 proxies with pools, CIDR rules, per-device overrides, health checks and failover.
  • TLS / HTTPS management: generate a CSR, install a signed certificate (PEM or .p7b), and serve the UI over HTTPS with automatic nginx configuration, rollback and expiry alerts. Gated by tls.manage.
  • Changes: advanced filter bar with per-field, URL-persisted filters and a calendar time-range picker.
Last updated on
Firewall AnalyzerRoadmap