Changelog

This changelog is reconstructed from the project's complete commit history (553 commits, March 2025 to October 2026). Entries are grouped by month, newest first, and folded by theme; merge commits and purely iterative fix-ups are rolled into the feature they belong to. The project is not yet formally versioned — see Versioning.

October 2026

Documentation hub & knowledge base

• Replaced the MkDocs site with an Astro knowledge hub: initial port, a neon-terminal theme, homepage and hero-title/section redesign, theme polish and full-text search improvements.
• Migrated and expanded the documentation into Astro (built up from earlier MkDocs drafts), reordered pages, enriched the in-app dashboard knowledge base and added new pages; removed the old MkDocs site.
• Folded measurements from generated reports into the knowledge base so the docs cite real numbers.
• Adopted the impeccable.style design basics across the hub.
• Project-wide content and wording audit.

Pattern registry

• Introduced a pattern registry: one machine-readable catalogue drives both the dashboard Pattern Database and the documentation, so the two cannot drift.
• Added a searchable, grouped checkbox popup selector for patterns on the Attack Simulation and Segmentation Validation pages, with registry-disabled patterns hidden.
• Added pattern unit tests and documented the registry in the Astro docs.

GDPR & device signature

• Added consent-gated, privacy-preserving identity: a one-way gdpr_signature re-recognises a returning visitor after a cookie/storage wipe without storing PII, now including the client IP in the computation.
• Surfaced gdpr_signature in the pattern-analyzer logs and dashboard UI, integrated GDPR into the dashboard, and added a dedicated Signature Simulation page (with an auto-agree fix).
• Segmentation Validation auto-agrees to the GDPR banner; Attack Simulation gained a session-clearing pattern to exercise the signature path.
• Added SIEM document clearing for consent flows.

Security-operations dashboard

• Added an Overview landing page: unique diverted adversaries, pool state, a decayed aggregate risk score (not the last request), auto-refresh every 3 s, and corrected health logic. Renamed its card to "Adversary IPs diverted".
• Added a Live Events page (an in-app event stream independent of Kibana), later backfilled and enriched.
• Added an Adversary Sessions drill-down page — live, async and actionable.
• Added a native Network IDS (Suricata) page, later enriched with filters, detail and live refresh.
• Added a Detection Policy editor (with defaults, and no longer discarding unsaved edits) and configurable security alerting that surfaces webhook delivery failures.
• Added an always-on Pool Scaling page with a Reclaim-idle-pools action.
• Added a Log Pipeline page that confirms edge-to-SIEM delivery end-to-end.
• Added a Forensics log search with export, time range, regex, saved searches and context lines.
• Added a Ctrl+K command palette with stack-lifecycle actions and an always-visible header button.
• Made Reporting an export hub routing to each report's page; Workloads defaults to the stack view and locks the honeypot layer while the stack is up; pre-warms Workload Telemetry history before the page opens.
• Added a global "Clear all attacks" action across the attack pages; dashboard UI gained a triple-dot overflow menu and SVG icons (with an overflow page-opening fix).
• Added a container-health fix, a staged PDF-export progress bar on Attack Simulation and an auto-updating time estimate on Segmentation Validation.

WordPress management from the dashboard

• Added a WordPress Studio page: the real wp-admin panel embedded in the dashboard (pinned to production through a fail-closed studio passthrough), with a one-click “Propagate to honeypot pools” that fans an editor's change out to every ready pool and shows a progress bar.
• Propagation reuses the content-sync service's own replication script in single-pool mode, so a manual push and the periodic sync share one allow-list / denylist: pages, posts, products, prices, categories and safe settings propagate; user accounts, orders, carts, API keys and payment/SMTP secrets never leave production.
• Added a WordPress Update page: checks for newer WordPress core and WooCommerce releases and upgrades production and every static pool together behind a Redis-flagged, Lua-served maintenance page, with a staged, weighted progress bar.
• Update model is update-production-then-re-sync: download core + WooCommerce once, migrate production, rsync the updated files to the pools, then migrate each static pool's database; the maintenance flag is TTL-guarded so the site self-recovers if an update is interrupted.
• Guaranteed the database-proxy layer's wp-content/db.php router drop-in survives a core update — snapshotted before the file update and restored byte-for-byte afterwards — so the production/honeypot database routing is always preserved.

Positioning, terminology & docs polish

• Framed WordPress + WooCommerce as the target demo application the whole honeypot (reverse-proxy and database layers) is built around, across the knowledge hub.
• Refocused the project as a defensive security platform growing toward a security-management layer above WordPress + WooCommerce instances, and stated explicitly that it performs only defensive security — no offensive tracking, hack-back or retaliation.
• Renamed “attacker” to “adversary” across the whole project (dashboard, edge, docs and tooling); “Attacker Sessions” became “Adversary Sessions”.
• Fixed an Astro whitespace quirk that joined words next to inline tags (e.g. bold phrases) in the rendered docs.

Pooling & segmentation validation

• Faster pool scaling (including WordPress-layer pooling) and a pool-scaling visualisation; mirrored on the Segmentation Validation page.
• Extended session validation with cookie/storage forgery and tamper-proofing: random windows clear or forge their session between steps, every multi-window run includes a hijack attempt (targeting a diverted session when one exists), and no window forges its cookie twice.
• Hardened the run against Docker's network churn: outlast ERR_NETWORK_CHANGED during pool builds, retry an attack page once after a connection error, treat an HTTP error response as a loaded page and never re-send attacks, and re-grab a step screenshot that comes back solid black.
• Recorded what each window really got after the scale-down, kept the post-scale-down reassignment out of the run timeline, and cleaned up the pools the reassignment check makes pool_manager build.
• Windows open the shop as their homepage (not about:blank); on the database-proxy layer two thirds of a run reaches the honeypot database and a third slips past to the shared files.
• Pool router drops assignments to scaled-down pools instead of proxying to them (no more 502); auto-refreshing "ready pools" line; stopped post-run traffic and halved proxy log shipping; transient-error and report-export hotfixes.
• Softer, more meaningful language used throughout the project.

Pool test report (PDF)

• Explained the run narrative: why each diverted session was diverted, why diverted windows show different scores, why a recovered session returns without its cart, why a scale-down leaves the compose-declared pools, and credited diversions to forged cookies where they preceded the pattern.
• Described a database-proxy-level run; attributed database-layer pools through MySQL's query log.
• Figures and tables: stacked Figure 2 step numbers, marked removed pools on their build row, rounded resource-use axis ticks, split the pre-build count into built vs already-free pools (counting spares already building), counted borrows too short for the routing samples, and stopped drawing a session-less read as a dip to production.
• Pagination: build long tables from small chunks so no row splits, keep headings/captions/small tables together, move a table split before its screenshot row, keep three lines of a paragraph with its heading, and shrink a figure to fill the page.
• Compacted tamper-table rows and the cart grid, listed patterns per round and by window, named the pattern behind a score-based diversion and HTTP-error answers under step screenshots, and dropped noise like "0 storage entries".
• Ended the run before the post-reassignment clean-up; tracked diagram fixes and resolved issues across several pool_test_report_issues*.md rounds.

Edge, detection & fixes

• Stopped dots and dashes acting as wildcards in URI signatures; Suricata rule spam fixes; broke the Suricata → Vector → Suricata anomaly feedback loop.
• Proxy stopped rate-limiting the shop's own static assets (which had left the cart page unrendered); fixed WooCommerce attribute reading; added cross-page log caching/handling (including in Kibana) and copy/export-logs on more pages.
• Health checks every 30 s (fast probing only until healthy) instead of every 10 s; error badges trust nginx's quiet log levels; one pre-warm summary line per start instead of ~160; services-stop report reads exit codes from Docker die events and lists a marker's events in order; resource sampling keeps docker inspect output when a container is gone.
• Compose services stop on SIGTERM instead of being killed after 10 s.
• Untested Kibana dashboard-import adjustments.

September 2026

Core refactor, tests & CI

• Refactored the dashboard to extract shared core/ and ui/ helpers and remove duplication; added the first unit tests for the Qt-free core, run in CI.
• Extracted threat_intel.lua (dedup threat-IP read-modify-write), testing/lib/scenario_common.sh, and siem/kibana/_kibana_client.py shared by the dashboard scripts.
• Added stage-by-stage tests for the router's decide_route(); added tests for the sophistication analyzer (fixing hyphenated-UA fragments never matching); ran the Lua unit tests on every push and PR.
• Repo weight: stopped committing a second WordPress core and dropped SQL-proxy leftovers; removed stale Lua backups; deleted commented-out dead compose services; capped project log growth so no log can fill the disk.
• Stopped tracking siem/docker/.env (real passwords); removed retired giveaway files from existing honeypot volumes.

PDF & exploit reports

• Exploits page: category selector (type, target, surface) drives multi-run with dropdown grouping and PDF export, generic attacks, a detection request and resource statistics; greys out CVEs the DB-proxy honeypot can't isolate and explains why.
• Exploit report: per-request routes with labelled markers above the graphs, "not routed" for requests the proxy answered itself, a Kibana request timeline under each exploit's graphs, each exploit sent in a quiet gap with the serving container highlighted, and a table of contents / exploit list.
• Resource graphs in reports: keep sampling while the exploit is sent, mark background work on the CPU graphs and leave it out of the statistics, and render charts/diagrams as vector graphics.
• Threat decay made honest: decayable seed, offense-scaled half-life, measured on a clean IP, with a THREAT_DECAY_ENABLED toggle; raised/clarified the honeypot threshold and dropped the threshold noise.
• Added 5 more CVEs (Bricks RCE; WP Automatic, Ultimate Member, BookingPress, LayerSlider SQLi).
• Extras page: auto-generated "Implementation" thesis chapter plus Architecture and CVE-matrix PDF exports, with per-service explanations and a Health-page screenshot; strips PHP comments when condensing; probability metrics beside the statistics; wrap embedded code/curl so long lines don't run off-page; cross-referencing architecture/routing/scoring diagrams.

Database-proxy honeypot layer

• Collapsed the honeypot pools into a single eshop with per-request DB routing: one honeypot database per adversary, a spare built on each assignment, and the database named in the X-Honeypot-DB header.
• Made it a selectable honeypot layer alongside the reverse-proxy layer (merged the db-proxy branch); renamed "reverse proxy level" to "WordPress proxy level".
• pool_manager: skip building pools when the host is low on resources, reuse idle pools, mount the clean-data override as a file, and restore pool passwords after a Redis flush.
• Identical product order on production and honeypot instances; named the honeypot site; silenced honeypot_db_init errors on absent WooCommerce tables; stopped the reverse proxy health-checking removed pool backends.

Resource monitoring, SIEM & eshop

• Added a Resources tab (per-container htop-style usage and CPU/memory/log graphs), fixed the GUI freeze, added sub-second cgroup sampling, hover-to-inspect lines, exploit-run markers and a pre-exploit baseline.
• Services page: start/stop with a PDF resource-graph export; record stop until down exits; peak memory; elapsed starts at 0 on launch; cap init_setup memory and number the event markers.
• Kibana: five distinct dashboards including threat decisions and decay; threat-intelligence enrichment; attribute proxied Suricata alerts via XFF and skip proxy probes; label honeypot pools by their containers in nginx logs.
• Vector: stop the SIEM aggregator dropping event batches on backpressure; only trust cgroup sampling when Docker's PIDs are local containers.
• Faster Docker Compose startup for the ids and siem stacks; a Learn page and in-app learning aids for students; real IPv4/IPv6 CIDR whitelist matching; identify adversaries by a tamper-proof session instead of their IP, keeping NAT neighbours out of an adversary's score; removed the reverse-proxy tarpit so both routes have equal latency; eshop frontend cleanup (homepage products, compact mobile header, stripped header chrome/hero for screenshots, sample product images).
• Fixes: content-sync duplicate-key and truncation, reverse_proxy redis/health false positives, prewarm/probe and Suricata startup log spam, init_setup writes server.crt on a fresh checkout, and a Start/Restart reentrancy fix (Restart from any state).

August 2026

• Built the Python dashboard GUI (PyQt) with remote-access/connection support, project upload, better settings and an initial-setup wizard with dependency check and .env.example autoparse.
• Threat analyzer GUI: clearer threat display, colored logs, score-and-status fit to screen, and the exploit page banner.
• Health page: error-log monitor with filtering, uptime timers, color legend wrapping, conditional refresh and resize, plus a startup fix.
• Replaced Logstash with Vector for better CPU usage and stability; capped ELK memory (Vector/Elastic had eaten 8 GB); AbuseIPDB integration with caching for the low API limit; began the blind virtual pentest and acted on its findings.
• Suricata rule work; added Suricata rules to the Lua layer; adjusted and de-noised Suricata and nginx error logs.
• Backups and content sync shown in the dashboard; backup handling and the session_store dialog improved; content replication between production and honeypot; WP-CLI setup instead of Git LFS; sample product images and DB seed fixes.
• Scoring no longer resets when a user clears cookies; fixed product-page requests to admin-ajax.php; XML-RPC handling; separated Lua patterns into their own file with Lua tests; Docker/hardening audit and mu-plugin fix.
• Dashboard theming, Kibana integration, Redis/Kibana/exploit panels, an app icon, logo and README/architecture updates.

March 2026

• Added the project logo and fixed up the README.

February 2026

• First honeypot pooling (untested), production hardening and a testing harness; working test scenarios with improved pass rate.
• Fixed the nginx admin handler, the database and Suricata config, and init-setup; general checklists and scenario adjustments.

November 2025

Reverse proxy & routing

• Reverse-proxy prewarm and cache; redirect to HTTPS; default ports to nginx; DNS resolver so Redis is reachable from nginx.
• Static-asset handling: pattern legitimisation, query-parameter allowance and access tuning to reduce 503s; routing thresholds, honeypot routing info logs and manual test URLs; disabled randomized routing; fixed the nginx Lua healthcheck path.

Database & migrations

• Production→honeypot copy script, a production SQL dump filtered for a clean honeypot migration, a migrations folder, and dummy-data migration; switched WooCommerce to live for public page access; removed end-user rate limits; fixed variable/dollar escapes and cleanup ordering.

ELK / SIEM / Filebeat

• Added ELK, dockerized it and moved it; Filebeat config and working setup; SIEM boilerplate and improvements; SQL-proxy and admin-handler work-in-progress; a Docker architecture diagram.

October 2025

• Project inception: thesis, assignment plan, and a demo PrestaShop dual setup without IDS redirection, then the WordPress/WooCommerce production eshop and database data.
• WooCommerce vulnerability planning; an init script to copy database files to the honeypot instance; a demo with Snort, sessions and nginx Lua redirect.
• Resource-usage test scaffolding (demo Docker Compose, port mapping), Suricata adoption, Git LFS for DB ibdata files, and a LaTeX CI/CD pipeline.

March 2025

• Initial commit; added the assignment and plan.

Versioning

The project is not yet released under formal version tags; this history is organised by month. Semantic versioning is planned for the engine, detection and dashboard components once interfaces stabilise.