GeezerVison

* fix[backend](mcp): add soar.node_types tool for flow node kind and executor discovery

* chore[](): updated go deps

* fix[frontend](soar-flows): removed redundant llm action node

* fix[backend](mcp/soar): updated flow properties schema in mcp catalog

* fix[frontend](soc-ai): drop dashboard chat scope when cleared outside dashboard view

* feat[frontend](soar/assitant): Edit with AI in flow editor

* feat[frontend](soar): click soar-edit panel header to open the active flow

* feat[frontend](soar): create flow with AI

* fix[backend](mcp/soar): fixed notifications type schema

* added css class for drag and drop movement pointer

* relocate grid placeholder CSS to feature styles

---------

Co-authored-by: Andres Aguilera <[email protected]>

* feat[backend](dashboards): added filters on dashboards

* fix[frontend](dashboards): added dashboard filter support

* fix[frontend](dashboards): added toast for every dashboard filter operation

Brings in e6d505c (fix(v12): keep schedule job green when a product has
zero instances configured), the only commit on origin/v12 not yet here.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

…epin go-sdk everywhere

Three changes landing together because the last two depend on the first:

- Redis -> Valkey: service, image (valkey/valkey:9-alpine), data dir and
  command in the installer; every consumer renamed to match
  (REDIS_ADDR/REDIS_PASSWORD/REDIS_DB -> VALKEY_ADDR/VALKEY_PASSWORD/
  VALKEY_DB) in agent-manager and log-input. go-redis itself is untouched --
  it already speaks Valkey's protocol.

- plugins/alerts: wires go-sdk's new store/cache into isDuplicate and
  getPreviousAlertId as a fast path in front of ClickHouse, closing the
  race where a burst of alerts for the same GroupBy/DeduplicateBy value,
  arriving faster than ClickHouse's own write-visibility lag, each see
  "nothing yet" and each create their own root alert. An atomic Claim
  picks exactly one winner among concurrent callers instead.

- go-sdk repinned to a596631 across every remaining plugin (ad-audit, aws,
  azure, bitdefender, crowdstrike, events, feeds, gcp, geolocation, o365,
  playground, rule-flood-guard, soar, soc-ai, sophos, stats) -- previously
  split across v1.1.27/28/31, none of which had this session's ClickHouse
  or cache fixes.

go build/go vet/go test clean across all 17 plugin modules touched.

…false is not treated as empty and uses the default true (#2809)

#2811)

* fix[backend](incidents): added tenant id on newly added incident alerts so newly linked alerts dont get a no tenant state

* fix[backend](incidents): avoided empty incident alert update call

…eation (#2817)

* fix[backend](pipelines): fixed pipeline update tenant shadowing

* chore[](): updated go deps

…, replace capabilities with allowIncidents

…dant AI prompt

…2833)

* feat[frontend](soar/socai): add soarCreateTitle i18n key

* fix[backend](soar): changed soar flow tool names

Co-authored-by: Andres Aguilera <[email protected]>

…view reliably (#2835)

The "Open in Alerts" link in the incident drawer seeded socaiTime 'now-30d',
which presetRange does not match (it looks up by preset id), falling back to
24h and hiding the alert once it aged past a day. It now seeds '30d'.

AlertsPage applied router-state seeds in a post-mount effect, racing the
initial unseeded fetch: whichever response landed last won, so the filtered
list intermittently clobbered back to all alerts. readSeed() now resolves the
seed synchronously into the initial customFilters/range state so the first
fetch already carries it.

Co-authored-by: Alex Sánchez <[email protected]>

* fix[definitions](soar): updated system soar flows to new flow schemas

* fix[plugins](socai): instruct ops agent to follow user instructions exactly when creating SOAR flows

* chore[](): updated go deps

* validate identity provider form fields before save

* fix[backend](iam): added identity provider format validations

* fix[frontend](iam): accept bracketed IPv6 hosts on idp form, clean dead ?? on paren check, port message 0..65535

- HOST_RE now allows [::1] alongside bare hostnames (the form no longer
  blocks IPv6 LDAP hosts; backend parity + the dial gap are documented in
  idp-form-validation.md under "Paridad con el backend").
- userFilter paren balance: each side resolves to a number with its own
  ?? 0. The right-hand ?? in the old one-liner was dead code (!== binds
  before ??), which read as if it guarded a zero-paren filter.
- 7 locales: port error says "between 0 and 65535" to match the validator
  and the backend, where 0 is the default (dialled as 389).
- 4 regression tests: bracketed IPv6 accepted, unbracketed rejected,
  single unclosed paren flagged, zero-paren filter accepted.

* fix[backend](iam): align LDAP host validation with dial for bracketed IPv6; fix bind password and name checks

---------

Co-authored-by: Alex Sánchez <[email protected]>
Co-authored-by: Alex Sánchez <[email protected]>

…ey object used by CustomFilterBar, mirroring alerts.filters per locale (#2844)

…d_nodes), docs/prompt instruct delta-only updates (#2845)

…ete to open (#2846)

…r ~40min (#2855)

The forwarder opened the bidirectional ProcessLog stream but only called
Send() — it never drained the Ack responses that log-input sends per log.
Unread acks filled the HTTP/2 flow-control window, backpressure built up
through the queue and the TCP listener, ingestion lag grew to ~13 min, and
the stream died with EOF after ~40 minutes; reconnect reset the lag.

Restructure upstream/logprocessor.go to mirror agent/agent/logprocessor.go
(minus the db layer):
- LogProcessor singleton (sync.Once) with conn/ack/sendErrWritten dedup flags
- handleAcknowledgements: drains plClient.Recv(), cancels on stream error
- processLogs: sends from collectorpkg.LogQueue, cancels on stream error
- createClient: invalid collector key backoff (codes.PermissionDenied, since
  log-input returns 'invalid credential'), up to 5 min, no self-uninstall
  (forwarder is a server-side service, cannot UninstallAll like the agent)
- service.go: obtain processor via GetLogProcessor() then run ProcessLogs
- collector.go: LogQueue raised 1000 -> 10000 to match the agent

Verified e2e 2026-10-07: 45+ min sustained at 10 logs/s, stream stayed up,
logs arriving with current timestamps, no lag growth, no EOF.

Fixes #2827

* fix[backend](soar/mcp): improved create /update schema descriptions and sync catalog and tools reference

* fix[plugins](soc-ai): changed toolcall usage policy and temperature

---------

Signed-off-by: Alex Sánchez  <[email protected]>

… Import panicking

…m integrations (#2959)

…#2961)

#2962)

* fix[frontend](pipeline-filters): improved pipeline filter repath generation

* fix[frontend](pipeline-filters): transform every non alfanumeric character into underscore

Signed-off-by: Alex Sánchez  <[email protected]>

---------

Signed-off-by: Alex Sánchez  <[email protected]>

* fix[frontend](threatintel): added full ai analyst components and tools

* feat[backend](threatintelligense): added ai asistant conversations persistence (tenant scoped)

* fix[frontend](threatintel): added markdown module and full ai sistant visualizations

* feat[backend](audit_log): added audit events on analyst conversation handler

* fix[backend](threatintel): added ai asistant chat unique index (tenant+title)

* fix[frontend](soar): scoped shell node templates by its selected platform

* fix[frontend](soar): added pre built shell nodes

* fix[frontend](threat-intel): gate generic corpus fallback on un-narrowed search; empty lookup resets query

* fix[frontend](soar): reverted flow direction on execution history

* fix[backend](soar): fixed context bag on soar flow interpolation

…dpoints (#2978)

…mo data and testing

- Added DarkWebMonitoringPage component to manage and display dark web monitoring records.
- Introduced types for DarkWebRecord and OrganizationBreachStats to structure data.
- Created demo records and organization breach statistics for testing purposes.
- Implemented filtering, searching, and exporting functionalities for records.
- Developed unit tests for DarkWebMonitoringPage to ensure proper rendering and functionality.

…ns dialogs

- Implemented CustomRangeExportDialog for selecting date ranges for exports.
- Added AdvancedExportOptionsDialog to allow users to apply filters and choose export options.
- Updated DarkWebMonitoringPage to handle opening and closing of the new dialogs.
- Enhanced export functionality to support filtering and date range selection.
- Added corresponding translations for new dialogs in English, German, Spanish, French, Italian, Portuguese, and Russian.
- Created unit tests for the new functionalities to ensure proper behavior.

…tionality

* fix[frontend](alerts): fixed events count on alert drawer

* fix[frontend](logexplorer): added sidebar filter option (outside)

* chore[frontend](): updated ecma script reference

* fix[frontend](shared): added field filter on custom filters

* Remove debug log from LogExplorerView

Signed-off-by: Alex Sánchez  <[email protected]>

* fix[frontend](alerts): make related logs loas reactive to alert param

Signed-off-by: Alex Sánchez  <[email protected]>

* chore[](): updated go deps

---------

Signed-off-by: Alex Sánchez  <[email protected]>

#2983)

…sidebar entry (#2988)

…with a warning instead of a lock when the destination changes

…into release/v12.0.0

…status management

- Added StatusPill component to handle breach status selection and display.
- Removed inline status handling from DarkWebMonitoringPage and integrated StatusPill.
- Updated DarkWebMonitoringPage to manage status changes through StatusPill.
- Enhanced internationalization with new keys for status management in multiple languages (en, de, es, fr, it, pt, ru).
- Added localized strings for mitigation steps and reasons for listing breaches.

* fix[frontend](shared): fixed filter updates on empty values

* fix[frontend](liveops): improved time filtering and refactored module

* fix[frontend](liveops): added loading indicator on filter change fetch

* liveops: use alert's real target name in scene zone labels

- WebAttack zone: 'Customer portal' -> target name
- BruteForce cloud zone: 'Microsoft cloud' -> target name
- travel scene: add home anchor to facts (was NaN first sign-in point)

* fix[frontend](liveops): added internationalization on ai questions

* fix[frontend](liveops): added internationalization on tooltips

* fix[frontend](liveops): added internationalization on scenes texts

* fix[frontend](liveops): added internationalization on scene descriptions and alert bell

* chore[](): updated go deps

* feat[frontend](dashboards): ordered dashboards by visualisations count

* refactor[frontend](settings): refactored settings data retention page to improve manteinability

* chore[agent](): upgraded agent version

Co-authored-by: yllada <yllada@://github.com>

---------

Co-authored-by: yllada <yllada@://github.com>

…date date input handling

…UI components

- Implemented `useDarkWebData` hook for fetching and managing dark web monitoring records and stats.
- Created `darkWebHttpService` and `darkWebMockService` for API interactions and mock data handling.
- Added CSV and PDF export functionality with `downloadCsv` and `printReportPdf` methods.
- Introduced `FloatingPanel` component for displaying dropdowns and integrated `useFloatingPanel` hook for positioning.
- Updated localization files for multiple languages with new loading and error messages.

* feat[frontend](liveops): added privilege escalation, ransomware, exfiltration, ransomware, persistence, data exfiltration, defense evasion, privilege escalation,
 generic detection

* feat[frontend](liveops): improved privilege escalation, randomware and outbound animation user and set a default uknow_user

Resolve i18n locale conflicts (de,en,es,fr,it,pt,ru) via semantic 3-way
union: keeps all dark-web keys (nav.darkWebMonitoring, darkWebMonitoring.*)
plus all v12 keys (nav.liveOps, liveOps.*, dataRetention.coldStorage.*).
Re-serialized to 4-space to match v12's locale format.

…r improved security and localization

- Updated `resolveTimeBounds` to collapse unparsed custom bounds to "now" and cap presets at the current moment.
- Introduced `parsePanelDate` for local wall-clock bounds in date-picker.
- Refactored `DarkWebMonitoringPage` to utilize new filtering logic in `record-query.ts`.
- Added `filterRecords` and `paginateRecords` functions for improved record management.
- Adjusted demo organization breach stats to reflect accurate totals.
- Enhanced CSV injection prevention in `neutralizeCsvCell` and added `safeHtml` sanitizer for i18n strings.
- Updated tests to cover new functionality and ensure accurate data representation.
- Improved localization strings for clarity and consistency across multiple languages.