GeezerVison

v11.4.0 re-cut: +highlight.js 10 (ReDoS fix)

fix[backend](storage): fixed module definition mismatch (#3100)

Merge pull request #3049 from utmstack/hotfix/v12-debian-docker-compose

fix(installer): remove docker-compose standalone package on Debian/Ubuntu

UTMStack v11.3.0 pre-release

fix[backend](federation_server): applying public route bypass to /v1/…

…mode federation endpoint (#2808)

fix(v12): keep schedule job green when a product has zero instances c…

…onfigured

Merge pull request #2777 from kryonsx/codex/aws-web-identity-noise-20…

…260929

fix(aws): remove the AssumeRoleWithWebIdentity success rule

Merge pull request #2755 from utmstack/feat/aws-o365-detection-gap-fill

feat(detections): add 9 AWS + 9 O365 gap-fill rules

fix[frontend](socai): changed anthropic model keys (#2363)

Co-authored-by: Yorjander Hernandez Vergara <[email protected]>

fix(rules/windows): exclude benign AMSI 'sentinel' harness from Power…

…Shell rule (#2311)

The 'Suspicious PowerShell (Encoded / Download Cradle / AMSI Bypass)' rule (4104
script block) fired on every PowerShell session: the injected defensive
PSBreakpoint/AMSI 'sentinel' instrumentation harness contains the literal token
'AmsiInitFailed', which matches the first regex branch. With groupBy:[dataSource]
this collapsed into a single alert with thousands of echoes.

Add a per-script-block exclusion for the harness's unique markers
(sentinelbreakpoints, \windows\sentinel\, Po_wer_Spl_oit_Indicators). All
attack tokens are preserved; a real payload run through the harness is a separate
4104 event that still fires.

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>