AiSOC v19.0.0 — the depth plan's analyst, collection and governance phases

[beenuar]

v19.0.0 is out. It finishes the depth plan's analyst, collection and governance phases — nineteen workstreams, integrated and graded as one tree, plus the fixes that came with them.

What's new

A semantic spine that holds under scale. A session now has one producer and three stores that cannot disagree about which session an event belongs to, enforced by a gate rather than a comment. A real security posture is collected for AWS, Azure, GCP, Google Workspace and GitHub and versioned, so a detection reads the posture that was true when an event happened rather than the posture now. Behavioural baselines moved into CORE as a fusion module, so the smallest deployment can run them.

Collection that meets an estate the way it emits. An OTLP logs receiver, a Kafka input for your own topics, and a real TAXII 2.1 server over the tenant IOC store. A cold-tier lake query now reports an estimated cost and a progress state instead of timing out silently, and claims its work atomically so two replicas never start the same scan.

Analyst surfaces that close the loop. A playbook can ask the person who signed in, then their manager — resolved from SCIM — and branch on the signed answer: "no, that wasn't me" and "nobody answered" both reach containment behind an analyst approval. AiSOC's own MCP server speaks streamable HTTP, authorized and audited per call. A case opens a war room that posts the timeline and verdicts as they change and syncs decisions back. A hunt that finds something becomes a cited report, exportable as PDF. The responder app is an installable build with real APNs and FCM delivery.

Deployment and governance. The Helm chart installs CORE with exactly one scheduler replica leading through a Postgres lease. WebAuthn is a console second factor, enforceable per role. An enforced audit retention window leaves the surviving chain verifiable. Accessibility coverage reached the case workspace and the alert list. A tenant's configured entitlement limit can refuse work when the tenant opts in.

Reliability

67 defects were fixed across this release and the two before it — 11 in v19.0.0, 16 in v18.0.0, 40 in v17.1.0. The one to call out: tenant deletion was impossible on any database holding audit rows. The audit-log immutability trigger refused the cascade its own foreign key declares, so the GDPR erasure path could never complete — and the offboarding test stayed green because its database held no audit rows. It now distinguishes a cascade from a direct delete, so a tenant can be erased while a direct delete of an audit row stays refused at both the privilege and trigger layers.

One breaking change

PATCH /api/v1/alerts/{id} used to answer 200 while silently dropping any field outside its five writable ones — a success response for a write that did not happen. It now answers 422, naming the field and the route that applies it. If you call that endpoint with disposition, severity, confidence or snoozed_until, read the BREAKING section of the changelog before upgrading.

Get it

• Release notes: https://github.com/beenuar/AiSOC/releases/tag/v19.0.0
• Images: ghcr.io/beenuar/aisoc-*:v19.0.0, published multi-arch (amd64 + arm64)
• The full, file-level inventory is the [19.0.0] section of CHANGELOG.md.

Thanks to everyone who reported, reviewed and tested.