You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/docs/release-notes/index.md
+31Lines changed: 31 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,36 @@
1
1
# Release Notes
2
2
3
+
## 0.1.0-beta.4 (2026-06-17)
4
+
5
+
### New Features
6
+
7
+
- Redesigned asset display in the activity Detection section for a consistent look with the activity Details ([pull 26](https://github.com/CompassSecurity/raptr/pull/26))
8
+
9
+
### Fixes
10
+
11
+
- Blue Team members can now view and restore soft-deleted assets ([pull 26](https://github.com/CompassSecurity/raptr/pull/26))
12
+
- Sandboxed the Jinja2 environment used to render report templates to prevent server-side template injection (SSTI), with clearer error handling and logging for rejected templates ([pull 22](https://github.com/CompassSecurity/raptr/pull/22))
13
+
- Sanitized file names during assessment import and export to prevent path traversal (zip-slip) and `Content-Disposition` header injection ([pull 23](https://github.com/CompassSecurity/raptr/pull/23))
14
+
- The activity `state` is now required on update, so a partial request can no longer silently reset the workflow state ([pull 24](https://github.com/CompassSecurity/raptr/pull/24))
15
+
- Restricted Blue Team file upload and deletion behind the activity update permission (activity must be visible, not deleted, and in a Waiting state) ([pull 25](https://github.com/CompassSecurity/raptr/pull/25))
16
+
- Hardened file upload against polyglot files by normalizing the stored file extension to the detected content type ([pull 27](https://github.com/CompassSecurity/raptr/pull/27))
- Earlier dependency and Biome version bumps ([6c2e2e7](https://github.com/CompassSecurity/raptr/commit/6c2e2e7), [3b08058](https://github.com/CompassSecurity/raptr/commit/3b08058))
31
+
- Scoped the release and pull-request CI workflows with `paths-ignore` and removed the unused sandbox workflow ([8206d27](https://github.com/CompassSecurity/raptr/commit/8206d27), [00ae160](https://github.com/CompassSecurity/raptr/commit/00ae160))
Copy file name to clipboardExpand all lines: docs/docs/user-guide/activities.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -84,7 +84,7 @@ The sidebar offers a quick overview and access to all activities and activity gr
84
84
85
85
The activity header shows the name and current state. Admins and Red Team members can change the state from the header. Blue Team members can only toggle between **Waiting Blue** and **Waiting Red** (when the activity is in one of those states).
86
86
87
-
Admins and Red Teamers can also access the :lucide-book-open: [Knowledge Base](knowledge_base.md) and :lucide-history: [History](activities.md#history) sections from the header.
87
+
Admins and Red Teamers can also access the :lucide-book-open: [Knowledge Base](knowledge_base.md) and :lucide-history: [History](activities.md#activity-history) sections from the header.
88
88
89
89
#### General Information
90
90
@@ -107,7 +107,7 @@ This General section has three main purposes:
107
107
-**Requirements**: Explain environmental prerequisites that must be in place before execution, see [overcoming requirements hell](getting_started.md#overcoming-requirements-hell). Supports [Markdown](#markdown-fields)
108
108
109
109
??? bug "Strict MITRE mapping"
110
-
Currently the MITRE mapping is not strictly enforced in the backend. It is possible to create an activity with a MITRE mapping that is not valid. This will lead to the activity not being displayed in the [MITRE ATT&CK Heatmap](evaluation.md#mitre-attack-heatmap) or in the [MITRE ATT&CK Navigator](evaluation.md#export) export. The frontend enforces a strict mapping by only allowing or filtering techniques based on the chosen tactics, and vice versa.
110
+
Currently the MITRE mapping is not strictly enforced in the backend. It is possible to create an activity with a MITRE mapping that is not valid. This will lead to the activity not being displayed in the [MITRE ATT&CK Heatmap](evaluation.md#mitre-attck-heatmap) or in the [MITRE ATT&CK Navigator](evaluation.md#mitre-navigator-layer) export. The frontend enforces a strict mapping by only allowing or filtering techniques based on the chosen tactics, and vice versa.
111
111
112
112
##### Expected Outcomes
113
113
@@ -122,7 +122,7 @@ This section is used to set the expected outcomes of the activity. The settings
122
122
!!! info "Alert and Stakeholder Notification terminology"
123
123
The term `Alert` is used in RAPTR for any kind of automatic generated information that the Blue Team receives from the security stack. This can be a SIEM alert, an EDR alert, a firewall alert, etc.
124
124
125
-
`Stakeholder Notification` refers to any kind of notification sent to stakeholders. This term originates from the fact that we often test external MSSPs/SOCs on behalf of the customer, without informing the Blue Team about the test. As well as the SOC's detection capabilities, the customer is also interested in testing whether the SOC adheres to defined processes and procedures. For example, SLAs and escalation through defined channels. Using the [evaluation templates](templates.md#evaluation-templates), you can define any metric for stakeholder notifications. E.g. quality and correctness of the notification etc.
125
+
`Stakeholder Notification` refers to any kind of notification sent to stakeholders. This term originates from the fact that we often test external MSSPs/SOCs on behalf of the customer, without informing the Blue Team about the test. As well as the SOC's detection capabilities, the customer is also interested in testing whether the SOC adheres to defined processes and procedures. For example, SLAs and escalation through defined channels. Using the [evaluation templates](templates.md#evaluation-template), you can define any metric for stakeholder notifications. E.g. quality and correctness of the notification etc.
126
126
127
127
??? bug "Only one expected severity"
128
128
Currently there is only one expected severity for alerts and stakeholder notification. The assumption is that both notifications should have the same severity level.
@@ -203,7 +203,7 @@ The static evaluation section shows the following data:
203
203
204
204
##### Dynamic Evaluation Questions
205
205
206
-
You can either add new [evaluation template](evaluation#evaluation-templates) questions here or if you added them to the [default evaluation questions](assessments.md#lucide-settings-2-default-evaluation-templates) on the assessment level they will appear here as well.
206
+
You can either add new [evaluation template](templates.md#evaluation-template) questions here or if you added them to the [default evaluation questions](assessments.md#default-evaluation-templates) on the assessment level they will appear here as well.
207
207
The dynamic evaluation questions can be used for any kind of evaluation that is not covered by the static evalaution questions.
208
208
209
209
??? abstract "Working with dynamic evaluation questions"
@@ -237,7 +237,7 @@ All free text fields in the activity form support Markdown formating. Furthermor
237
237
238
238
You can change between UTC and your local time from the [toolbar](user_preferences_and_ui.md#toggle-utc-and-local-time).
239
239
240
-
The format used to display time (`24h` or `AM/PM`) and date format (e.g. `MM/DD/YYYY` or `DD/MM/YYYY`) can be configured in your [profile settings](user_preferences.md#timezone-and-date-format).
240
+
The format used to display time (`24h` or `AM/PM`) and date format (e.g. `MM/DD/YYYY` or `DD/MM/YYYY`) can be configured in your [profile settings](user_preferences_and_ui.md#timezone-and-date-format).
241
241
242
242
Use the :lucide-calendar: calendar or the **now** button to set the date and time. You can also type a date and time directely into the field. RAPTR will do its best to parse the date and time you enter.
Copy file name to clipboardExpand all lines: docs/docs/user-guide/administration.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -83,7 +83,7 @@ The user management page `/admin/users` displays all users in a filterable table
83
83
[![Create a new user](../assets/admin-user-create.gif"Create a new user")](../assets/admin-user-create.gif){:target="_blank"}
84
84
85
85
??? info "User Invitation"
86
-
RAPTR does not send any E-Mails. After user creation, share the credentials with the user. They can change their password from the [profile page](user_preferences.md#password).
86
+
RAPTR does not send any E-Mails. After user creation, share the credentials with the user. They can change their password from the [profile page](user_preferences_and_ui.md#password).
87
87
88
88
??? Bug "Initial Password"
89
89
At its current stage, it is not possible to set or mark a user's password so that it must be changed upon first login.
Copy file name to clipboardExpand all lines: docs/docs/user-guide/evaluation.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,7 +40,7 @@ The static evaluation also tracks timing metrics:
40
40
-**Event-to-Alert time**: How long between the activity execution (start time) and the first alert
41
41
-**Alert-to-Stakeholder time**: How long between the alert time and the stakeholder notification
42
42
43
-
These fields are auto-calculated, but the evaluation result must be manually set. The following options exist `pass`, `fail`, and `N/A`. By default the `N/A` state is choosen. See [working with auto-calculated fields](#working-with-auto-calculated-fields).
43
+
These fields are auto-calculated, but the evaluation result must be manually set. The following options exist `pass`, `fail`, and `N/A`. By default the `N/A` state is choosen.
44
44
45
45
### Severity Evaluations
46
46
@@ -49,7 +49,7 @@ The system also compares expected vs. actual severity levels for alerts and stak
49
49
-**Alert vs expected severity**: The expected severity of the alert vs the actual severity of the alert
50
50
-**Stakeholder notification vs expected severity**: The expected severity of the stakeholder notification vs the actual severity of the stakeholder notification
51
51
52
-
These fields are auto-calculated, but the evaluation result must be manually set. The following options exist `pass`, `fail`, and `N/A`. By default the `N/A` state is choosen. See [working with auto-calculated fields](#working-with-auto-calculated-fields).
52
+
These fields are auto-calculated, but the evaluation result must be manually set. The following options exist `pass`, `fail`, and `N/A`. By default the `N/A` state is choosen.
53
53
54
54
??? bug "Only one expected severity"
55
55
Currently there is only one expected severity for alerts and stakeholder notification. The assumption is that both notifications should have the same severity level.
@@ -81,7 +81,7 @@ Each evaluation question which cannot be answered automatically must be manually
81
81
[![Working with dynamic evaluation questions](../assets/eval-dynamic-questions.gif"Working with dynamic evaluation questions")](../assets/eval-dynamic-questions.gif){:target="_blank"}
82
82
83
83
??? bug "Auto-calculated fields"
84
-
The timing and severity static evaluation questions text are auto-calculated. Nevertheless these fields support [Markdown](#markdown-fields). You can overwrite the fields. As long as the field ends in `(auto-calculated)` the field will be re-calculated on changes.
84
+
The timing and severity static evaluation questions text are auto-calculated. Nevertheless these fields support [Markdown](activities.md#markdown-fields). You can overwrite the fields. As long as the field ends in `(auto-calculated)` the field will be re-calculated on changes.
85
85
86
86
??? abstract "Working with auto-calculated fields"
87
87
[![Working with auto-calculated fields](../assets/eval-auto-calculated.gif"Working with auto-calculated fields")](../assets/eval-auto-calculated.gif){:target="_blank"}
Copy file name to clipboardExpand all lines: docs/docs/user-guide/knowledge_base.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ Each knowledge base article has:
16
16
17
17
Articles are linked to activities in two ways:
18
18
19
-
-**By MITRE technique**: When an activity is mapped to a MITRE technique, all knowledge base articles linked to that technique are automatically available in the activity's [Knowledge Base section](activities.md#knowledge-base).
19
+
-**By MITRE technique**: When an activity is mapped to a MITRE technique, all knowledge base articles linked to that technique are automatically available in the activity's knowledge base section.
20
20
-**By activity template**: [Activity templates](templates.md#activity-template) can reference specific knowledge base articles by name. When imported into an assessment, these links are carried over to the created activity — allowing templates to point to articles beyond just the MITRE technique mapping.
You can use the **Reset MFA** function to delete the current OTP secret. You will be logged out and can generate a new OTP secret on your next login.
35
35
36
-
An Administrator can also reset a users MFA. See [Administration](administration.md#lucide-shield-x-reset-mfa) for more information.
36
+
An Administrator can also reset a users MFA. See [Administration](administration.md#reset-mfa) for more information.
37
37
38
38
??? bug "No optional MFA choice"
39
39
The current RAPTR setup only support global MFA enforcement. Either it is required or not. There is no option to enable or allow MFA on a per user basis.
@@ -62,7 +62,7 @@ Some views, such as the assessments list or activity list, support auto-refreshi
62
62
### Toggle UTC and Local Time
63
63
64
64
Toggle between UTC and local time using the :lucide-globe: icon in the top navigation bar. Your preference is saved locally in your browser. All times in RAPTR should display according to this setting.
65
-
You can overwride your browser local time zone in the [profile settings](user_preferences.md#timezone-and-date-format).
65
+
You can overwride your browser local time zone in the [profile settings](#timezone-and-date-format).
66
66
67
67
??? abstract "Toggle between UTC and local time"
68
68
[![Toggle between UTC and local time](../assets/ui-toggle-utc-local.gif"Toggle between UTC and local time")](../assets/ui-toggle-utc-local.gif){:target="_blank"}
0 commit comments