Release 0.10.0: risk register, logs for the SIEM, steering dashboard

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to Strata. Versions follow [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
+## [0.10.0] - 2026-10-28
 ### Added
 - **Incident mode, with Muster** (*Incident* in the controls of an IS). Mark assets compromised, suspected or contained, from their sheet or from a playbook decision. The incident sheet then shows:
   - **who to call**: the contacts of the assets hit, on-call and 24/7 first, the owners of the business services they run, the IS contacts;
@@ -14,7 +14,30 @@ All notable changes to Strata. Versions follow [Semantic Versioning](https://sem
 - **Anonymised AI prompts per asset** (*AI prompts* on an asset sheet): one prompt for the major risks of the asset, one guide that has the AI list plausible incidents and write their response playbooks in Muster's `muster/v1` YAML, with `targets`. Names, addresses, subnets, contacts and the IS name are replaced by placeholders (`ASSET-T`, `ASSET-01`, `SEG-1`, `SVC-B1`); a leak check lists anything identifying left in the text, with your own terms to never send; the answer pasted back gets your names again, in the page only. French or English.
 - **The connection to Muster** (`MUSTER_URL`, `MUSTER_USER`, `MUSTER_PASSWORD`). This server signs in to Muster with an analyst account and lists its responses; the incident sheet of an IS shows those linked to it (declared in Muster with this IS, or naming its assets), and the others with *Open on this IS*. Opening one marks the assets it names, then the playbook runs from the map: answering a decision or finishing a step moves the response in Muster, the tasks ticked go both ways, and what Muster's analysts do shows on the map within seconds. A decision answered anywhere marks the assets its `effects` name. Every mark and every flow cut goes to Muster's timeline, so its report keeps them, written by the Strata account with the name of the person who did it. Each incident is its own situation: opening another one on the same IS puts the marks and cuts of the previous one aside (marks made by hand before any incident stay). A decision answered in Muster marks the assets as soon as a contributor has the IS open in Strata. Muster's report gets an *Assets hit (Strata)* section. Without `MUSTER_URL`, the two example incidents stay.
 - **API**: `GET /api/incidents`, `PUT /api/incidents/{IS id}` (contributors and up, no proposal), `GET /api/muster`, `GET /api/muster/incidents/{id}`, `POST /api/muster/incidents/{id}/advance`, `/tasks`, `/strata`, and the `incidents` and `muster` events on `/api/events`. Kept in `incidents.json`, outside the map and its history.
+- **Risk register** (*Risks*, the fourth view of an IS, next to Physical, Application and Business; and *Risks* on every asset sheet):
+  - **a threat landscape per asset**: 30 threats, each with its MITRE ATT&CK techniques, ENISA Threat Landscape families and EBIOS RM risk sources, apply to an asset from its type, exposure, criticality (its own or that of the business services it would hit), listening ports, system, vulnerabilities (CISA KEV, titles), role and Internet services. The sheet of a risk says why it applies. A threat can be added by hand or set aside with a justification;
+  - **the threat landscape of an IS**: how relevant each of the 8 risk sources is to it (0 to 3; cybercrime first by default, as in the ENISA Threat Landscape). A source rated 0 takes its threats away;
+  - **a risk matrix of its own for each asset**: likelihood from the threat, the exposure and reachability of the asset, its vulnerabilities (CVSS, EPSS, KEV) and its risk sources; impact from the threat and the criticality. Shown before requirements, with those applied, and once the planned ones are too;
+  - **requirements from baselines**: for each risk, the requirements that address it, each *applied*, *planned* or *not applicable*; each one applied removes its share of the likelihood or of the impact. Shipped: ANSSI *Guide d'hygiène informatique* (42 measures), NIST CSF 2.0 (106 subcategories), CIS Controls v8.1 (153 safeguards, numbering and paraphrased titles) and ISO/IEC 27001:2022 Annex A (93 controls, numbering and paraphrased titles); ANSSI is on by default. Import your own as JSON or CSV;
+  - **a decision for each risk**: treat, accept, transfer or avoid, with a justification;
+  - **an acceptance threshold per asset**: the matrix sets the highest acceptable level (moderate by default), which can differ by criticality (only low for critical assets, by default), and an asset sheet can set its own. A risk above the threshold of its asset, and not accepted, stays open;
+  - **in the 2D plan of an asset**, under its firewall rules: the requirements that address its risks, by baseline, with the risks each one reduces and its status (applied, partly applied, planned, not applied). The plans of the architecture file get it too;
+  - **overlapping requirements merged** (*Risks › Baselines*, in the large view): the requirements of different baselines that reduce the same threats and say much the same thing are grouped (one per baseline, from a similarity threshold you set). Merged, one requirement per group stands for the others: it takes all their threats, the others are no longer offered, and a status given to any of them still counts. The one kept is chosen by a criterion (*most demanding*, *widest coverage*, *best fit for this map*: the threats found on its assets, *preferred baseline*: in the order you give the baselines), or by hand; a group can be kept separate. Baselines are turned on and ordered there too;
+  - **logs for the SIEM** (*Risks › Logs for the SIEM*, and on each asset sheet): the minimum each asset must send so that its risks can be seen happening. Only the log sources it has (Windows Security and PowerShell, domain controller, EDR or Sysmon, Linux auth and auditd, firewall, VPN, web and WAF, database audit, hypervisor, backup, mail, network devices, OT, devices, DNS and proxy, availability, physical access, log source health), only the events of the threats that apply to it (Windows event IDs, Sysmon events, auditd rules…), at the verbosity its residual risk calls for: minimal, standard or detailed, with the setting to apply. Retention: 6 months, a year where a high or critical risk remains. The SIEM onboarding plan exports as CSV;
+  - **the register of an IS**: two heatmaps (before and with the requirements; click a cell to list its risks), the table of every risk, and a CSV export;
+  - **risk settings** shared by every IS (*Risks › Settings*): the matrix (3 to 5 levels each way, labels, the level of each cell, the acceptance threshold), the baselines in use, the threat catalogue (disable a threat, add your own), export and import as JSON. Saved like the rest of the map: in the history, through proposals for contributors, in exports and imports.
+- **Dashboard and KPIs** (*Steering › Dashboard and KPIs*, from the overview or an IS), ready for a steering committee:
+  - **seven key figures**, each with its value, its change over the period said as better or worse, and its trend: Internet-facing assets (and ports), assets with an administration port open to the Internet, open critical and high vulnerabilities (and those on the CISA KEV list), their median age, vulnerabilities past their remediation deadline (critical 15 days, high 30, medium 90, low 180), owner coverage (assets with a named technical or business owner, and critical assets), scan coverage (assets a vulnerability scanner knows);
+  - **four charts over time**: exposure, the age of open critical and high vulnerabilities (under 30 days to over 180), owner coverage, scan coverage; over 12 weeks, 6 months or 12 months, for the whole map or one IS;
+  - **the IS side by side**, and **the ten oldest open critical and high vulnerabilities** with how late they are;
+  - **measured from the history of the map**: the server rebuilds the map at the end of each period, and dates each vulnerability from the first version where it appears (or the date its scanner gives). A map kept in a browser keeps one snapshot a day; the demo comes with a year of past, rebuilt from the dates its vulnerabilities were found;
+  - *Print or PDF* prints the dashboard alone; *Export (CSV)* gives every figure, every period, every IS.
+- **Selecting an asset zooms on it and highlights it**: a click on an asset, in 3D or in the 2D diagram, or a search, brings the view close to it; the asset glows in the accent colour with a breathing ring under it (a pulsing halo in 2D), and the assets that have nothing to do with it fade. Closing its sheet, or a click on an empty space, zooms back out to the view from before.
+- **One VLAN alone**: a click on a plate, in 3D or in the 2D diagram, shows that VLAN alone: the other plates and their assets disappear, with the flows to them, and the view zooms in on it. *Show every VLAN*, Escape, a click on an empty space or a second click on the plate brings back the VLANs shown before, and the view zooms back out to where it was.
+- **API**: `GET /api/kpi` (the key figures over time), `PUT /api/risk` (approvers), `risk` in `GET /api/state`, the export, the import and proposals; `landscape` on IS documents, `risk` on asset documents.
 - **One-page build**: `npm run build:online` writes `dist-online/strata.html`, the whole interface without a server (map kept in the browser, three.js from jsDelivr).
+### Changed
+- The 3D model is no longer drawn while a lens (Application, Business, Risks) or the 2D diagram covers it: those views stay smooth on modest machines.
 
 ## [0.9.0] - 2026-10-26
 ### Added
@@ -195,6 +218,7 @@ All notable changes to Strata. Versions follow [Semantic Versioning](https://sem
 ## [0.1.0]
 - First release: 3D map of IS, zones, VLANs, assets, flows, exposure, vulnerabilities and incident contacts.
 
+[0.10.0]: https://github.com/SolidGeeks/strata/releases/tag/v0.10.0
 [0.9.0]: https://github.com/SolidGeeks/strata/releases/tag/v0.9.0
 [0.8.0]: https://github.com/SolidGeeks/strata/releases/tag/v0.8.0
 [0.7.0]: https://github.com/SolidGeeks/strata/releases/tag/v0.7.0