What's new in DAROS.

Every release is tested, certified, and traceable. Governed security operations — never autonomous.

Certified releasesDeterministic buildsTraceable evidence

v2.2.22026-07-20SOC External Intelligence Plane

Ingest signals from your entire enterprise — authenticated, verified, and proven. New connector framework with a governed source registry, tamper-evident origin proofs, and end-to-end evidence anchoring.

New

SOC connector framework with three certified source types (syslog, Windows Event, CloudTrail)
Origin proof anchored to the ProofChain for every ingested event (evidence_id)
Governed source registry with integrity checksum — anti-drift, fail-closed
Idempotent ingestion: safe client retries, replay returns the same result

Security

HMAC-SHA256 source authentication with ±300 s time window
Durable anti-replay nonce store (sliding window, GC bounded)
Strict JSON Schema validation per source — payload outside contract rejected
Rate limiting with sliding quota (default 600/min)

Fixed

Semantic HTTP statuses across the connector API (201/401/404/409/422/429/502)
Observed-at window enforcement — no backfill or forecast injection

Breaking

None — connector API v1.1 is backward compatible with v1.0

Connector framework documentation SOC connector invariants

v1.0.02026-07-27Certified Release Candidate

The first fully certified release of the DAROS platform: deterministic builds, a validated invariant set, and the complete governed SOC workflow — from detection to audit proof.

New

Release manifest system with deterministic workspace builds
Complete SOC workflow: detection, correlation, cases, investigation graph, evidence, audit proof
Full proof chain: proof_hash to record_hash to Evidence to Audit Proof

Security

Validated invariant framework enforced across the platform
Single deterministic decision authority — engines provide context only
4 CVEs accepted — transitive dependencies only, no exploitable path

Fixed

Reproducible workspace builds from release manifests

Breaking

None since the stabilization phase

Certification report

What's coming next

Published workstreams are updated only after the relevant implementation and verification have been reviewed.

Syslog server connector

UDP/TCP collector with upstream-signed ingestion (SOC-003B)

Windows Event Forwarding

EventID to canonical mapping for endpoint telemetry (SOC-003C)

Cloud connectors

CloudTrail, Azure Activity, and GCP Audit sources (SOC-003D)

Threat intelligence enrichment

IOC enrichment (IP, domain, hash, CVE, TTP) — enrichment only, never a decision

Governed response plane

Response workflows where the Decision Kernel remains the only authority

Fleet management

Multi-site and multi-tenant operations at scale

Operational intelligence

Assisted triage and dashboards — governed automation, never autonomous

Want the full picture?

Our team walks you through what each release means for your operations.

Talk to Sales

Create a personal account Request demo

Chargement...