SigmaHQ Auto-Sync, Trace Links & Security Fixes

Daily auto-sync for SigmaHQ community rules, trace navigation from log detail panel, audit logs for alert rules, and security/robustness fixes for ingestion and admin endpoints.

SigmaHQ rules auto-sync daily at 2:30 AM
View Trace link in log detail panel when trace_id is present
Audit log entries for alert rule create/update/delete
Admin pagination capped at 200 to prevent oversized allocations
NDJSON lines exceeding 1MB rejected with HTTP 400
api_key_id removed from log metadata (information disclosure fix)

Added

SigmaHQ auto-sync: SigmaHQ community rules now auto-sync daily at 2:30 AM for organizations that have existing community rules enabled.
Trace link in log detail panel: The log detail panel now shows a “View Trace →” link that navigates directly to the trace timeline when a trace_id is present in the log.
Audit logs for alert rules: Create, update, and delete operations on alert rules now generate audit log entries.

Fixed

Admin pagination cap: The limit parameter on admin list endpoints is now capped at 200, preventing oversized result set allocation.
NDJSON ingestion size limit: Individual lines exceeding 1 MB in NDJSON payloads are now rejected with HTTP 400 instead of being silently processed.
Log metadata information disclosure: api_key_id is no longer stored in log metadata. It was previously injected in v0.8.1 for exception log display but exposed sensitive data; the display now resolves the key name at read time instead.

All releases