What's Changed

• Opencti review by @Linko91 in #1156
• fix(huntress): redact credentials in logs and stop reporting false success by @taylorwalton in #1157
• 1158 customer portal fix token refresh missing updated by tag acl bypass on bulk alert delete and wrong customer on case creation by @Linko91 in #1159
• 1160 customer portal fake severity on overview non utc timestamp leaking report poller dead abortcontroller by @Linko91 in #1161
• fix(incidents): reset alerts and cases pagination on filter changes by @Linko91 in #1163
• feat(db): add customer_waf_instances table (#1166) by @taylorwalton in #1170
• feat(customer-waf): per-customer SOCFortress WAF config, client and read routes (#1166) by @taylorwalton in #1171
• feat(customer-waf): block / unblock IPs on a customer's WAF (#1167) by @taylorwalton in #1172
• feat(customer-waf): WAF page, customer WAF tab and Block at WAF on alerts (#1168) by @taylorwalton in #1173
• 1164 customer portal restyle the overview page by @Linko91 in #1174
• feat(customer-waf): set up WAF event forwarding into the SIEM (#1169) by @taylorwalton in #1175
• feat(customer-waf): CoPilot alerts from WAF events (#1169) by @taylorwalton in #1176

New ENV Variables

# SECURITY: Fernet encryption key for SOCFortress WAF service tokens stored in the
# database (Customers → WAF). Deliberately separate from TOTP_ENCRYPTION_KEY and
# with NO fallback: until it is set, WAFs can't be saved.
# ⚠️  Changing it makes stored WAF tokens unreadable — each WAF's token must then be
#     re-entered (issue a new one in the WAF under Service Tokens).
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
WAF_TOKEN_ENCRYPTION_KEY=REPLACE_ME

# SOCFortress WAF event forwarding (Customers → WAF → "Set up event forwarding").
# Each WAF gets its own Graylog Syslog TCP input on a free port in this range.
WAF_SYSLOG_PORT_RANGE=5600-5699
# Optional: the Graylog host/IP a WAF sends syslog to, pre-filled in the setup dialog.
# This is the address the *WAF* can reach — often not the Graylog API address CoPilot uses.
WAF_SYSLOG_DEFAULT_HOST=

Full Changelog: v0.1.92...v0.1.93