Changelog

Version 1.1.0

Fixed — wrong results

• Application-crash detections matched any source using event ID 1000, including one that logs a whole stack trace as a parameter — which then became the incident title and the CSV export. Crash and hang rules now require the genuine Application Error and Application Hang sources. On a real machine this cut a noisy 279 “incidents” down to 13 real ones.
• Rescanning the same source reported detections that were not there. The sliding-window state inside the stateful rules (brute force, for instance) survived between scans and replayed earlier timestamps — a second scan of an identical log went from 6 alerts to 10. Each scan now starts clean, and opening an older .evtx after a live scan no longer disables its rules.
• Severity counters counted alerts rather than incidents — a burst of 100 failed sign-ins read as “HIGH 96” next to a single card. They now match the list beside them.
• Template placeholders leaked into the text you read — “reported in module {{param4}}”. A missing property now renders as “(not recorded)”, and long values are collapsed to one line.
• “Mark as expected” silently did nothing on a correlated incident. Only the primary alert was suppressed, so the rest immediately re-formed the same card. Every signature in the chain is now suppressed — and the registry side updates its hidden-item count like the event side always did.

Fixed — crashes, hangs and exports

• Chart drill-downs and the reboot “View all” button threw an error instead of opening.
• A corrupt or truncated .evtx could spin the CPU indefinitely — a failing read neither advanced nor counted, so the loop never ended. Both readers now give up after 25 consecutive failures.
• CSV exports opened mangled in Excel — en dashes, middots and “×” in the narratives came through as gibberish. A failed export (read-only folder, file open elsewhere) now reports on the status line instead of raising a crash dialog.
• Turning Live off during its baseline scan still started the watchers, and drag-and-drop bypassed the busy guard, allowing a second analysis to run on top of the first.
• The log file did not roll at midnight — a session left running overnight kept appending to the previous day’s file.

Added

• Scan time range — last 24 hours, 7 days, 30 days, or all available. Live channels are filtered at the source, so narrowing the window is genuinely faster rather than reading everything and discarding it. For an imported .evtx the window is anchored on the file’s own newest event, so “last 7 days” of a months-old export still returns its last 7 days.
• A Cancel button for a scan or registry audit already in flight.
• Open several .evtx files at once — multi-select or drop a batch — and analyse them as one correlated timeline. A corrupt or locked file is skipped without losing the rest of the batch.
• An expected-items manager. Review everything you have hidden, see whether each came from an event detection or a registry finding, and restore them individually instead of all-or-nothing.
• Search and a severity filter over the incident list, with a live “X of Y” count and a Clear action.
• A new detection for remote sessions being reconnected or disconnected. The existing rule only caught a fresh remote sign-in, so someone who parks a session and reattaches later produced nothing at all.
• Registry paths and evidence are selectable and copyable, with explicit Copy buttons — they are the strings you paste into the registry editor or a ticket.
• The command-line --analyze mode gained --days=N and accepts several .evtx paths, mirroring the window.

Changed

• DeepDig follows your Windows light/dark preference and tracks changes live, instead of being locked to dark.
• Live monitoring no longer rebuilds the incident list when nothing has changed. It used to reset your scroll position and selection every 800 milliseconds. Correlation also retires closed clusters rather than re-testing every cluster it has ever created.
• Severity chips are now chosen by measured contrast rather than a rough brightness test. The critical-red chip sat at 3.5:1, below the 4.5:1 accessibility floor, and is now 5.2:1; all five severities pass, and a test keeps them passing.
• The results area survives higher display scaling instead of colliding with the view switcher, stat tiles wrap rather than clipping the longest label at minimum window size, and all counts are thousands-separated.
• A recurring incident shows its count once as a badge rather than twice, and the empty state no longer flickers between two messages.
• Accessibility — names on interactive elements for screen readers, and a visible keyboard focus ring on the custom buttons and pills.

Testing

• 48 tests, up from 21 — covering rescan repeatability, the crash-rule source filter, placeholder leakage, multi-file analysis and its error isolation, time ranges, the remote-session rule, the expected-items manager, and severity-chip contrast.
• A new test asserts that every colour the interface references resolves in both themes. A missing one neither crashes nor fails the build — it just renders blank — and this caught a real one.

Version 1.0.0

Analysis

• Event-log analysis — live local scan (“Scan This PC”) and offline .evtx import through a single engine.
• Built-in detection rules across credential access, persistence, privilege escalation, lateral movement, defense evasion, execution, stability and performance.
• Correlation & plain-English narratives — related alerts grouped into incidents with a readable story, severity, recommended actions and a MITRE ATT&CK mapping.
• De-duplication (“seen N×”) and suppression (“Mark as expected”), remembered across runs.
• Live real-time monitoring — a Live toggle streams new alerts with continuously updated correlation.
• Export incidents to CSV or JSON.

Trends & insights

• Trends view — charts of detections and events over time, top event types, and a by-category breakdown. A Detections | All events toggle switches each chart between active detections and the whole scanned log; click any bar to open a time-ordered, human-readable event list.
• Last-reboot card — last boot time, reason and kind (planned / unexpected); click for the full startup and shutdown history.

Registry Security Audit

• A read-only state inspection that runs after a local “Scan This PC”, in its own Registry findings tab. Checks Run/RunOnce keys, Winlogon tampering, IFEO debugger hijacks, UAC-bypass artifacts, Defender disable/exclusions, PowerShell policy and logging, suspicious-path services, installed remote-access tools, and USB / outbound-RDP history.
• Every finding carries a registry path, the evidence, an explanation, remediation, and a MITRE ATT&CK mapping — and can be marked as expected.
• USB findings show each device’s exact last-connected date and time.

App & reliability

• Branded splash and About window ((i) button) with the version and build number and a clickable backendside.com link; the product logo appears in the title bar and sidebar.
• Runs as the normal user (no forced prompt). When not elevated, a dismissible hint offers Restart as administrator for full coverage (live Security log + admin-only registry checks); the Microsoft Store build uses .evtx import for full coverage instead.
• Local rolling logs kept on your PC for the last few days (no telemetry), plus graceful error handling so a failure is reported rather than crashing the app.

Notes

• The Registry findings tab appears only after a local scan, not for imported .evtx files.
• Administrator rights unlock the live Security log and a few machine-wide registry checks; everything else works without admin.