---
title: "1.15.15 — MojoSec auth/host correlation, campaigns, and the blocking lifecycle"
description: "MojoSec now correlates SSH, sudo, and service/OOM evidence into per-node cases (an SSH failure burst followed by a success from the same address pages critical), coalesces distributed scanners into one campaign per tenant group, and owns all automatic MojoSec-driven IP blocking through a bounded rec…"
date: "2026-08-21"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-15-15/"
---

MojoSec now correlates SSH, sudo, and service/OOM evidence into per-node cases (an SSH failure burst followed by a success from the same address pages critical), coalesces distributed scanners into one campaign per tenant group, and owns all automatic MojoSec-driven IP blocking through a bounded recommendation → approval → execution lifecycle with validated targets, TTL-only blocks, honest applied-vs-pre-existing outcomes, and operator reversal. Everything is opt-in per installation; automatic execution is off by default and capped at one validated IP.

### Added
- MojoSec correlates SSH, sudo, and service/OOM evidence into per-node hourly cases behind a new opt-in `include_host` enrollment flag; an SSH failure burst followed by a success from the same address promotes the case to critical.
- High-severity evidence from two different sensor kinds on one node within an hour promotes the triggering case to critical (`corroborated_compromise`).
- Distributed scanners hitting the same family and site across a tenant group's sensors coalesce into one daily campaign case with a bounded exact-IP target set.
- A recommendation lifecycle (proposed → approved → executed → expired/reversed) now owns MojoSec-driven IP blocking, with per-target validation that refuses private, reserved, whitelisted, and operator-protected addresses, TTL-only blocks, and append-only audit of every state change and execution attempt.
- REST endpoints to list, approve, reject, and reverse recommendations; approval executes exactly the proposed targets.
- Automatic execution is off by default (`MOJOSEC_ACTION_AUTO_EXECUTE`) and applies only to a single validated IP from single-source impossible-path evidence.
- Optional driver-side deployment pre-registration (`require_registered_deployments`): trusted-deployment FIM routing can require a centrally registered deployment id, judged against server time.

### Changed
- On authoritative-enrolled installations, `block://` rules and the LLM agent's auto-block are suppressed for exactly the categories and vhosts the enrollment routes — the recommendation lifecycle is the single action owner there. Unenrolled vhosts, unrouted categories, shadow installations, and manual operator actions are untouched; the canary command lists which rules go quiet.
- The LLM agent's block tool validates its target and clamps TTL between 5 minutes and 7 days.
- Case list/detail expose campaign linkage and distinct-source counts; case metrics gain recommendation and enforcement counters.

### Fixed
- The ticket approve-block action was a silent no-op: it reported success and resolved the ticket without ever blocking. It now blocks through the validated path, requires the approver to hold security permissions, reports an already-existing block honestly, and leaves the ticket open on failure.

### Security
- An approval freezes a recommendation's target set — evidence observed after approval can never widen what executes under it.
- A wrong-typed protected-CIDR setting refuses every block target instead of silently protecting nothing.

### Upgrade notes
- Enrollment rows carrying the new `include_host` or `require_registered_deployments` keys fail the whole enrollment list closed on older binaries — deploy this release first, then update `MOJOSEC_CASE_SHADOW_TARGETS`.
- New incident migrations (five tables plus case columns); migrate before serving.