1.15.15 — MojoSec auth/host correlation, campaigns, and the blocking lifecycle

2026-08-21

MojoSec now correlates SSH, sudo, and service/OOM evidence into per-node cases (an SSH failure burst followed by a success from the same address pages critical), coalesces distributed scanners into one campaign per tenant group, and owns all automatic MojoSec-driven IP blocking through a bounded recommendation → approval → execution lifecycle with validated targets, TTL-only blocks, honest applied-vs-pre-existing outcomes, and operator reversal. Everything is opt-in per installation; automatic execution is off by default and capped at one validated IP.

Added

• MojoSec correlates SSH, sudo, and service/OOM evidence into per-node hourly cases behind a new opt-in include_host enrollment flag; an SSH failure burst followed by a success from the same address promotes the case to critical.
• High-severity evidence from two different sensor kinds on one node within an hour promotes the triggering case to critical (corroborated_compromise).
• Distributed scanners hitting the same family and site across a tenant group's sensors coalesce into one daily campaign case with a bounded exact-IP target set.
• A recommendation lifecycle (proposed → approved → executed → expired/reversed) now owns MojoSec-driven IP blocking, with per-target validation that refuses private, reserved, whitelisted, and operator-protected addresses, TTL-only blocks, and append-only audit of every state change and execution attempt.
• REST endpoints to list, approve, reject, and reverse recommendations; approval executes exactly the proposed targets.
• Automatic execution is off by default (MOJOSEC_ACTION_AUTO_EXECUTE) and applies only to a single validated IP from single-source impossible-path evidence.
• Optional driver-side deployment pre-registration (require_registered_deployments): trusted-deployment FIM routing can require a centrally registered deployment id, judged against server time.

Changed

• On authoritative-enrolled installations, block:// rules and the LLM agent's auto-block are suppressed for exactly the categories and vhosts the enrollment routes — the recommendation lifecycle is the single action owner there. Unenrolled vhosts, unrouted categories, shadow installations, and manual operator actions are untouched; the canary command lists which rules go quiet.
• The LLM agent's block tool validates its target and clamps TTL between 5 minutes and 7 days.
• Case list/detail expose campaign linkage and distinct-source counts; case metrics gain recommendation and enforcement counters.

Fixed

• The ticket approve-block action was a silent no-op: it reported success and resolved the ticket without ever blocking. It now blocks through the validated path, requires the approver to hold security permissions, reports an already-existing block honestly, and leaves the ticket open on failure.

Security

• An approval freezes a recommendation's target set — evidence observed after approval can never widen what executes under it.
• A wrong-typed protected-CIDR setting refuses every block target instead of silently protecting nothing.

Upgrade notes

• Enrollment rows carrying the new include_host or require_registered_deployments keys fail the whole enrollment list closed on older binaries — deploy this release first, then update MOJOSEC_CASE_SHADOW_TARGETS.
• New incident migrations (five tables plus case columns); migrate before serving.