## v1.3.1 — 2026-06-07

**Per-subcommand `--help` curation (TPG sweep).**

Every hunting recipe (`find-user`, `failed-logins`, `new-user`, `privilege-grant`,
`risky-signins`, `host-processes`, `host-connections`, `dns-to-domain`,
`host-file-writes`, `host-logons`, `alerts-by-severity`, `email-by-sender`,
`ioc-hash`, `ioc-ip`, `ioc-domain`, `rdp-sources`, `smb-anomaly`,
`kerberos-anomaly`, `legacy-auth`, `cloud-app-activity`, `oauth-consent`,
`inbox-rules`, `mail-forwarding`, `encoded-powershell`, `lolbin-exec`,
`pim-role-activation`, `conditional-access-change`, `mfa-fatigue`,
`user-connections-to-domain`, `user-uploads`, `uploads-containing-text`,
`user-activity-window`, `script-by-user`) and the reference commands
(`list-recipes`, `explain`, `event`, `port`) now carry a structured
`long_about` block with:

- a one-sentence description (what the recipe is for),
- `Queries:` — the actual SIEM tables / CEPs the emitted query hits on Sentinel /
  Defender XDR / QRadar,
- `Catches:` — the specific threat pattern the recipe is for, with cross-recipe
  pivots,
- a pointer to `socq explain <slug>` for full prerequisites, docs, analyst notes.

The root `socq --help` also gains an explicit **TOUCHES / PRODUCES / GATES**
header making it loud-and-clear that socq is fully read-only — it only emits
queries, never runs them — so there is no `--i-am-authorized` and no
destructive subcommand.

## v1.3.0 — 2026-06-07

Daily-SOC reference + recipe expansion.

**Five new code families** — extending `socq code`:
- `socq sysmon <ID>` — curated Sysmon event IDs (1, 3, 5, 7, 8, 10, 11, 12,
  13, 15, 22, 23) — process create, network conn, ProcessAccess (lsass /
  Mimikatz pivot), DNS-query (DGA / DoH), file create / delete (archived),
  registry persistence.
- `socq kerberos <CODE>` — pre-auth / KDC errors (6, 7, 12, 18, 23, 24, 25,
  32, 37, 41) — password spray, AS-REP roast, golden / silver ticket hints.
- `socq ldap <CODE>` — LDAP result codes (0, 1, 32, 48, 49, 50, 53) — AD
  enumeration, anon bind probing, bind spray, privilege probing.
- `socq aad <AADSTS>` — Azure AD / Entra sign-in errors (50034, 50053, 50055,
  50057, 50076, 50079, 50126, 50133, 50158, 53003, 65001, 700016) — cloud
  password spray, MFA fatigue, OAuth consent phishing, CA-policy blocks.
  Accepts the code with or without the `AADSTS` prefix.
- `socq tls <CODE>` — TLS alert codes (0, 10, 20, 40, 42, 44, 45, 46, 47, 48,
  70, 86, 112) — handshake debugging, MITM / downgrade / trust-store-drift.

All five families plug into `socq code <type>`, `socq code --search`, and
`socq code --list`.

**Five new hunting recipes** — covering the daily-investigation patterns
operators were piecing together by hand:
- `user-connections-to-domain --user U --domain D` — outbound connections
  from a user to a specific domain (URL substring + `.<domain>` suffix
  match). Sentinel + Defender + QRadar.
- `user-uploads --user U [--filetype pdf,xlsx,docx] [--to-domain D]` —
  upload events by user, optionally narrowed by file extension and / or
  destination domain. Covers SharePoint / OneDrive, MCAS, generic proxy.
- `uploads-containing-text --text PATTERN [--user U] [--to-domain D]` —
  uploads whose filename / DLP-classification snippet contains a substring.
  Use when a sensitive document is suspected leaked.
- `user-activity-window --user U --start TS --end TS` — bounded review of
  one user's sign-in + process + network + cloud activity between two
  timestamps (RFC3339 or `'YYYY-MM-DD HH:MM'`). Overrides `--last-*` so the
  recipe lines up with audit-period queries.
- `script-by-user --user U [--interpreter powershell,python,bash,…]` —
  scripting-engine executions by a user. Covers PowerShell, pwsh, Python,
  bash on WSL, cscript, wscript, cmd, node, ruby, perl.

## v1.2.0 — 2026-06-06

Daily-SOC reference expansion. Operators look up the same handful of
status / error codes every shift — HTTP 401/403/500, SMTP 421/535/550,
DNS NXDOMAIN, Linux EACCES — and each one has a predictable SOC story
(broken auth, password spray, content-filter reject, DGA candidate).
This release curates that story.

### Added — quick code lookup with SOC context
- **`socq http <code>`** — HTTP status code lookup (200, 301, 400, 401,
  403, 404, 429, 500, 502, 503, 504 to start).
- **`socq smtp <code>`** — SMTP reply code (250, 421, 450, 535, 550, 554).
- **`socq dns <code>`** — DNS rcode by number (0–5) or name
  (`NOERROR`, `FORMERR`, `SERVFAIL`, `NXDOMAIN`, `REFUSED`).
- **`socq errno <name>`** — Linux errno by symbolic name
  (`EACCES`, `ENOENT`, `ECONNREFUSED`, `ETIMEDOUT`).
- **`socq code <type> <code>`** — unified surface for the same data;
  pair with `--list` for the full catalogue or `--search <text>` for a
  free-text scan across every family.

Each entry surfaces:
- **What it is** — one-line spec definition.
- **SOC context** — what the code *means* in daily ops (the part
  operators actually look up).
- **Alert when** — concrete thresholds / patterns worth paging on.
- **Suggested actions** (with `--explain`) — concrete next steps.
- **False positives** — the benign causes worth ruling out first.
- **Pivots** — related `socq` recipes for the deep dive.
- **References** — RFC / man-page link.

The catalogue is intentionally narrow — the codes operators actually
look up at engagement time, with the analyst-side story spelled out
instead of a generic protocol definition. Adding a code is one entry
in `codes.rs` against the `CodeEntry` struct.

## v1.1.0 — 2026-06-05

Memo-mode expansion focused on daily Defender XDR + Sentinel + QRadar work.

### Added — 8 new hunting recipes (each with analyst notes + MITRE tags)
- **oauth-consent** [Sentinel / Defender] — OAuth consent grants for app
  consent phishing. T1528, T1098.003.
- **inbox-rules** [Sentinel / Defender] — `New-InboxRule` / `UpdateInboxRules`
  events; classic BEC tradecraft. T1564.008, T1114.003.
- **mail-forwarding** [Sentinel / Defender] — `Set-Mailbox` with
  ForwardingSmtpAddress / ForwardingAddress. T1114.003, T1098.002.
- **encoded-powershell** [Defender / QRadar] — PowerShell `-EncodedCommand`
  / `-enc` invocations. T1059.001, T1027.
- **lolbin-exec** [Defender / QRadar] — Curated LOLBin process list
  (certutil, mshta, rundll32, regsvr32, …). T1218, T1059, T1140.
- **pim-role-activation** [Sentinel] — Entra PIM just-in-time admin
  activations (RoleManagement audit category). T1078.004, T1098.003.
- **conditional-access-change** [Sentinel] — Entra CA policy create /
  update / delete (Policy audit category). T1556, T1484.002.
- **mfa-fatigue** [Sentinel] — Repeated MFA challenges within 15 min
  followed by a successful sign-in (push-bombing pattern). T1621, T1110.004.

### Added — reference commands
- **`socq ttp <T-code|name>`** — MITRE ATT&CK technique lookup. ~60
  curated enterprise techniques from attack.mitre.org with name, tactic,
  one-line summary, attack.mitre.org URL. Lists matching recipes.
- **`socq pack <slug>`** — investigation playbooks: `bec`, `ransomware`,
  `credential-theft`, `insider-exfil`, `initial-access`,
  `privilege-escalation`. Ordered recipe chains with a "why this step"
  line per item. Recipe references are compile-time-checked.
- **`socq syntax <topic>`** — KQL + AQL quick-reference cards covering
  operators, where-predicates, string/time/aggregation functions, and
  paste-ready patterns. Sourced from Microsoft Learn and IBM Ariel docs.

### Added — explain enhancements
- `RecipeMeta` now carries optional `analyst` notes (when to run, healthy
  baseline, common false positives) and a `mitre` ATT&CK tag list.
- `socq explain` surfaces analyst notes, MITRE tags, and a `socq ttp …`
  pivot block.
- `socq list-recipes` shows the MITRE tag set inline per recipe.

### Added — markdown export
- New global `--format md` flag. `explain` renders headings + bullet
  lists; emitted queries wrap in a fenced code block with the dialect
  tag (`kql` / `sql`) so they paste clean into runbooks / Notion / GitHub.

### Internals
- Catalogue grew from 20 → 28 recipes. Compile-time test enforces that
  every pack step references an existing recipe slug.

## v1.0.0 — 2026-06-04

Initial release.

- 20 daily-SOC recipes, each emitting ready-to-paste KQL (Sentinel + Defender XDR)
  and AQL (QRadar). Every recipe declares which targets it supports and surfaces
  gaps explicitly (e.g. Kerberos 4768/4769 is "NOT AVAILABLE" on Defender XDR;
  DNS recipes need a QRadar DNS DSM).
- Recipes: find-user, failed-logins, new-user, privilege-grant, risky-signins,
  host-processes, host-connections, dns-to-domain, host-file-writes,
  host-logons, alerts-by-severity, email-by-sender, ioc-hash, ioc-ip,
  ioc-domain, rdp-sources, smb-anomaly, kerberos-anomaly, legacy-auth,
  cloud-app-activity.
- Keyword time ranges: `--last-hour`, `--last-24h`, `--last-3d`,
  `--last-7d` (alias `--last-week`), `--last-30d` (alias `--last-month`),
  `--last-6m`. Absolute window via `--between START STOP` (RFC3339 or
  "YYYY-MM-DD HH:MM"); open-ended via `--since X`.
- Output is just the query text by default. `--header` wraps it with a 4-line
  comment (target / recipe / time / source) using the right dialect prefix
  (`//` for KQL, `--` for AQL). `--copy` pipes the result into wl-copy / xclip /
  xsel (first one on PATH).
- Event-ID catalogue: `socq event winos <id>` looks up any of 410 Windows
  Security Audit events with category, subcategory, min-OS, summary, and the
  full Microsoft event template. `socq event winos --search <text>` does
  free-text search across summaries and details.
- `event` source is hierarchical: `winos` is populated today; `linux`,
  `cisco`, `siem` stub out cleanly so future catalogues slot in.
- Port-number reference: `socq port <number>` returns the service, description,
  and a colour-coded security status flag (green SECURE / red INSECURE /
  yellow MIXED / magenta RISKY / grey INFO). 119 SOC-relevant ports curated.
  `socq port --search <text>` does free-text search; `socq port --list`
  prints the catalogue as one-liners. Honours `NO_COLOR`.
- `socq list-recipes` lists the catalogue with per-recipe target support.
- `socq explain <recipe>` shows prerequisites + per-target documentation
  links (Microsoft Learn for KQL; IBM Docs for AQL) so the audit trail back to
  the official schema is one command away.
- Zero runtime dependencies — single static-ish glibc binary.