HISN (حصن) v1.35.3 - Release notes November 2026 ===================================================================== Weak-password audit reminder. Nothing else changes. What you may notice - If no password audit has been run for a domain (or it is older than 90 days), the dashboard now shows a clear warning and every management report carries a short section, "Privileged-account passwords were not audited". Without that audit Hisn cannot tell whether your Tier 0 (administrator) accounts use weak or breached passwords - the fastest way an attacker takes over a domain - so it now says so plainly instead of leaving the weak-password checks quietly "not evaluated". Run the audit from the Password audit page and scan again to clear it. HISN (حصن) v1.35.2 - Release notes November 2026 ===================================================================== Setup fix. Nothing else changes. Fixed - When the service account (gMSA) name had been saved with spaces around it, an upgrade installed and started Hisn correctly but then ended with "Installation failed" (exit code 1), because its final check compared the name with the spaces. Setup now ignores the spaces. HISN (حصن) v1.35.1 - Release notes November 2026 ===================================================================== More precise Central Bank of Iraq mapping, and clearer "not evaluated" results. Scores can change slightly (see below). What you may notice - Shorter reports for management: the Executive, Attack paths, Changes and Remediation plan reports now start with their own content. Document control, the objective, criteria and limitations, and scope used to repeat the same pages at the start and end of every report; these reports now end with one short section, "About this report" (objective, basis, limitations, report ID, version, marking, fingerprint and the data-handling note). The Remediation plan keeps its sign-off block. The Technical and Compliance reports, which auditors use as evidence, keep every section in full. - CBI Cyber Resilience Controls: each check now cites only the sections it actually tests. The password policy checks map to Protect 8.2 Password Management only (they were also listed under Protect 1.2 Server Security Controls), network protocol checks to Protect 3.1, Defender to Protect 5, the AD backup check to Respond 3, domain controller health to Identify 3 Capacity Management and Respond 2.2 Disaster Recovery Plan, and the Tier 0 inventory to Identify 1 Assets Management. Protect 1.2 now holds the server hardening checks only. Older scans show the new mapping straight away. Fixed - When no domain controller could be read over remote PowerShell (WinRM), checks said "run a scan with collector 0.15 or later", even with a current collector. They now name the domain controller, Windows' error and what to do: when the scan account was refused, add it to Remote Management Users and Event Log Readers on the domain controllers. - In a domain without member servers, the member-server checks (S-001 to S-015) passed, so a report could show a control such as malware protection with "no failing checks" although nothing was examined. They are now "not evaluated - no active member servers" and no longer count towards the score. - Collector 1.3.1: when the scan account could connect to a domain controller but was not its administrator (for example a gMSA in Remote Management Users), one failed read (the audit policy) lost all of that DC's settings, and other reads failed quietly: services looked "not installed" and dcdiag tests failed. Hisn now records whether it read the DC as an administrator; if not, that DC's settings checks are "not evaluated" with the reason, instead of wrong findings. The user guide now says that DC settings need a scan account in Domain Admins; Remote Management Users alone lets the account connect but not read them. HISN (حصن) v1.35.0 - Release notes November 2026 ===================================================================== Iraq. Hisn now maps its checks to the Central Bank of Iraq's Cyber Resilience Controls for the financial and banking sector (first edition, June 2024), for ten frameworks in total. Scans, checks and scores do not change. What you may notice - A new framework, "CBI Cyber Resilience Controls (2024)", on the Compliance page, the dashboard compliance card, each finding's details, the Create report window (Compliance report), the compliance overview of every report and a new Excel column. - Findings map to the document's own sections, for example Protect 8.1 User Access Management, Protect 8.2 Password Management, Protect 8.4 Privileged Access Management, Protect 1.2 Server Security Controls, Protect 9 Patch Management, Detect 1 Security Monitoring and Respond 3 Data Backup and Restore Management. The document numbers each domain from 1, so every reference starts with its domain; the Compliance report lists them in the document's order. - Scans made with earlier versions show the new framework straight away; no new scan is needed. - The user guide names the ten frameworks. Hisn maps its checks to frameworks; it does not certify compliance. HISN (حصن) v1.34.1 - Release notes November 2026 ===================================================================== User guide update. Nothing else changes. Fixed - The user guide's pictures of the dashboard, a finding, the Create report window and the Compliance page now show all nine frameworks, including SAMA CSF and the UAE IA Regulation, and its text names them in both languages. HISN (حصن) v1.34.0 - Release notes November 2026 ===================================================================== Gulf frameworks. Hisn now maps its checks to two more frameworks used in the Gulf, for nine in total. Scans, checks and scores do not change. What you may notice - SAMA Cyber Security Framework v1.0 (Saudi Central Bank; banks, insurers and finance companies): identity and access findings map to 3.3.5 Identity and Access Management, hardening to 3.3.8 Infrastructure Security, certificate services to 3.3.9 Cryptography, auditing to 3.3.14 Cyber Security Event Management and patching to 3.3.17 Vulnerability Management. - UAE Information Assurance Regulation v1.1 (TDRA, 2020): mapped to its technical controls, for example T5.2.2 Privilege Management, T5.2.4 Review of User Access Rights, T3.6.2 Audit Logging, T7.4 Cryptographic Controls and T7.7 Technical Vulnerability Management. - Both appear on the Compliance page, on the dashboard compliance card, in each finding's details, in the Create report window (Compliance report), in the compliance overview of every report, and as two new columns in the Excel export. - Scans made with earlier versions show the two new frameworks straight away; no new scan is needed. - Reports cite control numbers and short titles only. A newer UAE IA Standard (v2) is being introduced by the UAE Cyber Security Council; Hisn uses the published v1.1 numbering until v2 is publicly available. Hisn maps its checks to frameworks; it does not certify compliance. HISN (حصن) v1.33.0 - Release notes November 2026 ===================================================================== Reports for auditors. Reports now carry what auditors in the US, UK and EU expect from assessment evidence, and every report can be downloaded as an editable Word or OpenDocument file. Scans, checks and scores do not change. What you may notice - Editable reports: the Create report window has two new buttons, "Word (.docx)" and "OpenDocument (.odt)". The file has real headings, tables whose header row repeats on every page, Arabic right-to-left layout, and the marking at the top and bottom of every page. Edit it, add your conclusions, save it as PDF and sign it with your own certificate. - Accepted risks: a new section lists every finding under a risk exception, with its justification, who approved it, until when, and whether it has expired; acknowledged findings are listed too. - Objective, criteria and limitations: each report states what it set out to assess, against which checks or framework version, and what Hisn does not assess (Entra ID, endpoints, network devices, physical security, people and processes). Checks that could not be evaluated are named and are not counted as passed. - Document control: who prepared the report, when, the data collection time, a report version and a distribution list (both optional in the Create report window), the report ID and the fingerprint. - Verified fixes: the remediation plan shows when each issue was first seen and who owns it; a finding fixed since the previous scan reads "Fixed - verified by scan #N on ". - Markings: choose FIRST TLP 2.0 (TLP:CLEAR, GREEN, AMBER, AMBER+STRICT, RED), UK OFFICIAL or OFFICIAL-SENSITIVE, US CUI, or your own text (Settings: report marking). The marking is printed at the top and bottom of every page. The earlier Internal / Confidential / Secret choices still work. - Pseudonymised names: an option replaces every user account name with user-0001, user-0002 ... (groups, computers, GPOs and built-in accounts keep their names). The mapping is not in the report. Fix scripts in such a report contain the pseudonyms and cannot be run as they are. Every report now carries a short note that account names can be personal data. - Accessibility: reports follow WCAG 2.1 AA (headings in order, table headers, text next to every chart, stronger contrast), as expected by Section 508 in the US and EN 301 549 in the EU. Some colours are slightly darker as a result. Hisn maps its checks to frameworks; it does not certify compliance. HISN (حصن) v1.32.1 - Release notes November 2026 ===================================================================== User guide release. Scans, alerts and the database do not change. What you may notice - The user guide (sidebar: User guide) is new: in English and Arabic, with a language switch that follows the console's language, and 25 pictures of the console's pages, each taken in English and in Arabic. - It starts with a five-step quick start, then explains each page in menu order: what the parts of the page mean and what to do next. New sections cover the dashboard, compliance, honey accounts and a glossary; the 1.32 pages (privileged sign-ins, lockouts, search) are covered with pictures. - The guide works without an internet connection, prints cleanly, fits a phone screen, and keeps its old section links working. - The pictures show an invented demo domain, not real data. Fixed - The guide's text was English only, and parts of it were out of date (setup file name, report names). HISN (حصن) v1.32.0 - Release notes November 2026 ===================================================================== Auditing release (collector 1.3.0): where privileged accounts sign in, why accounts lock out, which Group Policy setting changed, and one search over everything Hisn has recorded. Scan results (checks, score) do not change. The database is upgraded on first start; a copy is made first (hisn.db.bak-24-25). What you may notice - Privileged sign-ins (needs Live Watch). Hisn now records the SUCCESSFUL sign-ins of the Tier 0 accounts: Kerberos ticket requests (event 4768) and logons at a domain controller (4624), read for those accounts only. A new page shows which account signed in from which machine. - New alert "Tier 0 sign-in exposure": a privileged account signed in from a machine that is not a domain controller. Its password hash or ticket can be stolen from that machine. High for a workstation, medium for a member server or an unknown machine; one alert per account and machine per week. List your admin workstations and jump servers under "allowed machines" (names, PAW-*, addresses, ranges such as 10.0.7.0/24) and they are not reported. - Machine names: an address is shown with its name when the event carries it or the network's own DNS knows it (a reverse lookup from the Hisn server; it can be switched off). - Optional: keep every user's sign-ins (Settings: scope "all"). This stores far more rows; the default is privileged accounts only. Sign-ins are kept 90 days by default. - Account lockouts: each lockout now shows the machine that caused it and the likely reason - a password changed recently and an old one still stored, a service or scheduled task, a device, a person mistyping, or an attack - with the failed attempts behind it. Hisn does not unlock accounts. - Group Policy changes say WHICH setting changed, with the old and new value: user rights, security options, password / lockout / Kerberos policy, registry settings, restricted groups, scheduled tasks and scripts. Before, Activity only said "settings edited". The first scan after the upgrade records the starting point; details appear from the second scan. Passwords inside a GPO are never collected. - Search: one page searches directory changes, failed sign-ins, successful sign-ins and Watch alerts together, by text, kind and date, and exports the result as a CSV file. Fixed - Failed sign-ins could be lost exactly when there were many. When one read held more than a page of them (2,000 for Live Watch, 6,000 for a scan - a password spray, for example), the query for the next page was refused by Windows and that read's failed sign-ins were dropped. The same fault stopped the failed sign-in and decoy-account parts of the gap re-reads added in 1.31. - Removing a domain now also removes its recorded sign-ins. - A setting the server cannot accept is now refused with its own message (for example an allowed machine that is not a name, an address or a range) instead of a general "request is not valid". - The user guide covers the new pages (section 11). HISN (حصن) v1.31.0 - Release notes November 2026 ===================================================================== Platform and polish release. Scan results do not change (engine and collector checks are the same as 1.30.0); the console, Live Watch, the installer and the web pages do. What you may notice - Alert e-mails no longer slow the console. They are sent in the background, and several Live Watch alerts for the same domain within a few seconds arrive as one message, in English and Arabic. A failed send is written to the Audit log. - Live Watch checks several domains at the same time (up to 4), so one slow or unreachable domain controller no longer delays the others. - When Live Watch missed events (the console was stopped, or a busy DC returned more events than one read keeps), it now goes back and reads the missing window, and the Audit log says when the gap was closed. Before, those events were only reported as possibly missed. - Disk space: the raw data of older scans is kept compressed (about ten times smaller; reports of old scans still rebuild from it). The newest 3 scans per domain stay uncompressed (Settings: keepRawScans). No scan or backup starts when free disk space is below 2 GB (Settings: minFreeMB); the page says why. - A database written by a newer Hisn no longer makes the service restart every few seconds. The console stays up and shows a page, in English and Arabic, explaining that the newer version must be installed again (or a backup made with this version restored). - Error messages are translated. A server error now shows a sentence in the page's language instead of raw English or "Could not reach the server"; technical detail from Windows or a mail server is shown separately, marked as such. - Keyboard and screen readers: rows that open details (dashboard, Watch, compliance, categories, sign-ins, Activity) can be reached with Tab and opened with Enter or Space; a "Skip to content" link; the window title follows the page, and focus moves to the new page's heading. Chart points have labels and show their tooltip on focus. - Arabic wording is consistent: الطبقة صفر (Tier 0), الدرجة (score), ملاحظة (finding), حصن in sentences, المراقبة (Watch). Arabic pages use Western digits everywhere, and date ranges point the right way. - Live Watch timings are described as "within a minute", which is what the default polling gives. - Medium and low severity colours in charts have more contrast in both the light and the dark theme. Installer - An upgrade makes a backup of the data folder before it changes anything, and stops if the backup fails. - Installing an older version over a newer one is refused. - The install folder must be under Program Files; its permissions are set without inherited entries. - Any unexpected error from the install script now fails the setup instead of being reported as success. - Each release comes with a SHA256SUMS file and a software bill of materials (SBOM). Fixed - An e-mail subject could contain a line break from a domain or object name; it is now always one line. - The mail connection was left open when STARTTLS failed. - The login page could show a check count of "124" when the real count was unknown. - Several labels (logo upload "PNG only", LDAP evidence, the scanning message) were English-only on Arabic pages. HISN (حصن) v1.30.0 - Release notes November 2026 ===================================================================== Detection-quality release (engine 0.20.0, collector 1.2.0), from the audit of 1.29.9 (docs/audit/AUDIT-1.29.9.md in the source). Results CHANGE on the next scan - some findings appear, some disappear, some become "not assessed". Each change has a test. What you may notice - Findings that could not be checked now say so. When SYSVOL could not be read, G-001 (passwords in Group Policy) and the other GPO content checks used to PASS; they are now "not assessed". The same for AD CS when the CA or template query failed (it read as "AD CS not deployed"), for CA registry probes that all failed, for audit policy (M-001) and update level (I-035) that could not be read on a DC, and for checks whose data section was not collected. - New attack paths and findings that were missed: * write access through property sets (Membership, the account restrictions set that allows resource-based delegation, the logon information set, certificate mappings); * a computer placed in Domain Controllers by its primary group but not a domain controller (a planted "fake DC", P-017); * write access to the AD CS template settings that create ESC1 (C-003); adding members to Tier 0 groups (T-005); * Account, Server, Print and Backup Operators are now Tier 0 in attack paths, and Account Operators' control counts when the group has members (D-002). - Fewer false attack paths: a permission set on an OU now reaches only the kind of object it is meant for (a "manage user accounts" delegation no longer reaches the domain controllers in the same OU), and accounts protected by AdminSDHolder are not reached through their OU. Paths of different users are no longer merged into one. - The remediation plan's "first step" and its numbers now describe the same change, counted in users and paths. - Fewer noisy findings: T-003 (Account Operators' default rights on DCs, when the group is empty), D-009 (computer SPN writes from domain-join delegations), P-006 (members of Protected Users), S-012 / G-003 (managed service accounts and non-Windows machines), H-005 (forest-wide roles in a child domain), C-019 (SHA-1 on a self-signed root), C-014 (templates only administrators can use), G-021 (client-side SMB signing), A-006 (now medium, whole words). T-004 and C-018 are now medium. - Stricter where the old rule let weak settings pass: I-007 needs LDAP channel binding "Always" (2); M-004 needs logging level 5. - Settings made by Group Policy are read correctly: Kerberos encryption types (I-019), Security log size (M-002), and the effective Windows Firewall state (I-039, S-007). SMB1 found through the registry is reported (I-017). The tombstone lifetime defaults to 60 days when it is not set (H-002). - Fix scripts that failed when run now work: group removals check direct membership and use the forest root for forest-wide groups; "must change password" also clears "password never expires"; I-026 runs on each DC; K-007 uses the right cmdlet for users. - Compliance: the Five Eyes mapping is a reviewed list per check (the coverage figure was inflated); ANSSI is shown as indicative and its levels were off by one; STIG, CIS (v8.1) and PCI DSS (v4.0.1) references corrected. Collector 1.2.0 (runs on the next scan) - Member servers with unconstrained delegation are no longer contacted, so the scan identity's Kerberos ticket is never left on them (they are still reported by K-004). - A CA is probed only when its host is in this forest and its name is safe to pass to certutil. - Records whether SYSVOL and the AD CS queries could be read, managed service accounts, self-signed roots and Group Policy registry paths. HISN (حصن) v1.29.10 - Release notes November 2026 ===================================================================== Safety release from a full audit of 1.29.9 (docs/audit/AUDIT-1.29.9.md in the source). Each fix has a test. No change to scores. What you may notice - Rollback and remediation scripts: every line that changes something now carries -WhatIf or is commented out, as the script header has always said. In 1.29.9 several rollback lines (for example starting the Print Spooler on DCs, lockout threshold 0, machine account quota 10) ran for real if the script was executed. Uncomment only the lines you approve. - Compliance reports are now called "Framework mapping reports". Controls show "No failing checks" / "Failing checks" instead of "Compliant" / "Not compliant": Hisn maps its Active Directory checks to a framework; it does not certify compliance. - NCA ECC: privileged access findings now map to 2-2-3-4 Privileged access management (2-15 is Web Application Security). ISO 27001 "A.8.20 Networks security" and PCI DSS "2.2 Secure configurations" no longer appear twice; A.5.29 became A.5.30 ICT readiness for business continuity. - Live Watch shows "gaps": stretches of the Security log it could not read (a read that was cut short, or that timed out). Each gap is also written to the audit log. The next scan still compares the directory itself. - Live Watch in "domain controllers" mode refuses to start until a scan has listed the DCs (before, it read this server's own log instead). - A domain account that is locked out now sees "Your Active Directory account is locked out" instead of "Incorrect username or password". - Scans with "Anonymize names" no longer feed Watch, Activity, sign-in failures or honey-account checks (their names are hashes). Fixed - Live Watch in Forwarded-events mode could miss events delivered late by Windows Event Forwarding (regression in 1.29.9). - Live Watch: when one read held more events than allowed, 1.29.9 claimed to read the cut-off part again; it skipped it. It is now recorded as a gap. - Live Watch could stop for good after a read timed out (each retry asked for a larger window). It now skips ahead and records a gap. Reads of several DCs get more time. - Live Watch saved its position before storing the alerts of a read; an error then lost those alerts. The position is now saved last. - An anonymized scan replaced the Watch baseline: the next scans raised "domain controller gone / new" and similar alerts for every object. - A collector section that failed (for example trusts or DCs) was read as "everything removed", then "everything new" on the next scan. - A run of failed scans could delete the last completed scan. Failed scans are now kept apart; the latest completed scan is never deleted. - Watch list with two or more severities selected showed nothing; finding search with spaces or Arabic text found nothing. - A scan started just as a scan worker finished could stay queued. - SIEM forwarding: an event that can never be sent (too large) no longer blocks every later event; nothing is sent while forwarding is switched off. - Collections are refused when the domain name or SID contains characters a real domain never has (they reach reports and scripts). The Guest account (A-008) script quotes the domain SID. HISN (حصن) v1.29.9 - Release notes November 2026 ===================================================================== Reliability release: Live Watch, SIEM forwarding and content updates. Each fix has a test. No change to checks or scores. What you may notice - Live Watch alert e-mails are no longer repeated. An alert already stored is not e-mailed again when a later poll re-reads the same window (Sigma matches, sign-in incidents, LDAP reconnaissance and Tier 0 changes). - Live Watch no longer skips a domain controller's events when one DC fails to answer, lags behind the others' clocks, or a read is cut short: the read position now follows the slowest source, and a failing DC holds the window open for up to 24 hours. - SIEM forwarding: alerts raised while the receiver is down are kept and sent when it comes back (up to the queue limit), instead of being dropped. "Send test" no longer interferes with the sender. - Deleting a domain now removes its activity, sign-in failure and watched-group records too. Fixed - Online content update only accepts vendor-signed packages, and the update index must carry the package's SHA-256. - A perpetual licence's maintenance check now covers every content version form (2027.5 and 2026.11.45 were never checked; the last number is a patch number, not a day). - Scan results sent to the SIEM: with two scans running at once, one domain's "new/returned findings" list could be overwritten by the other's and not forwarded. HISN (حصن) v1.29.8 - Release notes November 2026 ===================================================================== Bug-fix release from a full code review of 1.29.7. Each fix has a test. No change to checks, scores or licences. What you may notice - Scans of only some categories no longer close findings in the other categories. A finding is marked "fixed" only when its check ran and passed; a check that could not be judged (data not collected) keeps the finding's state. Before, these findings were closed and then reported as "returned" by the next full scan. - Scheduled scans and the nightly backup still start if the console was busy at the set minute (up to an hour late). Before, that day's run was skipped. - Scheduled scans only run for domains the licence covers. With a licence bound to some domains, the other domains are no longer scanned every night. - Honey accounts: "Download creation script" with an OU works. Watched-group search finds names with spaces or Arabic letters. Fixed - The console kept one database connection open for every browser connection since the service started. They are now closed when the connection ends. - Failed sign-ins (which need no account) could push the whole audit history out of the audit log. They are now kept apart, so they can only replace older failed sign-ins. - I-026 (LSA protection) fix script: the Set-ItemProperty line was part of a comment and did nothing. It is now a command (still with -WhatIf). - P-001 advice uses a neutral example account name. - The installer no longer packs the developer documents (docs folder, CLAUDE.md) into the program folder; a build check now refuses a payload that contains them. HISN (حصن) v1.29.7 - Release notes November 2026 ===================================================================== Security release. A follow-up code security scan of the 1.29.6 console found four more issues; all are fixed, each with a test. No change to checks, scores, findings or licences. What you may notice - Run scan: the "Target server" must be this domain's server, its FQDN or one of its domain controllers from the last scan. Any other host is refused, so the scan account password can never be sent to a server someone just typed in. - Viewers (Hisn-Viewers) no longer receive admin-only settings: detection exceptions, Sigma rules, SIEM and e-mail servers, and scan account names. Their screens are unchanged. Fixed - E-mail "Send test": a password typed into the form is always used exactly as typed. An encrypted value copied from a backup can no longer be decrypted through the test button. - Old-scan cleanup only deletes folders inside the data folder's scans directory. A restored database that points a scan folder elsewhere (for example with "..") is corrected during restore. HISN (حصن) v1.29.6 - Release notes November 2026 ===================================================================== Security release. An independent code security scan of 1.29.5 found 27 issues; all are fixed in this version, each with a regression test. No change to checks, scores, findings or licences. What you may notice - E-mail settings: if you change the SMTP server, port or account, type the password again (it is no longer reused for a new server). Signing in to an SMTP server now needs STARTTLS or SSL; with "None" Hisn refuses to send the password. The saved SMTP password is now stored protected (DPAPI) and old ones are converted at start. - Domains: if you change a domain's name, server or account, type the scan account password again. - Installer: if the data folder already exists and is owned by an account other than SYSTEM, Administrators or the installing admin, or is a link/junction, setup stops and says so. - Collector: user, group, computer and OU descriptions that look like they contain a password are saved as "[hidden: may contain a password]" with a short hash. Anonymised collections also hide autologon names and sign-in failure details. Fixed - Fix scripts, honey account scripts and attack-path scripts: names and descriptions containing typographic quotes (‘ ’ ‚ ‛) can no longer break out of a PowerShell string. All scripts use one quoting rule. - Backup restore only writes Hisn's own data (database, licence, branding, content, scans). Crafted names such as ./config.json, Config.json, tls/... or drive paths are skipped. - Excel export: text starting with "=" is stored as text, never as a formula. - Collector: GPO, logon-script and scheduled-task paths are only checked when they point at the domain or one of its DCs, so a planted path cannot make the collector connect to another server. - Sign-in: parallel password guesses are counted before the check, so the lockout cannot be raced; a local admin password change during a sign-in is no longer overwritten. - Console log: control characters in requests are escaped, so a request cannot forge log lines. - LDAP recon detection: a computer named like the scan account plus "$" no longer inherits the scan account's exemption. - Update station: output folders are limited to SYSTEM, Administrators and the running admin; the cached MSRC data is only reused when its SHA-256 matches; the downloader is found by its exact name. - SharpHound converter: the output file name is made safe and always stays in the output folder. HISN (حصن) v1.29.5 - Release notes November 2026 ===================================================================== Bug-fix release: report branding. - Logo and organization name now appear on every report. "Open report" showed the report saved when the scan ran, so a logo or name added in Settings afterwards never appeared on it. It is now built from the scan with the current Settings (cached, so it still opens instantly). - Scans started from the scan dialog with the "Organization name" field left blank no longer hide the name set in Settings. A blank name on a scan now means "use Settings"; a name typed in the dialog still overrides it for that scan. - Custom reports without a cover page now show the logo and name in a strip at the top (before, they appeared only on the cover). - Existing scans are fixed too: open or generate their reports again. HISN (حصن) v1.29.4 - Release notes November 2026 ===================================================================== Design-system and accessibility release (from the 1.29.3 audit). No change to scans, findings, licences or data. Readability - Dark mode: severity and state labels (Critical, High, Open, Fixed...) now have their own dark colours; before, they kept the light-mode colours and were hard to read. Every text colour now passes the WCAG 4.5:1 contrast minimum in both themes. - Light mode: High and Medium labels, the warning banner and grey hint text are darker and pass 4.5:1. - New theme button in the sidebar: Auto (follows Windows), Light, Dark. Keyboard and screen readers - Dialogs: focus moves into the dialog and stays there, Escape closes it, and focus returns to the button that opened it. - Findings and scans lists: rows open with Enter or Space. - The current page, selected filters, toasts, sign-in errors and every settings field are announced to screen readers. - The browser's own confirmation boxes are replaced by the console's dialog (licence removal, domain deletion, honey accounts, password audit, content rollback). Layout - On a phone the sidebar folds into a menu button; no page scrolls sideways any more. - On screens 900 pixels tall or less the sidebar scrolls, so the language and Sign out buttons are always reachable. - Audit log: changed settings show their names ("Read interval (seconds): 60 -> 30") instead of internal keys. Design system - One set of tokens for colour, type (10 sizes), spacing, radius and shadows; no colour or size is written by hand any more. 160 inline styles in the page scripts became shared classes. - New release check (tests/test_design_tokens.py): the build fails if a text colour drops under 4.5:1, a colour or size bypasses the tokens, or a page uses the browser's confirm box. HISN (حصن) v1.29.3 - Release notes November 2026 ===================================================================== Clean-up release - no change in behaviour. - All examples, placeholders, test data and notes now use neutral, fictional names (CORP, corp.example.com, tigris.local). No company, customer or test-lab names remain in the program, the user guide or the release notes. - The installer no longer reads settings from an old pre-1.12 registry location. - New release check: the build fails if any such name comes back. HISN (حصن) v1.29.2 - Release notes November 2026 ===================================================================== Live Watch under a gMSA (found on the lab, hardening plan B2). - With the service running as a gMSA in Event Log Readers, Live Watch and the connection test failed with "Could not retrieve information about the Security log ... unauthorized". Event Log Readers may read the log's EVENTS but not its INFORMATION (size, record count), which Get-WinEvent reads first. Hisn now falls back to reading the events directly (EventLogReader) when - and only when - Windows refuses with that message. Administrator and LocalSystem installs are unchanged. - Connection test: the Security-log check reads the way Live Watch does. - Lab tool: -Remove repeats the delete until AD has removed a large OU. - PowerShell tests: 38 (the fallback, and that other access errors are still reported). HISN (حصن) v1.29.1 - Release notes November 2026 ===================================================================== Fixes found on the lab while testing the gMSA option (hardening plan B2) and timing a 20,000-account domain (C1). gMSA service account - it never took effect before this release: - Setup wrote the account in WinSW 3 syntax (); the bundled WinSW 2.12 reads and and silently ignored it, so the service stayed LocalSystem while Setup said "ready". Fixed. - The rights on C:\ProgramData\Hisn were granted with a command whose errors were discarded; a name with a leading space (pasted into the field) was not found and nothing was granted - the service then died at start. The name is trimmed, and a failed grant now stops Setup with the reason. - The service wrapper's logs now go to C:\ProgramData\Hisn\logs (a gMSA can only read the program folder). - Setup waits until the old service registration is really gone, shows any registration error, and checks the account the service actually runs as before it says "ready". Collector 1.1.2: - Run without -Server (by hand, by a script), two replication-metadata reads prompted for a server and the run waited for the keyboard. The console always passes -Server, so scans were not affected. - Those reads now also use the scan account when one is set. - New PowerShell test: no cmdlet is ever left to prompt. User guide: - Requirements: memory for the collector, and a measured sizing table - 20,017 users / 5,001 computers / 557 groups collected in 6 minutes, 981 MB peak, analysis 5 s, 62 MB of data. Lab tools: no confirmation prompt per object; the measurement passes -Server as the console does. HISN (حصن) v1.29.0 - Release notes November 2026 ===================================================================== Hardening plan Phase C: security self-test, documentation, lab tools. Security fixes (found by the new self-test - details in docs\SECURITY-SELFTEST.md): - HIGH: some remediation / rollback script blocks placed AD names in quotes without escaping, used the wrong quoting, or put names in comments where a line break ended the comment. Someone who can create or rename an AD object could choose a name that runs code when an administrator runs the script - even with -WhatIf. Every name is now PowerShell-escaped (LDAP-escaped inside filters), names reaching any script have line breaks removed, and the header's domain name is neutralised. Tested on every generator with hostile names. - HIGH: the attack-path "remove from group" fix ran without -WhatIf. - HIGH: one silent TCP connection to port 8443 blocked every new visitor (the TLS handshake ran on the accepting thread). It now runs per connection with a 10-second limit. - MEDIUM: Content-Length: -1 was read without a size limit. - MEDIUM: the audit-log CSV export could carry spreadsheet formulas planted as a user name on the sign-in page; such cells are now text. - LOW: malformed or non-object JSON hung four routes for 30 s or caused a 500; errors from the HTTP layer lacked the security headers. Tests: - tests\test_security.py: 37 tests attack a running console - every route without a session, as a viewer and without the CSRF token; session fixation; headers; 22 path-traversal probes; hostile bodies; slow and silent clients; old TLS; licence tampering; audit CSV; and hostile directory names through reports, Excel and every script. Documentation: - docs\ARCHITECTURE.md: the current design (routes and gates, data, collection layout, scans, Live Watch, backup/restore, identity, tests). - docs\SECURITY-SELFTEST.md: what was tried, found and fixed, and what the self-test does not cover - a page for tender packs. Lab tools (not installed; in the source and Hisn-LabTools.zip): - tools\lab\New-HisnLabPopulation.ps1: LAB ONLY - 20,000 disabled users, 5,000 computer objects and 500 nested groups in one tagged OU; -WhatIf, typed confirmation, -Remove deletes only that OU. - tools\lab\Measure-HisnCollect.ps1: times the collector and analysis, peak memory, output size; prints the sizing-table row. HISN (حصن) v1.28.0 - Release notes November 2026 ===================================================================== Hardening plan B2 (gMSA recommended) and B3 (collector tests). gMSA - the recommended service identity: - Setup's Options page: the field is now "Run as gMSA (recommended)", with a short explanation. Blank still installs as LocalSystem. - Left blank, Setup writes C:\ProgramData\Hisn\Create-Hisn-gMSA.txt: the exact commands (KDS root key, New-ADServiceAccount for this server, Event Log Readers, Remote Management Users, Install/Test-ADServiceAccount) with this server's names filled in. Hisn never runs them itself. - User guide, section 6: "Run the service as a gMSA", including other domains/forests and moving to a new server. Collector 1.1.1: - Fix: when the user or computer query failed, users.json held [null] (PowerShell's @($null) is one element) and the whole scan was refused with "users[0] is not a record with a sid". A failed section is now an empty list and the scan reports the section that failed. Tests: - tests\ps\Run-HisnPsTests.ps1: 35 tests run the real collector against a fake in-memory domain and the Live Watch reader against fake event logs - layout, the streamed writer (0 / 1 / 251 records), Arabic text, failing sections, -Anonymize, attack-path data, paging, WinRM/RPC fallback, and that the scan password never stays in the environment. Any write command or unfaked AD cmdlet fails the run. No Pester, RSAT or network needed; safe on a DC. Build-HisnRelease.ps1 runs them first. - Static checks in the Python suite: BOM on non-ASCII scripts, no write commands in the collector, every AD cmdlet faked, balanced syntax. HISN (حصن) v1.27.0 - Release notes November 2026 ===================================================================== Restore from the web console. - Settings > Backup and restore: every backup has a Restore button. Type RESTORE to confirm; the console restarts, takes a safety copy of the current state (Hisn-Backup--