Kurahi 2.4.0

Also available in Japanese.

Kurahi 2.4.0 adds Kurahi Guardian to Kurahi Core, so every edition has it. Proven engines and deterministic checks find problems, an agent explains them in Japanese or English, every finding becomes an incident case with signed evidence, and people decide what to do. Kurahi is built by the KODA SōKEN team. The complete list of changes is in the changelog.

With 2.4.0 you can:

• Protect the company’s file shares from ransomware. The shield that has guarded Kurahi’s own folders since 2.0 now watches the shares you list; a trip stops every agent and opens a case.
• Scan the shares every night. Incremental scans through ClamAV, Microsoft Defender or YARA. Infected files are kept as hashed quarantine copies; Kurahi never deletes files.
• Know that backups can be restored. Nightly checks of backup age and a real test restore, plus secrets left in files, unexpected open ports, Kurahi’s own integrity and expiring sign-ins.
• Handle every finding as a case. IT security reviews within 4 hours; urgent cases also go to management. No case may say a threat was removed or a system restored before a person confirms.
• Feed your SIEM and follow Japanese advisories. Syslog export (RFC 5424 or CEF), JPCERT/CC and IPA advisories matched to your products, and Microsoft Defender alerts.

See Kurahi Guardian for configuration and details.

What is new

Kurahi Guardian

• guardian in the configuration: shares, scan (engine, limits, YARA rules, quarantine), posture (backups, secret scan roots, allowed ports, credential warning days), siem and advisories. Every path must be absolute.
• Engine checks guardian_backup, guardian_restore_test, guardian_secrets, guardian_ports, guardian_integrity, guardian_credentials and guardian_scan. Missing configuration, a disabled Guardian, a timeout or an unreadable result is ESCALATE, never OK.
• The Security — Kurahi Guardian pack (core-guardian): a Security incidents queue, evidence and wording checks, a severity route, and the nightly routines guardian-posture and guardian-shares at L1. When a check escalates and no case cites it, Kurahi files the case itself.
• Tools guardian_advisories (JPCERT/CC, IPA) and m365_security_alerts (Microsoft 365 connector option security.alerts, read only).

Autopilot

• Work items filed by Autopilot carry their priority in source.fields, so routes can use it.
• Engine check output is always one line per fact, so a file name cannot add a verdict line.

Kurahi Desktop

• Desktop 0.5.0 is unchanged and works with 2.4.0; its installers are attached to this release.

Upgrade from 2.3.0

kurahi update (or install.sh / install.ps1 with --version 2.4.0) installs 2.4.0 as usual; see Updating. A 2.3.0 configuration loads unchanged; Guardian does nothing until you configure guardian. To use Defender alerts, turn on security.alerts in the Microsoft 365 connector; it requests the SecurityAlert.Read.All permission.

Roll back

install.sh --version 2.3.0 (Windows: install.ps1 -Version 2.3.0) installs 2.3.0 again; see Updating. Before you start 2.3.0:

• Remove guardian from the configuration file: 2.3.0 does not accept keys it does not know.
• Pause Projects created from the core-guardian pack: 2.3.0 does not know the guardian_* checks and refuses their routines file. Cases already filed stay in the queue.
• Turn off security.alerts in the Microsoft 365 connector.

Notes

• Guardian complements an EDR; it is not an EDR or a certified antivirus.
• Kurahi is self-hosted: your servers and any model provider you choose are separate from Kurahi.
• Checksums for every asset are in SHA256SUMS.txt and SHA256SUMS-desktop.txt.