Repository Issue Activity (beta)

#1925 [bug]

#1923 Improve `sort-csv` performance

#1915 -T, --visualize-timeline panics with a usize underflow on terminals 28-44 columns wide

#1906 Combine csv-timeline and json-timeline into a single dfir-timeline command

#1520 [bug] `ComplexData` fields are not extracted correctly(`csv-timeline`/`json-timeline`/`search`)

#1046 `-c` isn't working with `pivot-keywords-list`

#1613 Decode up to 2 times with `extract-base64`

#1825 [bug] -G with a custom rules config dir (-c) ignores its geoip_field_mapping.yaml (lookup is missing the .yaml extension)

#1820 [bug] Splunk-JSON fallback timestamp parse discards the UTC offset, skewing First/Last Timestamp in log-metrics

#1817 [bug] eid-metrics: u16 underflow in Event column width calculation on terminals narrower than 55 columns

#1332 aarch64 musl binary can't run

#1816 [bug] "Cannot open file" error shows the literal placeholder `{path}` instead of the file path in `read_jsonl_to_value` / `read_json_to_value`

#1811 [bug] count rules can emit an AggResult whose events span longer than the rule's timeframe (unchecked add_data in judge_timeframe)

#1810 [bug] temporal_ordered correlation does not enforce event order beyond the first rule (no-op `last_base = base;` in detect_within_timeframe)

#1894 [refactor] Reorganize DefaultMatcher pipe-modifiers into per-category traits (string/numeric/encoding/fieldref/cidr)

#1861 [refactor] Normalize DefaultMatcher pipe-modifiers into a MatchPlan; split matchers.rs

#1845 [refactor] Replace hand-rolled JSON serialization (emoji sentinels + csv::Writer text sink) with serde_json

#1892 logon-summary: also count RDP logons from RemoteConnectionManager 1149 and LocalSessionManager 25

#1045 Separate the contents of src/detections/rule/mod.rs into modules

#1888 Support additional PowerShell event IDs (4100, 4102, 403, 600) in extract-base64

#1886 Support additional PowerShell event IDs in extract-base64

#1882 Add first/last timestamp columns to logon-summary output

#1868 [refactor] Retire RwLock<Option<T>> global mutable state in favor of explicit threading

#1866 [refactor] De-duplicate repeated clap args via #[clap(flatten)]

#1864 [refactor] Extract a shared detection-batch helper to de-duplicate the main.rs batch loops