This page groups three changelogs — the Web App, the API, and the Attack Vector. Use the section list to navigate:

  Web App changelog 

  API changelog 

  Attack Vector changelog 

 Web App changelog

v2.18

✨ New Features

• Event Output detailsA dedicated tab now displays the output of the commands executed by an event, so you can immediately assess what information an attacker would have obtained and how it could be exploited.
• Extended API automation 15 new endpoints are now available, covering Attack Vector renaming, System Target management, campaign archiving, event comments, and detection and reaction source management. The full list is given in the API changelog below.

🤖 Connectivity and Deployment

• SSH support for Windows targets  Windows System Targets can now be reached over SSH, a connection method that is simpler to set up and that reduces the false positives some EDRs raise on WMI and WinRM connections.
• Latest Attack Vector version required  Event execution now requires the Attack Vector to be running its latest version, ensuring every deployment benefits from the newest capabilities and the most up-to-date event list.
• HarfangLab — Enriched Security Events Data collected from the HarfangLab API is now more detailed: each Security Event lists the Rule Name, Level, Confidence, execution status (Detected, Blocked, etc.) and the detection date and time. The detected command is also displayed precisely.
• Gatewatcher — NDR Detection Details Data collected from the Gatewatcher API now enriches BlackNoise events detected by the NDR, listing the Rule Name, the Risk, the Engine used for detection, and the detection date and time.
• Wazuh — Enriched Detections Data collected from the Wazuh API is now more detailed: each detection lists the Rule Name and the detection date and time, along with the precise detected command.

🔧 Improvements & fixes

• IOC Display IOCs are now displayed in code format, and long IOC values are rendered correctly.
• System Target Creation The System Target creation button remains visible while a search is active, aligning its behavior with the Attack Vectors list.
• WMI Connection Error Message The message returned on a WMI connection failure has been reworded to better identify the cause.
• Email Template Design  All notification emails now use a new template whose layout makes the key information easier to locate and read at a glance.
• Detection Time Entry A detection time entered earlier than the event execution is now kept as entered, instead of defaulting to the event execution end time.

v2.17

 New Features

• Exploitation status on eventsCampaign events now display their exploit status, indicating whether the attack attempt was blocked or successfully exploited by an attacker.

 Connectivity and Deployment

• HTTPS certificate check toggleConnectors now include a switch to disable HTTPS certificate verification when querying target platforms, if required by the environment.

 Improvements & fixes

• Account creation emailsA login-credentials email is now sent by default when a new user account is created. Administrators can still opt to withhold it and share credentials through their own channel.
• Scenario builder - event list paginationThe event list in the scenario builder now paginates correctly.
• Activity timeline - API-created eventsTimeline entries created via the API now correctly display the associated user.
• Scenario builder - deprecated eventsDeprecated events can now be removed from a scenario in the scenario builder.

v2.16

 New Features

• Wazuh EDR ConnectorBlackNoise now integrates with Wazuh EDR, enabling detection correlation and validation directly within your existing Wazuh deployment.
• Event IOC DisplayThe detail view of each event now lists the commands executed during the attack, giving analysts immediate visibility into adversary actions.
• User Mentions in CommentsUsers can now be mentioned in event comments, enabling targeted notifications and clearer collaboration during investigation workflows.
• Simulation Stop EndpointA new API endpoint allows running simulations to be stopped programmatically, giving operators finer control over automation workflows.

 Connectivity and Deployment

• WinRM Protocol SupportWinRM is now available as a connection protocol for Windows targets, expanding deployment flexibility for agentless attack simulations.
• Attack Vector Last Connection DateThe attack vector detail page now displays the date of last connection, providing clearer visibility into asset availability.

 Improvements & fixes

• Campaign Visibility FilterCampaigns are now filtered to active status by default, keeping the view focused on ongoing work. Archived campaigns remain accessible via a dedicated filter.

v2.15

 New Features

• Extended API automationNew API endpoints now allow more actions to be triggered programmatically: managing simulations and exploiting results directly from your existing tools and workflows.
• More download traceability in the Activity LogEvidence and attack surface downloads are now recorded in the activity logs, providing full visibility into exports performed by users.
• Campaign description editingCampaign descriptions can now be edited after creation

 Connectivity and Deployment

• Attack Vector Update Progress TrackingA progress bar now accompanies the attack vector update process, providing clear, real-time visibility into its completion status.

 Improvements & fixes

• Network Simulation CreationThe selected attack vector is now correctly applied when creating a network simulation in 1-step mode.
• Info Modal — Event CountThe event counter displayed in the info modal now reflects accurate values.
• Default Reactions ListThe default reactions list now displays all expected values upon selection.

v2.14

 New Features

• Sekoia XDR connector BlackNoise now connects directly to Sekoia XDR, giving you instant access to alerts linked to your BlackNoise events. Correlating executed simulations with your detection data has never been more straightforward.
• Gatewatcher NDR connector A new Gatewatcher NDR connector brings the same seamless experience to your NDR alerts, surface relevant detection data alongside your BlackNoise events in a single view.
• Attack Surface Management Quickly visualize all information obtained about assets identified from scan events: IP addresses, system types, open port numbers, and service fingerprints are all available in a dedicated tab.

 Connectivity and Deployment

• Attack Vector upgrades from the web applicationAttack Vectors can now be upgraded directly from the web application, no need to execute system command anymore.

 Improvements & fixes

• Editable credentials on targetsLogin and password fields on targets can now be updated at any time from the Resources section, giving you more flexibility to manage your test environments.
• MITRE ATT&CK tactic filter in Scenario builderThe Scenario builder now includes a category selector based on MITRE ATT&CK tactics, making it easier to find and organize events by adversary technique.
• Time offset support for connectorsConnector data is now automatically adjusted to account for clock drift on Attack Vectors, ensuring timestamps stay accurate and consistent across all your data sources.
• Reliable Attack Vector status notificationsStatus change messages for Attack Vectors are now delivered reliably, backed by an improved WebSocket connection.
• Clearer error reporting for event executionError messages returned during event execution are now fully surfaced in the interface, so you always know exactly what happened and why.
• Evidence names displayed correctlyEvidence entries now consistently show their proper names instead of internal identifiers.
• Simulation notes sorted correctly in campaignsSimulation notes on the campaign page are now displayed in the expected order.

v2.13

 Connectivity and Deployment

• Added a new tab in the Attack Vector details view to run the diagnostic tool, making troubleshooting and health checks easier. This feature is compatible with Attack Vector version 1.4.3 or later.
• Attack Vectors can now be deleted directly from the web application, simplifying infrastructure management.

 Improvements

• End date for CANCELED events are now properly adjusted, ensuring more accurate execution tracking.
• The Attack Vector time offset is now applied to the simulation event end date, improving time consistency across the platform.
• Improved time display in PDF reports for better readability and accuracy.

 Bug Fixes

• The “Last password change” information is now correctly updated in both the Admin interface.
• The “Connectors” tab in the campaign details page now correctly displays its content, restoring full visibility of configured connectors.
• Selecting an Attack Vector during simulation creation now works smoothly without triggering a front-end error message, ensuring a seamless configuration process.

v2.12

 New Features

• Integration of a HarfangLab EDR connector to automate the collection of Security Events associated with BlackNoise events. This integration makes it easier to correlate executed simulations with detection data coming from the EDR.
• Detailed execution logs are now available for events. These logs provide full visibility into each event step, including detailed information about executed system commands.
• Campaigns can now be renamed, improving flexibility and campaign management.
• Added a visual indicator when a document is uploaded to the campaign shared workspace, making shared content easier to identify.

 Connectivity and Deployment

• When an Attack Vector is not synchronized via NTP, the platform now calculates the time offset against the reference clock (requires Attack Vector version 1.4.0).
• Improved handling of WebSocket disconnections, increasing connection stability and reliability.
• Added additional validation on the use of special characters in Attack Vector names to prevent configuration issues.

 Improvements from Fixes

• File downloads in the “Documents” section are fully operational again for all user profiles, restoring a seamless document-sharing experience.

v2.11

 New Features

• Scenario Builder is now available. This new feature lets you create fully custom attack scenarios by picking events from the platform library and arranging them in any order you choose, all in just a few clicks. Events are automatically filtered to match your selected scope, so building a scenario that fits your environment has never been easier.
• Integration of a security solution connectors capability (for EDR, NDR, XDR, SIEM) to automate the collection of detection data for each BlackNoise event.

 Connectivity and deployment

• The Attack Vector upgrade command is now available to all roles directly from the Attack Vector modal, and is no longer restricted to Administrators and Operators.

v2.10

v2.9

 New behaviours

• Events are now consistent across all simulations within a campaign: each new simulation automatically replicates the event list from the first one, ensuring better overall consistency, regardless of changes made to the scenarios used to build the campaign.
• Added a “Comment” field when creating each simulation to support better documentation and tracking.
• Improved the display at Step 2 of the campaign creation process when no scope needs to be defined, for improved clarity.

 Connectivity and deployment

• Upgrade process for Attack Vectors has been optimized for improved reliability and performance.

 Bug Fixes

• Network scope input has been enhanced with support for copy/paste of IP addresses separated by commas or spaces.
• The number of Attack Vectors displayed in the creation button is now fully aligned with company quotas.
• The default sorting in user settings is now set to ascending order across all application lists, providing a more intuitive navigation experience.

v2.8

 New Features

• New API EndpointYou can now edit detection and response information for an event: detection status, response status, source, date & time, etc.You can also list all detection sources and response configurations for your company.
• Subscription pageCentralized view of subscription details: enabled features and quotas.Accessible to accounts with the Admin role.

 Connectivity and deployment

• DNS and NTP support per attack vector
• You can specify a DNS and/or a NTP server when creating an attack vector.
• The generated deployment command adapts automatically to include those settings so deployment remains a one-step operation.
• DNS and NTP fields are optional

 Bug Fixes

• Accurate event filtering: The events table now correctly reflects the filtered results.
• Correct Attack Vector count display: The number of attack vectors shown at the bottom of the page now matches the actual data.
• Improved notifications: Pagination has been fixed, and the notification link now navigates properly.
• Reliable comment indicators: The Execution page now correctly displays comment indicators, even for simulations with multiple targets.
• Consistent campaign scheduling: Campaigns now respect the user’s configured timezone instead of defaulting to UTC.
• Enhanced user management: Application users are now sorted by first name by default for easier navigation.

v2.7

 New Features

• New API EndpointYou can now create simulations directly linked to specific campaigns.
• Campaign Audit ImprovementsThe campaign timeline now automatically adapts to each simulation, providing clearer and more relevant insights.

 Bug Fixes

• Fixed an issue where Command and Control events were missing in the MITRE ATT&CK matrix view.
• Resolved a problem that prevented users from downloading all evidence from a simulation.
• Fixed a display issue where restarted events did not appear in the timeline.
• Corrected a bug where newly added scenarios did not show the “NEW” label.
• Restored automatic filters on the events page.

v2.6

 API access

• Generate API token for a full programmatic control of BlackNoise
• Resources visualisation (attack vectors, system targets, scenarios)
• Attack campaign execution
• Detection and reaction result retrieval / KPI.

 Attack simulations

• PDF simulation certificate
• Generate a PDF summary for each simulation. Use it for test reporting, sharing with stakeholders, and compliance evidence.
• Scoring scale changed
• Results now use a letter grading scale E → A+ to simplify interpretation and benchmarking across tests.
• Event timing control
• Inter-event delay is now freely configurable between 0 (continuous sequencing) and 60 minutes.
• Default delay set to 1 minute to improve detection-data analysis.
• Evidence file types
• .eml added to allowed file types for uploaded evidence.

 Connectivity and deployment

• Richer connection diagnostics
• Target system connection tests return expanded diagnostic fields to speed root-cause identification on failures (authentication/traffic blocked/service not active, etc.).
• Proxy support per attack vector
• You can specify a proxy when creating an attack vector.
• The generated deployment command adapts automatically to include proxy settings so deployment remains a one-step operation.

 Improvement of the app's user experience

• Onboarding tutorial
• First-login guided tutorial covering core workflows and configuration best practices.

v2.5

 New Features

• Manage Attack Vector updates directly from the application You can now handle your Attack Vector updates directly within the app. Requires Attack Vector version 1.3.6 or higher.
• Easier simulation replays There’s no longer a need to manually set a campaign to “Calibrated.” Starting a new simulation now automatically closes the previous one for a smoother workflow.

 Design Improvements

• Improved scenario display Scenarios are now better organized and clearly grouped by module: Network, System, and Cloud, making it easier to navigate and understand the targeted environments.

v2.4

 Track Progress Between Simulations

 New Global Dashboard

• Average campaign score
• Score evolution over time
• Improved detection and reaction efficiency

 Redesigned Campaign Display

• Smoother summary page
• Detailed list of events
• Dedicated tab with MITRE ATT&CK matrix representation of events

 New “Compliance” Scenario Format

 Improved Matrix View in Threat Library

 Updated to MITRE ATT&CK v17

v2.3

 Attack Scenarios

 Stop & Relaunch of Simulations

• Ability to interrupt an event in progress.
• Option to resume it or skip directly to the next event.

 Events – More Evidence Slots

 Improved Visualization

 Attack Vector

v2.2

 New "Admin" Profile

• Create, delete, and manage user accounts
• Reset passwords
• Disable 2FA

 Target System Connection Test

• Automatically tests connections before executing events, ensuring seamless execution. This is enabled by default during the campaign creation process to ensure smooth execution.

 Attack Vector Enhancements

• Attack Vector names now appear alongside IP addresses.
• Users can sort and search Attack Vectors by version.

 Improved Visualization

• New "Classic" theme using red, yellow, and green for better readability.
• Users can modify the default reaction list.

 MITRE ATT&CK Techniques Association

• Events can now be linked to multiple MITRE ATT&CK techniques for deeper analysis.

 Archived Campaigns & Navigation Improvements

• Archived campaigns can be excluded from statistics.
• Clicking on a "target" value applies an automatic filter in event lists.

v2.1.1

• Adding Suricata rules to strengthen your detection tools
• Ability to rename a Target system
• Allow uploading files in .webp format
• Added a filter in the list of campaigns that have an associated AV
• Added a filter in the list of campaigns that are bookmarked
• Display of the scenario with which the campaign was created
• Display of the version and IP address of the Attack Vectors
• Display of the deployment command of the Attack Vectors
• Choice of the display mode for hours from the profile page: 24h or AM/PM

v2.1.0

 This major update includes many new features. The most important are:

• Access to the BlackNoise scenario database (see "Threat Library")
• Deployment of Attack Vectors software in Docker format (see "Resources")
• Creation of Target Systems to set up the targets for OS commands events (see "Resources")
• Creation and setup of attack simulation campaigns based on scenarios
• Replay of campaign events as control tests to regularly check the progress of detection capabilities
• Improvement of the event details page design for better information use
• Redesign of app navigation

v1.4.12

• General Terms Revision
• Standardization of the "Type" filter order for events
• Adjustment of the "Temporal Distribution of Campaigns" graph on the Overview page
• Reduced size of cards in the Library

v1.4.11

• Modification of TTD and TTR for events in "Logged" and "Undetected" status

v1.4.10

• Display the BlackNoise events library
• Enable 1-click export of all proofs for a campaign
• Enable 1-click export of all event proofs
• Add a notification when a campaign is created or its status changes
• Add notification for the start or end of a control test
• Added notification for document submission
• Standardize campaign filters with event list filters
• Revamp the event list

v1.4.9

• Adjust "campaign list" view
• Adjust campaign details module
• Adjust Synthesis page
• Change number of events displayed on Risk Analysis page
• Replace "Detected events" with "Alerted and Logged events"
• Adjust captions on Overview page
• Adjust captions on Campaigns > Synthesis page
• Modify captions on Risk Analysis page
• Modify definition of statuses on event details page
• Add information note for Sigma rules
• Replace "Response efficiency" with "Reaction efficiency"

v1.4.8

• MTTD (Mean Time To Detect) and MTTR (Mean Time to Respond) are now part of Cyber Risks & Overview
• Dashboard has been replaced by Cyber Risks & Overview views
• "Detection compliance based on MITRE ATT&CK" section of Overview has been adjusted

v.1.4.5

• Change Score evolution graph
• Update switch modal for Calibrated
• Adjust "Attack campaign statistics" section of Overview

v1.4.4

• Get notified about new campaign activities (Comment and Killswitch)
• Add a Reports module for campaigns
• Create an "Event comment" category for all comment-related activities in the Timeline

v1.4.3

• Add Sigma rules for detecting system events
• Remove completion rate from event details
• Change "criticality" to "severity" for events
• Enable direct navigation between events (Previous / Next)
• Display event end date as well as start date
• Improve campaign tabs

v1.4.0

• Campaigns can be bookmarked (pinned)
• "Event start" info added to event details page
• Addition of a filter on the people behind actions in the Timeline
• Adaptation of the score description from the Synthesis page
• Replaced 'Decoy' with 'Deceptive' as the title of the detection source category

v1.3.1

• Notify all client users when the Kill Switch is activated
• Set automatic logout after 12 hours of inactivity
• Allow users to customize avatars by uploading an image
• Add absolute value view for MITRE ATT&CK graph in addition to percentage view
• Enhance the display of IOCs in the event details page

v1.3

• Add upload capabilities for detection and reaction proofs, which can be used to validate detection and/or reaction. Multiple proofs can be applied simultaneously to different events.
• Introduce a "comments" section for events to facilitate participant discussions about the event and its detection.
• Customize detection sources and applicable reactions for events.
• Make visual modifications to the Campaign Synthesis page.
• Automatically select events from the graph legends on the Synthesis page.
• Enhance available filters (IOC, comments, evidence).
• Export timeline in CSV format.
• Display excluded IP addresses on the campaign details page.
• Make visual changes to the global dashboard.
• Display dates and times according to local OS settings or UTC.
• Add email as an alternative method for receiving the OTP code for the 2FA.

v1.2

• Score calculation to assess detection and cyber response effectiveness for each campaign
• Configure of 2-factor authentication using the mobile app "authenticator"
• Timeline of campaign events to track simulations in chronological order and to identify SOC actions
• Add global Dashboard with an overview of results from all campaigns
• Multi-selection of events to simultaneously edit information
• Activate Kill switch from the app to halt simulations if necessary

v1.1.3.2

• Ability to set a date for each event
• Option to select multiple "Detection Sources" for each event
• Ability to choose multiple "Reactions" for each event
• Improve design of the event details sheet (better visibility of information, direct copying of field values, addition of a completion rate for each event based on the provided information)
• Inclusion of search fields in the list of campaigns and events
• Enhanced ordering of lists
• New design for the campaign's details

v1.1.3

• Export events to CSV
• Redesign visuals for the list of campaigns, events, forms, and graphs
• Add pagination for the list of campaigns
• Add search function to the list of events
• Incorporate filters into the list of events
• Include a "Comments" field for each event
• Add an "IOC" field for each event
• Provide access to Terms of Service (TOS) from the login page

v1.1

• Include a detailed view for events to access all technical information about the event, such as the description, source, target, link to MITRE ATT&CK tactic and technique, IOC, detection status, detection source, reaction, and reaction date.

v1.0

• List of simulated company attack campaigns
• List of events in each attack simulation campaign (ID, event name, date & time, source IP, target)
• Ability to report detected events
• Ability to report response to detected events
• Campaign summary page with key indicators and graphs
• Campaign overview: detection rate, detection sources, event detection by severity
• Distribution of event detection by main attack phases
• Distribution of event detection by attack phases from MITRE ATT&CK

 API changelog

v2.18

v2.16

v2.15

v2.8

v2.7

v2.6

 Attack Vector changelog

Build 1.4.13

• Support for passwords containing the special character “<” when connecting to targets
• Updating software packages and dependencies

Build 1.4.11

• A progress bar now accompanies the attack vector update process, providing clear, real-time visibility into its completion status.
• Default DNS settings changed for on-premise deployment

Build 1.4.10

• Upgrade from the web application. Attack Vectors can now be upgraded directly from the web application, without needed to execute system command.
• Faster network scan events. Execution time for network scan events has been optimized, reducing overall simulation duration.
• Clearer error reporting. Errors returned during event execution are now fully surfaced, giving better visibility into what happened.

Build 1.4.3

• Addition of a diagnostic tool, which can be run from the web app, making troubleshooting and health checks easier
• Minor fixes

Build 1.4.0

• Account for time offset when an Attack Vector is not synchronized via NTP.
• Improved management of WebSocket disconnections, enhancing connection stability and reliability.

Build 1.3.10

• Enhancement of the Attack Vector update feature for the Superadmin and Operator profiles within the web application.
• This version is required starting from version 2.10 of the web app to run events correctly

Build 1.3.8

• On-premise compatibility improvement.

Build 1.3.6

• Pick & Go operation. The Attack Vector retrieves from the BlackNoise stack the event code required to run the simulation.

Build 1.3.5

• Improvement of special characters entered in System Targets' passwords.

Build 1.3.4

• Added ability to configure an HTTP proxy.