{
  "summary": "Adds a Go-native Suricata-compatible rule engine for the SWG's IDS/IPS layer, off by default: admins can author and import their own .rules-syntax content/header signatures directly on the Firewall page, alongside a curated abuse.ch URLhaus feed of pre-vetted rules that ship pinned to block regardless of the feed's own declared action. Header/SNI/IP/port rules are evaluated at CONNECT time in the same detector chain as existing JA4/JA3/DGA/typosquat matching; content, pcre, and http.*-buffer rules are evaluated against the request/response body and merged with DLP's own verdict. A pcre: pattern using backreferences or lookaround - constructs Go's native regex engine can't represent - now falls back to a second, backtracking-capable engine instead of being silently skipped. The device/threat map on the admin dashboard can now be embedded in an external dashboard or wallboard via a separate, token-authenticated public route - data is always aggregated to country granularity, with no device names, usernames, or exact coordinates ever exposed - and includes a blocked-country red-zone overlay. Inbound email inspection now recognizes a native \"Report spam\"/\"Report phishing\" action taken directly in Gmail's webmail UI or via IMAP, not just a forwarded copy."
}