Roadmap 2026 (DRAFT)

[berggren]

[DRAFT] OpenRelik Roadmap 2026

Assisted Analysis

• Integrate AI agents to automate complex investigation steps, providing dynamic, contextual insights into forensic data and proactively run investigations with agents that answer specific forensic questions based on collected evidence.
• Flexible AI Configuration. Support granular control over AI models and parameters on a per-feature basis, ensuring the right model is used for each task (e.g., faster models for triage, powerful models for deep analysis).
• Expand OpenRelik MCP server to support third party integrations and provide more tools.

Storage & Artifact Management

• Flexible storage provider support. Expand beyond a single storage solution to support mapping read-only forensic artifacts from external NAS/SAN systems, improving compatibility for common DFIR environments.
• Disk image file browser. Introduces a Virtual File System (VFS) file browser for disk images, offering an interface for artifact navigation and analysis without full image mounting.
• Exporter workers. Automate the export of investigation results (reports, extracted files) to external services like GCS for long-term storage or automation hand-off.

Workflows

• Support Celery Chord patterns. This includes enabling a group of parallel tasks to execute concurrently, followed by a callback task that synchronizes their completion and aggregates all output files generated by the group for further processing.
• Integrate capabilities for using external data sources as direct input files. Develop a plugin/worker system for OpenRelik to ingest files seamlessly from external services like Google Cloud Storage (GCS) and other cloud providers. This approach will ensure a clean separation of concerns, improve dependency management, and allow for flexible data intake from different sources.
• Implement a mechanism to establish and maintain a shared context for all tasks within a given workflow. This shared context will facilitate the exchange of common data and metadata across tasks, reducing redundancy and improving data consistency throughout the workflow execution.

User Interface

• New Command-Line interface (CLI) Client. Introduce a robust CLI for seamless command-line operations, enabling automation and scripting capabilities.
• Web UI administration area. A dedicated administration section within the web user interface for selected system-wide configurations and management.
• Investigation view with assisted analysis using LLM based agents.

Operational Maturity & Quality

• Mature Kubernetes deployment. Simplify deployment and scaling to improve OpenRelik's reliability and ease of operation.
• Extended OpenTelemetry support. Expand metrics, tracing, and logging for insights into application performance and worker behavior, instrumental for effective debugging and optimization.
• New Integration/E2E testing pipeline. Build a robust pipeline for stability and quality across all core features, providing users with greater confidence in new releases.

Community & Contributor Growth

• Continuous worker updates. Ensure our core analysis workers are consistently updated, secure, and performant to maintain data integrity and efficiency.
• Increased community presence & support. Actively engage with users and contributors through expanded channels, comprehensive documentation, and community events to foster growth and align the project with real-world forensic needs.

[AlexeyKTS]

Hello,

Thank you for amazing work!
Is there any plans for SAML integration to be able integrate with EntraID?

[berggren]

Hi, no we do not have any current plans for SAML integration. The system is setup to easily plug in any authn provider. Take a look in the openrelik-server repo, under src/auth