Skip to content

Releases: OpenCTI-Platform/opencti

Version 6.9.8

16 Jan 08:56
@Filigran-Automation Filigran-Automation
6.9.8
8e2542f
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.8 Latest
Latest

Enhancements:

  • #6669 Ability to remove labels using automation/playbook

Bug Fixes:

  • #14025 Issue loading a report in Firefox browser in both Linux & Android
  • #13999 'import from hub' for dashboards is not working
  • #13996 "Update indexing fail” on CSV Feed update
  • #13683 Using date ranges in custom dashboard causes a crash

Pull Requests:

Full Changelog: 6.9.7...6.9.8

Contributors

renovate, Kroustille, and 6 other contributors
Assets 4
Loading

Version 6.9.7

12 Jan 14:44
@Filigran-Automation Filigran-Automation
6.9.7
97ca75e
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.7

Enhancements:

  • #13990 Implement new inference rules
  • #13975 Support multiple files upload at creation of entities
  • #13971 [client] Upload file at creation of entities instead of after the creation
  • #13944 [client] Add support of file download during import process
  • #11383 Create inference rule on attribution
  • #10505 [Rules Engine] If Report contains IP, and IP belongs to ASN then Report contains ASN

Bug Fixes:

  • #13940 Unable to add personal notifiers
  • #13933 Redirect the learn more of the OCTI demo banner to the Hub public trial page
  • #13901 Users add relations in orga admin context
  • #13897 Status renaming is not taken into account
  • #13888 Form Intakes cannot be launched when using "Toggle" field type on Malware is_family
  • #13818 AI Insights returns text in Markdown format instead of HTML.
  • #13792 Campaigns do not display Security Coverage Icons if there is an Associated Security Coverage
  • #13753 Simple Mailer {"variableName":"escape"} Error
  • #13624 Channel Entity Does Not Display Channel Type in GUI
  • #13610 Domain import fails when using “domain name” in CSV Mapper
  • #13058 Generated PDFs of RSS Feed For The Record Are Not Properly Created
  • #12445 "Interval" for the bookmark widget serves no purpose
  • #11800 GraphQL internal server error

Pull Requests:

Full Changelog: 6.9.6...6.9.7

Contributors

SamuelHassine, renovate, and 3 other contributors
Loading

Version 6.9.6

07 Jan 16:25
@Filigran-Automation Filigran-Automation
6.9.6
40b1334
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.6

Enhancements:

  • #13918 Support re-ordering of fields in form intakes
  • #13913 In Form Intakes, allow creation on the fly of entities in lookup
  • #13912 Add support for files in playbook container wrapper
  • #13911 Set form intakes to full width in import dialog and fix background in dark mode
  • #13893 [FEATURE] Resolve x_mitre_id from attack pattern name
  • #13848 [Taxii feeds] - Ability to import/export taxii feeds
  • #13268 Support automatic defanging/de-sanitization of observables in Form Intakes
  • #10183 Add a limit on number of sessions a user can have

Bug Fixes:

  • #13908 Unbounded buffering on SSE responses can cause OOM with slow clients
  • #13880 Playbooks and live triggers are not working after modifying a label
  • #13837 Knowledge Graph widget includes Has Label meta-relations
  • #13810 Tooltip on AI configuration is not correct in CE
  • #13604 When using open vocabulary in form intake, form cannot be validated
  • #13246 Relationships representative not displayed in Indicator Knowledge
  • #12510 FINTEL Template Preview Does Not Update if Changes are Made

Pull Requests:

New Contributors:

Full Changelog: 6.9.5...6.9.6

Contributors

richard-julien, xfournet, and 11 other contributors
Loading

Version 6.9.5

04 Jan 21:42
@Filigran-Automation Filigran-Automation
6.9.5
be4ab13
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.5

Enhancements:

  • #13840 Improve license management supporting official OIDs and grace period
  • #13725 Document prometheus exposed metrics

Bug Fixes:

  • #13856 [Playbook] Manual Playbook trigger ignores Playbook filters
  • #13826 Users cache is not refreshed when changing some group attributes
  • #13822 .csv export fails
  • #13811 Layout on history tab is broken
  • #13471 x_content_parse_exception on getAuthorizedMembers
  • #12320 Unable to Export Finished Intelligence if Content Contains Images
  • #11811 Setting default dashboard for a group does not apply

Pull Requests:

Full Changelog: 6.9.4...6.9.5

Contributors

richard-julien, xfournet, and 7 other contributors
Loading

Version 6.9.4

23 Dec 17:37
@Filigran-Automation Filigran-Automation
6.9.4
c189d85
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.4

Enhancements:

  • #13762 Upsert 'created' field under condition
  • #13254 OpenCTI manager live listening after restart lead to missing events

Bug Fixes:

  • #13785 Starts_with error in webhooks notifiers
  • #13070 filigran-chatbot dependency is downloaded from GitHub, preventing build in air-gapped CI
  • #13069 Connector manifest download from GitHub prevent build in air-gapped CI

Pull Requests:

Full Changelog: 6.9.3...6.9.4

Contributors

xfournet, SamuelHassine, and 4 other contributors
Loading

Version 6.9.3

19 Dec 16:34
@Filigran-Automation Filigran-Automation
6.9.3
f3cdf2d
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.3

Bug Fixes:

  • #13744 Import data dialog randomly reverts back to 1st Import mode step
  • #13709 Some file can have markings no longer existing in the platform

Pull Requests:

Full Changelog: 6.9.2...6.9.3

Contributors

richard-julien, renovate, and 7 other contributors
Loading

Version 6.9.2

17 Dec 15:35
@Filigran-Automation Filigran-Automation
6.9.2
eda32ac
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.2

Bug Fixes:

  • #13641 Array.isArray() function shall not be forbidden in Platform notifier
  • #8928 [CI] Drone build is failing on release branch because client-python is clone from master instead of release branch

Pull Requests:

Full Changelog: 6.9.1...6.9.2

Contributors

aHenryJard and Archidoit
Loading

Version 6.9.1

16 Dec 15:22
@Filigran-Automation Filigran-Automation
6.9.1
899d043
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.1

Enhancements:

  • #13659 [client] Ability to configure connectors to automatically create their associated service account
  • #13626 Resolve creator in the logs

Bug Fixes:

  • #13696 Some filters can be broken on old ES mappings
  • #13690 Exclusion decay rule: error when creating an indicator matching an exclusion decay rule in draft
  • #13688 Toolbar disapeared from container's entity/observable tabs
  • #13681 Playbook - Replace Does not work
  • #13675 In form intakes, observable syntax verification is not working
  • #13656 SSH key: key type does not fetch the key type open vocab
  • #13637 A user with manage creds but no org can login in platforms with Org segregation
  • #13614 [ci] backend check ts and lint are missing in github actions
  • #13301 Security Coverage is not displayed succesfully
  • #13280 Technical error on correlation view
  • #13033 [XTM-Composer] The composer tries to connect to OpenCTI for some time, then get stuck and does not retry
  • #12494 Malformed IPs with leading zeros can be created
  • #12078 External Reference URL regex issue with ending /
  • #11064 Playbooks: Promote Observable to Indicator - No File Type

Pull Requests:

New Contributors:

Full Changelog: 6.9.0...6.9.1

Contributors

richard-julien, jbanety, and 16 other contributors
Loading

Version 6.9.0

12 Dec 09:19
@Filigran-Automation Filigran-Automation
6.9.0
301aff5
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.9.0

Dear community, we're excited to announce the launch of OpenCTI 6.9.0! 🥳

This release focuses on solving key pain points and unlocking new use cases:

  • Make Priority Intelligence Requirements actionable
  • CTI-driven assessment by integrating OpenCTI & OpenAEV
  • Draft Authorize members, to protect from unwanted modification or approval
  • Avoid some IOC to decay by introducing Decay Exclusion Rules
  • Framework to import data in the platform via Form Intake
  • UI & UX improvements
  • Many other improvements (new capa for playbooks, pattern matching for IOC…)
  • New Integrations/Connectors

🌟 Make Priority Intelligence Requirements actionable (EE)

  • A new Threat Map widget in PIRs provides instant visual insight into your highest-priority threats, enabling faster threat assessment and prioritization.
  • Priority Intelligence Requirements are now actionable within playbooks through intelligent filtering based on identified threats and scores. This enhancement transforms PIRs from passive threat awareness into actionable automation.
    • Trigger enrichment and processing workflows upon threat detection
    • Automatically initiate actions based on PIR threat scores
    • Selective processing of entities (indicators, vulnerabilities, etc.) linked to specific PIR threats

This allows teams to move beyond static threat lists and automatically respond to prioritized threats. Playbooks now execute targeted actions on the threats that matter most to your organization, reducing noise and accelerating response times to high-priority threats.

🤖 CTI driven assessment by integrating OpenCTI & OpenAEV (CE)

Security assessments can now be initiated from threat intelligence in OpenCTI, executed as simulations in OpenAEV, and results automatically imported back into OpenCTI as actionable gap analyses, within a new entity type Security coverage. Additionally, the creation and generation of security coverages can now be fully automated through our playbook engine. This capability, combined with the ability to trigger playbooks based on PIR events, enables you to automatically test your defense posture against threats identified as relevant for your organization.

This first implementation lays the foundation for transforming security assessments from manual processes into automated, threat-driven continuous validation

See details in our documentation.

💡 Draft Authorize members, to protect from unwanted modification or approval & Service Account bypass (CE)

To get an approval workflow for draft, the first step has been for us to enable Authorize Members on Drafts.

This way, when creating a draft manually or via file upload, you will be able to define authorized members at draft creation. This will ensure no user will be able to validate your draft on your behalf or even modify it without your consent.

This change required us to introduce another related change: Service Account now bypasses Authorize Members. The rationale behind this behavior is that Service Accounts should be able to enrich observables within a Draft, even if the draft has some Authorize Members enabled. To be clear: even if Service Accounts are not added as Authorized Members, they will get the Edit permission on the entity (draft, containers). This bypass is a default behavior that cannot be changed.

👤 Avoid some IOC to decay by introducing Decay Exclusion Rules (CE)

Some IOCs should never expire: for instance, Yara rules (or any detection rules) should never be revoked, to avoid having any tools like your SIEM, XDR, EDR… failing to detect a malicious IOC.

This is the purpose of Decay Exclusion Rules: you can filter on some IOC attributes to avoid having the matching IOCs fall under a decay rule. Ultimately, it prevents your IOCs from being automatically revoked.

Please be careful with the decay exclusion rules:

  • Decay exclusion rules are always first against a decay rule: if an IOC matches both a Decay rule & a Decay Exclusion rule, the decay exclusion will apply.
  • An IOC that is currently matching a decay rule, will fall under a decay exclusion rule at upsert if the upsert matches the filters applied the decay exclusion rule.
  • It will not be possible for an IOC under a decay exclusion rule to be changed so that a decay rule is applied.

This feature should also help you if you use sources that also manage the lifecycle of your IOCs to avoid having 2 automated lifecycle management applied to your IOCs.

See details in our documentation.

🛡️ Framework to import data in the platform via Form Intake (CE)

Creating data in the platform can be a complex task, especially because:

  • Not all users are STIX experts.
  • Administrators need a way to enforce data collection consistently.

As a result, we’re proud to introduce the Form Intake, to streamline the collection of threat intelligence data from external sources and stakeholders through structured forms.

Form intakes allow Administrators to define a form to specify which entities should be created and their needed mandatory fields. Also, Administrators can decide to automatically create relationships between entities created via the form and to create them as a draft or not. Additionally, the administrator can also label the entity or a specific field with a non-STIX label: this helps users not familiar with the platform and/or STIX to easily enter information in the platform.

This feature has proven (since available from 6.8.X) to be useful in the FIMI context, sharing communities such as ISACs or even Incident reporting.

Please provide as much feedback as possible on this feature, which should help you consolidate your database with consistent data.

🎨 UI & UX improvements (CE)

We keep working on the UI & UX part to provide a better experience to users.

  • Improvement of the bulk search module to make it more useful and actionable, by allowing differentiated management of found entities (knowns) and not found entities (unknowns). Known entities now support bulk operations, and all unknown entities can be created simultaneously.
  • The create Relationship floating action button has been replaced on all entity tabs across the platform. You can now create relationships from any tab using the button located next to the Update button.
  • Custom themes are now available. Organizations can now align the platform’s visual design with their corporate branding guidelines.
  • The Composer catalog now adapts seamlessly to your screen size, providing a better experience on any device.
  • Open files in another tab in draft: when opening a file in a draft, it will open another tab, which should simplify usage of the app.
  • Clarify the Add behavior on Authorized Members: the “+” to add authorized members was confusing. Therefore, a proper button ADD has been introduced instead to clarify the behavior.

💡 Many other improvements (new capa for playbooks, pattern matching for IOC…)

  • New observable to model SSH keys (CE): a new observable type, SSH key, has been introduced to help the modelization of SSH keys.

  • Email notifier improvements (CE): In the current implementation of our platform's mailer notifier, the content is generated in HTML format. However, the description field of an entity is formatted in Markdown by default. We introduce a solution for converting Markdown-formatted content to HTML to ensure consistency and proper rendering in the mail notifications.

  • Pattern matching filter (CE/EE): now also available for indicators in playbook, Live streams, CSV Feeds, and TAXII Collection.

  • Composer configuration (EE): for configuring a global HTTP/HTTPS proxy for connector network connectivity.

  • Change the capability linked to playbooks (EE): Playbook capability has been split into two capabilities:

    • Manage playbooks: to allow users to create and manage playbooks
    • Use playbooks: to allow users to trigger playbooks manually and automatically.

    This should help administrators in managing the RBAC with a fine-grained approach. See details in our documentation.

  • Change of capability for Delete & Merge knowledge (CE): After some feedback from the community, we have decided to change the capability to merge & delete, to ensure that that now merge and delete are now two specific capabilities.

  • Add original value in the logs (CE): Understanding the changes on an entity in detail is key in Cybersecurity. Therefore, we have improved data traceability by allowing users to view the detailed changes about an entity. Now, each line of the history of an entity is clickable, to give you more details about the initial value and the new one.

  • Send to template in playbook (EE): a new box “Send email from template has been introduced”, allowing you to send email using the templates defined in parameters/security. The end goal is to send an email to users, leveraging the HTML capabilities of the Email template Editor. This template only supports user-related variables and not entity-related variables. Additionally, this capability supports some dynamic variables, such as selecting “dynamic objects from the object in bundle” (organization), to extract directly the users from the organization triggering the playbook. More info on our documentation page.

  • Introduction of an onboarding email template (EE): for new platforms, an email template for user onboarding will be prepopulated, to help administrators save time in setting...

Read more
Loading

Version 6.8.17

10 Dec 20:22
@Filigran-Automation Filigran-Automation
6.8.17
09d2ca0
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: 9B0E8C01D55046DD
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
Version 6.8.17

Enhancements:

  • #13625 Add ability to specify a provider in API client user agent and specify one in worker
  • #13623 Implement duration, type affinity and platforms affinity in security coverage to drive scenario generation
  • #13136 Create Security Coverage through playbooks

Pull Requests:

Full Changelog: 6.8.16...6.8.17

Contributors

SamuelHassine, renovate, and 2 other contributors
Loading