Skip to content

Releases: OpenCTI-Platform/opencti

Version 6.5.5

07 Mar 10:31
@Filigran-Automation Filigran-Automation
6.5.5
52b8fbd
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.5 Latest
Latest

Bug Fixes:

  • #10159 Several custom dashboards not working after 6.5.4 update
  • #10091 Error when generating an Indicator based on an X509 Certificate Observable
  • #10053 Bad margin/padding on some pages with an information section

Pull Requests:

Full Changelog: 6.5.4...6.5.5

Contributors

renovate, lndrtrbn, and 3 other contributors
Assets 4
Loading

Version 6.5.4

05 Mar 15:38
@Filigran-Automation Filigran-Automation
6.5.4
717798d
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.4

Bug Fixes:

  • #10107 [Customization] Default Values in attribute Markings Entity type cannot be disabled
  • #10062 Too high margin between elements in the data tab of containers
  • #10061 Wrong margin with the title in the history tab
  • #10031 Clicking on the burger button in the playbook list view open the playbook
  • #10030 Impossible to share Note with Organization
  • #10007 No longer option to bulk edit the score when filtering on “Entity type = IPv4”
  • #10006 Marking not accessible which are visible in the filters
  • #9949 OpenCTI TAXII2 Connector error
  • #9909 'In regards of' filter not working with observables
  • #9828 [Indicators/observables generation] When using the “select all” function and adding filters, generation is not available.
  • #9818 Inconsistancy of empty fields in Threat Actor Individual overview
  • #9723 Switching between card view and list view introduce size change in the toggle buttons group of a few pixels
  • #9616 The "more aliases" icon button is not vertically aligned with aliases chips
  • #8833 Platform 100% CPU Usage, unresponsive.
  • #8794 Inconsistent behavior on OpenCTI regarding artifact creation

Pull Requests:

New Contributors:

Full Changelog: 6.5.3...6.5.4

Contributors

jbanety, renovate, and 9 other contributors
Loading

Version 6.5.3

24 Feb 09:55
@Filigran-Automation Filigran-Automation
6.5.3
6146093
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.3

Enhancements:

  • #10028 Add capability to add a custom script snippet in the opencti html index

Bug Fixes:

  • #10004 Spacing issues in restricted entities screen
  • #9987 No link to OBAS when generating a simulation from an intrusion set
  • #9985 Missing "contains" filter in "Data > Relationships"
  • #9972 Not enough space before search bar of 'Rules engine'
  • #9836 RSS Feed connectors always say they are buffering even when nothing is going on
  • #9569 Align the height of hints to avoid strange effect on some windows
  • #9450 Marking values order: change TLP:AMBER+STRICT to be hierarchically greater than TLP:AMBER
  • #8429 In global search headers columns are not aligned
  • #8015 Unable to see "active" job in connector interface when there are more than 50 jobs in progress.

Pull Requests:

Full Changelog: 6.5.2...6.5.3

Contributors

renovate, savacano28, and 5 other contributors
Loading

Version 6.5.2

17 Feb 16:41
@Filigran-Automation Filigran-Automation
6.5.2
c7a2358
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.2

Enhancements:

  • #9882 Add markings support for workbench
  • #9860 Change behavior of invalid access to display 404 instead of login redirect

Bug Fixes:

  • #9971 No space in Exclusion lists screen
  • #9970 Editing Arsenal > Tools is not possible
  • #9962 Nothing happens at creation of a CSV mapper with existing name
  • #9944 Side deletions of ref relationships can lead to updated_at upgrade
  • #9940 Font Geologica is not used correctly
  • #9936 Prevent event loop CPU blocking when processing applyUpdate in container rules
  • #9923 Improve deletion of element with hundreds of thousands relationships
  • #9921 OBAS simulation on IntrusionSet throw error
  • #9894 Merge option isn't available on main search
  • #9887 Playbook running / not running not vertically aligned
  • #9881 Public dashboard doesnt correctly handle platform organization
  • #9880 Spacing is not correct in dissemination list table between search and headers
  • #9877 Exclusion lists are not case insensitive
  • #9859 Account unit system accept unvailable option
  • #9857 Entity types are not translated in 'main observable type' filter
  • #9840 Entity type not translated in path header of Fintel template edition
  • #9831 object_refs in Report object
  • #9816 No action at 'no label' chip click in indicators list of Knowledge view
  • #9815 Click on popover is propagate to the sighting line
  • #9788 Triggers in groups overview are not respecting the radius of 4px
  • #9740 Improve application stopping time
  • #9626 Add a 21 organization to a user, delete another one automatically
  • #9577 Don't save participants on Task creation
  • #9556 Columns titles not aligned in the connectors view
  • #9531 Linked entity and relationship lists inconsistent in knowledge tab
  • #9292 Label filter adding via an indicator line not working in Knowledge tab of an entity
  • #9234 Newly created users are always assigned to the default group even if another group is specified
  • #8343 Inconsistent behavior on overview of demographics

Pull Requests:

Read more

Contributors

richard-julien, SouadHadjiat, and 11 other contributors
Loading

Version 6.5.1

06 Feb 18:00
@Filigran-Automation Filigran-Automation
6.5.1
2327214
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.1

Bug Fixes:

  • #9854 Enrich button doesn't work
  • #9772 Missing translation for 'search' filters operator
  • #9588 Obervables of type hashes values are not correctly truncated in the graph of containers
  • #9533 [Playbook] Indicator generated by the playbook not added in the container
  • #9487 Incorrect background color in the 'Create Multiple Entities' dialog box
  • #8937 Data table content alignement in Create a relationship panels

Pull Requests:

Full Changelog: 6.5.0...6.5.1

Contributors

richard-julien, renovate, and 5 other contributors
Loading

Version 6.5.0

05 Feb 15:57
@Filigran-Automation Filigran-Automation
6.5.0
c9872d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.5.0

Dear community, we're excited to announce the launch of OpenCTI 6.5.0! 🥳

This release focuses on solving key pain points and unlocking new use cases:

  • Help analysts produce & disseminate finished intelligence
  • IOC management: introduce exclusion lists to avoid ingesting unwanted IOCs
  • AI: become an assistant for analysts

ℹ️ Enterprise Edition Activation Changes

Note

As you know, in June 2023 we introduced an “Enterprise Edition” of the platform. As we explained at the time, this was in no way a reneging on our commitment to open source software, which has been part of our DNA since the very first day of our adventure. We are convinced that we have honored this promise perfectly, continuing to invest heavily in the features of the community version and innovating for all our communities.

Access to the Enterprise Edition, subject to a special license and annual subscription, has remained for almost two years based on the good faith of the platform's users, with acceptance of the license requiring a simple checkbox in the platform settings.

To promote transparency and fair use of our products, OpenCTI 6.5.0 introduces a license key system to control activation of the Enterprise Edition. All Filigran customers and non-governmental charity organizations using EE in accordance with the terms of the license have already received their license key(s).

As a consequence, upgrading a platform with EE activated and without a valid license key will result in the full de-activation of all EE features. Of course, for organizations wishing to access the associated features for testing and development purposes, trial license keys can be generated automatically and independently from our website. Please, don't hesitate to reach out to us if you have any question or concern about this new license key system.

Analysts spend significant time working on incidents and reports to identify threats and create knowledge that improves their organization's security posture.

However, transforming this information into standardized, easily disseminated finished intelligence documents often proves challenging.

This is why we introduced the ability to create your own finished intelligence template 📜 (Enterprise Edition). From the container's customization page, you can now define templates that use variables of your container and the entities and relations present in your container. These predefined templates will reuse the intelligence contained in your container. Your analysts can simply generate finished intelligence from these templates to initialize documents pre-populated with relevant data. This significantly reduces the time needed to produce any kind of reports.

Better yet, these templates can be imported and exported 💡, allowing you to reuse them across different platforms!

In addition, we've added the capability to manage dissemination lists & leverage them to send PDF documents via email (Enterprise Edition) 📨. Once administrators define email distribution lists, analysts can use them to send Finished Intelligence documents directly to their dissemination circles. This gives non-OpenCTI users easy access to analyst-produced documents.

In certain circumstances, intelligence access needs to be more restricted—for instance, during critical incidents or when handling sensitive threat reports. To address this, we've added the ability to restrict access to a container with our authorized member mechanism 🔒(Enterprise Edition). Even with shared containers, enabling access restriction limits visibility to specifically authorized users, groups, or organizations. These authorized members receive only the access rights you grant them (view, edit, manage), helping you maintain data confidentiality.

To ensure restricted data remains manageable if an entity manager leaves your organization, administrators can access a restriction management panel 🔓 to remove restrictions on entities when needed.

Minimizing false positives is essential for improving the accuracy and effectiveness of threat detection. To support this, we've introduced exclusion lists ⛔ in OpenCTI.
This feature lets you create exclusion lists to prevent specific IOCs, such as internal IPs or trusted domains, from being ingested into the platform. By preventing the ingestion of these non-malicious IOCs, you ensure they are not propagated to your external detection solutions (ex: SIEM), reducing noise and enhancing detection accuracy.

AI should enhance analysts' daily work, which is why we've revamped our AI module ✨ (Enterprise Edition). Now available across all platform entities, it supports analysts in their daily tasks. From any entity, such as a threat, analysts can quickly view latest activity, get summaries from recent reports, and see activity logs—putting useful information at their fingertips!

Understanding and presenting data effectively is crucial in CTI. This is why we have worked on the following features.

  • Correlation views have been redesigned with this in mind. All container types can now correlate with each other—for example, if an incident response shares IOCs with a report, they'll be correlated. We've added an information panel explaining container correlations and improved the graph view to better illustrate entity relationships between containers. 💡
  • Dashboards, especially List widgets, now feature the ability to select columns in knowledge & entity perspective 📊. Users can select and reorder columns based on their needs. When filtering across multiple entity types, only common attributes will be available for selection.
  • We've added a useful feature to notifications: you can now filter on the trigger of the notification 🔔(via label click or filter selection). This helps you understand which trigger generated which notification.
  • Knowledge views for Attack Patterns have been enhanced with a relation view, making information easier to understand and manage. This improvement was specifically requested by the community 👂 to better handle Attack Patterns linked to threats.

Our OpenBAS :openbas: integration has been redesigned to support choosing the correct architecture when running simulations from OpenCTI. This includes a deprecation, detailed below.

In terms of data ingestion, OpenCTI now provides the capability to expose TAXII 2.1 data collections for pushing STIX-formatted data. Available under Data/Ingestion, the TAXII Push ingester enables users and external systems to import STIX 2.1 objects into OpenCTI through an exposed TAXII collection, ensuring full compliance with the 'Add objects' section of the TAXII 2.1 specification.

We’ve also updated and integrated a new GraphQL playground to enhance your development experience by making it easier to test and interact with our GraphQL API 😎.

Finally, we've improved performance for large dataset operations ⚡ through two backend enhancements: improved worker thread pool and relocated lock mechanism to a separate process. This means faster background task processing and more efficient operations on shared entities, resulting in fewer errors.

Regarding connectors and integrations, this milestone brought several new connectors and integrations like:

  • Tenable Security Center
  • Google SecOps SIEM
  • Proofpoint ET Pro Rep List
  • Spycloud
  • Zvelo
  • YARA Import Files

But also to enhance some connectors :

  • Hatching triage
  • Sentinel-Intel
  • RecordedFuture
  • Mandiant
  • Crowdstrike
  • ImportDocument
  • Harfanglab
  • Flashpoint

We deeply want to thank our Partner & Community for their contributions:

  • New connectors:
    • Loader Insight Agency File Feed
    • Intel471-V2
    • Zscaler ZIA
    • IBM XTI
    • Hunt.io
    • Wiz
  • Connectors enhancements:
    • TAXII2-connector
    • MISP connector
    • Feedly
    • Tagger
    • crtsh
    • Orange Cyber Defense
    • Zerofox
    • TheHive
    • Greynoize
    • VirusTotal
    • ShadowServer
    • ransomware.live

Finally, we have made efforts to expand the availability of our Docker containers. In addition to being hosted on Docker Hub, all OpenCTI containers are now also accessible via [GitHub Container Registry](https://github.com/orgs/OpenCTI-Platform/packages).

We hope this release will please you! Feel free to drop us a note about anything. We’re always happy to get feedback about our product usage, whether it’s to hear that everything works perfectly or to get some improvement ideas to.

All the details about what has been released for which repo is available here:

⚠️ Deprecation

Deprecation Notice: GenerationScenario Mutations in OpenCTI - OpenBAS

The following three mutations related to GenerationScenario have been deprecated due to changes in their signature and response format:

  • obasContainerGenerateScenario → Replaced by obasContainerGenerateScenarioWithInjectPlaceholders
  • obasThreatGenerateScenario→ Replaced by obasThreatGenerateScenarioWithInjectPlaceholders
  • obasVictimGenerateScenario→ Replaced by obasVictimGenerateScenarioWithInjectPlaceholders

Key Changes in new version : + WithInjectPlaceholders

New Signature Object: SimulationConfig

  • simulationType: Defines the type of simulation: Technical or Simulated
  • selection:
    -...
Read more

Contributors

richard-julien, SouadHadjiat, and 22 other contributors
Loading

Version 6.4.11

04 Feb 11:28
@Filigran-Automation Filigran-Automation
6.4.11
d32d207
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.4.11

Enhancements:

  • #9814 [backend] Limit inference explanations for single relationship

Bug Fixes:

  • #9824 An infinite update loop can happen when two instances listen to each other streams
  • #9795 [backend] Improve notification template verifications
  • #9771 Missing CSV feeds entity types translations
  • #9769 Bad confirmation message when deleting a dashboard or an investigation
  • #9752 [Task] When you try to add a participant, the message remains blocked.
  • #9270 Reindexing fail from opencti_stix_core_relationships-000001 to opencti_deleted_objects
  • #9057 In an Incident, the Observables count on Knowledge is one below the actual count
  • #8985 No action when clicking on a label in 'Add entities' panel
  • #8697 OpenCTI TAXII Feed - 413 Content Too Large
  • #8672 Missing entities listed in Knowledge tab
  • #8115 Incorrect display in Threat Actors menu category

Pull Requests:

Full Changelog: 6.4.10...6.4.11

Contributors

SouadHadjiat, renovate, and 6 other contributors
Loading

Version 6.4.10

29 Jan 17:14
@Filigran-Automation Filigran-Automation
6.4.10
3889848
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.4.10

Enhancements:

  • #9748 Improve prepareElementForIndexing function to prevent event loop blocking
  • #9481 Major upgrade of mistrail ai client to 1.3.6

Bug Fixes:

  • #9279 Bad margin in 'Add indicators to observable' panel

Pull Requests:

Full Changelog: 6.4.9...6.4.10

Contributors

richard-julien, renovate, and 4 other contributors
Loading

Version 6.4.9

28 Jan 08:55
@Filigran-Automation Filigran-Automation
6.4.9
1fba256
This commit was signed with the committer’s verified signature.
SamuelHassine Samuel Hassine
GPG key ID: 966CA4FD74C31B9B
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.4.9

Enhancements:

  • #9717 Remove some denormalized IDs for very large entities to improve performances

Bug Fixes:

  • #9721 Bad confirmation message when deleting an Infrastructure
  • #9719 Platform crashes after user deletion
  • #9698 Error when creating an Infrastructure
  • #9693 Bearer token plaintext in error logs of the worker
  • #9568 History tab top margin / spacing is incorrect
  • #9567 In create entity form (on the fly), spacing of the first field is not correct
  • #9520 Search feature in content mapping view does not search for highlighted text
  • #9401 Bug - GraphQLError: Execution timeout, too many concurrent call on the same entities / File not found or restricted
  • #9299 Can't download CSV/PNG/SVG of a dashboard widget
  • #9216 Clicking on a stopped live stream logout from the platform
  • #8981 The description of the relationship between an object and a TTP is not displayed
  • #8736 [RSS Feed] Error 403 on accessible public feeds
  • #8183 Upserting text field with "null" with configured default value lead to strange update behavior
  • #6835 Imported sightings' confidence level is always "5 - Improbable"

Pull Requests:

Full Changelog: 6.4.8...6.4.9

Contributors

SamuelHassine, renovate, and 7 other contributors
Loading

Version 6.4.8

17 Jan 12:36
@Filigran-Automation Filigran-Automation
6.4.8
7d5bb14
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
Version 6.4.8

Enhancements:

  • #9335 [Multiple connectors] Support AMBER+STRICT marking

Bug Fixes:

  • #9586 Suggestion engine select field is broken in containers
  • #9573 Cannot access CSV and TAXII feed if user has only capability to manage feeds
  • #9521 Task objects listed "Unknown"
  • #9428 Logout button miss placed if connected user as no knowledge capability
  • #9371 Sync ingestion: manage error on file issue and allow ingestion of elements with missing files
  • #9358 Memory leak when ingesting an opencti stream configured with an empty starting synchronization date
  • #9330 Tools entity version are not fillable
  • #9280 Ordering not working in add nested objects panel
  • #9211 Improve confidentiality of history
  • #9078 [Org segregation] Object not visible despite belonging to the correct organization
  • #8986 [livestream] renaming of observable creates a new one in perfect sync mode
  • #8843 Livetstream filtering of containers does not send event of ref being shared
  • #8146 Unable to display "sighting" detail when creating a sighting from an organisation entity
  • #7637 [Filter] Filter on "Observable" meta type

Pull Requests:

Full Changelog: 6.4.7...6.4.8

Contributors

renovate, aHenryJard, and 8 other contributors
Loading