Releases · OpenCTI-Platform/opencti

05 Feb 15:57

Filigran-Automation

6.5.0

c9872d8

Version 6.5.0 Latest

Latest

Dear community, we're excited to announce the launch of OpenCTI 6.5.0! 🥳

This release focuses on solving key pain points and unlocking new use cases:

Help analysts produce & disseminate finished intelligence
IOC management: introduce exclusion lists to avoid ingesting unwanted IOCs
AI: become an assistant for analysts

ℹ️ Enterprise Edition Activation Changes

Note

As you know, in June 2023 we introduced an “Enterprise Edition” of the platform. As we explained at the time, this was in no way a reneging on our commitment to open source software, which has been part of our DNA since the very first day of our adventure. We are convinced that we have honored this promise perfectly, continuing to invest heavily in the features of the community version and innovating for all our communities.
Access to the Enterprise Edition, subject to a special license and annual subscription, has remained for almost two years based on the good faith of the platform's users, with acceptance of the license requiring a simple checkbox in the platform settings.
To promote transparency and fair use of our products, OpenCTI 6.5.0 introduces a license key system to control activation of the Enterprise Edition. All Filigran customers and non-governmental charity organizations using EE in accordance with the terms of the license have already received their license key(s).
As a consequence, upgrading a platform with EE activated and without a valid license key will result in the full de-activation of all EE features. Of course, for organizations wishing to access the associated features for testing and development purposes, trial license keys can be generated automatically and independently from our website. Please, don't hesitate to reach out to us if you have any question or concern about this new license key system.

Analysts spend significant time working on incidents and reports to identify threats and create knowledge that improves their organization's security posture.

However, transforming this information into standardized, easily disseminated finished intelligence documents often proves challenging.

This is why we introduced the ability to create your own finished intelligence template 📜 (Enterprise Edition). From the container's customization page, you can now define templates that use variables of your container and the entities and relations present in your container. These predefined templates will reuse the intelligence contained in your container. Your analysts can simply generate finished intelligence from these templates to initialize documents pre-populated with relevant data. This significantly reduces the time needed to produce any kind of reports.

Better yet, these templates can be imported and exported 💡, allowing you to reuse them across different platforms!

In addition, we've added the capability to manage dissemination lists & leverage them to send PDF documents via email (Enterprise Edition) 📨. Once administrators define email distribution lists, analysts can use them to send Finished Intelligence documents directly to their dissemination circles. This gives non-OpenCTI users easy access to analyst-produced documents.

In certain circumstances, intelligence access needs to be more restricted—for instance, during critical incidents or when handling sensitive threat reports. To address this, we've added the ability to restrict access to a container with our authorized member mechanism 🔒. Even with shared containers, enabling access restriction limits visibility to specifically authorized users, groups, or organizations. These authorized members receive only the access rights you grant them (view, edit, manage), helping you maintain data confidentiality.

To ensure restricted data remains manageable if an entity manager leaves your organization, administrators can access a restriction management panel 🔓 to remove restrictions on entities when needed.

Minimizing false positives is essential for improving the accuracy and effectiveness of threat detection. To support this, we've introduced exclusion lists ⛔ in OpenCTI.
This feature lets you create exclusion lists to prevent specific IOCs, such as internal IPs or trusted domains, from being ingested into the platform. By preventing the ingestion of these non-malicious IOCs, you ensure they are not propagated to your external detection solutions (ex: SIEM), reducing noise and enhancing detection accuracy.

AI should enhance analysts' daily work, which is why we've revamped our AI module ✨ (Enterprise Edition). Now available across all platform entities, it supports analysts in their daily tasks. From any entity, such as a threat, analysts can quickly view latest activity, get summaries from recent reports, and see activity logs—putting useful information at their fingertips!

Understanding and presenting data effectively is crucial in CTI. This is why we have worked on the following features.

Correlation views have been redesigned with this in mind. All container types can now correlate with each other—for example, if an incident response shares IOCs with a report, they'll be correlated. We've added an information panel explaining container correlations and improved the graph view to better illustrate entity relationships between containers. 💡
Dashboards, especially List widgets, now feature the ability to select columns in knowledge & entity perspective 📊. Users can select and reorder columns based on their needs. When filtering across multiple entity types, only common attributes will be available for selection.
We've added a useful feature to notifications: you can now filter on the trigger of the notification 🔔(via label click or filter selection). This helps you understand which trigger generated which notification.
Knowledge views for Attack Patterns have been enhanced with a relation view, making information easier to understand and manage. This improvement was specifically requested by the community 👂 to better handle Attack Patterns linked to threats.

Our OpenBAS :openbas: integration has been redesigned to support choosing the correct architecture when running simulations from OpenCTI. This includes a deprecation, detailed below.

In terms of data ingestion, OpenCTI now provides the capability to expose TAXII 2.1 data collections for pushing STIX-formatted data. Available under Data/Ingestion, the TAXII Push ingester enables users and external systems to import STIX 2.1 objects into OpenCTI through an exposed TAXII collection, ensuring full compliance with the 'Add objects' section of the TAXII 2.1 specification.

We’ve also updated and integrated a new GraphQL playground to enhance your development experience by making it easier to test and interact with our GraphQL API 😎.

Finally, we've improved performance for large dataset operations ⚡ through two backend enhancements: improved worker thread pool and relocated lock mechanism to a separate process. This means faster background task processing and more efficient operations on shared entities, resulting in fewer errors.

Regarding connectors and integrations, this milestone brought several new connectors and integrations like:

Tenable Security Center
Google SecOps SIEM
Proofpoint ET Pro Rep List
Spycloud
Zvelo
YARA Import Files

But also to enhance some connectors :

Hatching triage
Sentinel-Intel
RecordedFuture
Mandiant
Crowdstrike
ImportDocument
Harfanglab
Flashpoint

We deeply want to thank our Partner & Community for their contributions:

New connectors:
- Loader Insight Agency File Feed
- Intel471-V2
- Zscaler ZIA
- IBM XTI
- Hunt.io
- Wiz
Connectors enhancements:
- TAXII2-connector
- MISP connector
- Feedly
- Tagger
- crtsh
- Orange Cyber Defense
- Zerofox
- TheHive
- Greynoize
- VirusTotal
- ShadowServer
- ransomware.live

Finally, we have made efforts to expand the availability of our Docker containers. In addition to being hosted on Docker Hub, all OpenCTI containers are now also accessible via [GitHub Container Registry](https://github.com/orgs/OpenCTI-Platform/packages).

We hope this release will please you! Feel free to drop us a note about anything. We’re always happy to get feedback about our product usage, whether it’s to hear that everything works perfectly or to get some improvement ideas to.

All the details about what has been released for which repo is available here:

openCTI: https://github.com/OpenCTI-Platform/opencti/releases
connectors: https://github.com/OpenCTI-Platform/connectors/releases
client-python: https://github.com/OpenCTI-Platform/client-python/releases

⚠️ Deprecation

Deprecation Notice: GenerationScenario Mutations in OpenCTI - OpenBAS

The following three mutations related to GenerationScenario have been deprecated due to changes in their signature and response format:

obasContainerGenerateScenario → Replaced by obasContainerGenerateScenarioWithInjectPlaceholders
obasThreatGenerateScenario→ Replaced by obasThreatGenerateScenarioWithInjectPlaceholders
obasVictimGenerateScenario→ Replaced by obasVictimGenerateScenarioWithInjectPlaceholders

Key Changes in new version : + WithInjectPlaceholders

New Signature Object: SimulationConfig

simulationType: Defines the type of simulation: Technical or Simulated
selection:
interval: Defines the execut...

Contributors

richard-julien, SouadHadjiat, and 22 other contributors

Assets 4

04 Feb 11:28

Filigran-Automation

6.4.11

d32d207

Version 6.4.11

Enhancements:

#9814 [backend] Limit inference explanations for single relationship

Bug Fixes:

#9824 An infinite update loop can happen when two instances listen to each other streams
#9795 [backend] Improve notification template verifications
#9771 Missing CSV feeds entity types translations
#9769 Bad confirmation message when deleting a dashboard or an investigation
#9752 [Task] When you try to add a participant, the message remains blocked.
#9270 Reindexing fail from opencti_stix_core_relationships-000001 to opencti_deleted_objects
#9057 In an Incident, the Observables count on Knowledge is one below the actual count
#8985 No action when clicking on a label in 'Add entities' panel
#8697 OpenCTI TAXII Feed - 413 Content Too Large
#8672 Missing entities listed in Knowledge tab
#8115 Incorrect display in Threat Actors menu category

Pull Requests:

[backend] Fix reindex error on deleting old objects (#9270) by @SouadHadjiat in #9742
[frontend] Fix QR code for OTP on dark mode that is not readable by @Kedae in #9773
Update dependency @opensearch-project/opensearch to v2.13.0 by @renovate in #9207
Update dependency nodemailer to v6.10.0 by @renovate in #9780
Update dependency filigran-ui to v0.29.2 by @renovate in #9779
[backend] add configurable taxii feed ingestion pagination (#8697) by @JeremyCloarec in #9659
Update dependency @datadog/pprof to v5.5.1 by @renovate in #9777
Update dependency pdfmake to v0.2.18 by @renovate in #9667
Update otel/opentelemetry-collector-contrib Docker tag to v0.118.0 by @renovate in #9538
Update graphql-tools monorepo by @renovate in #9438
Update dependency @date-io/date-fns to v3.2.0 by @renovate in #9430
Update dependency graphql to v16.10.0 by @renovate in #9361
Update dependency graphql-scalars to v1.24.1 by @renovate in #9338
Update dependency html-to-pdfmake to v2.5.20 by @renovate in #9322
Update dependency graphql-rate-limit-directive to v2.0.6 by @renovate in #9321
Bump nanoid from 3.3.7 to 3.3.8 in /opencti-platform/opencti-front by @dependabot in #9277
[frontend] Delete confirmation message for workspaces (#9769) by @Archidoit in #9770
[frontend] action on 'No label' click in 'Add entities' panel (#8985) by @Archidoit in #9749
Update dependency rate-limiter-flexible to v5.0.5 by @renovate in #9668
Update dependency monocart-reporter to v2.9.13 by @renovate in #8852
Update dependency react-router-dom to v6.29.0 by @renovate in #9781
[frontend] Align knowledge bar counters (#8115) by @delemaf in #9304
[backend] Fix null for objectParticipant in Task (#9752) by @Kedae in #9755
[backend] Improve template notification verifications (#9795) by @aHenryJard in #9810
[frontend] translate types in CSV feeds list (#9771) by @Archidoit in #9804
[backend] now also send event_id for events sent to worker coming from stream (#9824) by @JeremyCloarec in #9791

Full Changelog: 6.4.10...6.4.11