Skip to content

Releases: OpenCTI-Platform/opencti

Version 6.1.8

31 May 18:06
7cea4ce
Compare
Choose a tag to compare

Bug Fixes:

  • #7202 Add keyPrefix for sentinel mode

Pull Requests:

  • [backend] Add keyPrefix for sentinel redis mode by @Kedae in #7203

Full Changelog: 6.1.7...6.1.8

Version 6.1.7

31 May 12:23
fa70ede
Compare
Choose a tag to compare

Enhancements:

  • #7062 Improve CI for OpenCTI and client-python contribution.
  • #7020 [backend] Improve alias generation and resolution to improve data ingestion
  • #6813 Update CSV mapper to improve TTP mapping

Bug Fixes:

  • #7188 Support package is broken due to permissions issue in the container
  • #7175 Regression on quick export to PDF in an entity
  • #7109 [Notification] Bulk notification manipulation impossible
  • #7090 [Support Packages] Error when trying to generate then Timeout
  • #7064 Mutliple nested relations does not work
  • #6818 [CSV Mapper] MISSING REFERENCE ERROR when importing file with CSV mapper
  • #6716 Worker missing reference errors / Inconsistencies / Slow ingestion rate

Pull Requests:

Full Changelog: 6.1.6...6.1.7

Version 6.1.6

29 May 19:05
c30d366
Compare
Choose a tag to compare

Enhancements:

  • #7176 Implement the export of lists / search results in PDF

Bug Fixes:

  • #7168 When exporting in global search, the search term is not taken into account
  • #7154 Can't switch entity_type filter local mode in relationship creation from observable
  • #7153 No available relationship types for 'in regards of' filter in entity widget
  • #7151 No Authorized Member in the customization of a Feedback

Pull Requests:

Full Changelog: 6.1.5...6.1.6

Version 6.1.5

29 May 00:42
3b73665
Compare
Choose a tag to compare

Enhancements:

  • #6844 Improve CSV mapper behavior to allow correct count and failure tracking
  • #6799 Ability to filter on representatives starting with X in playbook and streams

Bug Fixes:

  • #7144 OpenCTI / OpenBAS integration does not work
  • #7112 Throwing User effective max confidence level is insufficient to update this element at upsert / ingestion
  • #7111 Support package: screen in error when there is more package line than the screen height
  • #7073 Missing warning before deletions of entity in container
  • #6921 Malware Source type filter also filter relationship with Malware-Analysis as source type
  • #6918 Missing Filters option when selecting entities for a nested relationship
  • #6817 [CSV Mapper] It errors when processing csv file with new lines in one of the columns

Pull Requests:

Full Changelog: 6.1.4...6.1.5

Version 6.1.4

23 May 23:37
ee1e281
Compare
Choose a tag to compare

Enhancements:

  • #7102 Taking into account workflow ID at relationship creation
  • #7058 [backend/frontend] Add an option in user to force stateless session
  • #7018 Improve search to prevent score ordering when specific ordering is requested
  • #6843 Be able to select the default dashboard for home
  • #5549 Add specific capability to access audit logging

Bug Fixes:

  • #7097 A user with no access to knowledge shouldn't see the Global Search bar
  • #7078 Error on Inject simulated emails
  • #7044 Error logs meta information missing
  • #7042 Boutton "Share as public dashboard" is displayed in Investigation screen
  • #7015 Deleting a report with orphans lead to errors
  • #6996 [Workbench] Creating or editing Observable File does not work
  • #6991 Once a report is shared with an organisation, added entities are not shared
  • #6919 Selecting a domain as a nested object of an Ipv4 crashes the front
  • #6797 Entities disappearing when editing container on workbench
  • #6421 Deletion leaves some orphans
  • #6383 System non-responsive (UI nearly unusable) when editing/downloading/saving large HTML files in content editor

Pull Requests:

Full Changelog: 6.1.3...6.1.4

Version 6.1.3

21 May 00:10
6a7d804
Compare
Choose a tag to compare

Enhancements:

  • #7026 Add chmod for docker files new directories .support and telemetry

Bug Fixes:

  • #6976 Remove "Entity" choice from Entity type list in data view filter
  • #6951 [Live stream] Deleting data on the sender's side deletes the data on the receiver's side
  • #6834 Can't unlink a task from a case template
  • #6824 TTPs export from knowledge tab does not work as expected
  • #6783 Page crash in data/entities when shift selecting multiple entities of the same type
  • #6658 Headers in CSV feeds are not respecting the separator

Pull Requests:

Full Changelog: 6.1.2...6.1.3

Version 6.1.2

16 May 23:52
221951f
Compare
Choose a tag to compare

Enhancements:

  • #6944 [backend] Add family option in Redis to support IPv6 domain connection
  • #5648 Implement test automation for CRUD

Bug Fixes:

  • #7000 [backend] Ensure export files visibility inside list or elements
  • #6983 [Rule engine] We can't access the config panel of rule engine
  • #6978 [Playbook] Issue when manipulating an observable
  • #6977 Most active labels on dashboard is not working
  • #6973 [TAXII collection] Not a valid ISO8601-formatted datetime (non-compliant with the TAXII 2.1 spec)
  • #6953 [Dashboard] No available option for "Relationship_type" filter
  • #6952 "Resolved credential object is not valid" when updating from 6.0.10 -> 6.1.0
  • #6941 [Playbook] Manipulate knowledge/manipulate all elements in the bundle Error
  • #6920 user with only access knowledge capability can remove entities from reports
  • #6886 CSV Mappers can have no representations, leading to errors in ingestion
  • #6866 [Playbook] Generation of indicator after enrichment does not work
  • #6796 [Playbook] Detection field not updated by the playbook
  • #6732 Dashboard time filter not properly taken into account depending on view
  • #6739 [Playbook] Rename Filter knowledge to Match to reflect his real behavior
  • #6311 [Playbook] Error when applying label on some types of observables

Pull Requests:

Full Changelog: 6.1.1...6.1.2

Version 6.1.1

15 May 10:24
75fc06c
Compare
Choose a tag to compare

Bug Fixes:

  • #6956 Align colors in triggers icons / chips
  • #6948 Public dashboards with platform organization are not working
  • #6942 Error when importing text files or PDFs
  • #6934 Back button no longer works
  • #6874 Already deleted error when cascade deleting in report
  • #6873 [technical] incorrect use of stixCoreRelationshipDistribution queries
  • #6845 [Indicator generation] Text displayed false
  • #6804 Several clicks needed to open an entity page displayed on a widget "List Distribution"
  • #6761 'sighting' export from an entity exports all the sightings of the platform
  • #6757 CSV feeds screen broken after deleting the CSV mapper
  • #6718 Confidence field is disabled in admin when > 100

Pull Requests:

Full Changelog: 6.1.0...6.1.1

Version 6.1.0

13 May 08:56
64d087e
Compare
Choose a tag to compare

Dear community, we're delighted to announce the release of OpenCTI 6.1.0 🥳! This milestone materializes our Extended Threat Management suite by integrating OpenCTI with our new Breach and Attack Simulation open-source platform OpenBAS 🔥 !! And that’s not all! 6.1 incorporates also a lot of long awaited features🚀!

First of all, let's discuss the OpenBAS integration 🤝. OpenBAS is a platform where you can define series of events (technical or not) to be simulated towards endpoints or players. These simulations help you evaluate your security posture. Evaluating security posture makes more sense when tested against real and relevant threats. Here comes your OpenCTI and all of its carefully triaged, qualified, and crafted CTI! Directly from the Overview of Reports, Cases, and even Threats, you can generate a Breach and Attack simulation, evaluate your security posture, and have results integrated into your threat context. At a glance, you'll know if you are at risk! 🤯 We are very excited to bring this to the community and can't wait to receive your feedback on it!

OpenCTI 6.1.0 also brings Public Dashboards 📢! Now, you can create snapshots of your custom Dashboards and share them via a permalink, with people who don't have access to your OpenCTI platform. But these snapshots aren't static—they dynamically update as data in OpenCTI changes over time! Because data confidentiality always matters 🤫, users and platform administrators can control which data is shared through Public Dashboards using a maximum marking definition setting.

Now, regarding confidentiality, we've enhanced how marking definitions are handled for files associated with Knowledge entities. You can specify the maximum marking for generating exported file contents and apply markings directly to the files themselves 🛡️.

With this milestone, we're thrilled to introduce a long-awaited feature: rollback on deletion! Who hasn't felt the frustration of accidentally deleting the APT28 Intrusion Set from the platform 😱? I certainly have 😉 ! Mistakes are inevitable, and until now, some deletion actions were not easily reversible. But those days are behind us! Users now have the ability to rollback deletions for up to 7 days, by default. When you delete a Knowledge entity or relation, it's sent to a Trash collector where it can be restored from! So, the next time you accidentally delete APT28 or Cobalt Strike and their countless relationships, fear not—they'll be waiting for you in the trash, ready to be restored 😌.

Speaking of rollback, you may have also noticed that a 6.0 minor release introduced rollback functionality for investigations' graphs. Give it a try!
Version 6.0 introduced the Max Confidence level feature for users and groups, offering a powerful tool for enhancing Knowledge quality within your platform. If you haven't already, check out the dedicated blog post for more details. OpenCTI 6.1 takes it a step further 🚀! Now, you can define max confidence level overrides per entity types! This means you can tailor the impact of connectors on entities like Intrusion Sets and Vulnerabilities differently. You can also give more control to users over certain entities like Reports while limiting control over others like Locations and Sectors, for example. Give it a try and let us know what you think about it!

We've dedicated some time to enhance our Assignee system for Cases. Now, when users are assigned to Cases (whether as Assignee or Participant), they'll receive automatic notifications about the assignment and any subsequent changes made to the Case. Additionally, you now have the option to define in your Profile how you prefer to be notified by default for these assignments 💼.

To enhance our ability to address any bugs you encounter on your OpenCTI platform, we're implementing a Support Package generation system. Administrators can now generate an archive containing relevant log files from all nodes, aiding in more precise diagnostics of any situation. Additionally, users now have the capability to copy and paste the stack trace directly when an error occurs in the front-end 🛠️.

On the Integration side, we updated Malpedia and Recorded Future connector to make them Playbook compatible. We also created a Crowdstrike Falcon EDR connector to send IoC from OpenCTI to Falcon. Community members brought also a lot of value over the last minor releases, with the development of connectors for NIST NVD CPE, RST Noise Control, MITRE ATLAS matrix, Malcore and Socprime. Thanks a lot! ♥️

OpenCTI 6.1 also introduces our telemetry framework. These metrics collection is now mandatory for us to improve platform performances, as current usage implies significantly larger data volumes than before. It is also essential for us to enhance internal workflows and adapt them to community usage patterns. All collected data are anonymous and statistical. You can find detailed information on the collected data and associated usage in the telemetry documentation.

Finally, for those within our community operating in highly confidential environments, we've made a significant improvement to our Python framework to natively support air-gapped architecture. Our CTO, Julien Richard, has authored a dedicated blogpost to assist you with this. Be sure to check it out for detailed guidance 🧠.

⚠️ Breaking changes

It is not possible anymore to ingest Objects with a name containing less than 3 characters (space character at the beginning or the end of the string are not included in the count)

Enhancements:

  • #6930 [playbook] Improve playbook to implement looping control and avoid extra execution
  • #6904 Report frontend error in logs and support package
  • #6899 [backend] Improve graphql subscriptions data control
  • #6898 [backend] Add batch aliases protection in graphql api
  • #6896 Secure schema changing force_disabled_introspection option to true by default
  • #6883 Introduce credential provider for elasticsearch / redis and minio
  • #6292 Implement the Telemetry framework into OpenCTI
  • #5859 OpenBAS integration
  • #5823 Marking definitions for uploaded files
  • #5797 Apply marking definition to export files
  • #5548 Be able to generate a "support package" by clicking on a button
  • #4903 Share Public Dashboard - MVP
  • #4900 Add overrides to the max confidence level of Users for specific Entities
  • #3389 Global problem about displayed nested / refs relationships everywhere
  • #3365 Notifying users when they are Assignee/Participant
  • #1536 Be able to go back or cancel suppression

Bug Fixes:

  • #6897 [backend] Prevent user to regenerate is 2FA secret
  • #6894 Cannot expand entities in investigations
  • #6888 Country flag next to IP addresses have disappeared in observables list
  • #6837 Impossible to add an override for a new user who doesn't have an initialized user confidence level.
  • #6833 Malware analysis name displayed as Unknown in Search list
  • #6832 Knowledge widget filters issues
  • #6827 OpenCTI doesn't have the same logo spacing on light and dark mode
  • #6820 Global search no indication when files are found
  • #6816 Cannot add Data Component through contextual component
  • #6809 Capability "Restrict organization access" has a different name in DB
  • #6787 Threat Actor Participate In Campaign not displayed in the Campaign knowledge Tab attribution view
  • #6779 Unusable filter for observables
  • #6777 Widgets handle relation between Role and Capability
  • #6768 Translation in french for light theme is not correct
  • #6765 Relationships of observables are not correctly displayed
  • #6764 Horizontal bar charts are not clickable anymore
    ...
Read more

Version 6.0.10

18 Apr 11:36
8109f46
Compare
Choose a tag to compare

Enhancements:

  • #6638 Improve objects resolutions event loop usage for large report (60K+ object_refs)
  • #6602 [backend/frontend] Add TrackingNumber and Credential observables
  • #6303 Upgrade react router to v6
  • #3167 Be able to rollback / cancel expanding an entity in investigation

Bug Fixes:

  • #6717 Impossible to search a user using its email address in Security => Users
  • #6708 Creating an entity with ending/starting whitespaces can lead to stream sync infinite loop
  • #6706 Marking displayed as none when creating a entity
  • #6703 Frontend not updated properly when adding a user to a group
  • #6702 Very slow session refresh and possible infinite loop in the cache management
  • #6698 User can create entities with blank names
  • #6696 Loader keeps turning in relationship creation from entity when Reverse relation
  • #6692 Entity type filters not protected in contextual relationship creation list
  • #6687 ObservedData name not displaying correctly in container list for an object
  • #6681 Small typo in pycti/entities/opencti_stix_cyber_observable.py line 1650
  • #6680 Not translated error message in creation report form
  • #6666 Linked RFI is not displayed in Report's entities panel
  • #6655 Most used filters are at the end of the list instead of beginning
  • #6648 Bad french translations
  • #6646 Missing translations on Profil page
  • #6635 Slow list entities graphQL queries with refs loading
  • #6601 UI stuck when opening the relationship edition form
  • #6599 Markers on map are not placed at the right place
  • #6585 In playbook => manipulate knowledge, statuses are not correctly grouped
  • #6581 [Playbook] The drop-down menu doesn't show everything
  • #6578 Opinion are not visible anymore
  • #6559 Error when merging imported entities
  • #6551 Error message when searching in Incidents / Knowledge / Attack patterns
  • #6528 Region countries are not highlited anymore
  • #6521 Widgets that use the entity color might end up unreadable
  • #6520 PolarArea widget does not take into account the colors of the entities
  • #6518 Relationship updates at CSV file import don't check confidence
  • #6507 [Merge] Bad management of Author when merging several Organizations
  • #6502 No error when merging two entities with a higher confidence level
  • #6501 The merge does not take into account the max confidence level in some cases.
  • #6499 Incomplete JSON export of reports
  • #6472 Redirect to specific vulnerability from a widget does not work
  • #6407 "Select all" not available for relationship creation
  • #6404 Error not shown in UI
  • #6384 when downloading artifact in encrypted zip, original file inside encrypted zip has also .zip added in name instead preserving original filename
  • #6379 When a document is imported in grouping, it does not appear in content
  • #6360 [Groupings] Content is not saved
  • #6319 Relationship Distribution gives inconsistent results when changing the limit parameter
  • #6174 [Export CSV (dashboard)] CSV export of widget cuts off data

Pull Requests:

Read more