Skip to content

Releases: OpenCTI-Platform/opencti

Version 6.4.2

28 Nov 17:33
e63f655
Compare
Choose a tag to compare

Enhancements:

  • #8403 CSV mapper: Ability to import entities that are present in multiple rows with various data for the same attribute & hhandle larger files through streaming
  • #7787 Retention rules may periodically publish error if trying to delete individual coresponding to a user
  • #7589 Improve CSV parser to stream file to handle very large volume of data

Bug Fixes:

  • #9150 In TAXII Client configuration, "Copy confidence level to OpenCTI Scores for Indicators" state is dropped
  • #9149 When uploading or creating a file in Content tab (Report for example) an error occurs
  • #9129 Colors of connectors list is not correct
  • #9117 Custom dashboard history distribution widget by creator crashes for non admin users
  • #9049 Deleting a marking definition never close the confirmation popup
  • #9021 Tooltip in recent history is troncated
  • #8974 Refactor file check access to improve speed and efficiency
  • #8927 Domain observable with hyphen/dash is incorrectly rejected
  • #8686 Author not assigned as Creator if object created outside Report
  • #8295 Missing indicator of the number of relationships between threat actors and narratives
  • #8268 [Dashboard] Exporting a dashboard with a “.” in the name doesn't add the “.json”.
  • #8179 Missing results when searching for observables containing a domain name
  • #7830 Reduce display delay after adding relationships

Pull Requests:

New Contributors:

Full Changelog: 6.4.1...6.4.2

Version 6.4.1

21 Nov 16:43
affbcb9
Compare
Choose a tag to compare

Bug Fixes:

  • #9099 Cannot download files in Content tab
  • #9074 OBAS results placeholder has wrong styling
  • #9073 Entity type filter values are not restricted in Relationship creation form list
  • #9063 Observable Persona global search and entity filter of Persona not working
  • #9022 In an investigation, you need to refresh the page after creating a new relationship to see it.
  • #8984 Uncorrect members ordering in Group Edition form
  • #8962 [Workbench] Validation is allowed even without the capability "Create / Update knowledge"
  • #8597 [Dashboard] Entities perspective displays the “relationship” message
  • #7828 When deleting a connector in ingestion => connectors, interface is redirected to the connector and then to the list
  • #7539 Default filters cannot be changed in some cases

Pull Requests:

Full Changelog: 6.4.0...6.4.1

Version 6.4.0

18 Nov 20:08
5087c95
Compare
Choose a tag to compare

Dear community, we're excited to announce the launch of OpenCTI 6.4! 🥳

This release has been mainly focused on solving the following pain points & unlocking the below use cases:

  • Protect platforms from unwanted configurations changes, by implementing a danger zone
  • Improve Mean Time To Response by facilitating actions on cases
  • Facilitate Graph manipulation, by enabling a set of new actions
  • Facilitate ingestion process, by making CSV mapper more flexible & improve errors on connectors
  • Vulnerability management, by developing additional integrations

If our platform is flexible, sometimes this flexibility can be harmful when it some new users to the platforms perform some actions which can have a negative on their experience, such as remove the Enterprise Edition, changing the platform organisation, updating some built-in roles & groups.

This is the reason why we introduced the concept of Danger Zone 🚸.

**From the moment you will upgrade, certain area of the platform will be protected. This means you will not be able to edit them without having a new specific role capability. For more information regarding this feature, please go to the dedicated documentation

Quick and efficient incident response is essential for many organizations, yet managing participant assignments and case updates can often be time-consuming, slowing down response times.

To streamline incident management, we’ve introduced direct in-UI options for assigning participants and assignees, removing the need to open the modification panel. Additionally, we now support bulk operations for updating fields like creator, assignee, priority, severity, and type🖊️ directly from the list view.

These enhancements enable faster, more flexible incident management, giving teams the ability to quickly assign resources and update cases at scale.

To complement on this topic, one great feature added this release is also the ability to enroll a specific entity within the playbook 🤖: starting from 6.4, you can create a playbook with the first step being “Available for manual enrollment / trigger”. By creating this step without any filter & the rest of your workflow, you can now, when navigating to a container, “enroll this entity in a playbook” to have an automation running on this specific entity. This will unlock lots of use cases, for instance to apply specific measures to a particular entity that you need to follow.

Users frequently need to work with knowledge graphs to manipulate information within containers. However, adding entities to an established knowledge graph has been a challenge, as forces were automatically reapplied, disrupting the graph's layout and usability. So as creating a large number of relationships with a single entity led to problems of timeout.

In this release, we’ve refined the knowledge graph experience to support smoother interactions. Now, if you disable forces on your graph, it will maintain its layout when new entities are added 📈, preserving your custom configurations.

Additionally, with valuable input from the community, we’ve enhanced relationship management within reports. Users can now select all relationships linked to a node or choose to isolate either parent or child relationships 💡—simplifying bulk actions, such as removing relationships from a container.

Investigation graphs have also been reworked to improved the representation of file objects (observable).

Knowledge ingestion through CSV files offers flexibility, but handling custom formats can be challenging. Users need efficient ways to create mappers and manage conditional data.

To enhance CSV ingestion, we’ve introduced two key improvements to CSV mappers.

Firstly, we’ve added a duplication feature for CSV mappers (and feeds) 📁across both ingestion and data sharing, simplifying the mapper creation process.

Secondly, the new Conditional Mapping 🧪functionality allows users to map columns based on specific conditions—particularly useful when a single column contains multiple entity types. For instance, users can configure the mapper to recognize whether a row is an IP address or URL based on values in a separate column, streamlining entity classification.

Ingestion have also been improved with the ability to map a confidence level information on our score notion (x_opencti_score) when ingesting Indicators/Observables from a TAXII Feed.

Few releases back we have started our work towards unlocking some vulnerability management capabilities within the app.

This is why we have now introduced the Tenable Vulnerability Management connector. Thanks to this connector, you can now monitor your assets using our system entity within OpenCTI & get some corresponding vulnerabilities.

Additionally, systems now have a knowledge view 🪟 to see their related vulnerabilities & a new relationship type “system has vulnerability” 🔗 has been introduced too. Thanks to the work already done to add EPSS, KEV & connectors already built, in addition to these fields being supported in the playbooks, vulnerability management within OpenCTI becomes doable to a certain extent within the platform 🔥

Connectors are essential for data ingestion, yet diagnosing errors within connectors can be challenging and time-consuming. Clear error insights are crucial for efficient troubleshooting and to maintain data flow continuity.

To simplify error resolution, we’ve enhanced the error logging for connectors 💬. Now, within the error tab, users can view errors categorized under CriticalWarning, and All, allowing for immediate prioritization. Each error entry includes an improved, human-readable explanation along with a unique error code. This code links directly to documentation that provides specific troubleshooting steps, helping users quickly identify and address issues.

When it comes to troubleshooting, you also need to understand which are the users who have taken a given action, in order to be able to trace back & understand what did happen. Our logging have been improve thanks to the introduction of a filter on the “system” user. 👥

Outside of these use cases, we have tackled some additional various issues.

  • We have ensured that in a container (or in the observable view), if you filter on one single observable type (in a report, using the right handside component), you can select-all and enrich all at once 🌎. This is will save you some time!
  • When using AI within a report, the generation will offer the user to select the language of generation. By default, we will use user’s language to generate the report through AI ✨, so that it won’t change anything to your current flow.
  • Within entities that contains a knowledge view about Attack Patterns, we have now introduce a flat list view of attack patterns 💡, in order to manipulate the attack pattern as entities & use the mass operations.
  • We have also introduced the ability, when defining an email notification in the notifier, to add a suffix to the email notification URL 📨, so that you can redirect to the precise entity when receiving a notification.
  • We’ve expanded dashboarding capabilities with a new widget —Cloud of Words📊—to give you more flexibility in dashboard creation.
  • Opinions across all entities are now clickable 🕵️, allowing you to see who shared feedback and their specific comments. Additionally, a new opinion filter let you configure widgets 📊to display the distribution of entities based on the average of their associated opinions.
  • New capability “Can use web interface export functions (PDF, PNG, etc.)” 🔒: it aims to control who can download images from a dashboard or a knowledge view & List groups & roles in alphabetical order 💡.
  • You can now Disable the trash 📴 if you do not need it.
  • Overall, we have also worked on security fixes & performance issues (for ingestion & deletion). Among security improvement, we have also added the ability to revoke & recreate a new token 🔒 for a user which would have seen its token leaked. Tokens & password are now hidden by default in UI🕵️.

In addition to Tenable connectors addition, two new enrichment connectors have also been added:

  • RiskIQ Passive Total enrichment
  • GreyNoise Vulnerability enrichment

We have also made a number of improvements to the Microsoft Sentinel, Tanium and Harfanglab connectors. The export of indicators and the import of incidents are now separated into two different connectors (stream & external-import).

On a finish note, we would like to thank you for your contributions 🙏 to our product, that helps making our product better: guillaumededrie, stefan1anuby, Bonsai8863, animedbz16, daimoyo007, cert-orangecyberdefense, polakovicp, DNRRomero, stefanbulof, annoyingapt, uTomasAnderson, bradchiapetta, brett-fitz, akhanafeer, mmolenda, initstring, Darkheir, WolfBytnner, Mathieu4141, DinkoReversingLabs, basvanschaik, curiouspython1.

Of course, a huge thank you to all for your contributions 🥇

We hope this release will please you! Feel free to drop us a note about anything. We’re always happy to get feedback about our product usage, whether it’s to hear that everything works perfectly or to get some improvement ideas to.

Enhancements:

  • #9054 Implement decryptionPvk in SAML 2
  • #8897 Add a static parameter to fully disable the trash on the whole platform
  • #8842 Show opinion comments in the report overview
  • #8680 Add an option in TAXII f...
Read more

Version 6.3.13

16 Nov 11:45
1086daf
Compare
Choose a tag to compare

Bug Fixes:

  • #9042 Organization mapping is not working with Microsoft when "." is present in path
  • #9026 PDF viewer is broken everywhere

Full Changelog: 6.3.12...6.3.13

Version 6.3.12

15 Nov 15:16
190083d
Compare
Choose a tag to compare

Enhancements:

  • #8966 Improve auto fixing platform at start for missing queues in rabbitmq
  • #8923 Improve error message notification in the UI
  • #8870 Improve errors in httpPlatform to not always propagate to the last middleware
  • #8793 Add integration tests to playbooks

Bug Fixes:

  • #9015 File markings are not present in the stream
  • #8996 Create a public dashboard: when accessing the dashboard an error message in widget shown "you must be logged to do this"
  • #8976 PDF export of HTML content is broken
  • #8973 Empty SHA256/SHA1 field when modifying File Observable
  • #8899 [RBAC - Dashboard] Need "Manage credentials" capability for "Activity & History" perspective
  • #8838 Prevent deletion of the organization that is used as plateforme organization or attibuted to a user
  • #8761 TAXII collection not accessible which is created by user on the demo website.
  • #8721 [Playbooks] unable to filter on "Platform Creation Date" on "Query knowledge on regular basis"
  • #8688 Container: in Source mode, you need to click twice on Source mode to quit the source mode
  • #8611 Indicator pattern and standard id are not updated through stream sync
  • #8425 Massive relationships creation screen is not respecting default radius of 4 (left entity + match)
  • #8413 [AI] "Summaries file"on all files does not always work
  • #8324 Fail to ingest CSV feed
  • #8279 Threat actor top bar right loading is not properly aligned

Pull Requests:

Full Changelog: 6.3.11...6.3.12

Version 6.3.11

07 Nov 17:56
944d588
Compare
Choose a tag to compare

Bug Fixes:

  • #8942 Possible performance drop at ingestion due to heavy regular expression
  • #8911 [Request for takedown case] Related entities weird behavior
  • #8910 The design of the ‘create’ button for an observable must be aligned with the other create buttons
  • #8908 Investigation: cannot expand observables of type File
  • #8884 Header in creation drawer is not correct on observable
  • #8831 Investigation: Unable to expand any indicators linked to a file obervable
  • #8818 [Workbench] Relationships not created
  • #8809 [entities merging] incorrect kept file when files names conflicts
  • #8646 Long title on dashboards can mess with UI
  • #8571 Regression in massive operations on data tables

Pull Requests:

Full Changelog: 6.3.10...6.3.11

Version 6.3.10

05 Nov 18:42
e083712
Compare
Choose a tag to compare

Enhancements:

  • #8869 [backend] Improve performance by better targeting indices for query

Bug Fixes:

  • #8901 Public dashboard erros on some widgets when not configuring any time range
  • #8867 Permissions from External Auth Server Not Mapped to OpenCTI Platform Groups When Logging in via loginFromProvider
  • #8675 [OPENCTI-MODULE] INGESTION - Error with taxii handler CISA-GOV - Atribute Must be a string
  • #8560 Title not taken into account in Text widget
  • #8330 Hamburger buttons to update or delete an attack pattern within an incident doesn't work and redirect to the attack pattern page.
  • #8178 Entities validated in a report's analyst workbench are not included in the report
  • #7965 ImportFileStix2 - Importing STIX file from within a Grouping does not add the imported objects to the Grouping
  • #7620 Domain observable with underscore is incorrectly rejected
  • #6361 Creating a lot of relationships at once causes a timeout error

Pull Requests:

New Contributors:

Full Changelog: 6.3.9...6.3.10

Version 6.3.9

31 Oct 17:40
e788171
Compare
Choose a tag to compare

Bug Fixes:

  • #8837 Bug may lead to deletion of all entities in OpenCTI
  • #8800 Finding report duplicates does not work properly
  • #8767 Having a large number of Organizations slows down the playbooks
  • #8642 Extremely high CPU usage in workers
  • #8575 Report export to STIX2 brings start_time == stop_time for relations
  • #8282 Useless vertical scrollbar in custom dashboard + hidden by the header

Pull Requests:

Full Changelog: 6.3.8...6.3.9

Version 6.3.8

30 Oct 11:52
60e625f
Compare
Choose a tag to compare

Bug Fixes:

  • #8825 Enrichment panel do not open for SCOs
  • #8720 Improve info log level for task manager to help troubleshoot issues
  • #8682 Reset of the "display as" settings
  • #8656 [CI] multi-repository PR should default as PR target branch and not master
  • #7720 Extension is not always set to ".json" in dashboard export, which lead to not be able to re-import without renaming the file
  • #7697 [filters] 'lower than / equals' operator for date filters doesn't take 'equals' into account

Pull Requests:

Full Changelog: 6.3.7...6.3.8

Version 6.3.7

29 Oct 11:38
88697d0
Compare
Choose a tag to compare

Enhancements:

  • #8636 Avoid breaking UI when too many labels are associated to an entity
  • #8151 Upgrade CKeditor to latest version
  • #6643 Leaked Tokens are not revokable

Bug Fixes:

  • #8742 Retro-compatibility mappings mode for reindexing broke the SSO login
  • #8740 Data is not deduplicated when an entity under restriction (marking) is updated
  • #8726 [Dashboard] Two "name" filter
  • #8712 Missing author column in the home dashboard reports list
  • #8683 No error when updating an indicator with incorrectly formatted pattern
  • #8681 Not possible to view the list of reports authored by an organization
  • #8649 cannot create a public dashboard from the dashboard list
  • #8630 [Dashboard] Counter in knowledge perspective no longer takes into account time filter
  • #8599 Observables distribution graph is not respecting the height of the box
  • #8557 Creation Date display error after node edit in Investigation graph
  • #8506 open a new tab from listing
  • #8501 Not possible to CTRL+click directly on the left menu (first level)
  • #8483 Sightings tabs in observables are broken
  • #8442 English grammar errors in the titles of the default dashboard widgets
  • #8333 Missing entites in shared report
  • #8291 OpenCTI failed to validate YARA rules containing "\r" escape sequence in text strings.
  • #8288 The 'entities overview' loader is not the one used in the rest of the application
  • #8225 Bad icon used in connector overview
  • #8180 Inconsistency in potential duplicate warning messages
  • #8175 Layout issue when loading cases
  • #8101 Organisation Admins: multiple issues
  • #8058 Multiple issues in opinions
  • #7992 CSV import is buggy
  • #7797 [Workbench] Sightings default value displayed as Unknown
  • #7796 Error at relationships export in json
  • #7719 N subscribers is not correctly vertically centered within the button
  • #6361 Creating a lot of relationships at once causes a timeout error

Pull Requests:

New Contributors:

Full Changelog: 6.3.6...6.3.7