Releases: OpenCTI-Platform/opencti
Version 3.1.0
Dear community, OpenCTI 3.1.0 has been released! This major version marks another step towards the stable and professional platform that we want to build over the long term. Thanks to the amazing work of @richard-julien, the implementation of the test coverage of critical functions of the platform has solved no less than 30 major bugs. Above all, this integration tests coverage now allows the community to grow in serenity, since we have more and more organizations that want to contribute to the development of OpenCTI.
We have also improved integration performance for reports containing a large number of indicators. We can now start the ambitious construction of the next milestones alongside CERT-EU and ANSSI: analytics and visualizations, collaboration and notification functions, integration with SIEMs and EDRs, etc.
Enhancements:
- #513 Introduce test coverage of critical database functions (API)
Bug Fixes:
Version 3.0.3
OpenCTI 3.0.3 has been released! This version fixes some bugs found by community members in the platform as well as in the Python library. Thanks to the amazing work of @maertv from the @certeu, the CrowdStrike (Falcon CTI platform) connector has been released too!
For the next major release, @richard-julien is working hard on the full test coverage of the API source code and we will introduce a lot of new features in future works (refactoring the workspaces, generalization of graphs and enhancing a lot of visualizations). Also, be ready for engagement features: analysts comments, modification/audit logs, sightings, etc.
Enhancements:
- #537 Additional fields for filtering indicators
- #531 Order tags in list
- #480 Merge duplicates entities
- #246 Implement a bulk data manager for entities/relations (delete, merge, split, etc.)
Bug Fixes:
Version 3.0.2
Dear community, OpenCTI 3.0.2 has been released! We fixed a lot of bugs related to the new RBAC system as well as some slowness in the ingestion process provided by workers. We also released a first version of the VirusTotal connector and enhanced the vulnerabilities entities with new attributes (CVSS3).
We are working hard on the next release to dramatically extend the test coverage and develop the data curation features (de-duplicate, merge, split, bulk edit/delete).
Enhancements:
- #503 Have a more detailed view of description when adding entities
- #469 Drop-down selection options/suggestions don't appear until you type something
- #429 "Edit this Doc" button URL
- #322 Documentation/Default Script to be updated
- #257 Enhance vulnerability entity
- #147 Vulnerability : add external information
- #49 Implement vulnerability enrichment
Bug Fixes:
- #523 Lower performances of the ingestion process since 3.X
- #521 Unable to delete relations in reports
- #520 Unable to delete a tag on an actor
- #519 Disrepectancies between the general search field and the search field to add entities in a report
- #500 Display issue in the pannel to add entities to the knowledge of a report
- #451 Dates for very long term relations
Version 3.0.1
OpenCTI version 3.0.1 has been released! We hotfixed 6 bugs linked to the implementation of the RBAC capabilities. On the next milestone, we will work on the test coverage of the platform to strengthen our ability to develop the product and its features in depth. Thank you to all community members who reported these bugs.
Bug Fixes:
- #488 First seen date can be more recent than last seen date
- #511 Unable to add permissions to a group
- #510 Problem when trying to add an external reference to a Threat Report
- #509 Author field does not update after creation of the entity
- #514 Incident view load indefinitely
- #516 User roles/capabilities change doesn't clear the token cache
Version 3.0.0
Dear OpenCTI community, we are proud to announce the release of OpenCTI version 3.0.0. This version is a turning point in the OpenCTI roadmap, as we worked hard on the following objective: allow you to deploy OpenCTI in production within your organization with the right level of security and the expected stability and performances, turn OpenCTI into an enterprise-grade product.
One of the most important enhancement in this version is the implementation of the RBAC system, associated to 3 new authentication strategies (LDAP/AD, OpenID, etc.). You are now able to create roles and assign roles to users to grant them capabilities (read knowledge, update knowledge, import, manage accesses, etc.). The other feature is about reports and data. The import/export system is now stable (with the observed-data management) and we improved again the performances of write operations. We also speeded-up a lot a views (report knowledge graph, listing of some relationships, etc.).
A lot of improvements not related to the main features of this release have been made. We published a new connector to analyze and extract IOCs from PDF files thanks to a member of our community. Many bugfixes on the API and the frontend, new content in the documentation and the creation of the virtual machine template hosting the whole stack for testing purposes. As we prepare a lot of new enrichment connectors for observables, we introduced the max TLP option to avoid leaking sensitive information. Other knowledge connectors will be soon published: AlienVault, CrowdStrike, TheHive, and other vendors.
In a few days, we will send you a message with the date of our first webinar, during which we will present how the platform could be used in different types of organization. As we often say, it is just the beginning of an exciting adventure, with soon much more community activities, data management, intelligent subsystems, visualizations and investigations capabilities.
Enhancements:
- #487 Introduce kill chain view and diamond model
- #484 Automatic completion of marking when creating links
- #467 Enrichment connectors must have a "MAX TLP" config to avoid enrichment on sensitive data
- #466 Report views enhancement
- #442 Huge documentation enhancement
- #403 Creating "targets" relation between an Attack Pattern and a Vulnerability
- #398 Pre-installed OpenCTI iso or ready VM?
- #380 Add inference when action is linked to a specific malware
- #373 LDAP / SSO authentication
- #372 Automatically populate reports
- #330 threats to entities relations
- #329 Organization to threat actor relations
- #328 Organization to organization relations
- #260 Automatically compute the marking of entities/relations from reports
- #182 Change the behavior of auto-complete field
- #148 Workspaces : Add type of entity when selecting an entity for widget creation
- #86 Implement Lockheed Martin Cyber Kill Chain in model
- #75 Implement the RBAC system
- #62 Organisation : reliability
Bug Fixes:
Version 2.1.4
OpenCTI 2.1.4 has been released! This version hotfixes 4 bugs and introduces some technical enhancements in the migration system (no more errors when launching a fresh platform). We also fixed 2 bugs in the Python library that impacted the import of vulnerabilities through the CVE connector. Thank you to all community members who reported these bugs. We will now focus on the next milestone: workspaces, outputs and the full support of LDAP/SSO with roles and permissions (read only, read write, etc.).
Enhancements:
- #445 Fresh platform should not apply migrations
- #413 [Doc] nodejs version on Ubuntu 18.04 is too old
Bug Fixes:
Version 2.1.3
Dear community, OpenCTI version 2.1.3 has been released! We mainly focused our work on the stability of the whole product as well as the resolution of some major bugs. However, several new features have also been implemented, in particular the possibility of exporting lists of entities in STIX2 or CSV format: exporting campaign indicators, reports about an intrusion sets, all malwares, etc. We have completed the refactoring of the Python library and added all the methods that were still missing on some entity types as well as the file upload feature. For the next release, we will carry on our huge refactor of workspaces and statistics in general. We also plan to conduct a documentation working session to improve it in depth.
Last but not least, we will soon plan the organization of a webinar that will be didicated to OpenCTI basics but also a very interesting use case for both red teams and blue teams: how to put all knowledge about an incident in OpenCTI and replay it using Caldera. Double advantage of such a scenario: the capitalization of knowledge related to the incident as well as the ability to test the reaction of SOC / CSIRT in the event of a similar attack. Your feedback and your impressions are precious, do not hesitate to send us your use cases and the difficulties you encounter!
⚠️ Breaking changes ⚠️
Grakn Core Server has been upgraded from 1.5.9 to version 1.6.2. The migration process of existing data cannot be done automatically even if you are using the Grakn Docker container. You have to follow the migration procedure Upgrading an Existing Installation to Grakn Core 1.6.x. available in the Grakn documentation. If you have any trouble to make this work, we are available to help you on our Slack channel or you can reach the Grakn team directly on their channel.
Enhancements:
- #424 Enhance searching of entities
- #412 Add OR/AND option to filter Observables & Indicators
- #396 Infinite loading lists in observables and entities of a report
- #391 Export lists of objects (intrusion sets, indicators, etc.)
- #390 Duplicate function askEnrich in the API
- #388 Display the number of entities in each view/lists
- #371 Migrate to Grakn 1.6.1
- #360 Redirect to the requested page after login
- #345 Add tagging for Tools/Vulnerabilities/Observables/Reports
- #334 Tags for reports
- #123 Implement CSV export
Bug Fixes:
- #432 Uploading a PDF threat report results in "Cannot read property 'toLowerCase' of null" error
- #427 Organisation type vs category
- #419 Filter with no tag not working anymore
- #416 infinite loading of reports using specific sort options
- #415 Mutation intrusionSetAdd creates an intrusion set with the first_seen value as the last_seen value
- #410 Exception when importing STIX 2 Indicators due to invalid default type in valid_from
- #407 Mandatory properties are not filled for inferred relations
- #405 Displaying an indicator constantly refreshes the page
- #404 Cannot create an Indicator of type Mac-Addr or Directory
- #381 New reports are added without a set "Processing Status"?
Version 2.1.2
Dear community, the OpenCTI platform version 2.1.2 has been released! This version provides users of the platform with many new features that will allow them to better modelize their CTI knowledge. We have resolved the gap that existed between the OpenCTI data model and the STIX2 schema by definitively separating the concepts of observables and indicators. It is now possible to create indicator in various formats: STIX Pattern, Snort, Sigma, YARA, etc.
All graphics and visuals are now based on ElasticSearch queries to increase performance. This will allow us to completely rework the workspaces and make them real monitoring tools in the next release. Also we have disabled all inferences rules on the platform by default, so a very important screen has been added to the settings section, allowing users to enable inferences rules if they really need it. The MISP connector has been fully refactored and a documentation is available. Finally, we have added many examples to the Python library.
Enhancements:
- #383 Improve performance by using Elastic when searching for relations (when we can)
- #375 Enhance display of relations and separate inferred/not inferred
- #366 Use ElasticSearch for all statistics (timeseries, distribution, etc.)
- #349 Enhance loaders/spinners everywhere
- #335 Detection rules (yara, snort, suricata, sigma, etc)
- #316 Split indicator/observable concepts, create indicators from observables
- #162 Refactor the observables schema to match STIX2 references
- #145 Enable/disable inferences rules in settings
- #58 Observables : expiration date
- #57 Observables : scoring/rating
Bug Fixes:
- #369 Store the remote IDs in some ES entities is useless and performance killer
Version 2.1.1
OpenCTI 2.1.1 has been released! This version is hotfixing 5 bugs (4 in the API/Frontend and 1 in the Python library) found after the last release. Thank you to all people who reported these bugs so we can now work on the next milestone. The next milestone will be focused on: improving performances of charts and relations display in the UI, development of many outputs and graphics (killchains, diamond model, PDF export of knowledge, full refactor/enhancement of workspaces, graph view of entities, comparison of threats TTPs/infrastructure and introduction of indicator concept.
Bug Fixes:
Version 2.1.0
Dear community, the OpenCTI platform version 2.1.0 has been released! This version is an important step for the future developments of OpenCTI as a full Cyber Threat Intelligence product. We have worked on major issues and features directly linked to what you can expect from OpenCTI and what we need, as a developers team, to build a powerful and durable application. We have done a lot of work on indexing in ElasticSearch and in general all the way API methods are organized (removing more than 7K lines of useless source code). Ingestion and reading performance have been improved by 12x or by 20x in some cases.
We have also completed the data model and have introduced very useful features to allow you to fully modelize threats that may target your organization. You are now able to directly link an observable on a relation "threat/incident => uses => TTP", for instance to indicate the registry key used for persistence or the sender email address of the phishing message. The attack patterns list has been reshaped to a true killchain with the description of each relation to ensure a better understanding of analysts. Observables can now be linked together, allowing you for instance to link hashes together if it corresponds to the same file, or link an IP address that resolves a domain name.
Last but not least, we have fully refactored the Python library and started to write a proper documentation, you have now access to many useful examples to interact with the OpenCTI platform in the Github repository. We will continue our efforts to make OpenCTI an indispensable tool for CTI, SOC and CSIRT teams around the world. We will soon publish usage and integration tips in existing workflows and plan a usecases-oriented webinar in January 2020.
Enhancements:
- #351 Be able to reset the state of a connector in the UI
- #339 ATT&CK techniques not searchable with their code
- #336 Add the ID of Attack Patterns
- #332 Observables must be able to indicate relations
- #319 Technical error thrown when not logged in
- #317 Observables filtering
- #315 Add Minio version in the "About tab"
- #314 Global performances improvement
- #308 Relations between observables
- #268 Global search in parameter of URL
- #266 Add a tags field on creation forms
- #245 Killchain view for Attack Patterns
- #219 Unable to add "localized in" relation
- #109 Import is really really slow
- #67 Export all entities to STIX2 JSON