Anomali

No entries match these filters. Clear filters

1. What's New in ThreatStream — 2026-09-30 Sep 30, 2026 · release notes

   Granular investigation permissions and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v19.2 support for ThreatStream

   • Enables Organization Administrators to control view and manage permissions for Investigations via granular user roles
   • Adds support for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques from version 19.2 in ThreatStream

   2 details in Everything

2. What's New in ThreatStream Next Gen — 2026-09-17 Sep 17, 2026 · release notes

   ThreatStream Next Gen adds PIR tag/keyword filtering controls, DGA detection tab, and scheduled PIR source citations.

   • Adds tags and keywords combination control in the PIR Inputs step for threat model filtering
   • Adds support for reading comments from analyzed threat models in PIRs
   • Adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Matches and DGA Matches tabs to the Detections page with filtering and sorting
   • Adds a Sources section to scheduled PIR reports listing used threat models, observables, and investigations

   4 details in Everything

3. What's New in ThreatStream — 2026-09-17 Sep 17, 2026 · release notes

   ThreatStream adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. credential support for AI clients and enriches STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. exports with threat model entities

   • Adds MCP Credentials capability to connect MCP-compliant AI clients to ThreatStream (Limited Availability)
   • STIX 2.0 and 2.1 exports now include associated Actors, Campaigns, and other related threat model entities even without explicit relationship types
   • STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. exports add an option to control whether observables are included in the bundle

   3 details in Everything

4. What's New in ThreatStream Next Gen — 2026-08-31 Aug 31, 2026 · release notes

   ThreatStream Next Gen GA introduces Anomali Agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. with AURA orchestrator and Entity Management for unified identity/asset risk scoring.

   • Anomali Agentic SOC capabilities in Security Analytics are now generally available, introducing AURA (Anomali Unified Response Agent) as the orchestrator for triaging alerts, investigating incidents, and building case narratives.

   1 detail in Everything

5. What's New in ThreatStream Next Gen — 2026-08-05 Aug 5, 2026 · release notes

   ThreatStream Next Gen enhances PIR workflows with model reuse and improved history navigation.

   • PIR: Output step allows appending findings to an existing threat model instead of generating a new one
   • PIR: History tab now includes a summary banner with clickable counts for collected, tagged, and generated items

   2 details in Everything

6. What's New in ThreatStream — 2026-08-05 Aug 5, 2026 · release notes

   ThreatStream adds Phishing.Database and premium Yara/DomainTools feeds to APP Store.

   • Adds Phishing.Database - Active IPs open-source feed to the APP Store
   • Adds Phishing.Database - Active Domains open-source feed to the APP Store
   • Adds Google Threat Intelligence - Live Yara Rules Hunting premium feed to the APP Store
   • Adds DomainTools Domain Hotlist premium feed to the APP Store
   • Adds Socket.dev Open Source Software Threat Feed premium feed to the APP Store

   5 details in Everything

7. What's New in ThreatStream Next Gen — 2026-07-23 Jul 23, 2026 · release notes

   ThreatStream Next Gen adds a History tab with per-run diagnostic logs to PIR details pages

8. What's New in ThreatStream Next Gen — 2026-07-15 Jul 15, 2026 · release notes

   ThreatStream Next Gen adds Output Tags, Collection Tags, and tag filtering for security reports

   • Output Tags option added to the PIR creation wizard (Description step) to configure tags automatically applied to selected outputs
   • Tag creation and tag filtering added to Security Reports; PIR-generated reports include an output tag with the generating PIR's name
   • Collection Tags option added to the PIR creation wizard (Description step) to configure tags automatically applied to matched observables, threat models, and investigations
   • PIR execution can now associate collected observables with resulting threat models or investigations, configurable per output type

   4 details in Everything

9. What's New in Security Analytics — 2026-07-09 Jul 9, 2026 · release notes

   Adds Mimecast cloud logs ingestion via updated Mimecast API 2.0 integration

10. What's New in ThreatStream — 2026-07-08 Jul 8, 2026 · release notes

    ThreatStream removes Rapid7 InsightVM enrichment from App Store

11. What's New in ThreatStream Next Gen — 2026-06-24 Jun 24, 2026 · release notes

    ThreatStream Next Gen adds permission-based controls and per-PIR sharing for PIRs

    • Adds permission-based controls for PIRs, allowing Organization Administrators to configure user capabilities for create, edit, run, and delete operations on PIRs

    1 detail in Everything

12. What's New in ThreatStream — 2026-06-24 Jun 24, 2026 · release notes

    Adds ja4_tls_fingerprint indicator type, multiple new APP Store feeds, and PDRP Takedown Service to ThreatStream.

    • Adds ja4_tls_fingerprint indicator type to ThreatStream for tracking TLS handshakes
    • Makes the URLhaus Hostfile open-source feed available for activation in the APP Store
    • Enables the Anomali PDRP Takedown Service enrichment for submitting takedown requests via the APP Store
    • Goes generally available with self-service on-boarding for the Anomali PDRP Enhanced premium feed
    • Adds Cognyte: Luminar IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., LeakedCredentials, and AI Cyber Feeds premium feeds to the APP Store

    5 details in Everything

13. What's New in Search — 2026-06-24 Jun 24, 2026 · release notes

    Anomali Search gains an OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. Field Panel to browse schema fields and filter results directly from the UI.

    • Adds the OCSF Field Panel (Limited Availability) in Event Search for browsing OCSF Version 1.2.0 schema fields by category.

    1 detail in Everything

14. Anomali Copilot Extension and Office 365 Add-Ins Release History — 2026-06-23 Jun 23, 2026 · release notes

    Anomali Copilot adds Scan main content only setting in v6.0.10

15. What's New in ThreatStream Next Gen — 2026-06-10 Jun 10, 2026 · release notes

    ThreatStream Next Gen adds PIR lookback window configuration and Safari/Edge browser support

16. What's New in ThreatStream — 2026-06-10 Jun 10, 2026 · release notes

    ThreatStream adds Zscaler URL push, PDRP asset config, and multiple new premium/intel feeds via App Store

    • Zscaler integration pushes observables to the Custom Malicious URLs list in ZIA
    • PDRP feed allows configuration of organizational assets on the Assets page
    • App Store adds Check Point Exposure Management IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Intelligence and Doppel premium feeds
    • App Store adds Intel 471 Verity API-based premium feeds (Breach Alerts, FINTEL Reports, Geopolitical Reports, Information Reports, Malware Intelligence, Spot Reports, Vulnerability Reports, Credential Intelligence, Watcher Alerts)
    • App Store adds Anomali C2 Detection, Anomali Credential Monitoring, and Anomali Early Warning (powered by RedSense) premium feeds

    +1 more show less

    • App Store adds Ransomfeed - Real-Time Ransomware Intelligence open-source feed

    6 details in Everything

17. What's New in Search — 2026-06-10 Jun 10, 2026 · release notes

    Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. schema support for Search views

18. What's New in Security Analytics — 2026-05-28 May 28, 2026 · release notes

    Security Analytics adds resource tagging for alerts with filtering, bulk editing, and permission controls.

    • Expanded Resource Tagging (Limited Availability): Apply tags to Alerts and filter them by tags, as well as bulk edit tags and permissions across alerts.

    1 detail in Everything

19. What's New in ThreatStream — 2026-05-28 May 28, 2026 · release notes

    ThreatStream adds Zscaler OneAPI support, open-source feeds to APP Store, and OCSB schema RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.

    • Adds Zscaler OneAPI integration alongside the legacy Zscaler API for collecting threat data.
    • Makes Anomali Dark Web Intelligence and Anomali Threat Briefing open-source feeds available for activation in the APP Store.
    • Enables Organization administrators to configure Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. using OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. schema fields in addition to the standard eventlog schema.

    3 details in Everything

20. What's New in Search — 2026-05-28 May 28, 2026 · release notes

    Anomali introduces resource tagging, OCSA schema RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., and customizable export timestamps.

    • Adds the ability to apply tags to Saved Searches, Alerts, Views, Macros, and Lookup Tables, including filtering by tag and bulk editing permissions.
    • Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for Schemas using OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. schema fields alongside standard eventlog schema.
    • Enables full-text indexing, correlations, and turbosearch-based AQL querying on the OCSF schema.
    • Adds a selectable timestamp format (human-readable or UNIX) when exporting search results.

    4 details in Everything

21. What's New in ThreatStream Next Gen — 2026-05-27 May 27, 2026 · release notes

    ThreatStream Next Gen adds PIR expiry dates and industry-specific threat landscape views.

    • Adds expiry date configuration to PIRs at creation or edit time
    • Expands Global Threat Landscape in Command Center to 26 industry verticals using STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. and CISA critical infrastructure sectors

    2 details in Everything

22. What's New in ThreatStream — 2026-05-13 May 13, 2026 · release notes

    ThreatStream adds Premium Digital Risk Protection service, RansomLook.io OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feed, and entity export to existing threat models.

    • Adds Premium Digital Risk Protection (PDRP) service via the App Store for external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. monitoring
    • Adds RansomLook.io open source ransomware OSINT feed availability in the App Store
    • Adds ability to add investigation entities to an existing threat model

    3 details in Everything

23. What's New in ThreatStream Next Gen — 2026-04-30 Apr 30, 2026 · release notes

    Anomali ThreatStream Next Gen generally available with AI-powered threat detection and unified intelligence workflows.

24. What's New in ThreatStream — 2026-04-30 Apr 30, 2026 · release notes

    ThreatStream Next Gen GA brings AI-powered capabilities and unified intelligence workflows

25. What's New in ThreatStream — 2026-04-29 Apr 29, 2026 · release notes

    ThreatStream adds search_filter to Threat Model Search API and five new OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feeds.

    • Adds the search_filter attribute to the Threat Model Search API endpoint to allow applying saved search filters when querying threat model entities
    • Enables activation of Anomali Curated RSS, PhishDestroy, PhishHunt.io - Active Phishing Blocklist, ShadowWhisperer Malware Blocklist, and TweetFeed open-source feeds in the APP Store

    2 details in Everything

26. What's New in Search — 2026-04-29 Apr 29, 2026 · release notes

    Search Tabs UI for multiple concurrent searches; whois operator parses=true for filtered results

    • Adds whois operator parsed=true parameter to filter and aggregate WHOIS results without manual JSON parsing
    • Adds Search Tabs UI feature on the Search homepage to launch one or more simultaneous searches

    2 details in Everything

27. What's New in ThreatStream — 2026-04-15 Apr 15, 2026 · release notes

    ThreatStream adds new indicator types, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. vulnerability scoring, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login page, and Takedown service enhancements.

    • Adds mal_port, compromised_port, and compromised_password indicator types to ThreatStream
    • Introduces SSO-integrated beta login page for direct sign-in without navigating to IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. first
    • Adds EPSS Score, EPSS Percentile fields and EPSS-based filtering options to Vulnerability basic search filters

    3 details in Everything

28. What's New in Dashboards — 2026-04-15 Apr 15, 2026 · release notes

    Adds Dashboard Tagging and Bulk Editing (Limited Availability)

    • Enables dashboard resource tagging to organize and filter dashboards
    • Allows bulk editing of tags, sharing settings, owner, bookmarks, and deletion

    2 details in Everything

29. ThreatStream OnPrem Release History — 2026-04-15 Apr 15, 2026 · release notes

    ThreatStream OnPrem 6.0 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API support, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. JSON export, Anomali Copilot, new indicator types, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. audit log integration.

    • Adds OAuth 2.0 API Credentials for ThreatStream OnPrem authentication
    • Adds JSON format export option for Security coverage of MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. profiles
    • Adds support for benign_domain, phish_file_name, fraud_file_name, mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url indicator types in ThreatStream OnPrem
    • Enables integration of ThreatStream OnPrem audit logs with SIEM systems
    • Adds Anomali Copilot chat interface leveraging agentic search techniques to the ThreatStream OnPrem UI

    5 details in Everything

30. What's New in Search — 2026-04-15 Apr 15, 2026 · release notes

    Anomali search adds organization-wide dashboard tags, shannon_entropy calc function, and timechart addtotals

    • Adds Resource Tags for Dashboards to create and manage an organization-wide tag catalog for locating and organizing dashboards by applying multiple tags with appropriate user permissions
    • Adds the shannon_entropy information theory function to the calc operator to calculate an entropy score for any string field and identify unusual patterns in event data
    • Adds addtotals=true option to the timechart operator to view a summary across all groups and time periods based on event counts

    3 details in Everything

31. What's New in Security Analytics — 2026-03-31 Mar 31, 2026 · release notes

    Security Analytics adds asset lookup table imports and persistent alert triage workflows.

    • Adds asset data import from Qualys, Rapid7, Tenable, AWS or CSV uploads into the asset lookup table
    • Introduces Alert Triages with persistent comment history and richer side-panel context for investigation workflows

    2 details in Everything

32. What's New in Search — 2026-03-31 Mar 31, 2026 · release notes

    Anomali search adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. schema support, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. heatmaps with configurable gradients, and lookup tables for asset data.

    • Adds OCSF Schema Support (Limited Availability) to leverage OCSF-normalized event telemetry alongside eventlog
    • Adds Visualization Type (Limited Availability) for frequency view in MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. heatmaps with configurable gradients and tooltips
    • Adds Lookup Tables (Limited Availability) including asset and investigation_elements lookup tables for asset data and investigation querying

    3 details in Everything

33. What's New in ThreatStream — 2026-03-17 Mar 17, 2026 · release notes

    Adds undo/redo support for node additions, deletions, and positions in ThreatStream investigation entities.

34. What's New in ThreatStream — 2026-03-09 Mar 9, 2026 · release notes

    ThreatStream adds a new out-of-the-box ATR Dashboard for Middle East conflict APT activity monitoring

35. What's New in Search — 2026-03-04 Mar 4, 2026 · release notes

    Anomali Search adds limited-availability gti operator for enrichment and seasonal ARIMA support.

    • Adds the gti operator to enrich observables with Google Threat Intelligence verdicts and metadata
    • Updates the ARIMA operator to support seasonal time-series modeling in limited availability

    2 details in Everything

36. What's New in ThreatStream — 2026-03-02 Mar 2, 2026 · release notes

    ThreatStream adds an out-of-the-box Middle East Conflict ATR dashboard for real-time threat monitoring.

    • Adds the The Middle East Conflict: Iran–Israel–USA Cyber Threat Monitor ATR Dashboard to ThreatStream
    • Provides real-time threat intelligence coverage of the cyber dimensions of the ongoing military conflict involving Iran, Israel, and the United States

    2 details in Everything

37. What's New in Dashboards — 2026-02-19 Feb 19, 2026 · release notes

    Dashboards can now be exported as HTML and scheduled reports added.

    • Adds the ability to export dashboards in HTML format
    • Enables creation of scheduled dashboard reports

    2 details in Everything

38. What's New in ThreatStream — 2026-02-18 Feb 18, 2026 · release notes

    ThreatStream adds CERT.PL, Phishing Army, Binary Defense, and DomainTools Iris Detect feeds; enables GTI API request capping.

    • Adds CERT.PL Malicious Domain Blocklist, Phishing Army, and Binary Defense open source feeds in the APP Store.
    • Adds DomainTools - Iris Detect premium feed in the APP Store.
    • Adds API request limit configuration for Google Threat Intelligence premium feed users.

    3 details in Everything

39. What's New in ThreatStream — 2026-02-04 Feb 4, 2026 · release notes

    Adds new_domain indicator type to ThreatStream.

40. What's New in Search — 2026-02-04 Feb 4, 2026 · release notes

    Anomali Search introduces a Linear Regression visualization to analyze variable relationships.

    • Adds the Linear Regression visualization type to Search (Limited Availability)

    1 detail in Everything

41. What's New in ThreatStream — 2026-01-28 Jan 28, 2026 · release notes

    ThreatStream adds SpyCloud Enterprise Protection premium feed via the APP Store

42. What's New in ThreatStream — 2026-01-26 Jan 26, 2026 · release notes

    ThreatStream adds ServiceNow OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. support with assignment group/category mapping and consolidates Polyswarm sandbox results.

    • Adds OAuth 2.0 credential support for the ServiceNow integration to allow assigning an assignment group and category when creating or updating security incidents
    • Consolidates Polyswarm sandbox detonation reports into a single column on the Sandbox page, displaying platform, scan results, confidence score, and malicious detection count

    2 details in Everything

43. What's New in ThreatStream — 2026-01-21 Jan 21, 2026 · release notes

    ThreatStream adds GreyNoise Benign and Suspicious IPv4 premium feeds and increases custom RSS feed limit to 1,000.

    • Adds GreyNoise - Benign IPv4 Scanner and GreyNoise Suspicious IPv4 Scanner premium feeds via the APP Store for activation
    • Increases the maximum number of configurable custom RSS feeds per organization to 1,000

    2 details in Everything

44. What's New in ThreatStream — 2026-01-12 Jan 12, 2026 · release notes

    ThreatStream GA: User & Role Management enables platform-wide RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.

    • User & Role Management is generally available, establishing role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for the Anomali platform.

    1 detail in Everything

45. What's New in ThreatStream — 2026-01-08 Jan 8, 2026 · release notes

    ThreatStream App Store now includes the Ransomware.live open source feed for activation.

46. What's New in Search — 2026-01-07 Jan 7, 2026 · release notes

    Search adds haversine trigonometric function and automatic CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure./key-value extractions.

    • calc enables the haversine function to calculate distances between sequential login events for identifying geographically improbable logins
    • Automatic extraction of JSON, Common Event Format (CEF), and key-value field pairs on-the-fly using dotted notation

    2 details in Everything

47. What's New in Security Analytics — 2026-01-06 Jan 6, 2026 · release notes

    Adds Google SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. log ingestion support for curated and custom alerts.

48. What's New in ThreatStream — 2026-01-06 Jan 6, 2026 · release notes

    ThreatStream adds support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v18.0 techniques and sub-techniques.

49. What's New in ThreatStream — 2025-12-22 Dec 22, 2025 · release notes

    ThreatStream OnPrem Ubuntu v6.0 generally available

50. ThreatStream OnPrem Release History — 2025-12-22 Dec 22, 2025 · release notes

    ThreatStream OnPrem 6.0 adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. profile JSON export, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API creds, Google TI integration, and Anomali Copilot.

    • Adds created_ts and source_created fields for advanced search-based rule matching
    • Supports exporting MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profile security coverage in JSON format
    • Enables User & Role Management for role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 support for API Credentials
    • Activates Google Threat Intelligence integration for Passive DNS enrichments

    +3 more show less

    • Adds Anomali Copilot chat with agentic search capabilities in the UI
    • Introduces new indicator types: benign_domain, phish_file_name, fraud_file_name, mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url
    • Adds support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm malware detonation

    8 details in Everything

51. What's New in ThreatStream — 2025-12-10 Dec 10, 2025 · release notes

    ThreatStream adds Lock SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Configuration feature and VMRAY Essential feed

    • Adds ability to lock or unlock SSO settings via the Lock SSO Configuration feature to prevent unauthorized changes
    • Makes VMRAY - UniqueSignal - Essential premium feed available for activation in the APP Store

    2 details in Everything

52. What's New in Dashboards — 2025-12-10 Dec 10, 2025 · release notes

    Anomali Dashboards adds Role Based Access Control for user-created dashboards and refreshes the Dashboard Library UI

    • Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to restrict who can view or modify user-created dashboards.
    • Refreshes Dashboard Library UI with improved filtering and permission-aware dashboard listing.
    • Improves Dashboard Library experience by respecting sharing and permissions for out-of-the-box, shared, and custom dashboards.

    3 details in Everything

53. What's New in Search — 2025-12-10 Dec 10, 2025 · release notes

    Anomali Search adds IsolationForest operator, Decision Tree visualization, and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for lookup tables/macros.

    • Adds IsolationForest operator to isolate anomalies in high-volume event data using an unsupervised algorithm
    • Adds Decision Tree visualization type to explore tree-based machine learning models and their results
    • Enables role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for user-created lookup tables
    • Enables role-based access control for user-created macros

    4 details in Everything

54. What's New in Search — 2025-12-03 Dec 3, 2025 · release notes

    Anomali Search now supports automatic JSON field extractions to allow flexible AQL queries on unmapped fields.

    • Adds automatic JSON field extractions to enable viewing and using extracted fields in AQL queries for downstream analysis without requiring mapping to the standard Anomali eventlog schema

    1 detail in Everything

55. Anomali ThreatStream Integrator Release History — 2025-12-02 Dec 2, 2025 · release notes

    ThreatStream Integrator v8.5.7 adds Ubuntu 24.x support and removes older Ubuntu versions.

    • Supported OS list adds Ubuntu 24.x as a supported Linux operating system.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Ubuntu 18.x and 20.x have been removed from the list of supported Linux OS, breaking deployments on those versions.
56. What's New in ThreatStream — 2025-11-19 Nov 19, 2025 · release notes

    Adds Abusix Threat Intelligence premium feed to ThreatStream App Store

57. What's New in Search — 2025-11-19 Nov 19, 2025 · release notes

    Anomali Search adds Bubble Chart visualization type to identify multi-dimensional patterns in limited availability.

    • Adds Bubble Chart visualization type for representing three dimensions of data and identifying patterns or relationships across complex datasets.

    1 detail in Everything

58. What's New in ThreatStream — 2025-11-13 Nov 13, 2025 · release notes

    Anomali ThreatStream v2.1.2 release notes for Azure Sentinel extension available

    • Updates the Azure Sentinel extension to version v2.1.2.
    • Makes the updated extension downloadable from the ThreatStream Downloads page.

    2 details in Everything

59. What's New in ThreatStream — 2025-11-05 Nov 5, 2025 · release notes

    The Falconfeeds.io premium feed is now available for activation in the APP Store.

60. What's New in ThreatStream — 2025-10-21 Oct 21, 2025 · release notes

    Adds Cisco Umbrella API v2 support in the App Store for enrichment

61. What's New in Search — 2025-10-17 Oct 17, 2025 · release notes

    Anomali adds limited-availability CrowdStrike Operators for integration and data interaction.

62. What's New in ThreatStream — 2025-10-13 Oct 13, 2025 · release notes

    ThreatStream now supports importing observables from custom RSS feeds.

    • Adds Importing RSS Feeds capability to ingest observables from custom RSS sources
    • Adds Anomali Copilot-generated summaries for ingested RSS articles

    2 details in Everything

63. What's New in Search — 2025-10-08 Oct 8, 2025 · release notes

    Anomali Search adds full-text indexing of raw log messages for keyword search and reduced AVC consumption.

64. What's New in ThreatStream — 2025-10-07 Oct 7, 2025 · release notes

    Adds benign_domain indicator type to ThreatStream

65. What's New in ThreatStream — 2025-09-30 Sep 30, 2025 · release notes

    ThreatStream adds Google Threat Intelligence premium feed via the App Store for activation.

66. What's New in Anomali Copilot — 2025-09-25 Sep 25, 2025 · release notes

    Copilot chat responses now support Markdown formatting (lists, tables, code blocks, links)

67. What's New in Search — 2025-09-24 Sep 24, 2025 · release notes

    Search now supports wildcard-based matching for string fields in join operators with dynamic lookup tables.

68. What's New in ThreatStream — 2025-09-23 Sep 23, 2025 · release notes

    ThreatStream adds custom RSS feed management and Spamhaus Passive DNS integration

    • Adds the ability to import, configure, and manage custom RSS feeds on ThreatStream
    • Adds Spamhaus Passive DNS service for domain and IP address historical investigation

    2 details in Everything

69. What's New in Search — 2025-09-10 Sep 10, 2025 · release notes

    Adds limited availability Federated Search for multi-org queries and dynamic Text widget variables.

    • Adds Federated Search to query and retrieve data across multiple managed organizations while maintaining data isolation
    • Adds Visualization Type text widget support for system or custom variables to dynamically populate values from AQL data or user inputs

    2 details in Everything

70. What's New in ThreatStream — 2025-09-08 Sep 8, 2025 · release notes

    ThreatStream adds JSON export for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profile security coverage.

    • Adds JSON format support to the Exporting MITRE ATT&CK Profiles feature.

    1 detail in Everything

71. What's New in Search — 2025-09-04 Sep 4, 2025 · release notes

    Adds Timeline and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Heatmap/Flow visualizations to Anomali dashboards; enables column selection for bar charts.

    • Adds Timeline visualization type to visualize user and entity behavior in a timeline view
    • Adds MITRE ATT&CK Heatmap visualization type to add MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmaps to your dashboards
    • Adds MITRE ATT&CK Flow visualization type to add panels with attack flows to your dashboards
    • Allows selecting or hiding specific columns for plotting bar charts

    4 details in Everything

72. Anomali ThreatStream Integrator Release History — 2025-09-02 Sep 2, 2025 · release notes

    Anomali ThreatStream Integrator v8.5.6 adds wildcard indicator types and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. field support for custom CSV outputs

    • Adds mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url to the list of supported wildcard indicator types for Palo Alto Networks ThreatStream Integrator integration destinations.
    • Adds UUID to the selectable output fields for custom CSV destination files.

    2 details in Everything

73. What's New in Security Analytics — 2025-08-26 Aug 26, 2025 · release notes

    Alert Triage Result Entries configurable limit added; License Limits and Usage Dashboard replaces deprecated Data Usage feature.

    • Adds the ability to specify the number of result entries an alert returns upon triggering in Alert Triage.

    1 detail in Everything

74. What's New in ThreatStream — 2025-08-26 Aug 26, 2025 · release notes

    ThreatStream adds Excel upload support for attack flows

    • Supports uploading attack flows in Excel format.

    1 detail in Everything

75. What's New in Anomali Copilot — 2025-08-26 Aug 26, 2025 · release notes

    Anomali Copilot introduces the AI Actor Profile dashboard for accessing threat actor data.

    • New AI Actor Profile dashboard provides comprehensive data on all known threat actors and their aliases.

    1 detail in Everything

76. What's New in Dashboards — 2025-08-26 Aug 26, 2025 · release notes

    Anomali dashboards gain multi-tab support to enable more targeted and efficient data analysis within a single view.

    • Adds Dashboard Tabs feature allowing dashboards to support one or more tabs for targeted analysis.

    1 detail in Everything

77. What's New in ThreatStream — 2025-08-25 Aug 25, 2025 · release notes

    Adds MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. Control for managing multiple customer environments via the UI

    • Adds MSSP Control feature to manage Anomali environments of individual customers

    1 detail in Everything

78. What's New in ThreatStream — 2025-08-12 Aug 12, 2025 · release notes

    This update introduces a new integration capability for CrowdStrike Operator.

    • Adds the CrowdStrike integration under the Operator category in ThreatStream.

    1 detail in Everything

79. What's New in Dashboards — 2025-08-08 Aug 8, 2025 · release notes

    Dashboards: License Limits and Usage Dashboard is now available to all Security Analytics users.

    • Adds the License Limits and Usage dashboard view for monitoring license consumption.

    1 detail in Everything

80. What's New in Search — 2025-07-29 Jul 29, 2025 · release notes

    Search Auto-Complete feature added to Anomali for easier AQL query construction

    • Adds Search Auto-Complete to generate AQL suggestions while constructing queries

    1 detail in Everything

81. What's New in ThreatStream — 2025-07-28 Jul 28, 2025 · release notes

    ThreatStream adds Google Threat Intelligence enrichment via the App Store

82. ThreatStream AirGap Release History — 2025-07-25 Jul 25, 2025 · release notes

    ThreatStream AirGap 5.6 adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15-v17 support, CSV feed integration, and multi-queue import configuration.

    • Adds support for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. versions 15.1, 16.1, 17.0, and 17.1
    • Adds support for the multi-queue feature allowing configuration of import workers

    2 details in Everything

83. Anomali SyncApp Release History — 2025-07-22 Jul 22, 2025 · release notes

    Anomali SyncApp 5.6 adds OpenSSL v3.x support for Ubuntu 22.x and fixes PDF rendering in synced Threat Bulletins

84. What's New in Search — 2025-07-16 Jul 16, 2025 · release notes

    Anomali adds superapi operator for internal ThreatStream API calls from AQL.

85. What's New in ThreatStream — 2025-07-15 Jul 15, 2025 · release notes

    ThreatStream adds the ability to add and export Attack Flow layouts within Investigations.

    • Adds Attack Flow layout support inside Investigations, allowing users to map attack flows directly into an investigation entity.
    • Enables exporting Attack Flows created in Investigations to the global attack flow library via a new export option.

    2 details in Everything

86. What's New in ThreatStream — 2025-07-14 Jul 14, 2025 · release notes

    ThreatStream adds four new wildcard indicator types and a Google Threat Intelligence integration for PassiveDNS

    • Adds mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url as supported indicator types in ThreatStream.
    • Adds support for the Google Threat Intelligence integration to include its data in PassiveDNS enrichments.

    2 details in Everything

87. What's New in ThreatStream — 2025-07-08 Jul 8, 2025 · release notes

    Adds initial Infoblox Threat Defense extension (v1.0.0) for ThreatStream

88. What's New in Search — 2025-07-02 Jul 2, 2025 · release notes

    Anomali adds a Limited Availability Copilot widget to dashboards for AI-powered threat hunting insights

89. What's New in Security Analytics — 2025-07-01 Jul 1, 2025 · release notes

    Adds ability to ingest event telemetry data from cloud log sources via API calls.

90. What's New in ThreatStream — 2025-07-01 Jul 1, 2025 · release notes

    ThreatStream adds phish_file_name and fraud_file_name indicator types

    • phish_file_name indicator type is added to ThreatStream
    • fraud_file_name indicator type is added to ThreatStream

    2 details in Everything

91. What's New in ThreatStream — 2025-06-30 Jun 30, 2025 · release notes

    ThreatStream enables filtering by created_ts and source_created in advanced search-based rules

    • created_ts and source_created fields are now supported for advanced search-based rule matching

    1 detail in Everything

92. What's New in Security Analytics — 2025-06-24 Jun 24, 2025 · release notes

    Retrosearch API /api/v1/xdr/retrosearch is deprecated; migrate to Search API and turbosearch.

    └──▷ BREAKING ON UPGRADE

    • !The /api/v1/xdr/retrosearch endpoint is deprecated; integrations must switch to the Search API.
93. What's New in ThreatStream — 2025-06-18 Jun 18, 2025 · release notes

    Anomali ThreatStream releases QRadar app v3.0.2

    • QRadar app updated to version 3.0.2

    1 detail in Everything

94. What's New in Search — 2025-06-18 Jun 18, 2025 · release notes

    timechart operator now supports makecontinuous flag to fill empty time buckets

95. What's New in ThreatStream — 2025-06-17 Jun 17, 2025 · release notes

    Adds Flexera Software Vulnerability Research premium feed and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v17.0/v17.1 support to ThreatStream.

    • Activates the Flexera Software Vulnerability Research premium feed from the APP Store
    • Supports MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques associated with v17.0 and v17.1

    2 details in Everything

96. What's New in Search — 2025-06-16 Jun 16, 2025 · release notes

    New Subsearch feature enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. queries within main searches to filter, manipulate, or correlate results across multiple tables.

    • Adds Subsearch capability to embed a search query within the main search for filtering, manipulating, or correlating results across multiple tables.

    1 detail in Everything

97. What's New in ThreatStream — 2025-06-10 Jun 10, 2025 · release notes

    Mandiant DTM premium feed now available for activation in the ThreatStream APP Store.

98. What's New in ThreatStream — 2025-05-23 May 23, 2025 · release notes

    ThreatStream v2025-05-23 adds Crowdstrike Falcon extension v1.7.1

99. What's New in ThreatStream — 2025-05-20 May 20, 2025 · release notes

    ThreatStream adds limited User & Role Management and enhanced Polyswarm sandbox submissions.

    • Enables role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. via the new User & Role Management feature for the Anomali platform
    • Adds support for multiple platform submissions in Sandbox malware detonation on Polyswarm
    • Adds QR code scanning capability for Sandbox malware detonation on Polyswarm
    • Adds file password protection support for Sandbox malware detonation on Polyswarm
    • Adds URL and file artifact submission support for Sandbox malware detonation on Polyswarm

    5 details in Everything

100. What's New in ThreatStream — 2025-05-19 May 19, 2025 · release notes

     ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and ThaiCert open source feeds in APP Store; deactivates TeamT5 APAC and OpenPhish

     • Activates MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Attack open source feed via the APP Store for threat intelligence enrichment
     • Activates ThaiCert open source feed via the APP Store for regional threat data integration

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The TeamT5 APAC Centric APT Intelligence Report premium feed has been deactivated and removed from the APP Store.
     • !The OpenPhish.com open-source feed has been deactivated and removed from the APP Store.
101. ThreatStream OnPrem Release History — 2025-05-08 May 8, 2025 · release notes

     ThreatStream OnPrem 5.9 adds ServiceNow bidirectional integration, new MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. profiles, and expanded indicator types

     • Adds Can Audit permission control setting to the User Admin tab in Settings
     • Enables bidirectional integration with ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows., configurable via the Integrations tab in Settings with domain dropdown selection
     • Supports MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1 and v16.1 techniques/sub-techniques and allows creation of multiple MITRE ATT&CK profiles with independent security coverage representation
     • Increases character limit for advanced search queries to 4,000 characters

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Integration with RiskIQ is no longer available due to end-of-life
102. What's New in Security Analytics — 2025-05-05 May 5, 2025 · release notes

     Anomali Security Analytics adds new Log Source Management feature for ingesting telemetry data.

     • Adds Log Source Management capability (Limited Availability) to add event telemetry data from various log sources using one or more ingestion methods

     1 detail in Everything

103. Anomali ThreatStream Integrator Release History — 2025-04-30 Apr 30, 2025 · release notes

     ThreatStream Integrator v8.5.4 adds Palo Alto Networks support for CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. indicator types and expands Trellix NitroSecurity compatibility.

     • Adds suspicious_ipcidr, suspicious_ipv6cidr, mal_ipcidr, and mal_ipv6cidr CIDR indicator types to the Palo Alto Networks destination sync process
     • Adds support for Trellix NitroSecurity versions 11.6.10 through 11.6.14

     2 details in Everything

104. What's New in ThreatStream — 2025-04-11 Apr 11, 2025 · release notes

     ThreatStream adds 42 new indicator types including web3 and benign variants.

     • asn, aws_account_id, benign_device_id, benign_email, benign_hash, benign_internal_email, benign_ip, benign_url, bitcoin_wallet, botnet_user_agent, cloud_instance_id, cobalt_strike_id, compromised_company, corp_vpn_ip, crypto_wallet, customer_account_id, device_serial_number, employee_id, encrypted_file_ext, exploit_cve_id, iam_user_id, internal_dns_name, internal_host_id, internal_ticket_id, mobile_malware, phone_number, phishing_target, platform_uid, session_token, suspicious_cmd_line, sso_session_id, telegram_id, threat_actor_hostname, tox_id, twitter_handle, visitor_token, web3_attack_vector, web3_compromised_wallet, web3_dns_hijacking, web3_exploitable_code, web3_malicious_contract, web3_malicious_token, web3_phishing_domain, xampp_jabber_id are now supported indicator types

     1 detail in Everything

105. What's New in Dashboards — 2025-03-24 Mar 24, 2025 · release notes

     Dashboards can now be cloned within the organization.

     • Adds dashboard cloning capability.

     1 detail in Everything

106. What's New in Search — 2025-03-17 Mar 17, 2025 · release notes

     Anomali Search introduces Views to create field aliases for direct query reference.

107. What's New in ThreatStream — 2025-03-13 Mar 13, 2025 · release notes

     ThreatStream adds Anomali Query Language (AQL) search available to all customers.

108. What's New in Search — 2025-03-13 Mar 13, 2025 · release notes

     AQL Search now supports observables and threat_models Lookup Tables for threat intelligence queries

     • Adds observables Lookup Table to AQL Search for querying ThreatStream observables
     • Adds threat_models Lookup Table to AQL Search for querying ThreatStream threat models

     2 details in Everything

109. What's New in Security Analytics — 2025-02-20 Feb 20, 2025 · release notes

     Adds alert triage capability when creating a search event alert in Security Analytics

110. What's New in ThreatStream — 2025-02-17 Feb 17, 2025 · release notes

     ShadowServer premium feed added to ThreatStream APP Store for activation

111. What's New in Security Analytics — 2025-02-12 Feb 12, 2025 · release notes

     Adds audit logging for user actions on dashboards.

     • Enables Audit Logs for Dashboards to track user interactions with dashboard objects.

     1 detail in Everything

112. Anomali Copilot Extension and Office 365 Add-Ins Release History — 2025-02-11 Feb 11, 2025 · release notes

     Adds turbosearch operator support to Anomali Copilot extension for viewing matches.

113. What's New in ThreatStream — 2025-02-11 Feb 11, 2025 · release notes

     Adds five new C2-related indicator types to ThreatStream detection capabilities.

     • Adds c2_dns_name indicator type for detecting command-and-control DNS names
     • Adds freq_abused_dns_provider indicator type for identifying frequently abused DNS providers
     • Adds mal_relay_server_ip indicator type for malicious relay server IPs (IPv4)
     • Adds mal_relay_server_ipv6 indicator type for malicious relay server IPs (IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.)
     • Adds suspected_c2_dns_name indicator type for suspected C2 DNS names

     5 details in Everything

114. What's New in Search — 2025-02-04 Feb 4, 2025 · release notes

     Anomali rebrands riskiq_ssl to mdti_ssl operator for ThreatStream enrichment

     └──▷ BREAKING ON UPGRADE

     • !The riskiq_ssl operator is renamed to mdti_ssl; queries using the old name will fail until updated.
115. What's New in Dashboards — 2025-02-03 Feb 3, 2025 · release notes

     New visualization types are now available for Anomali dashboards.

     • Adds new visualization types to the dashboard editor

     1 detail in Everything

116. What's New in ThreatStream — 2025-01-28 Jan 28, 2025 · release notes

     ThreatStream allows integrating multiple Feedly stream IDs in the APP Store.

     • Adds support for configuring multiple feedly_stream_id values per premium feed entry

     1 detail in Everything

117. What's New in ThreatStream — 2025-01-24 Jan 24, 2025 · release notes

     ThreatStream v1.7.0 Crowdstrike Falcon Integrator extension release

118. What's New in Search — 2025-01-24 Jan 24, 2025 · release notes

     Adds Anomali Virtual Compute (AVC) framework for measuring virtualized infrastructure usage during compute operations.

119. What's New in ThreatStream — 2025-01-21 Jan 21, 2025 · release notes

     ThreatStream gains Microsoft Defender TI integration and new platform navigation; RiskIQ support ends.

     • Enables activation of the Microsoft Defender Threat Intelligence enrichment via the APP Store to enrich threat data
     • Makes the new Anomali platform navigation generally available, with classic navigation removed after Jan 31, 2025

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The integration with RiskIQ and RiskIQ enrichment are no longer available in ThreatStream.
120. Anomali ThreatStream Integrator Release History — 2025-01-17 Jan 17, 2025 · release notes

     ThreatStream Integrator v8.5.1 defaults Intelligence API v2 for new installs and adds Trellix HX support

     • New installations default to Intelligence API version 2, enabling shared filter language between ThreatStream and Integrator.
     • Adds support for Trellix HX (formerly FireEye HX) as a destination.

     2 details in Everything

121. What's New in Search — 2025-01-17 Jan 17, 2025 · release notes

     The convert operator now accepts a header field argument to control which column becomes the table header during row/column rotation.

122. What's New in Search — 2025-01-08 Jan 8, 2025 · release notes

     Search functionality enhanced with drill-down capability for aggr operator results.

     • aggr operator now supports (Optional) drill-down into aggregated values to launch a new search

     1 detail in Everything

123. What's New in Search — 2025-01-02 Jan 2, 2025 · release notes

     Anomali Search adds +/- fields operator support, listinv for ThreatStream investigations, and fromjson extraction.

     • Adds + and - prefixes to the fields operator to optionally include or exclude specific columns in result tables
     • Introduces the listinv operator to retrieve a list of ThreatStream investigations
     • Updates the fromjson operator to extract top-level keys from JSON objects and create tabular results

     3 details in Everything

124. What's New in Search — 2024-12-19 Dec 19, 2024 · release notes

     Enhanced Search capability allowing direct access to JSON fields and array indexing.

     • Operate on JSON fields to expedite its use other different operators, including JSON arrays using positional indexing.

     1 detail in Everything

125. What's New in ThreatStream (2024) — 2024-12-16 Dec 16, 2024 · release notes

     ThreatStream adds InsightVM vulnerability management enrichment via the App Store

126. What's New in Search — 2024-12-06 Dec 6, 2024 · release notes

     Adds streamstats, listindest, and loadjob operators to the search stream for cumulative stats, destination listing, and job loading.

     • Adds streamstats operator to generate cumulative statistics for each event in your data, streaming up to the current event
     • Adds listindest operator to list configured Integrator destinations by integrator instance
     • Adds loadjob operator to load events or results of a previously completed search job query

     3 details in Everything

127. What's New in Search — 2024-12-05 Dec 5, 2024 · release notes

     Adds inlist operator to Search for checking field presence in lookup table columns

     • Enables the inlist operator to check if a field value is present in a lookup table column

     1 detail in Everything

128. What's New in Security Analytics — 2024-11-14 Nov 14, 2024 · release notes

     Adds role-based search to control how far back in time users can search event log data

129. What's New in Security Analytics — 2024-11-11 Nov 11, 2024 · release notes

     Anomali Security Analytics now offers limited availability audit logging to help admins monitor user actions.

     • Adds Audit Logging (Limited Availability) for administrators to audit user activity and view the history of different user actions.

     1 detail in Everything

130. Anomali ThreatStream Integrator Release History — 2024-11-06 Nov 6, 2024 · release notes

     ThreatStream Integrator v8.5.0 adds MISP informational data option and expands SDK destination retry logic

     • Adds include_informational option to MISP destination configuration to push metadata alongside indicators
     • Adds support for Infoblox version 9.0 platform integration

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Source filter default in the setup wizard changed from * (all indicators) to a placeholder, requiring explicit user configuration
131. What's New in Search — 2024-11-05 Nov 5, 2024 · release notes

     Adds Gantt Time Series and Text visualizations to dashboards, plus out-of-the-box macros for ThreatStream data.

     • Adds Gantt Time Series visualization type to analyze data based on date information across specific timeframes
     • Adds Text visualization type to add Markdown-formatted text panels to your dashboards
     • Adds out-of-the-box macros to fetch and analyze ThreatStream data without building complex search queries

     3 details in Everything

132. ThreatStream OnPrem Release History — 2024-10-28 Oct 28, 2024 · release notes

     ThreatStream OnPrem 5.8 adds Red Hat 8.10 support, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. connection command, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. Notes, and advanced search fields.

     • source_locations and target_locations intelligence fields added to Advanced Search and Filtering
     • New command to establish a connection between ThreatStream OnPrem and ThreatStream TAXII server
     • Added support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 Notes in Analyze > Observables
     • Polyswarm sandbox service added for malware detonation
     • Can Audit permission control setting added to User Admin tab in Settings

     5 details in Everything

133. What's New in Search — 2024-10-25 Oct 25, 2024 · release notes

     Anomali Search now supports Lookup Tables and Macros, with turbosearch operator enhancements for historical data analysis.

     • Lookup tables are now generally available from the Search menu

     1 detail in Everything

134. What's New in Dashboards — 2024-10-18 Oct 18, 2024 · release notes

     Adds variable and panel dependency configuration to Dashboards

     • Added an ability to configure variable and panel dependencies in Dashboard Settings

     1 detail in Everything

135. What's New in Dashboards — 2024-10-16 Oct 16, 2024 · release notes

     Anomali release brings AQL Dashboards to GA for security visualization.

     • AQL Dashboards are now generally available for visualizing security and IT operations trends.

     1 detail in Everything

136. What's New in Search — 2024-10-16 Oct 16, 2024 · release notes

     Adds AQL Search APIs to issue, monitor status, and retrieve results via REST.

     • Exposes AQL Search APIs for issuing new searches, monitoring their status, and receiving results via the REST interface

     1 detail in Everything

137. What's New in ThreatStream (2024) — 2024-10-14 Oct 14, 2024 · release notes

     ThreatStream adds the ability to create multiple MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profiles with independent security coverage.

     • MITRE ATT&CK Profiles — Allows creating and managing multiple distinct profiles in ThreatStream
     • Multiple MITRE ATT&CK Profile support — Enables mapping different security coverage representations per profile

     2 details in Everything

138. What's New in Anomali Copilot — 2024-10-08 Oct 8, 2024 · release notes

     Anomali Copilot chat now numbers source references for each response part

     • Adds numbered source indicators to Anomali Copilot chat responses to map text to origins

     1 detail in Everything

139. What's New in ThreatStream (2024) — 2024-09-24 Sep 24, 2024 · release notes

     ThreatStream adds Anomali Takedown Service and ReversingLabs Spectra Analyze enrichment apps to the APP Store

     • Adds Anomali Takedown Service as an activatable app in the ThreatStream APP Store for data enrichment.
     • Adds ReversingLabs Spectra Analyze as an activatable app in the ThreatStream APP Store for data enrichment.

     2 details in Everything

140. What's New in Security Analytics — 2024-09-23 Sep 23, 2024 · release notes

     Anomali Security Analytics adds MS Office 365 log source support

141. What's New in Anomali Copilot — 2024-09-23 Sep 23, 2024 · release notes

     Anomali Copilot Asset Analyzer feature is now generally available.

142. What's New in ThreatStream (2024) — 2024-09-18 Sep 18, 2024 · release notes

     Initial release of the Cofense Vision extension for ThreatStream (v1.0.0)

143. What's New in Security Analytics — 2024-09-11 Sep 11, 2024 · release notes

     The release introduces NXLog support for log ingestion.

     • Added support for NXLog.

     1 detail in Everything

144. What's New in Search — 2024-09-06 Sep 6, 2024 · release notes

     Anomali Search gains first/last aggregation functions and a set operator for combining subsearch results.

     • Adds first and last aggregation functions to return the first and last entry in a search result set
     • Adds set operator to generate a table from two subsearches with a set operation applied

     2 details in Everything

145. What's New in Search — 2024-09-05 Sep 5, 2024 · release notes

     Anomali Search adds fieldsummary and snowincident AQL operators for output analysis and ServiceNow integration.

     • Adds fieldsummary operator to generate a summary of output fields from the AQL
     • Adds snowincident operator to create an incident in ServiceNow

     2 details in Everything

146. What's New in ThreatStream (2024) — 2024-09-04 Sep 4, 2024 · release notes

     ThreatStream adds Anomali Botnets & C2 Intelligence and IBM X-Force premium feeds to the APP Store.

     • Adds Anomali Botnets & C2 Intelligence feed activation to the ThreatStream APP Store
     • Adds IBM X-Force premium feed activation to the ThreatStream APP Store

     2 details in Everything

147. What's New in ThreatStream (2024) — 2024-09-03 Sep 3, 2024 · release notes

     Adds ReversingLabs Spectra Intelligence enrichment to ThreatStream APP Store

148. What's New in Search — 2024-09-03 Sep 3, 2024 · release notes

     Search now supports anomalousvalue, cluster, and predict operators for advanced analytics.

     • Adds anomalousvalue operator to compute anomaly scores per field across events
     • Adds cluster operator to generate data clusters based on similarity
     • Adds predict operator to make predictions for time series data

     3 details in Everything

149. What's New in Search — 2024-09-02 Sep 2, 2024 · release notes

     Anomali Search: Updated examples for the json_extract function in calc operator

150. What's New in ThreatStream (2024) — 2024-08-27 Aug 27, 2024 · release notes

     ThreatStream adds a domain selection dropdown to the ServiceNow integration activation process.

151. What's New in Security Analytics — 2024-08-23 Aug 23, 2024 · release notes

     Adds Cribl as a new log source in Security Analytics for expanded telemetry ingestion.

152. What's New in Anomali Copilot — 2024-08-22 Aug 22, 2024 · release notes

     Custom Copilot for analyzing custom data is now generally available.

     • Adds the Custom Copilot feature, enabling analysis of custom data, moving from beta to general availability.

     1 detail in Everything

153. What's New in ThreatStream (2024) — 2024-08-22 Aug 22, 2024 · release notes

     ThreatStream v15.1 adds support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques and sub-techniques.

     • Supports MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques associated with v15.1

     1 detail in Everything

154. What's New in Search — 2024-08-22 Aug 22, 2024 · release notes

     Anomali Search introduces the concurrency operator for counting overlapping spans in search queries.

     • Adds the concurrency operator to allow searching and aggregating events based on span overlaps.

     1 detail in Everything

155. What's New in Security Analytics — 2024-08-20 Aug 20, 2024 · release notes

     Adds Azure Alert Forwarding capability in Anomali Security Analytics

     • Added support for forwarding all types of alerts to Azure.

     1 detail in Everything

156. What's New in Search — 2024-08-16 Aug 16, 2024 · release notes

     Adds Sankey diagram visualization type for displaying proportional flow rates.

157. What's New in ThreatStream (2024) — 2024-08-15 Aug 15, 2024 · release notes

     ThreatStream adds ThreatBook CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. and Mandiant v4 premium feeds via the App Store.

158. What's New in Search — 2024-08-15 Aug 15, 2024 · release notes

     Adds Heatmap visualization type and addinv, outlier, transpose operators for ThreatStream investigations.

     • Adds the Heatmap visualization type to display data as a color-coded matrix for identifying patterns and anomalies
     • Adds the addinv operator to append elements to an existing ThreatStream investigation
     • Adds the outlier operator to modify numeric outputs for input fields containing outliers
     • Adds the transpose operator to create pivot tables for use in visualizations

     4 details in Everything

159. What's New in Security Analytics — 2024-08-14 Aug 14, 2024 · release notes

     Alert throttling configuration added for Event Search alerts in Security Analytics

     • Enables configurable alert throttling for Event Search alerts to reduce notification volume

     1 detail in Everything

160. What's New in ThreatStream (2024) — 2024-08-13 Aug 13, 2024 · release notes

     ThreatStream adds support for six new indicator types including actor_phone_number and ransomware_group.

161. What's New in Search — 2024-08-13 Aug 13, 2024 · release notes

     Adds ability to inject relative and absolute URLs into ThreatStream and Security Analytics domains within visualizations.

162. What's New in Search — 2024-08-09 Aug 9, 2024 · release notes

     Adds anomalydetection operator and mvzip function for advanced search queries

     • anomalydetection operator to find outliers in numeric fields.
     • mvzip function with the calc operator to create a new multivalue field with concatenated values from two other multivalue fields.

     2 details in Everything

163. What's New in Search — 2024-07-29 Jul 29, 2024 · release notes

     Search now supports uuid function within calc operator for dynamic UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. generation.

     • Adds uuid function to the calc operator to generate UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. in search queries
     • Improves flexibility of the calc operator by enabling UUID generation capabilities

     2 details in Everything

164. What's New in Security Analytics — 2024-07-24 Jul 24, 2024 · release notes

     Adds webhook support for forwarding Event Search alerts to third parties

165. What's New in Search — 2024-07-24 Jul 24, 2024 · release notes

     Anomali Search adds the contingency (ctable) operator for cross-table value occurrence analysis.

     • Adds the contingency (alias: ctable) operator to generate a cross table of field value occurrences

     1 detail in Everything

166. What's New in Security Analytics — 2024-07-18 Jul 18, 2024 · release notes

     Security Analytics adds append capability to CSV Import for lookup tables

167. What's New in ThreatStream (2024) — 2024-07-18 Jul 18, 2024 · release notes

     ThreatStream adds 13 new indicator types for gaming and social platforms.

168. What's New in ThreatStream (2024) — 2024-07-15 Jul 15, 2024 · release notes

     ThreatStream adds bidirectional integration with ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows..

169. What's New in ThreatStream (2024) — 2024-07-09 Jul 9, 2024 · release notes

     ThreatStream adds Target Industry field to Import Assistant and Feedly premium feed integration

     • Adds Target Industry field to the Import Assistant UI for mapping observables
     • Makes Feedly for Threat Intelligence premium feed available via activation in the APP Store

     2 details in Everything

170. ThreatStream OnPrem Release History — 2024-07-08 Jul 8, 2024 · release notes

     ThreatStream OnPrem v5.8 adds multihoming, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. location support, Sigma evaluation in AQL, Polyswarm sandbox, and new UI fields.

     • Adds source_locations and target_locations intelligence fields for advanced search and filtering
     • Adds OS upgrade to Ubuntu 22 LTS and password authentication to Elastic Search
     • Adds Source Locations and Target Locations fields to Import Assistant, observable details pages, and Threat Models
     • Adds 325 STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 locations (27 regions, 247 countries, 50 US States, Washington DC) support
     • Adds 'Add to New (for each rule match)' action to rules for creating investigations per match

     +6 more show less

     • Adds AQL Search capability to initiate Sigma rule evaluation from a Sigma signature details page
     • Adds Export MITRE ATT&CK to JSON option to investigation details pages export menu
     • Adds Polyswarm as a sandbox service for malware detonation
     • Adds Can Audit permission control setting to User Admin tab
     • Allows Read Only users to view their API Key on the My Profile tab
     • Adds support for STIX 2.1 Notes in Observable details

     11 details in Everything

171. What's New in ThreatStream (2024) — 2024-07-03 Jul 3, 2024 · release notes

     Adds suspicious_md5 indicator type to ThreatStream

172. What's New in ThreatStream (2024) — 2024-07-02 Jul 2, 2024 · release notes

     ThreatStream adds a Limit field to the Virus Total v3 enrichment activation wizard.

173. What's New in ThreatStream (2024) — 2024-06-12 Jun 12, 2024 · release notes

     ThreatStream adds Polyswarm sandbox service for malware detonation.

174. What's New in Anomali Copilot — 2024-06-10 Jun 10, 2024 · release notes

     Anomali Copilot adds an edit feature to chat sessions.

175. What's New in ThreatStream (2024) — 2024-06-07 Jun 7, 2024 · release notes

     ThreatStream enables Read Only users to view their API Key via the My Profile tab.

176. What's New in ThreatStream (2024) — 2024-06-04 Jun 4, 2024 · release notes

     ThreatStream adds ten new Anomali Copilot RSS feed sources via the App Store for 2024.

     • Adds News and Research RSS feeds from Facebook, Intezer Blog, Duskrise Blog, Infoblox, Recorded Future, Red Canary Blog, Redsense, SecureWorks, Symantec, and The Diffreport Blog to the Anomali Copilot App Store

     1 detail in Everything

177. What's New in ThreatStream (2024) — 2024-05-21 May 21, 2024 · release notes

     ThreatStream adds Source Locations field to Import Assistant and threat models

     └──▷ BREAKING ON UPGRADE

     • !The Location field in the Import Assistant is renamed to Target Locations.
     • !The Locations attribute and search filter for threat models are renamed to Target Locations.
178. What's New in ThreatStream (2024) — 2024-05-20 May 20, 2024 · release notes

     Adds Tenable.io enrichment via the APP Store for ThreatStream users.

     • New Tenable.io integration available in the APP Store for data enrichment.

     1 detail in Everything

179. What's New in ThreatStream (2024) — 2024-05-10 May 10, 2024 · release notes

     ThreatStream adds location field to Import Assistant for observable assignments.

     • location field is added to the Import Assistant allowing you to assign target locations when importing observables and creating threat models.

     1 detail in Everything

180. Anomali Copilot Extension and Office 365 Add-Ins Release History — 2024-05-09 May 9, 2024 · release notes

     Anomali Copilot 6.0 adds chat tab, side panel UI, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ID copying and direct Event Search links.

     • Adds a Chat tab to the Anomali Copilot browser extension (Chrome/Edge/Firefox) for conversational interaction.
     • Adds a side panel view for the Anomali Copilot browser extension.
     • Enables copying MITRE entity IDs directly from the Scan tab.

     3 details in Everything

181. What's New in Security Analytics — 2024-04-29 Apr 29, 2024 · release notes

     Adds ingesting logs via HTTP API Gateway in Anomali Security Analytics.

     • Added support for ingesting logs uploaded via an HTTP API Gateway.

     1 detail in Everything

182. What's New in ThreatStream (2024) — 2024-04-23 Apr 23, 2024 · release notes

     Adds Export MITRE ATT&CK to JSON option in ThreatStream investigation details pages for direct JSON export of MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. models.

183. Anomali SyncApp Release History — 2024-04-10 Apr 10, 2024 · release notes

     Anomali SyncApp 5.5 adds a health check script to verify appliance functionality and minimum system requirements.

184. ThreatStream AirGap Release History — 2024-04-10 Apr 10, 2024 · release notes

     ThreatStream AirGap 5.5 adds Ubuntu 22 LTS support, appliance health check command, Postgres password management, and package export script.

     • Added support for Ubuntu 22 LTS as the operating system for the ThreatStream AirGap virtual machine
     • Added a package export script
     • Added support for Postgres password management

     3 details in Everything

185. Anomali Copilot Extension and Office 365 Add-Ins Release History — 2024-04-02 Apr 2, 2024 · release notes

     Anomali Copilot adds Safari extension distribution and Proxy URL config support

     • Adds browser extension setting to specify a proxy URL for the ThreatStream site

     1 detail in Everything

186. What's New in Anomali Copilot — 2024-03-01 Mar 1, 2024 · release notes

     Anomali Copilot generative AI solutions reach general availability.

     • Anomali Copilot generative AI suite is generally available.

     1 detail in Everything

187. What's New in ThreatStream (2024) — 2024-02-27 Feb 27, 2024 · release notes

     ThreatStream adds Add to New action for rule matches and two new Symantec premium feeds.

     • Adds Add to New (for each rule match) action to rules for creating investigations from matches
     • Adds Symantec Malicious Files premium feed availability in the APP Store
     • Adds Symantec Malicious URLs premium feed availability in the APP Store

     3 details in Everything

188. What's New in ThreatStream (2024) — 2024-02-20 Feb 20, 2024 · release notes

     ThreatStream adds support for STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. Notes entities

189. What's New in Security Analytics — 2024-02-14 Feb 14, 2024 · release notes

     Adds Enable Splunk HTTP Event Collector action for scheduled retrospective searches

190. What's New in ThreatStream (2024) — 2024-02-12 Feb 12, 2024 · release notes

     ThreatStream adds cross-investigation visibility for observables and updates the Investigations UI.

     • Adds the ability to view other open investigations associated with selected observables during an investigation.

     1 detail in Everything

191. What's New in ThreatStream (2024) — 2024-02-08 Feb 8, 2024 · release notes

     The release adds a new permission setting to the User Admin tab.

192. Anomali Copilot Extension and Office 365 Add-Ins Release History — 2024-02-07 Feb 7, 2024 · release notes

     First GA release of Anomali Copilot Extension and Office 365 Add-ins with Match integration.

     • General availability of the Anomali Copilot browser extension and Office-365 Add-ins (formerly Lens+)
     • Observables matching Anomali Match but unknown in ThreatStream are now marked as Match to help detect zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. threats
     • Enhanced summary flow for a faster experience

     3 details in Everything

193. ThreatStream OnPrem Release History — 2024-02-02 Feb 2, 2024 · release notes

     ThreatStream 5.7 adds ja3_md5 indicators, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. heat maps, Attack Surface Management features, and STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. incident support.

     • Adds ja3_md5 indicator and threat types to ThreatStream for JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. hash analysis
     • Adds vuln_risk_score indicator type to ThreatStream
     • Adds target_industry and target_region intelligence fields for searching by region and industry
     • Adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tab with heat map to Threat Model details pages
     • Adds ability to import, update, and export MITRE attack flows in Attack Flows

     +7 more show less

     • Adds Asset Inventory tab to the renamed Attack Surface Management product
     • Adds asset tagging feature to Attack Surface Management
     • Adds Export to PDF option to the Export menu of Investigations
     • Adds Can Use Rules permission control setting on the User Admin tab of Organization settings
     • Adds support for STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1/TAXII incidents
     • Adds support for MITRE ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques v13.1 and v14.1
     • Adds modular upgrade support with visible steps for the upgrading process

     12 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The contains search operator no longer supports values consisting of less than 3 characters
     • !Support for the VMRay Freemium sandbox service is discontinued
     • !The Cuckoo sandbox service is no longer available for new ThreatStream users
194. What's New in Search — 2024-02-01 Feb 1, 2024 · release notes

     New IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Match and Ignite dashboards, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. integration for ThreatStream and AQL, UEIBA algorithms, and AQL search capabilities.

     • Adds the IOC Match Dashboard for visibility into critical and trending IOC detections
     • Adds the Ignite Dashboard with endpoint analytics panels to investigate source hosts
     • Enables SOAR alerts to add tags to ThreatStream observables or send AQL results via AQL operators
     • Supports UEIBA algorithms including ARIMA, DBSCAN, k-means clustering, LinearRegression, LocalOutlierFactor, LogisticRegression, and StandardScaler
     • Introduces AQL Search to perform analytic functions on IT operations logs, security event logs, and lookup tables

     5 details in Everything

195. What's New in ThreatStream (2024) — 2024-01-30 Jan 30, 2024 · release notes

     ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework integration in v14.1, enabling detection and analysis based on attack techniques.

196. What's New in ThreatStream (2023) — 2023-12-21 Dec 21, 2023 · release notes

     ThreatStream adds the Anomali Phishing & Fraud intelligence channel in the APP Store

197. What's New in ThreatStream (2023) — 2023-12-11 Dec 11, 2023 · release notes

     New Can Use Rules permission control and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v13.1 support in ThreatStream

     • Adds the Can Use Rules permission control setting to the User Admin tab for finer-grained access management.
     • Adds support for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques associated with version 13.1.

     2 details in Everything

198. What's New in ThreatStream (2023) — 2023-11-21 Nov 21, 2023 · release notes

     The 2023 update for ThreatStream introduces the new Attack Surface Management Tagging feature.

199. What's New in ThreatStream (2023) — 2023-11-17 Nov 17, 2023 · release notes

     ThreatStream adds Recorded Future Vulnerability Risk List and multiple Auto Lens+ RSS feeds to the APP Store

     • Adds Recorded Future Vulnerability Risk List premium feed available for activation in the APP Store
     • Adds open source Auto Lens+ powered RSS feeds to the APP Store: Advisory - RedPacket Security, Advisory - UI CERT, News - HITB Sec News, News - Graham Cluley Blog, Research - Akamai, Research - Cofense, Research - Kaspersky, and Research - Palo Alto Networks

     2 details in Everything

200. What's New in ThreatStream (2023) — 2023-11-15 Nov 15, 2023 · release notes

     ThreatStream adds support for incidents via STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services..

     • Adds STIX 2.1 incident support for TAXII exchanges
     • Updates entity attribute schema to match Supported Attributes for STIX Entities specification

     2 details in Everything

201. ThreatStream OnPrem Release History — 2023-10-31 Oct 31, 2023 · release notes

     ThreatStream OnPrem 5.6 adds TLP v2.0 support, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. v2 access controls, weekly ASA reports, and bulk observable search.

     • Adds TLP: Amber+Strict classification and replaces TLP: White with TLP: Clear in Advanced Search queries to support TLP v2.0
     • Adds toggles to control access to API roots of discovery URLs for TAXII v2.0 and v2.1 imports in the TAXII settings page
     • Adds phish_victim_email indicator type for observables linked to phishing attack victims
     • Enables weekly Attack Surface Assessment (ASA) reports for identifying vulnerabilities and misconfigured services (requires subscription)
     • Allows bulk keyword search across all observables from the universal search interface

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Anomali Community Visibility setting is no longer supported for import mailboxes.
202. What's New in ThreatStream (2023) — 2023-10-11 Oct 11, 2023 · release notes

     ThreatStream adds target_industry and target_region fields for searching and labeling actors, malware, incidents, tools, and bulletins.

203. What's New in ThreatStream (2023) — 2023-10-05 Oct 5, 2023 · release notes

     ThreatStream adds Auto Lens+ subscription type to APP Store filter options for Community and Enterprise versions.

204. What's New in ThreatStream (2023) — 2023-09-25 Sep 25, 2023 · release notes

     ThreatStream adds Bitdefender-powered Adversary and Vulnerability & Exploit Intelligence channels via the APP Store.

     • Adds Anomali Adversary Intelligence channel powered by Bitdefender
     • Adds Anomali Vulnerability & Exploit Intelligence channel powered by Bitdefender

     2 details in Everything

205. What's New in ThreatStream (2023) — 2023-09-21 Sep 21, 2023 · release notes

     ThreatStream adds ja3_md5 indicator and threat type support for new detection capabilities

     • Adds the ja3_md5 indicator type to ThreatStream for analyzing TLS JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. hashes
     • Adds the ja3_md5 threat type to ThreatStream for correlating threats via JA3 hashes

     2 details in Everything

206. What's New in ThreatStream (2023) — 2023-09-14 Sep 14, 2023 · release notes

     New Auto Lens+ RSS feeds available in APP Store; advanced search body operator behavior updated

     • Adds support for eight new open source Auto Lens+ powered RSS feeds in the APP Store: Advisory - AU CERT, Advisory - FI CERT, News - Hackread, News - Heimdal Security Blog, News - Security Affairs, Research - Fox IT, Research - Netlab 360, and Research - Rapid7.

     1 detail in Everything

207. What's New in ThreatStream (2023) — 2023-09-13 Sep 13, 2023 · release notes

     ThreatStream adds a Default Landing Page setting to the My Profile page for customizing post-login navigation.

208. What's New in ThreatStream (2023) — 2023-09-06 Sep 6, 2023 · release notes

     Adds Export to PDF option for ThreatStream investigations.

     • Investigations now support exporting directly to a PDF file via the Export menu.

     1 detail in Everything

209. What's New in ThreatStream (2023) — 2023-09-05 Sep 5, 2023 · release notes

     ThreatStream enables importing, updating, and exporting MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Attack flows via the new Attack Flow Library.

210. What's New in ThreatStream (2023) — 2023-08-29 Aug 29, 2023 · release notes

     ThreatStream adds Auto Lens+ powered RSS feeds from multiple vendors to the APP Store

211. What's New in ThreatStream (2023) — 2023-08-28 Aug 28, 2023 · release notes

     Adds a MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tab to threat model details pages.

212. Anomali ThreatStream Integrator Release History — 2023-08-21 Aug 21, 2023 · release notes

     ThreatStream Integrator v8.3 adds sync failure email alerts and extension upgrade notifications.

     • Adds email alerts to specified recipients when a source or destination sync failure occurs
     • Adds a notification pop-up that displays when an upgrade to an existing Integrator extension is available

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !McAfee NitroSecurity (ESM) destination name is renamed to Trellix NitroSecurity (ESM)
213. What's New in ThreatStream (2023) — 2023-08-09 Aug 9, 2023 · release notes

     Adds eight new Auto Lens+ powered RSS feeds to the ThreatStream App Store.

     • Advisory - BE CERT RSS feed available for activation in the APP Store
     • Advisory - Digital Sicher BSI RSS feed available for activation in the APP Store
     • Advisory - Sweden CERT RSS feed available for activation in the APP Store
     • News - Cybereason RSS feed available for activation in the APP Store
     • News - Naked Security RSS feed available for activation in the APP Store

     +3 more show less

     • News - WeLiveSecurity RSS feed available for activation in the APP Store
     • Research - Crowdstrike RSS feed available for activation in the APP Store
     • Research - Symantec Enterprise RSS feed available for activation in the APP Store

     8 details in Everything

214. What's New in ThreatStream (2023) — 2023-08-04 Aug 4, 2023 · release notes

     ThreatStream adds Attack Surface Management with new Asset Inventory tab

     └──▷ BREAKING ON UPGRADE

     • !The previous Attack Surface Assessment product name is changed to Attack Surface Management.
215. What's New in Security Analytics — 2023-08-03 Aug 3, 2023 · release notes

     Anomali Security Analytics adds ingestion support for AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. and Azure Event Hubs logs

     • Adds AWS Application Load Balancer log ingestion capability to the event telemetry pipeline
     • Adds Azure Event Hubs log ingestion capability to the event telemetry pipeline

     2 details in Everything

216. What's New in ThreatStream (2023) — 2023-08-01 Aug 1, 2023 · release notes

     ThreatStream Observables page receives new look and feel.

217. What's New in ThreatStream (2023) — 2023-07-31 Jul 31, 2023 · release notes

     ThreatStream adds support for eight new Auto Lens+ powered RSS feeds via the APP Store.

     • Adds Auto Lens+ powered RSS feed connectors: Advisory - FR CERT, Advisory - Cisco Talos Intelligence, News - Dark Reading, News - Security Week, News - ZDNet, Research - SecureWorks, Research - F5 Labs, and Research - Sophos.

     1 detail in Everything

218. ThreatStream OnPrem Release History — 2023-07-31 Jul 31, 2023 · release notes

     ThreatStream OnPrem 5.6 adds TLP Clear support, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. access toggles, bulk observable search, and weekly Attack Surface Assessment reports.

     • Adds TLP: Clear indicator (replacing TLP: White) to support TLP v2.0
     • Adds new setting in Settings > TAXII to skip strict checking of unresolved domains during imports
     • Adds toggles in Settings > TAXII to control access to API roots of discovery URLs for TAXII v2.0 and v2.1
     • Adds phish_victim_email indicator type for emails of phishing attack victims
     • Adds weekly Attack Surface Assessment (ASA) reports via the Analyze menu to identify vulnerabilities and misconfigured services

     +2 more show less

     • Enables bulk keyword search for observables in the Advanced Search page
     • Adds toggle in Settings > Email Notifications (My Profile page) to receive immediate email notifications when a rule is disabled

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Anomali Community Visibility setting for import mailboxes is no longer supported
219. What's New in ThreatStream (2023) — 2023-07-28 Jul 28, 2023 · release notes

     ThreatStream adds vuln_risk_score indicator type and updates Splunk App to v6.7

     • Adds the vuln_risk_score indicator type for storing vulnerability risk scores.
     • Updates the ThreatStream Splunk App to version 6.7.

     2 details in Everything

220. What's New in Security Analytics — 2023-07-28 Jul 28, 2023 · release notes

     Anomali Security Analytics adds configurable alert actions and the ability to delete scheduled retrospective search jobs

     • List on Activity Page, Send Email, Add to Investigation, Forward Syslog, and Forward to Splunk HTTP Collector are new configured alert actions for Link alerts.

     1 detail in Everything

221. What's New in ThreatStream (2023) — 2023-07-21 Jul 21, 2023 · release notes

     ThreatStream adds trial activation for three Team Cymru premium feeds via the APP Store.

222. What's New in ThreatStream (2023) — 2023-07-14 Jul 14, 2023 · release notes

     ThreatStream adds Auto Lens+ RSS feeds and threat model entity details; renames feed/stream terminology.

     • Adds eight Open Source Auto Lens+ RSS feeds (JP CERT, DataBreach Today, Microsoft Security Blogs, Threatpost, Cyble, Mandiant, McAfee, Securelist) available for activation in the APP Store
     • Adds organization user total view count of intelligence to threat model entities
     • Renames stream to feed, source optimizer to feed optimizer, and replaces API/field names stream_id/stream_name with feed_id/feed_name in the ThreatStream interface

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !API/field names stream_id and stream_name are replaced by feed_id and feed_name; existing integrations relying on the old field names must update their queries or payloads.
223. What's New in ThreatStream (2023) — 2023-06-30 Jun 30, 2023 · release notes

     Adds phish_victim_email indicator type for phishing attack victims.

224. What's New in ThreatStream (2023) — 2023-06-28 Jun 28, 2023 · release notes

     ThreatStream adds config for TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. import domain checking and updates search UI.

     • Adds a setting to skip strict checking of unresolved domains during TAXII imports
     • Updates the universal search results page with a new look and feel

     2 details in Everything

225. What's New in Security Analytics — 2023-06-28 Jun 28, 2023 · release notes

     Anomali Security Analytics now splits Threat Model activity search results into distinct IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and IOA tabs for clearer analysis.

     • Adds separate IOC Matches and IOA Matches tabs to the Threat Model activity search details pages

     1 detail in Everything

226. What's New in ThreatStream (2023) — 2023-06-27 Jun 27, 2023 · release notes

     ThreatStream adds Bitdefender Mobile and Ransomware premium feeds via APP Store

227. What's New in ThreatStream (2023) — 2023-06-16 Jun 16, 2023 · release notes

     ThreatStream adds private tags for STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. imports and the Global Security Event Intel intelligence channel.

     • Adds support for additional private tags when importing STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 1.x XML files
     • Adds support for additional private tags when configuring TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 1.x sites
     • Introduces the Anomali Global Security Event Intel intelligence channel in the APP Store

     3 details in Everything

228. What's New in ThreatStream (2023) — 2023-06-15 Jun 15, 2023 · release notes

     ThreatStream adds retrospective search for threat models, template cloning, and CSV investigation export.

     • Adds Retrospective Search option to the Actions menu of Match-supported threat models
     • Adds clone option to the Actions menu for the Anomali Default Template in Threat Model Export Report Templates
     • Enables exporting investigations to a CSV file from Investigation details pages

     3 details in Everything

229. What's New in ThreatStream (2023) — 2023-06-08 Jun 8, 2023 · release notes

     ThreatStream adds a new email notification capability for Org Admins, triggered specifically when alert rules are disabled within the platform.

     • Disabled Rule Notifications setting added to the My Profile page for Org Admins

     1 detail in Everything

230. What's New in Security Analytics — 2023-06-08 Jun 8, 2023 · release notes

     Anomali Security Analytics adds AWS SQS/S3 asset ingestion and customizable alert Query Delay offset.

     • Adds support for ingesting asset data from Amazon Web Services SQS or S3 locations to the Managing AWS Asset Data Imports workflow
     • Allows customizing the Query Delay offset for continuous-schedule alerts, defaulting to 2 hours

     2 details in Everything

231. What's New in Security Analytics — 2023-06-01 Jun 1, 2023 · release notes

     Security Analytics adds aggregation view to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Match Search results

     • IOC Match Search now aggregates search results when an event log matches multiple indicators or an indicator has multiple source feeds, showing the aggregation count with an expander in the leftmost column.

     1 detail in Everything

232. What's New in ThreatStream (2023) — 2023-05-26 May 26, 2023 · release notes

     ThreatStream adds access control toggles for TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. v2.0 and v2.1 API roots.

     • Adds taxii_v2_api_root_access config key to control visibility of TAXII v2.0/v2.1 API discovery endpoints
     • Enables granular access management for TAXII feed discovery URLs via configuration toggles

     2 details in Everything

233. What's New in ThreatStream (2023) — 2023-05-22 May 22, 2023 · release notes

     ThreatStream adds Disconnect.me Malware, Malvertising, and Digitalside MISP OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feeds via App Store.

     • Adds Disconnect.me Malware open source feed available for activation in the APP Store.
     • Adds Disconnect.me Malvertising open source feed available for activation in the APP Store.
     • Adds Digitalside MISP open source feed available for activation in the APP Store.

     3 details in Everything

234. What's New in ThreatStream (2023) — 2023-05-19 May 19, 2023 · release notes

     ThreatStream adds drag-and-drop table settings for list views

235. What's New in ThreatStream (2023) — 2023-05-18 May 18, 2023 · release notes

     ThreatStream adds WhoisXMLAPI premium enrichment via APP Store

236. What's New in ThreatStream (2023) — 2023-05-12 May 12, 2023 · release notes

     Adds four free Auto Lens+ GPT-powered RSS feeds to the APP Store for ThreatStream

237. What's New in Security Analytics — 2023-05-10 May 10, 2023 · release notes

     Anomali Security Analytics adds Microsoft Defender ATP alert ingestion and preferred tag support for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. actions.

     • Adds Microsoft Defender ATP event telemetry integration to ingest alerts
     • Enables use of organization's Preferred Tags with the Add tags to IOCs action

     2 details in Everything

238. What's New in ThreatStream (2023) — 2023-05-09 May 9, 2023 · release notes

     ThreatStream adds Dataminr Pulse premium feed via the APP Store.

239. What's New in ThreatStream (2023) — 2023-05-01 May 1, 2023 · release notes

     ThreatStream adds blank status filtering, 10k domain limit for ASA, and PDF widget selection.

     • Enables filtering Attack Surface Assessment issues with a blank status
     • Increases the maximum number of domains for assessment to 10,000
     • Allows selecting specific widgets for export to a PDF file in the UI

     3 details in Everything

240. What's New in ThreatStream (2023) — 2023-04-28 Apr 28, 2023 · release notes

     ThreatStream adds advanced search filters to find feeds by name.

241. What's New in ThreatStream (2023) — 2023-04-26 Apr 26, 2023 · release notes

     ThreatStream adds premium feeds and threat model report configuration options

     • Adds Bitdefender Intelligence - APTs, C2 Servers, Phishing and Fraud, and Vulnerabilities as activatable premium feeds in the APP Store.
     • Adds an option to include or exclude a description heading in threat model report templates.

     2 details in Everything

242. What's New in ThreatStream (2023) — 2023-04-25 Apr 25, 2023 · release notes

     ThreatStream adds a refresh option to retrieve latest enrichment data for observables.

243. What's New in ThreatStream (2023) — 2023-04-24 Apr 24, 2023 · release notes

     Anomali ThreatStream adds Energy Defense channel and auto-approves low-confidence observables from import mailboxes

     • Adds the Anomali Energy Defense intelligence channel in the APP Store.
     • Auto-approves and includes low confidence observables imported from import mailboxes.

     2 details in Everything

244. What's New in ThreatStream (2023) — 2023-04-21 Apr 21, 2023 · release notes

     ThreatWorx premium feed available in APP Store; Splunk App v6.6.3 released.

     • Adds the ThreatWorx Threat and Vulnerability Intelligence premium feed to the APP Store for activation.
     • Releases Splunk App v6.6.3 for ThreatStream.

     2 details in Everything

245. What's New in Security Analytics — 2023-04-21 Apr 21, 2023 · release notes

     Security Analytics adds support for automatic mapping of Microsoft Defender alert, device, and email events in the log source integration.

246. Anomali ThreatStream Integrator Release History — 2023-04-20 Apr 20, 2023 · release notes

     ThreatStream Integrator v8.2 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. auth, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. for destinations, live logging changes, and removes Bro Intel.

     • Adds Enable Single Sign-on option to security settings for ThreatStream credential login
     • Supports STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 format for custom destination exports

     2 details in Everything

247. What's New in Security Analytics — 2023-04-19 Apr 19, 2023 · release notes

     Security Analytics adds ingestion of Google Cloud Platform VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. flow and firewall logs.

248. What's New in ThreatStream (2023) — 2023-04-17 Apr 17, 2023 · release notes

     Adds node details hover and chart panning to ThreatStream investigations.

     • Investigations: View node details by hovering over nodes and move the chart around the workspace by right clicking on the chart of investigation entities.

     1 detail in Everything

249. What's New in ThreatStream (2023) — 2023-04-05 Apr 5, 2023 · release notes

     ThreatStream adds mouse wheel zooming to the Investigations UI

250. What's New in ThreatStream (2023) — 2023-04-04 Apr 4, 2023 · release notes

     ThreatStream increases email import address limit from 10 to 20.

     • Increases the number of supported email import addresses for receiving observables to 20.

     1 detail in Everything

251. What's New in Security Analytics — 2023-04-04 Apr 4, 2023 · release notes

     Anomali Security Analytics adds IOA Match visibility to ThreatStream investigations across IOA Match, Alerts, and Forensics & Retrospective Activity pages.

     • Adds IOA Match results visibility in ThreatStream investigations from the IOA Match search page
     • Adds IOA Match results visibility in ThreatStream investigations from the Alerts search page
     • Adds IOA Match results visibility in ThreatStream investigations from the Forensics & Retrospective Activity search page

     3 details in Everything

252. What's New in ThreatStream (2023) — 2023-03-31 Mar 31, 2023 · release notes

     ThreatStream OnPrem v5.5 adds Attack Surface Assessment asset details and User Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. key reset.

     • Adds Asset details pages to the Attack Surface Assessment feature to view specific asset information.
     • Adds an ability to reset a user's API Key from the User Admin page for easier account management.

     2 details in Everything

253. ThreatStream AirGap Release History — 2023-03-31 Mar 31, 2023 · release notes

     ThreatStream AirGap 5.4 adds support for Ubuntu 20.04 LTS operating system.

     • Adds Ubuntu 20.04 LTS as the supported OS for the ThreatStream AirGap virtual machine.

     1 detail in Everything

254. What's New in ThreatStream (2023) — 2023-03-29 Mar 29, 2023 · release notes

     ThreatStream adds GreyNoise-Malicious IPv4 Scanner and Recorded Future Alerts premium feeds in APP Store.

     • Adds GreyNoise-Malicious IPv4 Scanner premium feed available for activation in the APP Store
     • Adds Recorded Future Alerts premium feed available for activation in the APP Store

     2 details in Everything

255. Anomali Match OnPrem Release History — 2023-03-24 Mar 24, 2023 · release notes

     Anomali Match OnPrem 4.6.0 adds tagging alerts via ThreatStream, Splunk HTTP forwarding, and Rapid7 InsightVM asset import

     • Add tags to IOCs alert action sends a request to ThreatStream to add selected tags to the indicator intelligence when an alert rule is triggered.
     • Forward to Splunk HTTP Collector alert action forwards the alert message to Splunk via its HTTP Event Collector when a rule is triggered.
     • Added support for importing asset data from Rapid7 InsightVM Console.

     3 details in Everything

256. What's New in ThreatStream (2023) — 2023-03-23 Mar 23, 2023 · release notes

     ThreatStream adds bulk keyword search for observables via a new bulk search feature.

     └──▷ HOW TO FIND IT
     Search for multiple indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. in a single operation.
     📍Performing Bulk Observable Searches
     • Adds the ability to perform bulk keyword searches to find specific observables.

     1 detail in Everything

257. What's New in ThreatStream (2023) — 2023-03-15 Mar 15, 2023 · release notes

     ThreatStream adds Attack Surface Grade widget to Attack Surface Assessment reports

258. What's New in ThreatStream (2023) — 2023-02-28 Feb 28, 2023 · release notes

     ThreatStream adds bulk tag management for Threat Models, enhanced Custom Dashboard personalization, a new UI for Streams, and Recorded Future-Large Risk List support.

     • Adds ability to bulk edit (add and remove) tags of Threat Models via Bulk Tag Management
     • Enhances Custom Dashboards with widget notes, customizable date ranges, and additional editing options for personalization
     • Redesigns the Streams list page UI within Managing Feeds
     • Enables activation of the Recorded Future-Large Risk List premium feed in the APP Store

     4 details in Everything

259. Anomali SyncApp Release History — 2023-02-28 Feb 28, 2023 · release notes

     Anomali SyncApp 5.3 adds a Backfill Monitor to track intelligence download progress in Source mode.

     • Backfill Monitor tracks progress of large intelligence backfills, showing download status for different intelligence types and overall completion.
     • Workflow change in dual SyncApp configuration changes the location of downloaded observable snapshots in a source SyncApp compared to v5.2.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The location of downloaded observable snapshots in a source SyncApp has changed compared to v5.2 in dual SyncApp configurations.
260. What's New in ThreatStream (2023) — 2023-02-27 Feb 27, 2023 · release notes

     ThreatStream adds IPQS Fraud and Risk Scoring enrichment via the APP Store.

261. What's New in ThreatStream (2023) — 2023-02-17 Feb 17, 2023 · release notes

     ThreatStream adds asset risk score and filtering to Attack Surface Assessment report details

262. ThreatStream OnPrem Release History — 2023-01-31 Jan 31, 2023 · release notes

     ThreatStream OnPrem 5.4 adds SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2.0/2.1 client, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Mobile/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. support and new observable indicator types.

     • Adds configurable rule filters for Campaigns, Courses of Action, Identities, Incidents, Infrastructure, Intrusion Sets, Malware, Tools, and Vulnerabilities.
     • Adds valid_until to STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0 exports.
     • Adds valid_until, labels, confidence, and indicator_types fields to STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. exports.
     • Adds Sigma signatures as a signature type in the Threat Model.
     • Adds SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. 2.0-compliant identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO).

     +4 more show less

     • Enables receiving data from TAXII 2.0 and 2.1 servers via the TAXII Client.
     • Supports Mobile and ICS types of MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Framework in Investigations.
     • Adds bot_domain, bot_md5, bot_url, exploit_md5, and compromised_username indicator types for observable analysis.
     • Adds Bulk Edit Tags action on the Observables Advanced search page.

     9 details in Everything

263. What's New in ThreatStream (2023) — 2023-01-30 Jan 30, 2023 · release notes

     ThreatStream adds weekly Attack Surface Assessment reports and ZeroFox premium feed integration.

     • Adds automated weekly Attack Surface Assessment (ASA) reports to identify vulnerabilities, misconfigured services, and out-of-date software
     • Enables activation of the ZeroFox Cyber Threat Intelligence premium feed via the APP Store

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The ZeroFox Threat premium feed has been removed from the ThreatStream APP Store and is no longer available for use.
264. What's New in ThreatStream (2023) — 2023-01-26 Jan 26, 2023 · release notes

     ThreatStream adds Symantec Threat Alert Indicators premium feed available in APP Store.

265. What's New in Security Analytics — 2023-01-19 Jan 19, 2023 · release notes

     Anomali Security Analytics adds Kafka log ingestion and Cloud Link support for AWS S3/SQS custom logs.

     • Added support for using Cloud Link to ingest custom log sources from AWS S3 or SQS

     1 detail in Everything

266. What's New in ThreatStream (2022) — 2022-12-21 Dec 21, 2022 · release notes

     Anomali ThreatStream adds managed Anomali Intelligence Channels for curated threat data.

267. What's New in ThreatStream (2022) — 2022-12-20 Dec 20, 2022 · release notes

     ThreatModel now associates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques and sub-techniques for v11.3 and v12.1.

     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. technique and sub-technique association in ThreatModel

     1 detail in Everything

268. What's New in ThreatStream (2022) — 2022-11-30 Nov 30, 2022 · release notes

     ThreatStream adds Mobile and ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework support for Investigations

     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Mobile and ICS technique types to ThreatStream, enabling their use within Investigations.
     • Updates the UI for the Trusted Circles page with a new look and feel.
     • Updates the Import Job Details page with a new look and feel.

     3 details in Everything

269. What's New in Security Analytics — 2022-11-29 Nov 29, 2022 · release notes

     Anomali adds a Filter UI for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Match Search based on trusted_circle_ids

270. What's New in ThreatStream (2022) — 2022-11-29 Nov 29, 2022 · release notes

     ThreatStream adds themed custom dashboards and enhanced SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. self-provisioning in 2022 release.

     • Adds three regional Intelligence Insights custom dashboards for AMER, APAC, and EMEA covering the last 90 days
     • Improves user self-provisioning of SSO with greater flexibility for configuring service or provider details
     • Adds a recommended value for the no data threshold in Feed Notifications

     3 details in Everything

271. What's New in Security Analytics — 2022-11-16 Nov 16, 2022 · release notes

     The Microsoft Defender log source integration now ingests device and email events directly. A reference for common event schema fields is also provided.

272. What's New in Security Analytics — 2022-11-09 Nov 9, 2022 · release notes

     Adds trusted_circle_ids field to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Match Search queries in Security Analytics

     • Added support for field-based searches using the trusted_circle_ids field in IOC Match Search.

     1 detail in Everything

273. What's New in ThreatStream (2022) — 2022-11-03 Nov 3, 2022 · release notes

     ThreatStream introduces the Attack Flow Library to visualize attack technique sequences and relationships.

     • Attack Flow Library: Visualize the sequence of techniques used in an attack, the relationships between techniques, and other information.

     1 detail in Everything

274. What's New in ThreatStream (2022) — 2022-11-02 Nov 2, 2022 · release notes

     Anomali Curated Twitter open source feed now available in APP Store

275. What's New in ThreatStream (2022) — 2022-10-31 Oct 31, 2022 · release notes

     Adds Description Templates for rich text threat models and configurable Feed Health Notification frequencies

     • Adds Description Templates to manage rich text content from ThreatStream Settings, Threat Models or investigations
     • Adds configurable frequency for Health Feed Notifications

     2 details in Everything

276. What's New in ThreatStream (2022) — 2022-10-28 Oct 28, 2022 · release notes

     ThreatStream adds Cofense Triage premium feed support

277. What's New in ThreatStream (2022) — 2022-10-24 Oct 24, 2022 · release notes

     ThreatStream adds bulk editing of up to 10,000 observable tags and Sigma signature support

     • Edit (add and remove) tags of the first 10,000 observables from the Observables Advanced search page
     • Sigma is added to the list of signature types available in ThreatStream

     2 details in Everything

278. Anomali Match OnPrem Release History — 2022-10-23 Oct 23, 2022 · release notes

     Anomali Match 4.5 adds Threat Model type filters, new Universal Link sources (Cribl/QRadar/NetWitness), memory-based alerts, and syslog/translog/script alert actions.

     • Adds Threat Model types filter to exclude unwanted types in Threat Models
     • Adds Cribl log source support as a Universal Link ingestion destination
     • Adds IBM QRadar log source support as a Universal Link ingestion destination
     • Adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. NetWitness log source support as a Universal Link ingestion destination
     • Adds memory utilization-based alerting for correlation engine capacity thresholds

     +1 more show less

     • Improves asset table sorting to ascending/descending values in the UI

     6 details in Everything

279. What's New in ThreatStream (2022) — 2022-10-14 Oct 14, 2022 · release notes

     Adds retrospective search capability on Match Cloud instances for ThreatStream bulletins.

280. What's New in Security Analytics — 2022-10-13 Oct 13, 2022 · release notes

     Adds visibility into subscription health via a dashboard and alerts.

     • Adds a new Data Usage Dashboard to visualize consumption against subscription limits
     • Enables email notifications to alert users when approaching data or subscription thresholds

     2 details in Everything

281. What's New in ThreatStream (2022) — 2022-09-30 Sep 30, 2022 · release notes

     ThreatStream 2022 adds generally available Feed Health Notifications via email or in-app alerts.

     • Makes the Feed Health Notification feature generally available

     1 detail in Everything

282. What's New in ThreatStream (2022) — 2022-09-27 Sep 27, 2022 · release notes

     Allows non-admin users to manage preferred tags and filter kill chain tags in ThreatStream.

     • Adds kill chain tag filtering option for preferred tags list allowing non-admin users to choose inclusion or exclusion
     • Enables non-admin users to add new tags to their preferred tags list

     2 details in Everything

283. What's New in ThreatStream (2022) — 2022-09-23 Sep 23, 2022 · release notes

     ThreatStream adds access to the Anomali Premium Digital Risk Protection feed for new customers.

284. What's New in ThreatStream (2022) — 2022-09-15 Sep 15, 2022 · release notes

     ThreatStream adds Attack Surface Assessment Report to help evaluate organizational asset exposure.

285. Anomali ThreatStream Integrator Release History — 2022-08-31 Aug 31, 2022 · release notes

     ThreatStream Integrator v8.1 adds SDK extension upload, priority filtering, context-aware errors, and backup/restore

     • Adds drag-and-drop upload for .zip SDK extensions to configure custom destination integrations
     • Adds SORT option to the Indicator filter to prioritize indicators by tag order when downloading to destinations
     • Adds source-filter capability to select ThreatStream-defined filters for application on Integrator sources and destinations
     • Adds context-aware error messages displayed inline next to the invalid field instead of a top-right notification
     • Adds Backup and Restore feature to export essential data and recreate the system for disaster recovery or testing

     5 details in Everything

286. What's New in ThreatStream (2022) — 2022-08-31 Aug 31, 2022 · release notes

     ThreatStream Integrator v8.1 release introduces new capabilities for threat data integration.

     • Releases ThreatStream Integrator v8.1 from the ThreatStream Downloads page.

     1 detail in Everything

287. What's New in ThreatStream (2022) — 2022-08-30 Aug 30, 2022 · release notes

     ThreatStream adds beta feed health notifications via email or in-app alerts when feeds are down.

288. What's New in ThreatStream (2022) — 2022-08-25 Aug 25, 2022 · release notes

     ThreatStream adds automated investigation tasks and Intezer Analyze enrichment.

     • Adds Automating Investigation Tasks feature to run predefined sequences of enrichments on specific observable types

     1 detail in Everything

289. What's New in ThreatStream (2022) — 2022-08-03 Aug 3, 2022 · release notes

     Adds Restrict TLP White Comments organization setting to block public TLP White comments in ThreatStream

290. What's New in Security Analytics — 2022-08-02 Aug 2, 2022 · release notes

     Adds support for scheduled retrospective search jobs in Security Analytics.

291. What's New in ThreatStream (2022) — 2022-07-27 Jul 27, 2022 · release notes

     ThreatStream adds Cybersixgill Reports Premium feed for activation in the APP Store.

292. What's New in Security Analytics — 2022-07-25 Jul 25, 2022 · release notes

     Adds Netskope log ingestion to Anomali Security Analytics event telemetry.

     • Added support for ingesting Netskope logs to Event Telemetry.

     1 detail in Everything

293. What's New in ThreatStream (2022) — 2022-07-25 Jul 25, 2022 · release notes

     ThreatStream adds Bfore.Ai PreCrime Network feed via APP Store; renames Matches/My Attacks from Sightings.

     • Bfore.Ai subscribers can activate the Bfore.Ai PreCrime Network feed from the APP Store
     • Matches and My Attacks (previously known as Sightings) now provide a comprehensive view of attack data from Match Cloud, on-premise, and integrations

     2 details in Everything

294. What's New in Security Analytics — 2022-07-08 Jul 8, 2022 · release notes

     Anomali Security Analytics now ingests asset data from Rapid7 InsightVM Platform.

295. What's New in Security Analytics — 2022-07-07 Jul 7, 2022 · release notes

     Anomali Security Analytics adds the ability to automatically tag IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. via the Add tags to IOCs action in alert updates.

296. What's New in Security Analytics — 2022-06-30 Jun 30, 2022 · release notes

     Adds Azure NSG flow logs and Mimecast log ingestion capabilities.

     • Added support for ingesting Azure NSG flow logs
     • Added support for ingesting Mimecast logs

     2 details in Everything

297. Anomali SyncApp Release History — 2022-06-30 Jun 30, 2022 · release notes

     Anomali SyncApp 5.2 adds configuration file support and sync for MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. Attack Patterns and Custom Objects

     • OpenSSL 1.1.1 added as an installation prerequisite
     • Configures via a reusable configuration file for multiple deployments
     • Adds synchronization of Custom Objects (Threat Model entities)
     • Adds synchronization of MITRE Attack Patterns, supporting versions 7.2 to 11

     4 details in Everything

298. ThreatStream AirGap Release History — 2022-06-30 Jun 30, 2022 · release notes

     ThreatStream AirGap 5.2 adds Trusted Circles, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ingestion, config file support, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and cloud scoring.

     • Adds Automated Creation of Trusted Circles for multi-organization instances
     • Adds Configuring Organizations and Users to Ingest MITRE Attack Patterns for v7.2+ techniques
     • Adds ThreatStream Using a Configuration File for deployment-wide configuration
     • Adds Custom Branding options in the configuration wizard
     • Adds Disabling DNS Lookups during intelligence synchronization

     +7 more show less

     • Adds Sharing Intelligence with Trusted Circles capability
     • Adds Enhanced Backup and Restore Procedure optimization
     • Adds Information Classification Banner to the UI
     • Adds Information Misuse Warning setting in the configuration wizard
     • Adds Reverse Proxy Support for isolated UI hosting
     • Adds Single Sign On via SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration
     • Adds ThreatStream Cloud Scoring for ML-based confidence scores

     12 details in Everything

299. What's New in ThreatStream (2022) — 2022-06-30 Jun 30, 2022 · release notes

     ThreatStream adds pre-built themed custom dashboards for ransomware, RATs, and China-based threat actors.

300. What's New in ThreatStream (2022) — 2022-06-29 Jun 29, 2022 · release notes

     Mandiant subscribers can activate the Mandiant v4 feed via the APP Store

301. What's New in Security Analytics — 2022-06-14 Jun 14, 2022 · release notes

     New Asset Details page with risk score, timeline, and vulnerability data in Security Analytics

     • Adds a new Asset Details page accessible from the Overview dashboard Top 20 Impacted Hosts by Risk Score panel or the Activity Search Asset results table to view Risk Score, match history timeline, match results table, and vulnerabilities.

     1 detail in Everything

302. What's New in ThreatStream (2022) — 2022-06-14 Jun 14, 2022 · release notes

     Cybersixgill Reports Freemium feed available in ThreatStream APP Store

303. What's New in ThreatStream (2022) — 2022-06-07 Jun 7, 2022 · release notes

     ThreatStream enables ingestion of six new open source threat intelligence feeds into the APP Store for organizational use.

304. What's New in ThreatStream (2022) — 2022-06-06 Jun 6, 2022 · release notes

     ThreatStream Feed Health is GA, allowing users to view synchronization history of active feed sources from the App Store for the last 30 days.

305. What's New in ThreatStream (2022) — 2022-05-31 May 31, 2022 · release notes

     ThreatStream adds bot_domain, bot_md5, bot_url, exploit_md5 indicator types and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v10-v11 support

     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques and sub-techniques from v10.0, v10.1, and v11.0 to the Anomali Threat Model

     1 detail in Everything

306. What's New in ThreatStream (2022) — 2022-05-25 May 25, 2022 · release notes

     ThreatStream STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. exports add valid_until, labels, confidence, and indicator_types fields

307. What's New in Security Analytics — 2022-05-24 May 24, 2022 · release notes

     The release introduces scheduled reporting capabilities and enhances diagnostic visibility for data connections.

     • Adds scheduled reports to export dashboard snapshots filtered by time range and search expression
     • Improves health status indicators for Links and log sources

     2 details in Everything

308. What's New in ThreatStream (2022) — 2022-05-24 May 24, 2022 · release notes

     ThreatStream adds dashboard management UI, Anomali Lens trending widgets, and private Streams for organizations.

     • Adds a new dashboard management screen to show, hide, and search dashboards in one place
     • Adds Anomali Lens trending widgets with news context and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. attack pattern data (Lens+ only)
     • Enables creating new Streams that are private to your organization rather than visible to the community

     3 details in Everything

309. What's New in ThreatStream (2022) — 2022-05-13 May 13, 2022 · release notes

     ThreatStream adds support for the Recorded Future Analyst Notes premium feed via the APP Store.

310. What's New in Security Analytics — 2022-05-10 May 10, 2022 · release notes

     Anomali Security Analytics now ingests AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow and VPC DNS logs.

     • Adds support for ingesting AWS VPC Flow logs
     • Adds support for ingesting AWS VPC DNS logs

     2 details in Everything

311. What's New in Security Analytics — 2022-04-29 Apr 29, 2022 · release notes

     Adds Carbon Black EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. log ingestion to Security Analytics

     • Adds support for ingesting Carbon Black EDR logs

     1 detail in Everything

312. What's New in Security Analytics — 2022-04-28 Apr 28, 2022 · release notes

     Anomali Security Analytics adds Tenable.io asset ingestion and spike/frequency alerting.

     • Adds support for ingesting asset data from a Tenable.io scanner
     • Adds support for spike and frequency detection alerts

     2 details in Everything

313. What's New in ThreatStream (2022) — 2022-04-28 Apr 28, 2022 · release notes

     ThreatStream v7.3.1 adds SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. admin and Beta Feed Health sync history view.

     • Adds a Beta capability to view synchronization history of active feed sources from the last 30 days in the APP Store

     1 detail in Everything

314. What's New in ThreatStream (2022) — 2022-04-27 Apr 27, 2022 · release notes

     ThreatStream (2022) adds TAXII 2.xTAXII 2.xAn HTTPS-based protocol for exchanging threat intelligence, maintained by OASIS, that gives cyber tools a standard REST API for pushing and pulling STIX objects between organizations. client capabilities and a new username compromise indicator type.

315. What's New in ThreatStream (2022) — 2022-04-26 Apr 26, 2022 · release notes

     ThreatStream updates Threat Model entity attachments to support 15 files and broader entity types.

     • Threat Model entity attachments can now include up to 15 files at once
     • Threat Model entity types besides Signatures and TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. can contain file attachments

     2 details in Everything

316. What's New in Security Analytics — 2022-04-22 Apr 22, 2022 · release notes

     Security Analytics adds ingestion support for Microsoft Defender event telemetry

     • Added support for ingesting Microsoft Defender logs

     1 detail in Everything

317. What's New in Security Analytics — 2022-04-20 Apr 20, 2022 · release notes

     Adds Match Analysis Dashboard and two new exclude lists (Suppress Feeds, Suppress iTypes)

     • Adds Match Analysis Dashboard providing analytics on threat intelligence feeds, indicator types, indicators, and DGA domains that match network events.
     • Adds Suppress Feeds and Suppress iTypes exclude lists to filter correlation and activity search results.

     2 details in Everything

318. What's New in Security Analytics — 2022-04-12 Apr 12, 2022 · release notes

     Anomali Security Analytics adds Multi Dimensional Dashboard for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. match analytics

     • Adds the Multi Dimensional Dashboard with ten visualizations and table panels to show IOC matches over time and by source

     1 detail in Everything

319. Anomali ThreatStream Integrator Release History — 2022-04-05 Apr 5, 2022 · release notes

     ThreatStream Integrator v8.0 adds Intelligence API v2 option and UI dashboard updates.

     • Adds Intelligence API version 2 as an available option for filtering intelligence with expanded fields and platform-compatible syntax
     • Updates the user interface to display Source and Destination tabs as dashboards accessible from the top navigation bar
     • Makes System Settings accessible via a gear icon in the top navigation bar
     • Presents Destinations as separate tiles on the Destinations dashboard with color-coded sync status indicators that highlight errors on failure

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Installer no longer supports Windows OS versions other than 64-bit
     • !Hadoop Hive and Cloudera Impala destinations are removed from the Integrator binary
     • !Support for Microsoft NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. Proxy is removed
     • !Support for CentOS 8.x is removed
     • !Support for Internet Explorer 11 is removed
320. What's New in Security Analytics — 2022-04-04 Apr 4, 2022 · release notes

     Adds CrowdStrike FDR S3 bucket ingestion to Anomali Security Analytics event telemetry.

     • Added support for ingesting CrowdStrike logs from a CrowdStrike FDR S3 bucket.

     1 detail in Everything

321. ThreatStream OnPrem Release History — 2022-03-29 Mar 29, 2022 · release notes

     ThreatStream OnPrem v5.3 adds local TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. self-service, custom dashboard exports, and advanced Threat Model search.

     • Adds a local TAXII server so clients can poll data stored on the ThreatStream appliance via TAXII 1.x, 2.0, and 2.1 discover URLs
     • Enables SSO self-service provisioning for SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and OKTA Marketplace identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.
     • Allows creation of custom dashboard widgets from saved advanced Threat Model search filters, with export capabilities in PDF (dashboard) and PNG (individual widget)
     • Introduces advanced search functionality in the Anomali Threat Model allowing construction and saving of specialized search filters, including an increased character limit of 2,000 for saved observable search filters
     • Adds Key Filters section to left filter on Observable and Threat Model basic search screens to locate organization-created data or open source feeds

     +9 more show less

     • Adds ability to toggle rule execution with an Enabled switch without removing the rule
     • Enables export of investigations list in CSV format
     • Adds Bulk Add option to Explore pivoting chart and table view in investigations to add candidate observables from PDF or TXT files
     • Allows viewing alternate versions of MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques and sub-techniques associated with v7.2+ via View Alternate Version in Actions menu on attack pattern details pages
     • Adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. Import screen to view status of STIX import jobs
     • Adds new indicator types: actor_subject, apt_subject, fraud_email_subject, hack_tool_md5, malware_email_subject, phishing_email_subject, spam_email_subject, suspicious_email_subject, email_attachment_subject, compromised_email_subject
     • Adds CipherTrace Sentry, Deloitte Codex, GreyNoise, ReversingLabs, and Symantec Endpoint Security enrichments from APP Store
     • Enables Org Admins to configure whether organization users can auto-import observables discovered during Sandbox detonations via Allow Observable Imports from Sandbox setting
     • Adds Email Report Distribution setting for Org Admins to restrict email domains for sharing Threat Model entities

     14 details in Everything

322. What's New in ThreatStream (2022) — 2022-03-28 Mar 28, 2022 · release notes

     ThreatStream adds Confidence filter to Import Review, advanced rule targets for Campaigns/Malware etc., and rule disable notifications.

     • Adds a Confidence filter and an Exclude button on the Included tab of the Import Review screen for import jobs
     • Expands Advanced search-based rules to match Campaigns, Courses of Action, Identities, Incidents, Infrastructure, Intrusion Sets, Malware, Tools, and Vulnerabilities
     • Sends email notifications when rules are automatically disabled by ThreatStream, even when the Notify Me setting is disabled

     3 details in Everything

323. What's New in ThreatStream (2022) — 2022-03-25 Mar 25, 2022 · release notes

     Adds an Investigations tab to Threat Model entity details pages in ThreatStream.

324. What's New in ThreatStream (2022) — 2022-03-24 Mar 24, 2022 · release notes

     ThreatStream enables drag-and-drop reordering of dashboards on the home screen

     • Adds drag-and-drop capability to rearrange dashboard tabs on the home screen

     1 detail in Everything

325. What's New in ThreatStream (2022) — 2022-03-16 Mar 16, 2022 · release notes

     ThreatStream adds McAfee DXL Integrator extension v1.0

326. What's New in ThreatStream (2022) — 2022-02-28 Feb 28, 2022 · release notes

     ThreatStream adds Tenable.sc enrichment and ability to delete errored import jobs

     • Adds the Tenable.sc vulnerability management enrichment for data enrichment workflows.

     1 detail in Everything

327. What's New in ThreatStream (2022) — 2022-02-23 Feb 23, 2022 · release notes

     ThreatStream enables rules based on advanced observable or Threat Model search queries.

328. What's New in ThreatStream (2022) — 2022-02-22 Feb 22, 2022 · release notes

     ThreatStream adds secondary intelligence requirements to existing initiatives and allows associating imports/sandbox detonations with them

     • Enables adding intelligence requirements as secondary initiatives within open intelligence initiatives
     • Allows association of import sessions with intelligence initiatives

     2 details in Everything

329. What's New in ThreatStream (2022) — 2022-02-09 Feb 9, 2022 · release notes

     CrowdStrike Falcon, Elastic, and Splunk v6.5.6 integrations now available for ThreatStream

     • Adds CrowdStrike Falcon Integrator extension v1.1 to the ThreatStream Downloads page
     • Adds Elastic Integrator extension as a Certified Partner Integrator Extension on the ThreatStream Downloads page
     • Makes the latest version of the ThreatStream Splunk App, v6.5.6, available on the ThreatStream Downloads page

     3 details in Everything

330. What's New in ThreatStream (2022) — 2022-01-27 Jan 27, 2022 · release notes

     New Integrator Status widget on Weekly Summary dashboard and Feed Health column in APP Store list view

     • Adds the Integrator Status widget to the Weekly Summary dashboard with an updated interface displaying integration health details.
     • Adds a new Feed Health column to the APP Store list view to display current status of feed sources.

     2 details in Everything

331. What's New in ThreatStream (2022) — 2022-01-26 Jan 26, 2022 · release notes

     ThreatStream adds Can Use Match permission and Query.AI enrichment in the 2022 release.

     • Adds Can Use Match permission to control organization user access to the Security Analytics UI for Cloud beta participants
     • Adds the Query.AI enrichment to the Enrichments library

     2 details in Everything

332. What's New in ThreatStream (2022) — 2022-01-24 Jan 24, 2022 · release notes

     ThreatStream adds import-time domain-based exclusion for scraped observables to reduce noise.

     • Enables automatic exclusion of email, domain, and URL observables sharing the source URL's domain during Scrape from URL imports

     1 detail in Everything

333. What's New in ThreatStream (2022) — 2022-01-05 Jan 5, 2022 · release notes

     ThreatStream release includes new QRadar App v3.0.0 and Content Package v1.2.0 for threat intel integration.

     • QRadar App version 3.0.0 is now available from the ThreatStream Downloads page.
     • QRadar Content Package version 1.2.0 is now available from the ThreatStream Downloads page.

     2 details in Everything

334. What's New in ThreatStream (2021) — 2021-12-15 Dec 15, 2021 · release notes

     ThreatStream adds SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and OKTA Marketplace identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..

335. Anomali Match OnPrem Release History — 2021-12-10 Dec 10, 2021 · release notes

     Anomali Match OnPrem 4.4.2 adds pinned Details icon in Activity Search and Incidents tables

336. What's New in ThreatStream (2021) — 2021-11-30 Nov 30, 2021 · release notes

     ThreatStream adds ATTM feed and moves enrichments to APP Store

     • Adds Anomali Targeted Threat Monitoring (ATTM), a premium curated feed for identifying threats to organizational brand and assets, available from the APP Store.
     • Moves Enrichment management to the ThreatStream APP Store, replacing the previous Integrations tab location.
     • Updates the GreyNoise enrichment integration.

     3 details in Everything

337. Anomali ThreatStream Integrator Release History — 2021-11-30 Nov 30, 2021 · release notes

     Anomali ThreatStream Integrator 7.3 adds granular proxy controls and QRadar reference set mode

     • Adds QRadar reference set mode to switch from indicator type-based to tag-based reference sets for custom rule creation
     • Adds Include URL Parameters option to destinations that support passing query parameters with URLs
     • Adds proxy enable/disable toggles to control traffic between ThreatStream and Integrator versus individual destinations
     • Adds Ubuntu 20.x OS support

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Crowdstrike built-in integration removed as the API is no longer supported; use the standalone Crowdstrike SDK extension instead
     • !Ubuntu 16.x is no longer supported
338. What's New in ThreatStream (2021) — 2021-11-23 Nov 23, 2021 · release notes

     ThreatStream adds TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. discover URL for polling feeds and auto-saves last advanced search query in UI.

     • Adds a new TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2.1 discover URL to enable polling ThreatStream data into TAXII 2.1 clients
     • Advanced observable and Threat Model search screens now automatically save the most recent advanced search query

     2 details in Everything

339. What's New in ThreatStream (2021) — 2021-11-22 Nov 22, 2021 · release notes

     ThreatStream adds ability to associate rules, observables, and Threat Model entities with intelligence initiatives

     • Associates Threat Model entities with intelligence initiatives via manual selection or saved advanced search

     1 detail in Everything

340. What's New in ThreatStream (2021) — 2021-10-25 Oct 25, 2021 · release notes

     Workgroups Dashboard added to ThreatStream for viewing activity in member workgroups.

     • Adds the Workgroups Dashboard UI view to see latest activity from user's member workgroups

     1 detail in Everything

341. What's New in ThreatStream (2021) — 2021-10-20 Oct 20, 2021 · release notes

     Release notes for ThreatStream (2021) primarily list a new integrator extension download.

342. What's New in ThreatStream (2021) — 2021-10-14 Oct 14, 2021 · release notes

     New CrowdStrike Falcon Integrator extension (v1.0) for ThreatStream.

343. What's New in ThreatStream (2021) — 2021-09-30 Sep 30, 2021 · release notes

     Adds Symantec Endpoint Security enrichment to ThreatStream data

344. What's New in ThreatStream (2021) — 2021-09-29 Sep 29, 2021 · release notes

     Adds Anomali Lens trending widgets to custom dashboards for Lens+ users

345. What's New in ThreatStream (2021) — 2021-09-28 Sep 28, 2021 · release notes

     ThreatStream now supports creating STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. compliant relationship objects (SROs) during Threat Model creation and observable import

346. What's New in ThreatStream (2021) — 2021-08-27 Aug 27, 2021 · release notes

     Adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v7.2+ coverage on control matrix and ability to set default version for investigations.

     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v7.2 and later techniques and sub-techniques to the security control matrix for investigation inclusion

     1 detail in Everything

347. ThreatStream AirGap Release History — 2021-08-27 Aug 27, 2021 · release notes

     ThreatStream AirGap 5.1 adds custom dashboard widgets, private investigations, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. import, and more trusted circle sync.

     • Trusted Circle Mapping synchronizes feed data from ThreatStream Cloud to trusted circles on AirGap
     • FQDN or System ID can be updated via the appliance update flow
     • External Image Link button displays in place of external images when no cloud connectivity is available
     • Ciphertrace, Deloitte Codex, Greynoise, HYAS, Polyswarm, Recorded Future, Splunk Sightings, Spur, and VirusTotal v3 enrichments are now available on ThreatStream
     • Custom dashboard widgets can be created based on saved observable or Threat Model search filters

     +13 more show less

     • MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. representation of organization security controls can be configured and overlaid on investigation models
     • Advanced search with saved filters added to the Anomali Threat Model; character limit for saved observable search filters increased to 2,000
     • Key Filters section added to the left filter for Observable and Threat Model basic search screens
     • PDFs can be generated from customizable templates for Threat Model entities
     • STIX 2.1 compatible custom objects can be imported through the STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. tab of the import assistant
     • Private investigations visible only to the creator can be created
     • Bulk Add option added to the Explore pivoting chart and table view on the investigations UI for PDF/TXT files
     • CSV export available from the investigations list view screen
     • Selection Details panel added to the Explore pivoting tool on the investigations UI
     • Deselect All and Select All options added to the Indicators by Type dashboard widget
     • Enabled switch allows toggling rule activation for matching keywords in new intelligence
     • Org Admins can restrict email domains for sharing Threat Model entities
     • Read Only users can be added to workgroups

     18 details in Everything

348. What's New in ThreatStream (2021) — 2021-08-25 Aug 25, 2021 · release notes

     ThreatStream introduces Intelligence Initiatives to centralize collections and threat models.

     • Adds the Intelligence Initiatives capability for grouping related threat intelligence feeds (Collections), investigations, and Threat Model entities by organizational goals.

     1 detail in Everything

349. Anomali SyncApp Release History — 2021-08-17 Aug 17, 2021 · release notes

     SyncApp 5.1 adds ThreatStream AirGap trusted circle sync, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. entity filtering, association limits, and performance improvements.

     • Adds the ability to synchronize trusted circle data from Cloud to ThreatStream AirGap via Trusted Circle Synchronization
     • Adds support for synchronizing Attack Patterns, Courses of Action, Identities, Infrastructure, Intrusion Sets, and Tools with additional MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. fields
     • Adds a new configuration prompt to set the maximum number of associations synchronized per observable or Threat Model entity
     • Enhances Threat Model filtering controls during configuration to specify which entities are synchronized
     • Implements performance enhancements for association handling to reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., network, memory, and disk usage

     5 details in Everything

350. What's New in ThreatStream (2021) — 2021-08-16 Aug 16, 2021 · release notes

     New ThreatStream integrator extensions for Microsoft Defender for Endpoint and FireEye Helix

     • Adds the initial release of the Microsoft Defender for Endpoint Integrator extension (v1.0)
     • Adds the initial release of the FireEye Helix Integrator extension (v1.0)

     2 details in Everything

351. What's New in ThreatStream (2021) — 2021-08-06 Aug 6, 2021 · release notes

     ThreatStream releases Excel Add-in for Anomali Lens+ customers

352. What's New in ThreatStream (2021) — 2021-07-27 Jul 27, 2021 · release notes

     Updated the Audit UI for easier filtering and report exports, updated GreyNoise enrichment, and upgraded the Cuckoo sandbox platform to support Windows 7 detonations.

353. What's New in ThreatStream (2021) — 2021-07-26 Jul 26, 2021 · release notes

     ThreatStream adds Submit Sandbox permission and improved advanced search filter UI.

     • Adds the Submit Sandbox user permission to control which users can submit to a sandbox detonation service
     • Improves the user interface for constructing advanced search filters on Observable and Threat Model search pages

     2 details in Everything

354. What's New in ThreatStream (2021) — 2021-07-22 Jul 22, 2021 · release notes

     ThreatStream adds configurable API endpoint for Joe Sandbox malware submissions

     └──▷ HOW TO FIND IT
     Configure the specific Joe Sandbox subscription endpoint when activating the integration in ThreatStream.
     📍Activating Joe Sandbox
355. Anomali ThreatStream Integrator Release History — 2021-06-30 Jun 30, 2021 · release notes

     ThreatStream Integrator 7.2.3 adds Infoblox DNS View override and granular CrowdStrike indicator limits.

     • Adds DNS View name as an optional integration setting to override the default for Infoblox
     • Replaces single Maximum entries setting with three new settings: Maximum number of Hash indicators, Maximum number of Domain indicators, and Maximum number of IP address indicators for CrowdStrike integrations, increasing overall limit to 100,000

     2 details in Everything

356. What's New in ThreatStream (2021) — 2021-06-29 Jun 29, 2021 · release notes

     ThreatStream adds SEKOIA.IO and ThreatFabric feeds via App Store; VT v3 pivots expanded.

     • SEKOIA.IO Threat Intelligence feed available in the APP Store
     • ThreatFabric Mobile Threat Intel feed available in the APP Store
     • VirusTotal v3 Hash to Submitter ID pivot now available for enrichment
     • VirusTotal v3 Url to Submitter ID pivot now available for enrichment

     4 details in Everything

357. What's New in ThreatStream (2021) — 2021-06-25 Jun 25, 2021 · release notes

     ThreatStream adds PDF export for custom dashboards, PNG export for widgets, and a ReversingLabs ransomware intel feed.

     • Adds the ability to export custom dashboards in PDF format
     • Adds the ability to export individual dashboard widgets in PNG format
     • Makes the ReversingLabs - Ransomware and Related Tools Intel List feed available for activation in the APP Store

     3 details in Everything

358. What's New in ThreatStream (2021) — 2021-06-21 Jun 21, 2021 · release notes

     ThreatStream releases Azure Sentinel Integrator extension v1.1.1.

359. What's New in ThreatStream (2021) — 2021-06-17 Jun 17, 2021 · release notes

     ThreatStream adds Flashpoint Compromised Credentials feed via APP Store

360. What's New in ThreatStream (2021) — 2021-06-07 Jun 7, 2021 · release notes

     ThreatStream adds configurable observable import settings for Sandbox detonations in Organization Settings

     • Adds Allow Observable Imports from Sandbox setting to Organization Settings for Org Admins to control automatic import of observables found during Sandbox detonations.
     • Adds option within the above setting to pre-select the Import Observables checkbox on the Sandbox detonation window.

     2 details in Everything

361. What's New in ThreatStream (2021) — 2021-06-02 Jun 2, 2021 · release notes

     ThreatStream adds Hack Tool File Hash (hack_tool_md5) indicator type.

362. Anomali Match OnPrem Release History — 2021-05-28 May 28, 2021 · release notes

     Anomali Match 4.4 adds custom parsers for Universal Link, custom dashboard fields, threat model alerting, and saved search sharing.

     • Adds User defined parsers for custom log sources when used with Universal Link 4.4, enabling parsing of events like customer name from non-standard logs via live streaming or sample content
     • Adds ability to define custom fields beyond the default schema to be included in Activity dashboards, such as mapping message ID from mail gateway logs or query/answer from DNS logs
     • Adds alerts for threat model matches (Threat Bulletins, Actors, Campaigns, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., Vulnerabilities) with new context fields TM id, TM name, and TM type visible on the Activity > Alert page
     • Adds Rule action to add IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. matches to an investigation in ThreatStream when configuring alerts, displaying only local investigations if ThreatStream is OnPrem
     • Automatically excludes inbound traffic with Action type = Blocked, Denied, Dropped, or Rejected from correlation to reduce load, with option to select which types are included

     +4 more show less

     • Adds limit on intelligence processed by the correlation engine based on available memory to prevent memory issues, with notifications when limits are encountered
     • Enhances management of saved searches allowing Admins to manage all and normal users to view all and manage their own
     • Allows limiting fields forwarded to a destination when using the alert action, instead of forwarding all fields by default
     • Adds Beta Source filter for downloading intelligence from ThreatStream site via query settings to limit types of intelligence downloaded

     9 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. traps for port monitoring are no longer supported; users must use SNMP traps for process monitoring instead
363. What's New in ThreatStream (2021) — 2021-05-27 May 27, 2021 · release notes

     ThreatStream adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. relationship object creation and SWIFT ISAC feed support

     • Adds ability to create STIX compliant relationship objects (SROs) in the Threat Model.
     • Adds credentialed activation of the SWIFT ISAC Threat Intelligence Feed via the APP Store.

     2 details in Everything

364. What's New in ThreatStream (2021) — 2021-05-25 May 25, 2021 · release notes

     ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v9 techniques and sub-techniques to the Threat Model

365. What's New in ThreatStream (2021) — 2021-05-24 May 24, 2021 · release notes

     ThreatStream adds custom dashboard widgets for trending threat intelligence via Anomali Lens+

366. What's New in ThreatStream (2021) — 2021-05-11 May 11, 2021 · release notes

     ThreatStream adds Polyswarm Freemium Hot Malware feed activation via the APP Store.

     • Provides threat model recommendations for Sunburst Supply Chain Attacks.

     1 detail in Everything

367. What's New in ThreatStream (2021) — 2021-04-28 Apr 28, 2021 · release notes

     ThreatStream adds CipherTrace Sentry enrichment and rule toggle switch

     • Adds Qualys Vulnerability Management Enrichment configuration options to specify assets for patch reports
     • Updates HYAS Insight enrichment to v1.3.0
     • Adds an Enabled switch to rules to toggle matching

     3 details in Everything

368. What's New in ThreatStream (2021) — 2021-04-27 Apr 27, 2021 · release notes

     ThreatStream adds Deloitte Codex enrichment and nine new email-related indicator types.

     • Adds support for the Deloitte Codex enrichment source in ThreatStream
     • Adds actor_subject, apt_subject, fraud_email_subject, malware_email_subject, phishing_email_subject, spam_email_subject, suspicious_email_subject, email_attachment_subject, and compromised_email_subject indicator types to the platform

     2 details in Everything

369. What's New in ThreatStream (2021) — 2021-04-26 Apr 26, 2021 · release notes

     ThreatStream releases two UI capabilities: reusable dashboard widgets driven by saved filters and bulk CSV export for investigations.

370. What's New in ThreatStream (2021) — 2021-04-12 Apr 12, 2021 · release notes

     Anomali Link updates for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. NetWitness v1.0.1 and Splunk v2.2.1 released.

371. Anomali ThreatStream Integrator Release History — 2021-03-26 Mar 26, 2021 · release notes

     ThreatStream Integrator 7.2.0 adds Maintenance Mode, automatic upgrade downloads, and one-click upgrades

     • Adds Maintenance Mode to unschedule jobs and stop destination web servers during upgrades
     • Enables automatic download of new versions by checking for upgrades in the background
     • Introduces a One-click upgrade option in the UI to install the latest version with a single action
     • Adds a setting to automatically download the latest version of the Integrator documentation
     • Adds support for FireEye HX 5.0, McAfee NitroSecurity ESM 11.3, and QRadar 7.4.1 integrations

     5 details in Everything

372. What's New in ThreatStream (2021) — 2021-03-25 Mar 25, 2021 · release notes

     ThreatStream adds Read Only user support in workgroups and STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. custom object import.

     • Allows adding Read Only users to workgroups
     • Adds ability to import STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 compatible custom objects via the STIX tab of the import assistant

     2 details in Everything

373. What's New in ThreatStream (2021) — 2021-03-24 Mar 24, 2021 · release notes

     ThreatStream adds High Sierra 10.13.2, Ubuntu Linux 16.04 x64, and Android 9 malware detonation targets

     • Adds macOS High Sierra 10.13.2 sandbox environment for malware detonation analysis
     • Adds Ubuntu Linux 16.04 x64 sandbox environment for malware detonation analysis
     • Adds Android 9 sandbox environment for malware detonation analysis

     3 details in Everything

374. ThreatStream OnPrem Release History — 2021-03-22 Mar 22, 2021 · release notes

     ThreatStream OnPrem 5.1 adds ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., custom dashboards, Splunk/PolySwarm/HYAS/Spur enrichments, JIRA integration, and expanded Threat Model capabilities.

     • Adds Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services (ADFS) integration for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) and user administration.
     • Adds ability to create custom dashboards with customizable widgets visible to specific users or the organization.
     • Adds Splunk Sightings integration to view sightings from a Splunk cloud instance on observable details pages.
     • Adds PolySwarm enrichment.
     • Adds HYAS Insight enrichment.

     +31 more show less

     • Adds Spur IP Context enrichment.
     • Adds new investigation widget for tracking assigned investigations by status and assignee.
     • Adds JIRA integration to create and update JIRA tickets from the Investigations user interface.
     • Adds ability to export stream details in CSV format.
     • Adds ability to export Sandbox Reports in CSV format.
     • Adds compromised_service_account indicator type for observables.
     • Adds fraud indicator types: fraud_domain, fraud_email, fraud_ip, fraud_md5, and fraud_url.
     • Adds ability to share Threat Model entities via email with optional PDF attachment using configurable templates.
     • Adds support for importing and exporting STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0 and STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. Threat Model entities and indicators.
     • Adds ability to filter Threat Model search results by entity Owner.
     • Adds Show Only Open Source Threat Models search filter in the Threat Model list view.
     • Adds CVSS 2.0 and CVSS 3.0 columns to the Threat Model list view.
     • Adds ability to specify Source Created and Source Modified timestamps during Threat Model entity creation.
     • Adds ability to associate labels to Threat Model and observables associations with an Associated Creation Date timestamp.
     • Adds Search All pivot option in the Explore pivoting chart's enrichment menu.
     • Adds ability to automatically add MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. associated with entities resulting from pivots on the Explore chart.
     • Adds ability to create ad-hoc connections between investigation entities and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. TTPs.
     • Adds ability to rename node groups in the Explore pivoting tool.
     • Adds ability to set investigations and tasks to Unassigned after initial assignment.
     • Adds granular subscription options for email and in-app investigation notifications based on specific events.
     • Adds configuration for default timezone for timestamps displayed in the user interface via Org Admin settings.
     • Adds setting for Org Admins to configure whether ThreatStream Integrator performs a full resynchronization when joining new Trusted Circles or feeds.
     • Adds ability for Org Admins to specify a maximum session lifetime for users.
     • Adds ability for Org Admins to audit PDF Report creation activity from the Audit screen.
     • Adds default Anomali Template option for PDF Report creation and set as user-level default.
     • Adds ability to configure custom SSO error message when authenticating via SSO with a non-existent account.
     • Adds restriction of rule email notifications and investigation visibility to specific workgroups.
     • Adds Reviewed By column to Investigation details pages Imports list and Import list view.
     • Adds ability to associate observables with Vulnerabilities and Signatures during import.
     • Adds remaining sandbox submission counts for the current 24-hour period in the sandbox submission window.
     • Adds ability to toggle APP Store between tile view and alternate list view with search function.

     36 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Cuckoo sandbox detonations are now limited to 150 submissions per 24 hours.
375. What's New in ThreatStream (2021) — 2021-03-05 Mar 5, 2021 · release notes

     Adds Group-IB Anti-Phishing, Brand Abuse Add on, or Threat Intelligence feeds via the APP Store.

376. What's New in ThreatStream (2021) — 2021-02-25 Feb 25, 2021 · release notes

     ThreatStream adds advanced search with saved filters, a new Chat UI, and bulk observable imports in Investigations.

     • Adds advanced search functionality to Threat Model, allowing users to construct specialized search filters that can be saved for later use
     • Updates the ThreatStream Chat interface with a completely new user experience
     • Adds a Bulk Add option to the Explore pivoting chart and table view in Investigations to import candidate observables from PDF or TXT files
     • Allows analysis to be added to investigation entities that are in the Not Imported status

     4 details in Everything

377. What's New in ThreatStream (2021) — 2021-02-24 Feb 24, 2021 · release notes

     Read-only users can now add shared custom dashboards and perform advanced searches.

     • Read only users can now add shared custom dashboards to their home screens on ThreatStream
     • Read only users can now perform advanced observable and Threat Model searches

     2 details in Everything

378. What's New in ThreatStream (2021) — 2021-02-23 Feb 23, 2021 · release notes

     ThreatStream adds Key Filters to Observable and Threat Model search screens.

379. What's New in ThreatStream (2021) — 2021-02-22 Feb 22, 2021 · release notes

     ThreatStream 2021 adds contextual data enrichment in Explore pivoting and email domain restrictions for Threat Model sharing.

     • Adds contextual data enrichments within the Explore pivoting tool for investigations
     • Enables Org Admins to restrict email domains for Threat Model entity sharing via Organization Settings

     2 details in Everything

380. What's New in ThreatStream (2021) — 2021-02-11 Feb 11, 2021 · release notes

     ThreatStream adds GreyNoise enrichment for data correlation.

381. What's New in ThreatStream (2021) — 2021-02-08 Feb 8, 2021 · release notes

     Adds Crowdstrike Falcon X feed integration for ThreatStream users

     • Adds Crowdstrike Falcon X as a new intelligence feed available in the APP Store

     1 detail in Everything

382. What's New in ThreatStream (2021) — 2021-01-28 Jan 28, 2021 · release notes

     ThreatStream adds VirusTotal v3 enrichment and Qualys Patch Report search support

     • Adds VirusTotal v3 API as a new enrichment source for data enrichment
     • Adds Qualys Patch Report search option to the existing Qualys Vulnerability Management enrichment

     2 details in Everything

383. What's New in ThreatStream (2021) — 2021-01-25 Jan 25, 2021 · release notes

     ThreatStream adds cloned custom dashboards and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. JSON configuration in 2021 release

     • Adds ability to clone and edit custom dashboards originally created by the Anomali Threat Research team
     • Adds capability to configure a representation of MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Security Control Framework using a JSON file generated by the MITRE ATT&CK Navigator tool

     2 details in Everything

384. What's New in ThreatStream (2020) — 2020-12-17 Dec 17, 2020 · release notes

     ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage mapping, private investigations, and dashboard theming in 2020 release.

     • Adds the ability to configure security controls representation using the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Framework and overlay them on investigation models for coverage snapshots
     • Enables users to create Private Investigations that are visible only to themselves
     • Introduces a new Selection Details panel in the Explore pivoting tool within the investigations UI to search nodes and view details without drilling down
     • Allows adding Themed Custom Dashboards created by the Anomali Threat Research team to the home screen

     4 details in Everything

385. What's New in ThreatStream (2020) — 2020-12-15 Dec 15, 2020 · release notes

     ThreatStream adds Select All and Deselect All controls to the Indicators by Type dashboard widget.

386. ThreatStream OnPrem Release History — 2020-11-20 Nov 20, 2020 · release notes

     ThreatStream OnPrem 5.1 adds ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. integration in Investigations, Splunk/PolySwarm/HYAS/Spur enrichments, JIRA ticketing, and custom dashboards.

     • Adds Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services (ADFS) support for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and user administration
     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmap mapping within Investigations with ad-hoc TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. connections
     • Adds Splunk Sightings integration to view sightings on observable details pages
     • Adds PolySwarm enrichment
     • Adds HYAS Insight enrichment

     +4 more show less

     • Adds Spur IP Context enrichment
     • Adds new JIRA integration to create and update tickets from the Investigations UI
     • Adds custom dashboards with customizable widgets, including a new Investigations dashboard widget
     • Adds ability to share Threat Model entities via email with optional PDF attachment using customizable templates

     9 details in Everything

387. What's New in ThreatStream (2020) — 2020-11-18 Nov 18, 2020 · release notes

     ThreatStream v2.1.0 QRadar App release available for integration

388. What's New in ThreatStream (2020) — 2020-11-06 Nov 6, 2020 · release notes

     ThreatStream Anomali Lens now supports entity navigation.

389. Anomali ThreatStream Integrator Release History — 2020-10-05 Oct 5, 2020 · release notes

     ThreatStream Integrator 7.1.0 adds LogRhythm data enrichment, CrowdStrike OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs., RedHat 8 support, and UI password change.

     • Adds LogRhythm enriched data output for indicator matches
     • Limits ThreatModel indicator associations to 10,000 per entity
     • Deprecates the auto-update feature; manual update is now required
     • Adds Admin password change capability in the User Interface previously CLI-only
     • Requires OAuth2 authentication for CrowdStrike integration

     +3 more show less

     • Adds support for RedHat 8.x and CentOS 8.x operating systems
     • Adds support for additional indicator types: compromised_serv_account, fraud_ip, fraud_domain, fraud_email, fraud_md5, fraud_url, phish_md5 and custom ThreatStream OnPrem types
     • Adds a new sync event log file separate from the main integrator.log

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The auto-update feature has been deprecated, requiring manual updates.
390. What's New in ThreatStream (2020) — 2020-09-30 Sep 30, 2020 · release notes

     ThreatStream adds list view and search to APP Store, increases investigation attachment limit, and enables org-level Never Scan lists in Lens plugin.

     • APP Store gains a toggleable list view UI and search functionality for locating streams
     • Investigation attachments now support files up to 20MB (previously lower)
     • Org Admins can manage a central Never Scan list for Anomali Lens users

     3 details in Everything

391. Anomali Match OnPrem Release History — 2020-09-29 Sep 29, 2020 · release notes

     Anomali Match 4.3 adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. NetWitness Link support, Azure cloud deployment, Azure AD SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., PDF exports, and Universal Link backups.

     • Support for deploying Anomali Match on Microsoft Azure Cloud
     • New Anomali Link connector for forwarding events from the RSA NetWitness platform
     • Single Sign-On integration with Microsoft Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
     • Dashboard export to PDF format
     • Scheduled reports generation in PDF format

     +2 more show less

     • Organization Selector enabled on Activity > Threat Models and Incident > Details views
     • New built-in log sources in Universal Link: Apache Kafka topics, Azure Sentinel, and Elasticsearch

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Compatibility with older versions of Universal Link is dropped; Anomali Match 4.3 requires Universal Link 4.3
392. What's New in ThreatStream (2020) — 2020-09-29 Sep 29, 2020 · release notes

     ThreatStream adds default PDF report templates and email attachments for Threat Model entities.

     • Adds the ability to set a default PDF Report template as a user-level setting in the Threat Model section.
     • Enables optional attachment of PDF exports of Threat Model entities when sharing via email in the Threat Model section.
     • Allows Org Admins to audit PDF Report creation activity from the Audit screen within ThreatStream settings.

     3 details in Everything

393. What's New in ThreatStream (2020) — 2020-09-28 Sep 28, 2020 · release notes

     ThreatStream adds Spur IP Context enrichment, new fraud indicator types, enhanced STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export and Explore pivoting

     • Added Spur IP Context enrichment
     • Added fraud_domain, fraud_email, fraud_ip, fraud_md5, and fraud_url indicator types
     • STIX 1.x Indicator exports now include observables' tags as Cybox:Keywords (up to 250)
     • Added Search All pivot option in the Explore investigations chart

     4 details in Everything

394. What's New in ThreatStream (2020) — 2020-09-24 Sep 24, 2020 · release notes

     Explore pivoting chart in ThreatStream now preserves zoom level when adding new nodes

     • Investigations > Explore: Pivoting chart maintains its current zoom state after a new node is added

     1 detail in Everything

395. What's New in ThreatStream (2020) — 2020-09-23 Sep 23, 2020 · release notes

     ThreatStream adds configurable max session lifetime and defanged observable search to investigations.

     • Adds Maximum Session Lifetime configuration for Org Admins to terminate active sessions after a specified time
     • Enables Observable Search to accept defanged domain, email address, IP address, and URL queries, returning non-defanged values

     2 details in Everything

396. What's New in ThreatStream (2020) — 2020-08-31 Aug 31, 2020 · release notes

     ThreatStream adds custom dashboards, per-rule notification opt-in, association labels, Lens Threat Bulletins, and investigation improvements

     • Adds Custom Dashboards with widget-based threat data views and per-user or organization-wide visibility controls
     • Adds Notify Me setting at the user level to opt in or out of email notifications for individual rules
     • Adds labels to Threat Model and observable associations plus an Associated Creation Date timestamp for tracking context
     • Adds the ability to create Threat Bulletins from the Anomali Lens interface when no entities are detected during scanning
     • Enhances Anomali Lens+ to leverage organization-created Actor and Malware entities on ThreatStream, preventing classification as Unknown

     +2 more show less

     • Adds the ability to delete investigation attachments
     • Enhances Explore pivoting chart with mouse wheel zoom (holding control key) that centers on selected nodes

     7 details in Everything

397. What's New in ThreatStream (2020) — 2020-08-28 Aug 28, 2020 · release notes

     ThreatStream PDF template cloning and hex colors; STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 1.2 import adds Cybox:Keywords as tags

     • Threat Model PDF exports now support hex color codes in templates.
     • Threat Model allows cloning PDF report templates to create editable versions.
     • STIX 1.2 imports now add Cybox:Keywords as observable tags.

     3 details in Everything

398. What's New in ThreatStream (2020) — 2020-08-27 Aug 27, 2020 · release notes

     ThreatStream adds HYAS Insight enrichment source for threat data correlation.

     • Adds HYAS Insight to the list of available enrichments.

     1 detail in Everything

399. What's New in ThreatStream (2020) — 2020-08-17 Aug 17, 2020 · release notes

     ThreatStream adds hash as a valid type value for observable search filtering.

400. What's New in ThreatStream (2020) — 2020-08-07 Aug 7, 2020 · release notes

     ThreatStream adds v1.0.1 of the VMware Carbon Black Enterprise EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Integrator extension.

401. What's New in ThreatStream (2020) — 2020-07-31 Jul 31, 2020 · release notes

     ThreatStream 2020 adds ADFS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., private organization tags in Streams, and rule wizards.

     • Adds ADFS Support for single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services
     • Adds organization-private tag creation to the Streams configuration workflow
     • Allows matched intelligence to be added to existing investigations (previously new-only)
     • Enables assignee configuration for rule-matched investigations
     • Restricts investigation visibility to specific organization workgroups

     +2 more show less

     • Introduces a wizard interface for creating and editing rules
     • Adds workgroup-scoped visibility to created rules

     7 details in Everything

402. What's New in ThreatStream (2020) — 2020-07-27 Jul 27, 2020 · release notes

     ThreatStream adds node group renaming and flexible linking between nodes and groups in Explore investigations

     • Adds the ability to rename node groups on the Explore pivoting tool within investigations
     • Enables creating links between individual nodes and groups, preserving links across ungrouping

     2 details in Everything

403. What's New in ThreatStream (2020) — 2020-07-21 Jul 21, 2020 · release notes

     Anomali ThreatStream adds PolySwarm enrichment and releases Match Lens+ v4.2.3.

     • Added the PolySwarm enrichment to enrich threat data.

     1 detail in Everything

404. What's New in ThreatStream (2020) — 2020-06-30 Jun 30, 2020 · release notes

     ThreatStream adds OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feed management in beta, Kaspersky APT & Recorded Future integrations, plus Chat and dashboard widgets

     • Adds OSINT feed enable/disable toggle in APP Store (beta)
     • Enables activation of Kaspersky APT Intelligence Reporting feed via SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate upload in APP Store
     • Enables activation of Recorded Future intelligence feed from APP Store
     • Adds general availability for ThreatStream Chat with Organization and Trusted Circle members
     • Extends Overview Dashboard Investigations widget to filter by Assignee

     +1 more show less

     • Displays all four investigation statuses (Unassigned, In Progress, Pending, Complete) and user-created counts on Reporting Dashboard Investigations widget

     6 details in Everything

405. What's New in ThreatStream (2020) — 2020-06-29 Jun 29, 2020 · release notes

     ThreatStream adds Workgroups to restrict visibility of observables, Threat Models, and investigations

406. What's New in ThreatStream (2020) — 2020-06-26 Jun 26, 2020 · release notes

     ThreatStream updates Lens with streamlined workflow, entity filtering by highlight type, and improved TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. detection.

     • Adds streamlined investigations workflow to the on-board Anomali Lens
     • Enables filtering highlighted entities by highlight type in Anomali Lens
     • Improves TTP detection capabilities within Anomali Lens
     • Updates APP Store tiles for better readability and usability

     4 details in Everything

407. What's New in ThreatStream (2020) — 2020-06-25 Jun 25, 2020 · release notes

     ThreatStream adds custom SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication error messages and a freemium VMRay integration for malware detonation.

     • Adds the ability to configure a custom error message displayed when an SSO user attempts to authenticate with an account that does not exist in ThreatStream
     • Adds a new freemium VMRay sandbox integration, enabling users to activate malware detonation from the ThreatStream UI at no additional charge

     2 details in Everything

408. What's New in ThreatStream (2020) — 2020-06-24 Jun 24, 2020 · release notes

     ThreatStream 2020 adds multi-keyword input and simplified indicator selection in Rule configuration

     • Allows adding multiple keywords in a comma-separated or line-broken list in the rule configuration workflow.
     • Displays keywords as a comma-separated list on the Edit Rule window for easier modification.

     2 details in Everything

409. Anomali Match OnPrem Release History — 2020-06-05 Jun 5, 2020 · release notes

     Anomali Match 4.2.2 adds MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. support for ESM and Splunk links, MISP in peer deployments, and customer info to investigations.

     • Adds Anomali Link support for ArcSight ESM and Splunk to forward third-party customer information in MSSP deployments
     • Enables MISP intelligence feeds in peer group deployments (previously standalone only)
     • Includes Customer ID and Customer Name fields from observables in the INVESTIGATIONS > Description tab in ThreatStream
     • Adds Organization Selector to DASHBOARDS and ACTIVITY pages
     • Enhances MyEvents Map dashboard Recent Intelligence query dropup to include custom saved searches

     5 details in Everything

410. What's New in ThreatStream (2020) — 2020-05-30 May 30, 2020 · release notes

     Adds pending import session approval/rejection via pop-up in Investigation UI

411. What's New in ThreatStream (2020) — 2020-05-29 May 29, 2020 · release notes

     ThreatStream adds org-level integrator resync control and default UI timezone settings.

     • Adds a setting for Org Admins to configure whether the ThreatStream Integrator performs a full intelligence resynchronization when joining a new Trusted Circle or subscribing to a new feed
     • Adds a setting for Org Admins to configure a default timezone for timestamps displayed on the ThreatStream user interface
     • Adds a Reviewed By column to the Import list view (hidden by default, selectable via the settings wheel) showing the username of the approver

     3 details in Everything

412. What's New in ThreatStream (2020) — 2020-05-28 May 28, 2020 · release notes

     ThreatStream adds JIRA integration for ticket creation and updates from the Investigations UI

413. What's New in ThreatStream (2020) — 2020-05-27 May 27, 2020 · release notes

     ThreatStream adds timestamps to observable rule emails and enhances MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Investigation Entities filter.

     • Adds timestamps of the most recent import matching a rule to observable email notifications
     • Enhances MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Investigation Entities filter to include ASNs, metadata, tags, and entities without TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. associations

     2 details in Everything

414. What's New in ThreatStream (2020) — 2020-05-26 May 26, 2020 · release notes

     ThreatStream now allows associating Signatures with observables during import and increases Sandbox Report CSV export limits.

     • Add Association button in the Import Assistant to link Signatures with observables during import
     • Sandbox Reports CSV export limit increased to 10,000 entries

     2 details in Everything

415. What's New in ThreatStream (2020) — 2020-05-14 May 14, 2020 · release notes

     ThreatStream adds Open Source observables and threat model search filters

     • Adds a new observable search filter, Open Source Intelligence, to filter on observables provided by open source intelligenceopen source intelligenceOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. feeds aggregated by ThreatStream.
     • Adds a new search filter on the Threat Model list view, Show Only Open Source Threat Models, to search Threat Model entities provided by open source intelligence streams exclusively.

     2 details in Everything

416. What's New in ThreatStream (2020) — 2020-05-06 May 6, 2020 · release notes

     ThreatStream (2020) adds generally available template-based PDF report generation for Threat Model entities.

417. What's New in ThreatStream (2020) — 2020-04-30 Apr 30, 2020 · release notes

     ThreatStream v5.0 adds compromised_service_account indicator type, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. association features, and granular investigation notifications.

     • Adds compromised_service_account as a new Indicator Type for tracking compromised service accounts
     • Enables creating ad-hoc connections between investigation entities and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. within an investigation
     • Adds automatic addition of MITRE ATT&CK Techniques to investigations when using the on-board Explore pivoting chart
     • Allows subscribing to email and in-app investigation notifications based on a granular list of events

     4 details in Everything

418. ThreatStream OnPrem Release History — 2020-04-30 Apr 30, 2020 · release notes

     ThreatStream OnPrem 5.0 adds bulk import actions, new integrations, and granular user controls

     • Auto-Approve option enables automatic approval of import jobs by users with Approve Import privileges
     • Bulk approve or reject import jobs from the Import list view screen
     • New AbuseIPDB, Pastebin Dump Collection, Farsight DNSDB, Openports, Shodan, URLScan.io, and Web Of Trust enrichments
     • Delete import jobs owned by your organization
     • Filter advanced observable searches by import_source and created_by

     +14 more show less

     • CSV file upload for adding entries to the Import Whitelist
     • Export user information in CSV format via Org Admin settings
     • urlscan.io added to Analysis Links on Domain, IP address, and URL observable details pages
     • Bulk remove observable tags from the Observables search page
     • Add Malware threat model entity type
     • Phishing Mailbox creation wizard can now create both investigations and import sessions
     • Restrict ThreatStream Cloud UI access for non-admin users via Org Admin settings
     • Create Read Only user accounts on ThreatStream
     • Export charts in PNG format from Observable details pages and Investigation pivoting tools
     • Filter threat model search results by signature type
     • Edit observable values and add observables while import jobs are in Ready to Review status
     • Filter import jobs on the Import page by Owner
     • Configure password expiration notification days via Organization Settings
     • Increase Permitted CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. limit to 1000 for exclusive organization access

     19 details in Everything

419. What's New in ThreatStream (2020) — 2020-04-29 Apr 29, 2020 · release notes

     Adds sharing Threat Model entities via email from the Threat Model List View screen

420. What's New in ThreatStream (2020) — 2020-04-28 Apr 28, 2020 · release notes

     ThreatStream adds Owner filter to Threat Model search and displays user info in entity history

     • Adds Owner filter to Threat Model search results for filtering by the entity creator
     • Displays user information next to actions in Threat Model entity history view

     2 details in Everything

421. What's New in ThreatStream (2020) — 2020-04-27 Apr 27, 2020 · release notes

     ThreatStream 2020 release introduces CSV export for sandbox data and refines investigation workflow logic for imported observables.

422. Anomali Match OnPrem Release History — 2020-04-24 Apr 24, 2020 · release notes

     Anomali Match 4.2.1 adds MISP integration, DGA false-positive API, bulk notification deletion, and timezone overrides for log sources.

     • Adds MISP as a configured threat intelligence source in Security Analytics during initial setup or via the threat intelligence site configuration.
     • Adds a new API endpoint to update the status of specific DGA domains to False Positive, adding them to the DGA whitelist.
     • Configures Security Analytics to push observables and DGA matches to ThreatStream for display in My Recents Attacks and Sightings widgets.
     • Adds a Delete All button in the Mail icon's Message Notification Center to delete all notifications in bulk.
     • Adds ability to specify a custom default timezone for log sources: Symantec ICDx, Custom, Fortinet, and Syslog on Security Analytics Settings pages.

     +3 more show less

     • Adds option to send an email to the incident owner when a rule action is configured to create an incident.
     • Enhances full-text search by transforming unquoted queries (e.g., apt) into wildcard matches (*apt).
     • Adds Threat Download dashboard to monitor download status and errors for all configured threat sites.

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The saved search previously named SOC filter is renamed to Anomali SOC filter.
     • !Views Matches by Tag and Matches by Source Port have been removed from dashboards.
423. What's New in ThreatStream (2020) — 2020-04-23 Apr 23, 2020 · release notes

     ThreatStream adds MD5, SHA1, SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., and SHA512 hash filters to Observable Search UI

424. What's New in ThreatStream (2020) — 2020-04-14 Apr 14, 2020 · release notes

     Anomali Lens is now on-board within the ThreatStream platform.

     • Adds Anomali Lens to ThreatStream as an onboard feature.

     1 detail in Everything

425. What's New in ThreatStream (2020) — 2020-04-08 Apr 8, 2020 · release notes

     ThreatStream adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2/2.1 support for file, email, mutex, registry types and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. columns to Threat Model list view

     • Adds file, email-message, mutex, and windows-registry_key object types to STIX 2 and 2.1 import/export in Threat Model

     1 detail in Everything

426. What's New in ThreatStream (2020) — 2020-03-31 Mar 31, 2020 · release notes

     Adds VMRay malware detonation integration and beta PDF report generation for ThreatStream.

     • New VMRay integration enables malware detonation via the VMRay commercial service
     • Beta PDF Reports feature allows generating reports from customizable templates

     2 details in Everything

427. Anomali ThreatStream Integrator Release History — 2020-03-31 Mar 31, 2020 · release notes

     Anomali ThreatStream Integrator v7 adds Windows Server 2016/2019 support, custom data location flag, and MISP destination fields

     • Adds support for Windows Server 2016 and 2019 as required operating systems for Integrator v7
     • Enables specifying a custom data storage directory on Windows via a new configuration option
     • Adds Intelligence Type, Indicator Event Name fields and Tags to Include selection for MISP destination

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Windows Server 2012, RedHat v6, and CentOS v6 are deprecated and no longer supported for Integrator v7.
     • !Support for Carbon Black Response (pre-6.4), FireEye HX (3.0/3.0.1/4.0), McAfee NitroSecurity ESM (9.3/9.5/9.6/10.0/10.1), QRadar (7.2.8/7.3.0/7.3.1), RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. NetWitness (10.4/10.5), and Splunk (6.6/7.0) integrations has been deprecated.
428. What's New in ThreatStream (2020) — 2020-03-30 Mar 30, 2020 · release notes

     ThreatStream adds workgroup-scoped rule email notifications and Nation State as a Victim type for Actors.

     • Restricts rule email notifications to a specific user workgroup

     1 detail in Everything

429. What's New in ThreatStream (2020) — 2020-03-27 Mar 27, 2020 · release notes

     ThreatStream now associates observables with vulnerabilities during the import process.

430. What's New in ThreatStream (2020) — 2020-03-26 Mar 26, 2020 · release notes

     ThreatStream adds CSV export for streams and enhanced admin email notifications.

     • Email notifications to organization administrators now include assigned user permissions

     1 detail in Everything

431. What's New in ThreatStream (2020) — 2020-03-24 Mar 24, 2020 · release notes

     ThreatStream adds subtypes field to hash observables for detailed hash type metadata.

432. What's New in ThreatStream (2020) — 2020-03-20 Mar 20, 2020 · release notes

     ThreatStream adds Splunk Sightings integration to view sightings on observable details pages

433. What's New in ThreatStream (2020) — 2020-03-03 Mar 3, 2020 · release notes

     ThreatStream Sandbox URL submission limit increased to 2000 characters

     • The maximum character length for URLs submitted to the ThreatStream Sandbox for detonation is now 2000.
     • The Submit Malware documentation has been updated to reflect the new URL length constraint.

     2 details in Everything

434. What's New in ThreatStream (2020) — 2020-03-02 Mar 2, 2020 · release notes

     ThreatStream adds in-app chat for Organization and Trusted Circle members (Beta)

435. ThreatStream OnPrem Release History — 2020-03-02 Mar 2, 2020 · release notes

     ThreatStream OnPrem 5.0 adds import filtering, whitelist CSV upload, and PNG export for investigations

     • Adds import_source and created_by filter options to advanced observable searches
     • Adds Import Whitelist support for bulk entry via CSV file upload
     • Enables PNG export of charts in Investigations and Observable details pages via new Export icon
     • Adds Auto-Approve option for import jobs submitted by users with Approve Import privileges

     4 details in Everything

436. What's New in ThreatStream (2020) — 2020-02-28 Feb 28, 2020 · release notes

     ThreatStream adds STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.0/2.1 import/export and support for new Threat Model entity types.

     • Adds STIX 2.0 and STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. import capabilities for Threat Model entities and Observables (basic patterns only)
     • Adds STIX 2.0 and STIX 2.1 export capabilities for Threat Model entities and Observables
     • Adds support for Attack Patterns, Courses of Action, Identities, Infrastructure, Intrusion Sets, and Tools to the ThreatStream Threat Model

     3 details in Everything

437. What's New in ThreatStream (2020) — 2020-02-24 Feb 24, 2020 · release notes

     ThreatStream adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. integration in Investigations and FireEye Mandiant dedicated feed support.

     • Leverage the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Framework within Investigations via Anomali Lens

     1 detail in Everything

438. Anomali Match OnPrem Release History — 2020-02-23 Feb 23, 2020 · release notes

     Anomali Match OnPrem 4.1.7 adds Anomali Lens integration and Sumo Logic support in Universal Link.

     • Adds integration with Anomali Lens to access features of Security Analytics
     • Supports Sumo Logic as a new built-in log source for Universal Link

     2 details in Everything

439. What's New in ThreatStream (2020) — 2020-01-31 Jan 31, 2020 · release notes

     ThreatStream adds a gift icon in the top nav to view the five most recent platform features.

440. What's New in ThreatStream (2020) — 2020-01-30 Jan 30, 2020 · release notes

     Prevent external users from adding public tags to your organization's data.

     • Adds the Allow public tags on data owned by my organization setting to control whether non-organization users can add Anomali Community (public) tags.

     1 detail in Everything

441. What's New in ThreatStream (2020) — 2020-01-27 Jan 27, 2020 · release notes

     ThreatStream UI allows selecting multiple tags via suggestion dropdown.

     • Adds multi-tag selection from the tag suggestion dropdown when adding tags to an entity.

     1 detail in Everything

442. What's New in ThreatStream (2020) — 2020-01-24 Jan 24, 2020 · release notes

     ThreatStream now supports sending up to 10,000 domains in a single snapshot to OpenDNS Umbrella.

443. What's New in ThreatStream (2020) — 2020-01-22 Jan 22, 2020 · release notes

     ThreatStream updates the Streams page UI for managing feeds in v2020-01-22.

     • The Streams page receives a new UI for feed management.

     1 detail in Everything

444. What's New in ThreatStream (2020) — 2020-01-14 Jan 14, 2020 · release notes

     Org Admins can grant or revoke API key access for individual users via the User Admin tab.

     • Adds API key grant and revoke controls to the User Admin tab for Org Admins
     • Enables per-user API key management in ThreatStream settings

     2 details in Everything

445. What's New in ThreatStream (2020) — 2020-01-13 Jan 13, 2020 · release notes

     Adds consent-based usage data collection to customize user experience in ThreatStream

446. What's New in ThreatStream (2020) — 2020-01-07 Jan 7, 2020 · release notes

     ThreatStream adds Owner filter to import jobs on the Import page

447. What's New in ThreatStream (2019) — 2019-12-24 Dec 24, 2019 · release notes

     ThreatStream auto-populates the Source field for Threat Model entities originating from feeds

448. What's New in ThreatStream (2019) — 2019-12-20 Dec 20, 2019 · release notes

     ThreatStream now supports filtering imported observables by type and deleting organizational import jobs

     • Adds import_jobs DELETE endpoint to remove imports owned by your organization.
     • Enables filtering import job observables (Domain, Email, Hash, IP, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., String, URL) by Type.

     2 details in Everything

449. What's New in ThreatStream (2019) — 2019-12-10 Dec 10, 2019 · release notes

     ThreatStream maintains Investigation list view column selections across navigation.

     • Column selections on the Investigations list view are maintained after you navigate away from the page.

     1 detail in Everything

450. What's New in ThreatStream (2019) — 2019-12-05 Dec 5, 2019 · release notes

     ThreatStream now supports importing whitelist entries from CSV files.

     • Adds the ability to add entries to your Whitelist from a CSV file

     1 detail in Everything

451. What's New in ThreatStream (2019) — 2019-12-04 Dec 4, 2019 · release notes

     ThreatStream imports now display all associated investigations directly on the import job screen.

     • Adds all associated investigations to the import job screen for multi-investigation jobs
     • Improves visibility of investigation links during the import process

     2 details in Everything

452. What's New in ThreatStream (2019) — 2019-12-03 Dec 3, 2019 · release notes

     ThreatStream introduces an automation feature for import workflows. Users with Approve Import privileges can now use the Auto-Approve option to automatically approve their own import jobs, removing the need for manual intervention.

453. ThreatStream AirGap Release History — 2019-11-25 Nov 25, 2019 · release notes

     ThreatStream AirGap 4.1.1 adds new enrichments, bulk observable/tag management, and import workflow controls

     • Adds AbuseIPDB, DomainTools Iris, Farsight DNSDB, Have I Been Pwned?, Pastebin Dump Collection, ReversingLabs, RiskIQ, Shodan, URLScan.io, and Web of Trust enrichments to the threat intelligence platform
     • Enables configuration of custom support links in outbound emails from the platform
     • Adds multihoming support to monitor ThreatStream AirGap on an additional interface separate from the production network
     • Configures ThreatStream AirGap to run behind a reverse proxy
     • Adds the Malware threat model entity for modeling malware-related threats

     +18 more show less

     • Provides a Notifications List View to see all notifications sent by ThreatStream in one place
     • Allows rules to be configured for keyword matches in signatures, indicator type exclusions, and keyword matches in vulnerabilities
     • Enables Org Admins to export user information in CSV format
     • Associates contextual notes to import whitelist entries during organization exclude list updates
     • Adds the Investigation Task List dashboard widget to the Overview Dashboard for viewing assigned tasks
     • Provides a View details link on observable details pages to view changes to individual instances of an observable
     • Adds urlscan.io to Analysis Links for Domain, IP address, and URL observables on their details pages
     • Removes observable tags in bulk from the Observables search page
     • Filters observable search results by observable value type
     • Allows editing the expiration date of individual observables while reviewing import sessions
     • Enables users with Approve Import privileges to approve and reject import jobs in bulk from the Import list view screen
     • Adds the ability to create Read Only users on ThreatStream
     • Allows importing existing content as threat model entities via rich text, PDF, or TXT uploads
     • Filters threat model search results by signature type
     • Extends observable export capability to actors, campaigns, incidents, signatures, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and vulnerabilities associated with threat model entities
     • Configures the number of days before password expiration at which users receive reset notifications
     • Increases the permitted CIDRs for exclusive organizational access to 1000
     • Adds the ability to delete investigation tasks

     23 details in Everything

454. What's New in ThreatStream (2019) — 2019-11-25 Nov 25, 2019 · release notes

     ThreatStream allows adding and editing observables during the Ready to Review import stage.

     • Adds ability to add additional observables to import jobs while in Ready to Review status
     • Enables editing values of observables on Included and Excluded tabs before approval

     2 details in Everything

455. What's New in ThreatStream (2019) — 2019-11-08 Nov 8, 2019 · release notes

     ThreatStream adds a page field to Threat Model entity details for PDF imports.

456. What's New in ThreatStream (2019) — 2019-11-07 Nov 7, 2019 · release notes

     ThreatStream adds Observables Expiration Date column and Investigation description font editing.

     • Added an Expiration Date column to the observables search screen (hidden by default)
     • Added the ability to edit text fonts in Investigation descriptions

     2 details in Everything

457. Anomali ThreatStream Integrator Release History — 2019-10-31 Oct 31, 2019 · release notes

     ThreatStream Integrator 6.9.0 adds granular login access controls and hostname/IP endpoint configuration.

     • Adds Integrators Login Access options to restrict non-admin users from changing settings
     • Adds Hostname/IP Address option to specify the integration endpoint instead of the default device IP

     2 details in Everything

458. What's New in ThreatStream (2019) — 2019-10-17 Oct 17, 2019 · release notes

     ThreatStream allows excluding whitelisted observables from rules and suppressing their notifications

     • Adds the ability to configure Rules to exclude observables that exist in your organization import whitelist.
     • Adds the ability to suppress notifications for observables imported by your organization.

     2 details in Everything

459. What's New in ThreatStream (2019) — 2019-10-16 Oct 16, 2019 · release notes

     ThreatStream adds filterable import_source and created_by fields to advanced observable searches

     • Adds import_source (set during observable import) as a filterable field in advanced observable searches
     • Adds created_by (user who submitted the import job) as a filterable field in advanced observable searches

     2 details in Everything

460. What's New in ThreatStream (2019) — 2019-10-15 Oct 15, 2019 · release notes

     ThreatStream adds password support for sandbox submissions and customizable PDF exports for threat model entities.

     • Adds the ability to specify passwords for protected files during sandbox submission
     • Allows customization of elements included in threat model entity PDF exports

     2 details in Everything

461. What's New in ThreatStream (2019) — 2019-10-14 Oct 14, 2019 · release notes

     ThreatStream adds GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services., DNSTwister, Pastebin Dump Collection, and URLScan.io enrichments.

     • Adds Anomali GeoIP enrichment capability
     • Adds DNSTwister enrichment capability
     • Adds Pastebin Dump Collection enrichment capability
     • Adds URLScan.io enrichment capability

     4 details in Everything

462. Anomali Match OnPrem Release History — 2019-10-11 Oct 11, 2019 · release notes

     Anomali Enterprise 4.1 adds Anomali Lens integration, IN operator, AWS deployment, Elasticsearch alert forwarding, and new dashboards

     • Adds ThreatStream Organization tab configuration to authorize connections from Anomali Enterprise to ThreatStream
     • Adds support for connecting Anomali Lens to discover real-time IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. matches in the browser
     • Adds AWS deployment option for Anomali Enterprise on customer hardware
     • Adds full refresh functionality with an option to keep or delete existing threat models during backfill
     • Adds Tenable.sc asset import via defined queries

     +7 more show less

     • Adds Elasticsearch as a custom log source for Universal Link and forwards alerts to it
     • Adds Match Analysis Dashboard to view feed, indicator, and DGA domain matches and suppress feeds/iTypes
     • Adds enhanced DGA matching with machine learning and custom filter support for Source Type = Threat Indicator Matches
     • Adds ability to opt-in to reporting DGA false positives to Anomali during log uploads
     • Adds User Activity page and report with predefined search for user events
     • Adds Symantec ICDx event source and pivot to Symantec STAR service from indicators
     • Updates UI with resizable columns on Activity pages and new Source/Link Type columns in saved searches and DGA Match views

     12 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The term cluster is replaced with peer group in all references
     • !The Mark as Benign designation on DGA Whitelist is changed to Mark as False Positive
463. What's New in ThreatStream (2019) — 2019-10-02 Oct 2, 2019 · release notes

     ThreatStream adds edit-before-approval for imports, sandbox UI refresh, and Auto-Arrange in Explore.

     • Allows users without Approve Import privileges to edit import session parameters before approval
     • Updates the Sandbox screen with a new user interface
     • Adds an Auto-Arrange function to the Explore interface to control node staticity when adding nodes

     3 details in Everything

464. ThreatStream AirGap Release History — 2019-09-27 Sep 27, 2019 · release notes

     ThreatStream AirGap 3.0 adds Threat Model sync, custom indicators, new UI dashboard, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logout URL config, and expanded import/export formats.

     • Adds Threat Model Synchronization to retrieve actor, threat bulletin, and TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. information from the ThreatStream Cloud platform.
     • Adds Custom Indicator Types creation capability for use on ThreatStream.
     • Adds Overview Dashboard with new UI for graphical data rendering and organization activity.
     • Adds Message of the Day banner configuration for all organization users.
     • Adds Preferred Tags list for quick selection in any Tags field.

     +12 more show less

     • Adds ability to Delete Investigations from the UI.
     • Adds Vulnerabilities viewing and creation within the Threat Model on the UI.
     • Adds enhanced Rules with keyword match functionality supporting up to 100 distinct keywords.
     • Adds updated Threat Model UI and streamlined publication workflow.
     • Adds Password History Retention setting for Org Admins.
     • Adds SSO Logout URL configuration for alternate logout redirection.
     • Adds support for copying content from .doc, docx, and .pdf files into rich text editors.
     • Adds Import using URL for observables from plain text feeds or links to CSV, HTML, JSON, PDF, TXT, or XML files.
     • Adds Observable Export in CSV, OpenIOC, PDF, Snort, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. v1.1.1, v1.2, and v2 formats.
     • Adds bidirectional Observable Associations creation from the UI.
     • Adds ability to Resubmit Excluded Observables after editing values.
     • Adds ability to Re-import Observables to update details or status.

     17 details in Everything

465. ThreatStream OnPrem Release History — 2019-09-24 Sep 24, 2019 · release notes

     ThreatStream OnPrem 4.1.1 adds Malware entity, new enrichments, bulk import approval, and read-only user support.

     • Adds the Malware threat model entity for tracking malware-specific indicators
     • Adds AbuseIPDB, Farsight DNSDB, Openports, Shodan, and Web Of Trust as new enrichment integrations
     • Allows Org Admins to restrict ThreatStream Cloud UI access for non-admin users
     • Enables bulk export of user information in CSV format from Organization Settings
     • Associates contextual notes to import whitelist entries for better exclusion management

     +13 more show less

     • Adds Investigation Task List dashboard widget on the Overview screen
     • Adds urlscan.io to Analysis Links for Domain, IP address, and URL observables
     • Allows bulk removal of observable tags from the Observables search page
     • Filters observable search results by observable value type
     • Enables manual management of Sightings data
     • Allows editing expiration date of individual observables during import session review
     • Enables bulk approve/reject of import jobs for users with Approve Import privileges
     • Adds support for creating Read Only user roles
     • Supports importing threat model entities via rich text, PDF, or TXT file upload
     • Filters threat model search results by signature type
     • Extends export of associated observables to actors, campaigns, incidents, signatures, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and vulnerabilities
     • Configures days-before-expiration notification for password resets
     • Increases permitted exclusive CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. grants to 1000 per organization

     18 details in Everything

466. What's New in ThreatStream (2019) — 2019-09-24 Sep 24, 2019 · release notes

     Adds Match Integration URL to Organization settings for validating Match connections.

467. What's New in ThreatStream (2019) — 2019-09-04 Sep 4, 2019 · release notes

     ThreatStream introduces a new Malware entity for threat modeling and enhances mailbox configuration with a wizard supporting phishing investigations.

468. What's New in ThreatStream (2019) — 2019-08-30 Aug 30, 2019 · release notes

     ThreatStream adds a Notifications List View for viewing sent alerts and allows Org Admins to restrict Cloud UI access for non-admins.

     • Adds a Notifications List View to see the complete history of notifications sent by ThreatStream
     • Allows Org Admins with ThreatStream OnPrem deployments to restrict access to the ThreatStream Cloud user interface for non-admin users

     2 details in Everything

469. What's New in ThreatStream (2019) — 2019-08-22 Aug 22, 2019 · release notes

     ThreatStream now allows users to configure Rules that perform keyword matching against the Signatures field of indicators, enabling more precise detection logic.

     • Adds configurable keyword match rules for Signature fields.

     1 detail in Everything

470. What's New in ThreatStream (2019) — 2019-08-21 Aug 21, 2019 · release notes

     ThreatStream adds CSV export of user information for Org Admins

471. What's New in ThreatStream (2019) — 2019-08-16 Aug 16, 2019 · release notes

     ThreatStream allows contextual notes on import whitelist entries

472. What's New in ThreatStream (2019) — 2019-08-15 Aug 15, 2019 · release notes

     ThreatStream adds Investigation Task List widget to the Overview dashboard.

473. What's New in ThreatStream (2019) — 2019-08-13 Aug 13, 2019 · release notes

     ThreatStream adds an audit log to observable details pages to track changes to confidence, tags, and other fields.

474. What's New in ThreatStream (2019) — 2019-08-12 Aug 12, 2019 · release notes

     ThreatStream adds manual Sightings management and Shodan enrichment.

     • Adds the ability to manually manage Sightings data.
     • Adds Shodan enrichment for threat intelligence.

     2 details in Everything

475. Anomali ThreatStream Integrator Release History — 2019-08-09 Aug 9, 2019 · release notes

     Anomali ThreatStream Integrator adds Allowed Tags feature for MISP destinations to filter forwarded events.

476. What's New in ThreatStream (2019) — 2019-08-08 Aug 8, 2019 · release notes

     ThreatStream updates import workflow to preserve exclusion notes and allow bulk editable expiration during review

     • Adds the ability to edit the expiration data of all observables included in an import session during review.
     • When an excluded observable is moved to the included table in an import session, its Reason for Exclusion is maintained in the Notes column.

     2 details in Everything

477. What's New in ThreatStream (2019) — 2019-08-07 Aug 7, 2019 · release notes

     ThreatStream adds editable observable expiration during import reviews and rule-based exclusion of indicator types.

     • Adds the ability to edit the expiration date of individual observables while reviewing import sessions
     • Adds the ability to configure rules based on the exclusion specific indicator types

     2 details in Everything

478. ThreatStream OnPrem Release History — 2019-07-31 Jul 31, 2019 · release notes

     ThreatStream OnPrem 3.0 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. monitoring, cipher suite customization, phishing URL detonation, MOTD banner, and expanded remote associations.

     • Adds SNMP monitoring support for ThreatStream OnPrem systems
     • Adds a new setting to enable detonation of URLs from forwarded phishing emails
     • Adds the ability to configure a custom cipher suite for ThreatStream OnPrem
     • Adds a Message of the Day banner feature configurable by administrators
     • Expands capabilities for creating associations between local and remote data

     +1 more show less

     • Adds an Overview Dashboard with graphical renderings of recent data and activity

     6 details in Everything

479. What's New in ThreatStream (2019) — 2019-07-31 Jul 31, 2019 · release notes

     ThreatStream adds Farsight DNSDB enrichment and updates AlienVault ThreatCrowd

     • Added the Farsight DNSDB enrichment.
     • Updated the AlienVault ThreatCrowd enrichment.

     2 details in Everything

480. What's New in ThreatStream (2019) — 2019-07-29 Jul 29, 2019 · release notes

     ThreatStream adds Read Only user roles and Web of Trust enrichment for threat data.

     • Added the ability to create Read Only users on ThreatStream
     • Added the Web of Trust enrichment

     2 details in Everything

481. Anomali ThreatStream Integrator Release History — 2019-07-23 Jul 23, 2019 · release notes

     Anomali ThreatStream Integrator 6.8.0 adds MISP as a new destination integration.

482. What's New in ThreatStream (2019) — 2019-07-17 Jul 17, 2019 · release notes

     ThreatStream adds Activate Enrichments UI actions for Observables and Explore to surface unactivated data sources.

     • Adds an "Activate Enrichments..." tab on observable details pages to list available unactivated enrichments
     • Adds an "Activate Enrichments..." menu item to the Actions list in the Explore pivoting tool for unactivated enrichments
     • Adds urlscan.io to the Analysis Links list on Domain, IP address, and URL observable detail pages

     3 details in Everything

483. What's New in ThreatStream (2019) — 2019-07-16 Jul 16, 2019 · release notes

     ThreatStream adds filtering and streamlined activation links to the Integrations settings screen.

     • Adds a filter to the Integrations screen in ThreatStream settings for browsing available integrations
     • Enhances the enrichment activation process with intuitive vendor registration links

     2 details in Everything

484. What's New in ThreatStream (2019) — 2019-07-15 Jul 15, 2019 · release notes

     ThreatStream adds IBM Resilient integration and CSV export for user activity.

     • Added the IBM Resilient integration
     • Added the ability to export user activity in CSV format

     2 details in Everything

485. What's New in ThreatStream (2019) — 2019-07-10 Jul 10, 2019 · release notes

     ThreatStream adds filtering of threat model search results by signature type

486. Anomali ThreatStream Integrator Release History — 2019-07-08 Jul 8, 2019 · release notes

     ThreatStream Integrator v6.7.0 adds threat model support, destination enable/disable, and log rotation

     • Adds threat_model download options to the Threat intelligence source configuration for QRadar and SDK integrations
     • Adds API version 2.0 support in ThreatStream integration to leverage threat model data
     • Adds an option to enable or disable specific destinations directly from the UI widgets
     • Adds log rotation capability with configurable maximum file size and maximum number of rotated files

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Support for Tanium version 6.5 is no longer available
     • !Support for Splunk versions 6.4 and 6.5 is removed; versions 7.1 and 7.2 are now required
     • !Support for Ubuntu 14.x is withdrawn; support is added for Ubuntu 18.x
487. Anomali Match OnPrem Release History — 2019-07-02 Jul 2, 2019 · release notes

     Anomali Match OnPrem 3.5 adds Symantec ICDx support, customizable VM installation size, and UI redesign.

     • Adds Symantec ICDx event source support for ingesting threat intelligence data
     • Allows customization of installation size when installing Anomali Enterprise on a VM
     • Redesigns the Downloads page in the UI to provide direct access to Anomali Links binaries

     3 details in Everything

488. What's New in ThreatStream (2019) — 2019-06-28 Jun 28, 2019 · release notes

     ThreatStream adds password expiration notification timing and browser plugin Threat Model entity search.

     • Adds configurable days-before-expiration for user password reset notifications in Organization Settings
     • Browser Plugin now searches Threat Model entities (previously observables only) and supports direct drill-down to observable details

     2 details in Everything

489. What's New in ThreatStream (2019) — 2019-06-26 Jun 26, 2019 · release notes

     ThreatStream now checks imported file hashes against a known benign whitelist.

490. What's New in ThreatStream (2019) — 2019-06-18 Jun 18, 2019 · release notes

     ThreatStream adds AbuseIPDB enrichment for IP address data.

491. What's New in ThreatStream (2019) — 2019-06-14 Jun 14, 2019 · release notes

     ThreatStream adds bulk observable tag removal and configurable password expiration notifications.

     • Adds bulk tag removal from the Observables search page

     1 detail in Everything

492. What's New in ThreatStream (2019) — 2019-06-04 Jun 4, 2019 · release notes

     Adds the Anomali Open Ports enrichment to ThreatStream data enrichment pipeline

493. ThreatStream AirGap Release History — 2019-05-29 May 29, 2019 · release notes

     ThreatStream AirGap 4.0 adds Enrichments SDK, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. restriction, bulk edit, and TLP assignment capabilities

     • Enrichments SDK enables third-party enrichment development for ThreatStream AirGap
     • Permitted CIDRs restricts organization access to specific IP ranges on ThreatStream AirGap
     • Bulk Edit Observables allows editing multiple observables simultaneously
     • Observable TLP allows assigning Traffic Light Protocol colors during import and from observable details pages
     • Mailbox Proxy User supports specifying a proxy user for threat intelligence mailboxes

     5 details in Everything

494. What's New in ThreatStream (2019) — 2019-05-21 May 21, 2019 · release notes

     ThreatStream rules now support keyword matching against Vulnerability attributes.

     • Adds keyword search capability within Vulnerabilities to ThreatStream Rules.

     1 detail in Everything

495. What's New in ThreatStream (2019) — 2019-05-08 May 8, 2019 · release notes

     ThreatStream now exports observables for Actors, Campaigns, Incidents, Signatures, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and Vulnerabilities.

496. What's New in ThreatStream (2019) — 2019-05-07 May 7, 2019 · release notes

     ThreatStream now features the generally available Investigations UI for threat analysis.

497. What's New in ThreatStream (2019) — 2019-05-02 May 2, 2019 · release notes

     ThreatStream adds bulk approve/reject for import jobs in the UI

498. What's New in ThreatStream (2019) — 2019-05-01 May 1, 2019 · release notes

     Adds Reversing Labs and DomainTools Iris enrichments to ThreatStream

     • Reversing Labs Spectra Intelligence enrichment added

     1 detail in Everything

499. What's New in ThreatStream (2019) — 2019-04-30 Apr 30, 2019 · release notes

     ThreatStream adds observable value type filtering and investigation task deletion.

     • Adds the ability to filter observable search results by observable value type
     • Added the ability to delete investigation tasks

     2 details in Everything

500. What's New in ThreatStream (2019) — 2019-04-26 Apr 26, 2019 · release notes

     Adds Have I Been Pwned? data source to ThreatStream for enrichment.

501. ThreatStream OnPrem Release History — 2019-04-15 Apr 15, 2019 · release notes

     ThreatStream OnPrem 4.0 adds Enrichments SDK, ServiceNow integration, custom indicator types, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., bulk edit, and TLP assignment

     • Enrichments SDK allows developers to create third-party enrichments for ThreatStream OnPrem.
     • New ServiceNow Integration triggers ticket creation from investigations with details and attachments.
     • Custom Indicator Types can be created for local use on ThreatStream OnPrem.
     • Configurable SSO Redirection sends users to an SSO portal at the login screen.
     • Bulk Edit capability allows editing multiple observables simultaneously.

     +2 more show less

     • Observable TLP Assignment enables setting TLP colors during import or from observable details.
     • Mailbox Proxy User can be specified for threat intelligence mailboxes to define ownership of unregistered email submissions.

     7 details in Everything

502. What's New in ThreatStream (2019) — 2019-04-05 Apr 5, 2019 · release notes

     ThreatStream adds bulk editing for observables

503. What's New in ThreatStream (2019) — 2019-03-26 Mar 26, 2019 · release notes

     ThreatStream adds organization-level IP restriction via CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. settings

     • Organization Settings now supports restricting access to specific IP CIDRs

     1 detail in Everything

504. What's New in ThreatStream (2019) — 2019-03-22 Mar 22, 2019 · release notes

     ThreatStream enhances observable management by introducing Traffic Light Protocol (TLP) classification capabilities. Users can now assign TLP colors during the import process and modify them via the UI details page, enabling better information sharing governance for cyber threat intelligence.

505. What's New in ThreatStream (2019) — 2019-03-19 Mar 19, 2019 · release notes

     ThreatStream release introduces new data enrichment capabilities.

     • The tool now supports domain history lookups via the new Anomali Whois History enrichment.

     1 detail in Everything

506. What's New in ThreatStream (2019) — 2019-02-15 Feb 15, 2019 · release notes

     ThreatStream gains a workflow enhancement allowing admins to control the visibility scope of sandbox reports post-generation.

     • Sandbox: Added the ability to edit the visibility of sandbox reports.

     1 detail in Everything

507. What's New in ThreatStream (2019) — 2019-02-14 Feb 14, 2019 · release notes

     ThreatStream Explore gains metadata search and manual node linking.

     • Adds metadata search to the Explore interface for filtering indicators
     • Adds ability to manually link nodes within the Explore visual graph

     2 details in Everything

508. What's New in ThreatStream (2019) — 2019-02-08 Feb 8, 2019 · release notes

     ThreatStream adds ability to generate reports on user activity.

509. What's New in ThreatStream (2019) — 2019-02-07 Feb 7, 2019 · release notes

     Adds the ability for Org Admins to delete sandbox reports owned by their organization.

510. What's New in ThreatStream (2019) — 2019-02-04 Feb 4, 2019 · release notes

     ThreatStream adds configurable default sandbox detonation platform

511. Anomali Match OnPrem Release History — 2019-01-31 Jan 31, 2019 · release notes

     Anomali Match OnPrem v3.3 adds MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. multi-tenant support, REST search API, and Azure SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..

     • Adds MSSP multi-tenant data separation for managed security services.
     • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint for searching events or intelligence on Anomali Enterprise.
     • Adds Single sign-onSingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with Microsoft Azure.
     • Adds built-in log source parsers for Fortinet, NetFlow, sFlow, and Syslog.
     • Allows defining custom log sources and parsers in CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure., CSV, JSON, KV, and LEEF formats.

     5 details in Everything

512. Anomali ThreatStream Integrator Release History — 2019-01-24 Jan 24, 2019 · release notes

     Anomali ThreatStream Integrator 6.6 adds Forcepoint TRITON AP-WEB integration and a new SDK for custom integrations

     • Supports a new integration—Forcepoint TRITON AP-WEB versions 8.3 and 8.4.
     • Introduces ThreatStream Integrator Software Development Kit (SDK) to create custom integrations.
     • Enables threat intelligence to be pushed to Splunk from ThreatStream or fetched by Splunk from ThreatStream.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removes SuSE Linux as a supported platform for ThreatStream installations.
513. What's New in ThreatStream (2019) — 2019-01-17 Jan 17, 2019 · release notes

     ThreatStream now allows deleting observables directly from their detail pages.

     • Adds the ability to delete individual observables from the observable details page in the UI.

     1 detail in Everything

514. What's New in ThreatStream (2019) — 2019-01-09 Jan 9, 2019 · release notes

     Adds AlienVault ThreatCrowd, Hybrid Analysis, OpenDNS, and VirusTotal enrichment sources to ThreatStream

     • Added AlienVault ThreatCrowd enrichment support.
     • Added Hybrid Analysis enrichment support.
     • Added OpenDNS enrichment support.
     • Added VirusTotal enrichment support.

     4 details in Everything

515. What's New in ThreatStream (2018) — 2018-12-19 Dec 19, 2018 · release notes

     ThreatStream adds limit for maximum nodes returned in a single Explore search

516. Anomali Match OnPrem Release History — 2018-12-11 Dec 11, 2018 · release notes

     Anomali Match OnPrem v3.2.2 adds clustering support, centralized link management, Threat Model Matches report, and configurable search result fields.

     • Support for clustering multiple Anomali Enterprise systems
     • Centralized management of Anomali Enterprise Universal Links through the user interface
     • New executive report for Threat Model Matches
     • Ability to collect logs for pre-installed Universal Links and upload them to Anomali Enterprise with one click
     • Ability to set the fields that are displayed for search results via Field Sets

     5 details in Everything

517. What's New in ThreatStream (2018) — 2018-11-15 Nov 15, 2018 · release notes

     ThreatStream adds proxy user configuration for threat intelligence mailboxes

518. What's New in ThreatStream (2018) — 2018-11-12 Nov 12, 2018 · release notes

     ThreatStream adds ability to anonymize user and organization information for Actors, Campaigns, Incidents, Observables, Signatures, Threat Bulletins, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., and Vulnerabilitie

519. ThreatStream OnPrem Release History — 2018-11-09 Nov 9, 2018 · release notes

     ThreatStream OnPrem v3.1 adds email notification routing to local UI, private tags, and passive SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. search in Explore.

     • Adds a configuration option to route all email notifications from the OnPrem instance rather than ThreatStream Cloud
     • Adds support for creating private tags on threat model entities and intelligence derived from rule matches
     • Updates the Explore interface with new passive SSL search capabilities

     3 details in Everything

520. What's New in ThreatStream (2018) — 2018-11-01 Nov 1, 2018 · release notes

     ThreatStream adds phish_md5 indicator type for observables

     • Adds phish_md5 to the list of supported observable indicator types

     1 detail in Everything

521. What's New in ThreatStream (2018) — 2018-09-04 Sep 4, 2018 · release notes

     ThreatStream allows making tags added via rule matches private to the organization.

522. Anomali Match OnPrem Release History — 2018-08-30 Aug 30, 2018 · release notes

     Anomali Match OnPrem 3.2.1 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. monitoring, user audit logs, and password policies.

     • Adds SNMP monitoring for health of various Anomali Enterprise processes and ports
     • Adds user activity audit log to track account actions
     • Adds password policy enforcement for user accounts

     3 details in Everything

523. What's New in ThreatStream (2018) — 2018-08-28 Aug 28, 2018 · release notes

     ThreatStream now supports private tags for all threat model entities

     • Adds the ability to add private tags to any entity within a threat model.

     1 detail in Everything

524. What's New in ThreatStream (2018) — 2018-08-13 Aug 13, 2018 · release notes

     ThreatStream adds Sandbox UI modal submission and exclusive API key activation for Joe Sandbox

     • Adds Submitting Malware via a user-friendly pop-up modal on the Sandbox user interface

     1 detail in Everything

525. What's New in ThreatStream (2018) — 2018-08-09 Aug 9, 2018 · release notes

     ThreatStream (2018) adds CSV observable tagging and OpenDNS Umbria outbound integration capabilities.

     • Adds ability to tag imported observables with My Organization visibility when importing via CSV
     • Adds OpenDNS Umbrella integration for sending threat intelligence based on custom user-defined search filters

     2 details in Everything

526. What's New in ThreatStream (2018) — 2018-08-03 Aug 3, 2018 · release notes

     ThreatStream adds permission configuration during user creation via Admin UI

     • Adds the ability to assign user permissions at the time of user creation in the ThreatStream User Administration interface

     1 detail in Everything

527. Anomali Match OnPrem Release History — 2018-06-29 Jun 29, 2018 · release notes

     Anomali Enterprise v3.2 adds clustering support, First Boot Wizard, Threat Model Matches report, log collection for Universal Links, and configurable search result fields.

     • Adds support for clustering multiple Anomali Enterprise systems
     • Adds centralized management of Anomali Enterprise Universal Links through the user interface
     • Adds First Boot Wizard to configure essential Anomali Enterprise settings
     • Adds one-click log collection and upload for pre-installed Universal Link logs alongside Anomali Enterprise logs
     • Adds ability to set displayed fields for search results via Field Set configuration

     5 details in Everything

528. What's New in ThreatStream (2018) — 2018-06-25 Jun 25, 2018 · release notes

     Adds Message of the Day banner configuration for org admins in ThreatStream

     • Adds Organization Settings capability to configure a site-wide Message of the Day banner displayed at the top of the screen for all users

     1 detail in Everything

529. What's New in ThreatStream (2018) — 2018-06-20 Jun 20, 2018 · release notes

     ThreatStream adds configurable account lockout policy for failed logins

     • Org admins can now configure an account lockout policy for consecutive failed login attempts via Organization Settings

     1 detail in Everything

530. What's New in ThreatStream (2018) — 2018-06-14 Jun 14, 2018 · release notes

     ThreatStream adds support for searching complete phrases within the Threat Model.

     • Adds ability to search complete phrases in Threat Models
     • Enables phrase-based filtering in threat model queries

     2 details in Everything

531. What's New in ThreatStream (2018) — 2018-06-04 Jun 4, 2018 · release notes

     ThreatStream 2018 release adds search functionality to Threat Model entity descriptions.

532. What's New in ThreatStream (2018) — 2018-06-01 Jun 1, 2018 · release notes

     ThreatStream allows configuring post-execution sandbox recording duration via Analysis Time.

     • Adds the ability to configure the amount of time that the sandbox records runtime activity of detonated files after execution.

     1 detail in Everything

533. Anomali ThreatStream Integrator Release History — 2018-05-25 May 25, 2018 · release notes

     ThreatStream Integrator v6.5 adds Cloudera integration support and faster indicator downloads.

534. What's New in ThreatStream (2018) — 2018-05-14 May 14, 2018 · release notes

     ThreatStream 2018-05-14 adds ability to edit investigation titles

     • Allows users to modify the title of an existing investigation via the UI

     1 detail in Everything

535. What's New in ThreatStream (2018) — 2018-05-08 May 8, 2018 · release notes

     ThreatStream adds new Zscaler integration.

536. What's New in ThreatStream (2018) — 2018-05-04 May 4, 2018 · release notes

     ThreatStream released a feature allowing administrators to tailor email communications for new user onboarding.

     • New Organization Settings area allows customization of new user emails.

     1 detail in Everything

537. ThreatStream OnPrem Release History — 2018-04-06 Apr 6, 2018 · release notes

     Anomali ThreatStream OnPrem 2.5 adds remote associations, preferred tags, investigation deletion, and DomainTools integration.

     • Adds Remote Associations to link local ThreatStream OnPrem data with remote ThreatStream Cloud data
     • Adds Preferred Tags feature allowing creation of frequently used tag lists for quick selection in any Tags field
     • Adds ability to Delete Investigations belonging to your organization directly from the ThreatStream OnPrem UI
     • Adds DomainTools Integration for subscribers to leverage Whois data on observable details pages

     4 details in Everything

538. Anomali ThreatStream Integrator Release History — 2018-02-23 Feb 23, 2018 · release notes

     Anomali ThreatStream Integrator 6.4 adds Windows installation support.

     └──▷ BREAKING ON UPGRADE

     • !Tanium 6.2 is not supported; migrating to this release will break compatibility with Tanium 6.2.
539. Anomali Match OnPrem Release History — 2018-02-13 Feb 13, 2018 · release notes

     Anomali Enterprise 3.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via ThreatStream, Executive Reports, expanded Threat Model entities, and a beta Risk Score with vulnerability weighting.

     • ThreatStream single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication available for Anomali Enterprise
     • Out-of-the-box Executive Threat Analysis Report replaces deprecated IOC Match report
     • Overview Dashboard displays the last 10 threat model entities (Actors, Campaigns, TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., Vulnerabilities) matching events
     • Asset Model supports importing Qualys Cloud Platform scanner reports and adding assets to an Asset Whitelist
     • Risk Score calculation enhanced to weight asset vulnerabilities in beta

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The IOC Match report is deprecated; users must create an identical executive report after upgrading
540. Anomali ThreatStream Integrator Release History — 2017-12-07 Dec 7, 2017 · release notes

     Anomali ThreatStream Integrator v6.3.5 adds Cisco ASA firewall support

     • Adds Cisco ASA platform support for threat intelligence integration

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !ThreatStream Integrator does not support Tanium 6.2; migrating to this release while running Tanium 6.2 will break compatibility
541. Anomali Match OnPrem Release History — 2017-11-22 Nov 22, 2017 · release notes

     Anomali Enterprise v3.0 adds Real Time Forensics dashboard, Asset Model upload, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and Risk Score calculations.

     • Adds Real Time Forensics dashboard accessible via Dashboards > Real Time Forensics for retrospective analysis of events matched against the latest observables (defaulting to last 6 months).
     • Introduces Asset Model upload capability, allowing network infrastructure attributes (IPs, hostnames, MACs, criticality, location) to be uploaded and used to enrich event matches for risk analysis.
     • Exposes a REST API for managing the Asset Model, complementing the existing UI upload feature.
     • Adds Risk Score (Beta) calculation to matched events based on weighted factors including asset criticality, with display across multiple dashboards.
     • Adds ability to specify one or more indexes for Splunk Link drilldown searches to limit scope and improve response time.

     5 details in Everything

542. ThreatStream OnPrem Release History — 2017-11-01 Nov 1, 2017 · release notes

     ThreatStream OnPrem v2.4 adds Private Tags default TLP color and Compromised Service Account indicator type; v2.3 added Risk IQ/PhishMe integrations.

     • Adds Private Tags feature allowing Org Admins to set red as the default TLP color for comments on intelligence
     • Adds Compromised Service Account and Compromised Host Name as new indicator types exclusively on ThreatStream OnPrem
     • Adds support for Risk IQ and PhishMe subscriptions via Third Party Integrations in the UI
     • Adds Private Tags feature allowing Org Admins to set red as the default TLP color for comments on intelligence

     4 details in Everything

543. Anomali ThreatStream Integrator Release History — 2017-10-03 Oct 3, 2017 · release notes

     Anomali ThreatStream Integrator v6.3 adds Check Point, Infoblox 8.2, McAfee NitroSecurity support and My Attacks for QRadar/LogRhythm.

     • Adds Check Point as a new integration destination for indicator export
     • Expands integration support to Infoblox version 8.2
     • Expands integration support to McAfee NitroSecurity versions 10.0 and 10.1
     • Enables My Attacks observability for QRadar and LogRhythm environments, extending prior ArcSight ESM and Splunk coverage

     4 details in Everything

544. Anomali Match OnPrem Release History — 2017-09-20 Sep 20, 2017 · release notes

     Anomali Match OnPrem v2.5 adds indicator suppression, type exclusion, REST forensics API, and UI Alt-click filtering

     • Suppressed indicator status allows whitelisting specific indicators to exclude them from the matching process
     • Indicator type exclusion lets you filter out specific indicator categories from match results to reduce noise
     • REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. enables programmatic retrieval of forensic search results previously only available via UI

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Default license restricts indicator matches, retrospective searches, DGA matches, and export to the first 1 GB of event logs per day
545. ThreatStream OnPrem Release History — 2017-08-16 Aug 16, 2017 · release notes

     ThreatStream OnPrem 2.2 adds URL-based observable imports, Word/PDF text editor support, threat model cloning, and Email/Phishing integration.

     • Adds the ability to import observables by specifying URLs that point to plain text intelligence feeds or direct links to CSV, HTML, JSON, PDF, TXT, or XML files.
     • Enables copying and pasting content from .doc, docx, and .pdf files into rich text editors for threat model entities, preserving all formatting.
     • Adds the ability to create local copies of Actors, Campaigns, Incidents, and Threat Bulletins (threat model cloning).
     • Makes the Email/Phishing tab accessible in the ThreatStream OnPrem UI, allowing observables to be imported via email.

     4 details in Everything

546. Anomali ThreatStream Integrator Release History — 2017-08-11 Aug 11, 2017 · release notes

     Adds integration destinations including AccelOps, ArcSight ESM, Carbon Black, and QRadar for ThreatStream Integrator.

     • Adds AccelOps as an integration destination
     • Adds ArcSight ESM 6.9 support
     • Adds ArcSight ESM 6.11 support
     • Adds Blue Coat Proxy SG as an integration destination
     • Adds BroIntel as an integration destination

     +13 more show less

     • Adds Carbon Black as an integration destination
     • Adds Common Event Format (CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure.) as an integration destination
     • Adds Cloudera Impala as an integration destination
     • Adds CrowdStrike Falcon as an integration destination
     • Adds FireEye as an integration destination
     • Adds Hadoop Hive as an integration destination
     • Adds Infoblox as an integration destination
     • Adds LogRhythm as an integration destination
     • Adds Palo Alto Networks as an integration destination
     • Adds QRadar 7.3 support
     • Adds RSA NetWitness as an integration destination
     • Adds Syslog as an integration destination
     • Adds Tanium as an integration destination

     18 details in Everything

547. Anomali Match OnPrem Release History — 2017-07-26 Jul 26, 2017 · release notes

     Anomali Enterprise v2.3 adds NetFlow/sFlow ingestion, manual sync trigger, DGA REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and UI rename.

     • Adds OVERRIDE SCHEDULE AND SYNC NOW option for sites to initiate unscheduled threat intelligence downloads
     • Supports NetFlow and sFlow data ingestion via Anomali Universal Link v2.2.0
     • Adds REST API endpoint to retrieve DGA Probability and Malware Family for domain sets from the DGA detection algorithm
     • Makes user credentials optional in SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. mail settings
     • Renames Forensics to Retrospective in the UI and enables investigation creation from retrospective search results

     5 details in Everything

548. Anomali ThreatStream Integrator Release History — 2017-07-13 Jul 13, 2017 · release notes

     Anomali ThreatStream Integrator 6.1 adds custom destinations with CSV, JSON, and Snort output formats.

     • Adds the ability to define a custom destination that exposes threat intelligence as an endpoint on ThreatStream Integrator in CSV, JSON, or SNORT formats
     • Adds support for concurrent connections from multiple integrated destinations on a single ThreatStream instance
     • Introduces full migration and upgrade support from ThreatStream Integrator to ThreatStream

     3 details in Everything

549. ThreatStream OnPrem Release History — 2017-06-16 Jun 16, 2017 · release notes

     ThreatStream OnPrem 2.1 adds observable export formats, excluded observable resubmission, investigation phase assignment, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. client integration.

     • Adds Observable Export capability to export search results in various formats
     • Resubmit Excluded Observables feature allows editing and resubmitting import jobs for observables excluded due to typos
     • ThreatStream setup now checks for duplicate IP addresses against the Docker IP address with easy editing
     • Investigations Enhancements allow assigning entities (actors, observables) to multiple phases within structured threat models like KillChain
     • View all entities while cycling through structured threat models in investigations

     +3 more show less

     • Improved audit log tracks investigation updates
     • Exporting an investigation to a ThreatBulletin now runs a duplicate check
     • New Taxii Client aggregates TAXII data and integrates it with existing ThreatStream Hybrid intelligence

     8 details in Everything

550. Anomali Match OnPrem Release History — 2017-06-14 Jun 14, 2017 · release notes

     Anomali Match OnPrem v2.2 adds MyEvents Map, saved searches, AWS S3 alert forwarding, and configurable session/refresh timeouts.

     • MyEvents Map provides an interactive geographic visualization of outbound threat destinations matching observables.
     • Saved search allows saving queries for reuse in alerts and scheduled forensic searches.
     • Alert forwarding to AWS S3 supports CSV and JSON output formats for alert data.

     3 details in Everything

551. Anomali ThreatStream Integrator Release History — 2017-06-12 Jun 12, 2017 · release notes

     Version 6.0.2 adds ability to exclude header row from CSV output files for custom destinations.

552. Anomali ThreatStream Integrator Release History — 2017-05-14 May 14, 2017 · release notes

     First GA release of ThreatStream Integrator adds Splunk and Custom Destination integrations with CSV/JSON/SNORT support.

     • Adds ThreatStream Integrator as a new cyber tooling component with general availability in version 6.0
     • Adds integration support for Splunk to ingest threat intelligence data
     • Adds Custom Destinations feature allowing access to downloaded threat intelligence via HTTP endpoints
     • Supports output formats CSV, JSON, and SNORT for Custom Destinations

     4 details in Everything

553. Anomali Match OnPrem Release History — 2017-05-03 May 3, 2017 · release notes

     Anomali Match OnPrem 2.1 adds CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. notation support in search filters and DGA domain whitelisting.

     • Ability to whitelist domains

     1 detail in Everything

554. ThreatStream OnPrem Release History — 2017-03-31 Mar 31, 2017 · release notes

     ThreatStream OnPrem v2.0 adds TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. ingestion, observable linking, and CSV export capabilities.

     • Adds the ability to associate observables with related observables in the Investigation UI.
     • Integrates a ThreatStream-provided Joe Sandbox service for automated malware detonation during investigations.
     • Enables viewing an improved Investigation activity log to track update history.
     • Adds TAXII server support as a new source for receiving threat intelligence feeds.
     • Adds CSV format export capability for observable search results.

     5 details in Everything

555. ThreatStream OnPrem Release History — 2017-02-21 Feb 21, 2017 · release notes

     ThreatStream OnPrem v1.6 adds centrally managed investigations and Explorer node export in CSV/PDF

     • Adds central management of threat investigations via the Investigations feature
     • Enables exporting Explorer nodes as CSV or PDF files
     • Expands Threat model search to include Tags and Aliases fields
     • Adds Source Optimizer metrics for viewing and comparing open source feed performance

     4 details in Everything

556. ThreatStream OnPrem Release History — 2016-11-20 Nov 20, 2016 · release notes

     ThreatStream OnPrem 1.5 adds in-place upgrades and geographic visualization on MyEvents Map.

     • Adds in-place upgrade capability
     • Enables geographic location visualization of threats on the MyEvents Map

     2 details in Everything

557. Anomali Match OnPrem Release History — 2016-07-26 Jul 26, 2016 · release notes

     Anomali Enterprise v1.2.1 adds auto upgrade support for QRadar Link and extends Farsight trial to 45 days.

558. Anomali Match OnPrem Release History — 2016-07-21 Jul 21, 2016 · release notes

     Anomali Match OnPrem v1.2 adds QRadar collection/forwarding, alert forwarding to Syslog/ArcSight/Splunk, and event correlation filters.

     • Adds QRadar support for collecting events into Anomali Enterprise via the Anomali Enterprise Link for QRadar
     • Enables Alert Forwarding to a Syslog server, ArcSight ESM (as CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure. events), Splunk (as JSON events), and QRadar
     • Introduces the Event Correlation Filter capability allowing users to define criteria such as confidence >= 90 and severity = very-high

     3 details in Everything

559. Anomali Match OnPrem Release History — 2016-05-11 May 11, 2016 · release notes

     Anomali Match adds URL field to DGA Matches dashboard

560. ThreatStream OnPrem Release History — 2016-05-11 May 11, 2016 · release notes

     ThreatStream OnPrem 1.4.1 adds local keyword alert configuration

     • Adds the ability to configure local keyword alerts

     1 detail in Everything

561. ThreatStream OnPrem Release History — 2016-05-02 May 2, 2016 · release notes

     Adds bulk IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. cloning from Search page and PDF export for IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., Threat Models, and search results

     • Adds the ability to clone Indicators of Compromise (IOCs) in bulk directly from the Search page
     • Enables exporting IOCs, Threat Model entities, and search results in PDF format

     2 details in Everything

562. ThreatStream OnPrem Release History — 2015-11-25 Nov 25, 2015 · release notes

     ThreatStream OnPrem 1.2 adds proxy server support for outbound traffic

     • Adds support for using ThreatStream OnPrem through a proxy server
     • Introduces new context-sensitive online Help and PDF User Guide

     2 details in Everything