https://cybertoolchain.io/tools/anomali New releases and features in Anomali, tracked by The Cyber Toolchain. en Wed, 24 Jun 2026 00:00:00 GMT https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm Wed, 24 Jun 2026 00:00:00 GMT ThreatStream Next Gen adds permission-based controls and per-PIR sharing for PIRs • Adds permission-based controls for PIRs, allowing Organization Administrators to configure user capabilities for create, edit, run, and delete operations on PIRs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 24 Jun 2026 00:00:00 GMT Adds ja4_tls_fingerprint indicator type, multiple new APP Store feeds, and PDRP Takedown Service to ThreatStream. • Adds `ja4_tls_fingerprint` indicator type to ThreatStream for tracking TLS handshakes • Makes the URLhaus Hostfile open-source feed available for activation in the APP Store • Enables the Anomali PDRP Takedown Service enrichment for submitting takedown requests via the APP Store • Goes generally available with self-service on-boarding for the Anomali PDRP Enhanced premium feed • Adds Cognyte: Luminar IOCs, LeakedCredentials, and AI Cyber Feeds premium feeds to the APP Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 24 Jun 2026 00:00:00 GMT Anomali Search gains an OCSF Field Panel to browse schema fields and filter results directly from the UI. • Adds the 'OCSF Field Panel' (Limited Availability) in Event Search for browsing OCSF Version 1.2.0 schema fields by category. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/Copilot_Release%20Notes.htm https://docs.anomali.com/Content/Release_Notes/Copilot_Release%20Notes.htm Tue, 23 Jun 2026 00:00:00 GMT Anomali Copilot adds 'Scan main content only' setting in v6.0.10 • Adds the `Scan main content only` setting to Scanning Settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm Wed, 10 Jun 2026 00:00:00 GMT ThreatStream Next Gen adds PIR lookback window configuration and Safari/Edge browser support • Adds browser support for Safari and Edge Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 10 Jun 2026 00:00:00 GMT ThreatStream adds Zscaler URL push, PDRP asset config, and multiple new premium/intel feeds via App Store • Zscaler integration pushes observables to the Custom Malicious URLs list in ZIA • PDRP feed allows configuration of organizational assets on the Assets page • App Store adds Check Point Exposure Management IoC Intelligence and Doppel premium feeds • App Store adds Intel 471 Verity API-based premium feeds (Breach Alerts, FINTEL Reports, Geopolitical Reports, Information Reports, Malware Intelligence, Spot Reports, Vulnerability Reports, Credential Intelligence, Watcher Alerts) • App Store adds Anomali C2 Detection, Anomali Credential Monitoring, and Anomali Early Warning (powered by RedSense) premium feeds • App Store adds Ransomfeed - Real-Time Ransomware Intelligence open-source feed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 10 Jun 2026 00:00:00 GMT Adds OCSF schema support for Search views • Enables creation of Search views using the OCSF schema type Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_sa.htm https://docs.anomali.com/Content/whats_new/whats_new_sa.htm Thu, 28 May 2026 00:00:00 GMT Security Analytics adds resource tagging for alerts with filtering, bulk editing, and permission controls. • Expanded Resource Tagging (Limited Availability): Apply tags to Alerts and filter them by tags, as well as bulk edit tags and permissions across alerts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Thu, 28 May 2026 00:00:00 GMT ThreatStream adds Zscaler OneAPI support, open-source feeds to APP Store, and OCSB schema RBAC • Adds Zscaler `OneAPI` integration alongside the legacy Zscaler API for collecting threat data. • Makes Anomali Dark Web Intelligence and Anomali Threat Briefing open-source feeds available for activation in the APP Store. • Enables Organization administrators to configure Role-Based Access Control using OCSF schema fields in addition to the standard eventlog schema. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Thu, 28 May 2026 00:00:00 GMT Anomali introduces resource tagging, OCSA schema RBAC, and customizable export timestamps. • Adds the ability to apply tags to Saved Searches, Alerts, Views, Macros, and Lookup Tables, including filtering by tag and bulk editing permissions. • Adds Role-Based Access Control for Schemas using OCSF schema fields alongside standard eventlog schema. • Enables full-text indexing, correlations, and turbosearch-based AQL querying on the OCSF schema. • Adds a selectable timestamp format (human-readable or UNIX) when exporting search results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm Wed, 27 May 2026 00:00:00 GMT ThreatStream Next Gen adds PIR expiry dates and industry-specific threat landscape views. • Adds expiry date configuration to PIRs at creation or edit time • Expands Global Threat Landscape in Command Center to 26 industry verticals using STIX 2.1 and CISA critical infrastructure sectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 13 May 2026 00:00:00 GMT ThreatStream adds Premium Digital Risk Protection service, RansomLook.io OSINT feed, and entity export to existing threat models. • Adds Premium Digital Risk Protection (PDRP) service via the App Store for external attack surface monitoring • Adds `RansomLook.io` open source ransomware OSINT feed availability in the App Store • Adds ability to add investigation entities to an existing threat model Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm https://docs.anomali.com/Content/Release_Notes/whats_new_next_gen.htm Thu, 30 Apr 2026 00:00:00 GMT Anomali ThreatStream Next Gen generally available with AI-powered threat detection and unified intelligence workflows. • ThreatStream Next Gen is now generally available as a modernized platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Thu, 30 Apr 2026 00:00:00 GMT ThreatStream Next Gen GA brings AI-powered capabilities and unified intelligence workflows • New unified intelligence workflows enable faster threat detection and response through the `ThreatStream Next Gen` platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 29 Apr 2026 00:00:00 GMT ThreatStream adds `search_filter` to Threat Model Search API and five new OSINT feeds. • Adds the `search_filter` attribute to the Threat Model Search API endpoint to allow applying saved search filters when querying threat model entities • Enables activation of Anomali Curated RSS, PhishDestroy, PhishHunt.io - Active Phishing Blocklist, ShadowWhisperer Malware Blocklist, and TweetFeed open-source feeds in the APP Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 29 Apr 2026 00:00:00 GMT Search Tabs UI for multiple concurrent searches; whois operator parses=true for filtered results • Adds `whois` operator `parsed=true` parameter to filter and aggregate WHOIS results without manual JSON parsing • Adds Search Tabs UI feature on the Search homepage to launch one or more simultaneous searches Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 15 Apr 2026 00:00:00 GMT ThreatStream adds new indicator types, EPSS vulnerability scoring, SSO login page, and Takedown service enhancements. • Adds `mal_port`, `compromised_port`, and `compromised_password` indicator types to ThreatStream • Introduces SSO-integrated beta login page for direct sign-in without navigating to IdP first • Adds EPSS Score, EPSS Percentile fields and EPSS-based filtering options to Vulnerability basic search filters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm Wed, 15 Apr 2026 00:00:00 GMT Adds Dashboard Tagging and Bulk Editing (Limited Availability) • Enables dashboard resource tagging to organize and filter dashboards • Allows bulk editing of tags, sharing settings, owner, bookmarks, and deletion Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/OnPrem_Release_Notes.htm https://docs.anomali.com/Content/Release_Notes/OnPrem_Release_Notes.htm Wed, 15 Apr 2026 00:00:00 GMT ThreatStream OnPrem 6.0 adds OAuth 2.0 API support, MITRE ATT&CK JSON export, Anomali Copilot, new indicator types, and SIEM audit log integration. • Adds `OAuth 2.0` API Credentials for ThreatStream OnPrem authentication • Adds `JSON` format export option for Security coverage of MITRE ATT&CK profiles • Adds support for `benign_domain`, `phish_file_name`, `fraud_file_name`, `mal_wildcard_domain`, `mal_wildcard_url`, `sus_wildcard_domain`, and `sus_wildcard_url` indicator types in ThreatStream OnPrem • Enables integration of ThreatStream OnPrem audit logs with SIEM systems • Adds `Anomali Copilot` chat interface leveraging agentic search techniques to the ThreatStream OnPrem UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 15 Apr 2026 00:00:00 GMT Anomali search adds organization-wide dashboard tags, shannon_entropy calc function, and timechart addtotals • Adds `Resource Tags for Dashboards` to create and manage an organization-wide tag catalog for locating and organizing dashboards by applying multiple tags with appropriate user permissions • Adds the `shannon_entropy` information theory function to the `calc` operator to calculate an entropy score for any string field and identify unusual patterns in event data • Adds `addtotals=true` option to the `timechart` operator to view a summary across all groups and time periods based on event counts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_sa.htm https://docs.anomali.com/Content/whats_new/whats_new_sa.htm Tue, 31 Mar 2026 00:00:00 GMT Security Analytics adds asset lookup table imports and persistent alert triage workflows. • Adds asset data import from Qualys, Rapid7, Tenable, AWS or CSV uploads into the asset lookup table • Introduces Alert Triages with persistent comment history and richer side-panel context for investigation workflows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Tue, 31 Mar 2026 00:00:00 GMT Anomali search adds OCSF schema support, MITRE heatmaps with configurable gradients, and lookup tables for asset data. • Adds OCSF Schema Support (Limited Availability) to leverage OCSF-normalized event telemetry alongside eventlog • Adds Visualization Type (Limited Availability) for frequency view in MITRE ATT&CK heatmaps with configurable gradients and tooltips • Adds Lookup Tables (Limited Availability) including asset and investigation_elements lookup tables for asset data and investigation querying Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Tue, 17 Mar 2026 00:00:00 GMT Adds undo/redo support for node additions, deletions, and positions in ThreatStream investigation entities. • Enables undo and redo chart options to reverse node additions, deletions, and position changes in investigation entities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Mon, 09 Mar 2026 00:00:00 GMT ThreatStream adds a new out-of-the-box ATR Dashboard for Middle East conflict APT activity monitoring • Adds the 'Middle East Conflict - APT & Adversary Activity Monitor' out-of-the-box dashboard to track nation-state and APT activity tied to geopolitical developments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 04 Mar 2026 00:00:00 GMT Anomali Search adds limited-availability gti operator for enrichment and seasonal ARIMA support. • Adds the `gti` operator to enrich observables with Google Threat Intelligence verdicts and metadata • Updates the `ARIMA` operator to support seasonal time-series modeling in limited availability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Mon, 02 Mar 2026 00:00:00 GMT ThreatStream adds an out-of-the-box 'Middle East Conflict' ATR dashboard for real-time threat monitoring. • Adds the 'The Middle East Conflict: Iran–Israel–USA Cyber Threat Monitor' ATR Dashboard to ThreatStream • Provides real-time threat intelligence coverage of the cyber dimensions of the ongoing military conflict involving Iran, Israel, and the United States Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm Thu, 19 Feb 2026 00:00:00 GMT Dashboards can now be exported as HTML and scheduled reports added. • Adds the ability to export dashboards in HTML format • Enables creation of scheduled dashboard reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 18 Feb 2026 00:00:00 GMT ThreatStream adds CERT.PL, Phishing Army, Binary Defense, and DomainTools Iris Detect feeds; enables GTI API request capping. • Adds `CERT.PL Malicious Domain Blocklist`, `Phishing Army`, and `Binary Defense` open source feeds in the APP Store. • Adds `DomainTools - Iris Detect` premium feed in the APP Store. • Adds API request limit configuration for `Google Threat Intelligence` premium feed users. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 04 Feb 2026 00:00:00 GMT Adds `new_domain` indicator type to ThreatStream. • `new_domain` indicator type is added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 04 Feb 2026 00:00:00 GMT Anomali Search introduces a Linear Regression visualization to analyze variable relationships. • Adds the `Linear Regression` visualization type to Search (Limited Availability) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 28 Jan 2026 00:00:00 GMT ThreatStream adds SpyCloud Enterprise Protection premium feed via the APP Store • Adds `SpyCloud Enterprise Protection` as an available premium feed in the ThreatStream APP Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Mon, 26 Jan 2026 00:00:00 GMT ThreatStream adds ServiceNow OAuth 2.0 support with assignment group/category mapping and consolidates Polyswarm sandbox results. • Adds `OAuth 2.0` credential support for the ServiceNow integration to allow assigning an assignment group and category when creating or updating security incidents • Consolidates Polyswarm sandbox detonation reports into a single column on the Sandbox page, displaying platform, scan results, confidence score, and malicious detection count Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 21 Jan 2026 00:00:00 GMT ThreatStream adds GreyNoise Benign and Suspicious IPv4 premium feeds and increases custom RSS feed limit to 1,000. • Adds `GreyNoise - Benign IPv4 Scanner` and `GreyNoise Suspicious IPv4 Scanner` premium feeds via the APP Store for activation • Increases the maximum number of configurable custom RSS feeds per organization to 1,000 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Mon, 12 Jan 2026 00:00:00 GMT ThreatStream GA: User & Role Management enables platform-wide RBAC • User & Role Management is generally available, establishing role-based access control for the Anomali platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Thu, 08 Jan 2026 00:00:00 GMT ThreatStream App Store now includes the Ransomware.live open source feed for activation. • Adds `Ransomware.live` open source feed to the ThreatStream APP Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 07 Jan 2026 00:00:00 GMT Search adds haversine trigonometric function and automatic CEF/key-value extractions. • `calc` enables the `haversine` function to calculate distances between sequential login events for identifying geographically improbable logins • Automatic extraction of JSON, Common Event Format (CEF), and key-value field pairs on-the-fly using dotted notation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_sa.htm https://docs.anomali.com/Content/whats_new/whats_new_sa.htm Tue, 06 Jan 2026 00:00:00 GMT Adds Google SecOps log ingestion support for curated and custom alerts. • Adds `Google SecOps` data ingestion capability for both curated and custom alerts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Tue, 06 Jan 2026 00:00:00 GMT ThreatStream adds support for MITRE ATT&CK v18.0 techniques and sub-techniques. • Supports MITRE ATT&CK v18.0 techniques and sub-techniques. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Mon, 22 Dec 2025 00:00:00 GMT ThreatStream OnPrem Ubuntu v6.0 generally available • Releases ThreatStream OnPrem for Ubuntu v6.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/OnPrem_Release_Notes.htm https://docs.anomali.com/Content/Release_Notes/OnPrem_Release_Notes.htm Mon, 22 Dec 2025 00:00:00 GMT ThreatStream OnPrem 6.0 adds MITRE profile JSON export, OAuth 2.0 API creds, Google TI integration, and Anomali Copilot. • Adds `created_ts` and `source_created` fields for advanced search-based rule matching • Supports exporting MITRE ATT&CK profile security coverage in JSON format • Enables User & Role Management for role-based access control • Adds OAuth 2.0 support for API Credentials • Activates Google Threat Intelligence integration for Passive DNS enrichments • Adds Anomali Copilot chat with agentic search capabilities in the UI • Introduces new indicator types: `benign_domain`, `phish_file_name`, `fraud_file_name`, `mal_wildcard_domain`, `mal_wildcard_url`, `sus_wildcard_domain`, and `sus_wildcard_url` • Adds support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm malware detonation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 10 Dec 2025 00:00:00 GMT ThreatStream adds Lock SSO Configuration feature and VMRAY Essential feed • Adds ability to lock or unlock SSO settings via the 'Lock SSO Configuration' feature to prevent unauthorized changes • Makes VMRAY - UniqueSignal - Essential premium feed available for activation in the APP Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm https://docs.anomali.com/Content/whats_new/whats_new_dashboards.htm Wed, 10 Dec 2025 00:00:00 GMT Anomali Dashboards adds Role Based Access Control for user-created dashboards and refreshes the Dashboard Library UI • Adds role-based access control to restrict who can view or modify user-created dashboards. • Refreshes Dashboard Library UI with improved filtering and permission-aware dashboard listing. • Improves Dashboard Library experience by respecting sharing and permissions for out-of-the-box, shared, and custom dashboards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 10 Dec 2025 00:00:00 GMT Anomali Search adds IsolationForest operator, Decision Tree visualization, and RBAC for lookup tables/macros. • Adds `IsolationForest` operator to isolate anomalies in high-volume event data using an unsupervised algorithm • Adds `Decision Tree` visualization type to explore tree-based machine learning models and their results • Enables role-based access control for user-created lookup tables • Enables role-based access control for user-created macros Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 03 Dec 2025 00:00:00 GMT Anomali Search now supports automatic JSON field extractions to allow flexible AQL queries on unmapped fields. • Adds automatic JSON field extractions to enable viewing and using extracted fields in AQL queries for downstream analysis without requiring mapping to the standard Anomali eventlog schema Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/Release_Notes/Integrator_Release_Notes.htm https://docs.anomali.com/Content/Release_Notes/Integrator_Release_Notes.htm Tue, 02 Dec 2025 00:00:00 GMT ThreatStream Integrator v8.5.7 adds Ubuntu 24.x support and removes older Ubuntu versions. • `Supported OS` list adds `Ubuntu 24.x` as a supported Linux operating system. Breaking changes: • Ubuntu 18.x and 20.x have been removed from the list of supported Linux OS, breaking deployments on those versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 19 Nov 2025 00:00:00 GMT Adds Abusix Threat Intelligence premium feed to ThreatStream App Store • Adds the `Abusix Threat Intelligence` premium feed as an available item in the ThreatStream APP Store for activation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/whats_new/whats_new_search.htm https://docs.anomali.com/Content/whats_new/whats_new_search.htm Wed, 19 Nov 2025 00:00:00 GMT Anomali Search adds Bubble Chart visualization type to identify multi-dimensional patterns in limited availability. • Adds `Bubble Chart` visualization type for representing three dimensions of data and identifying patterns or relationships across complex datasets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Thu, 13 Nov 2025 00:00:00 GMT Anomali ThreatStream v2.1.2 release notes for Azure Sentinel extension available • Updates the `Azure Sentinel` extension to version `v2.1.2`. • Makes the updated extension downloadable from the ThreatStream Downloads page. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Wed, 05 Nov 2025 00:00:00 GMT The Falconfeeds.io premium feed is now available for activation in the APP Store. • The Falconfeeds.io premium feed is now available for activation in the APP Store. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali https://docs.anomali.com/Content/TS_Release_Notes.htm https://docs.anomali.com/Content/TS_Release_Notes.htm Tue, 21 Oct 2025 00:00:00 GMT Adds Cisco Umbrella API v2 support in the App Store for enrichment • `Cisco Umbrella Investigate` enrichment now supports `API v2` via the App Store Full history on Cyber Toolchain: https://cybertoolchain.io/tools/anomali