Which threat actor, malware or campaign is behind an indicator we just saw?

stores observables and indicators inside the STIX2 knowledge schema linked to the threat actors, intrusion sets and campaigns they relate to, so an analyst can pivot from one artifact to the full picture of who and what it connects to

Is this the same infrastructure or actor another team already investigated?

holds all ingested intelligence in one shared knowledge base rather than per-team spreadsheets, so relationships and prior sightings surface automatically when new data is entered or ingested

Which of our investigations are still open and what do they cover?

represents an investigation as a scoped custom view with its own date range and filters on entity pages, separate from the global data set, so its boundaries stay visible without touching other work

Did an automated enrichment step change data without a person reviewing it?

records playbook runs against a restricted set of identities allowed to execute AI-driven enrichment, and logs the change so activity can be attributed rather than appearing as an anonymous edit

Can an AI assistant query our threat data directly instead of someone using the web frontend?

exposes the knowledge base through a native MCP server over Streamable HTTP, with connection details available from the user profile, so an assistant can pull answers from the same data the platform holds

OpenCTI release history — The Cyber Toolchain

7.261103.0 Nov 3, 2026 · issue 130

OpenCTI adds Elasticsearch 9 support, global TLS verification switches, custom fields, mass workflow operations, and ingestion health checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261103.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261103.0

Control TLS certificate verification globally with new switches added to platform configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
OpenCTI now accepts a Filigran license installed as the platform license, in addition to the native OpenCTI license format.
OpenCTI now supports Elasticsearch 9 servers via a dual Elastic client.
Enable custom fields on entities through a new custom fields feature.
Apply mass operations on workflow status and playboks across multiple objects at once.

+2 more show less

Form intake now supports deferred creation of objects — objects prepared in a form are not created until the form is submitted.
Ingestion health checks now include health settings and validation of users with incorrect capabilities.

Control TLS certificate verification globally with new switches added to platform configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
OpenCTI now supports Elasticsearch 9 servers via a dual Elastic client.
Enable custom fields on entities through a new custom fields feature.
Apply mass operations on workflow status and playboks across multiple objects at once.

3 more in Everything

7.261030.0 Oct 30, 2026 · issue 126

OpenCTI adds dashboard variable restriction modes, Hub import for custom views, theme export, and manual security coverage updates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261030.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261030.0

Add dashboard variable restriction modes to control how variables can be used within dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Import custom views directly from the Hub using the new import-from-Hub button in custom views.
Export themes as part of configuration presets, allowing platform appearance settings to be packaged and shared.
Import a configuration bundle from the bootstrap wizard, enabling faster initial platform setup.
Manually update security coverage results, giving analysts direct control over coverage data without waiting for automated runs.

+4 more show less

Use pingConnector in pycti to report connector errors back to OpenCTI for better connector health visibility.
Show full timestamps (date and time) instead of date-only in table views, with configurable display.
Restrict management of custom-field definitions to Enterprise Edition instances.
Prepare ingestion health monitoring (event type and scope filter values, email notifications, guards, service account checks, and UI) behind a feature flag.

Add dashboard variable restriction modes to control how variables can be used within dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Import custom views directly from the Hub using the new import-from-Hub button in custom views.
Export themes as part of configuration presets, allowing platform appearance settings to be packaged and shared.
Import a configuration bundle from the bootstrap wizard, enabling faster initial platform setup.
Manually update security coverage results, giving analysts direct control over coverage data without waiting for automated runs.

+2 more show less

Use pingConnector in pycti to report connector errors back to OpenCTI for better connector health visibility.
Prepare ingestion health monitoring (event type and scope filter values, email notifications, guards, service account checks, and UI) behind a feature flag.

2 more in Everything

7.261023.0 Oct 23, 2026 · issue 119

OpenCTI 7.261023.0 upgrades the knowledge graph with SVG export, keyboard control, grouped nodes, and ingestion health monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261023.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261023.0

Supports SVG export and higher-resolution image export from the knowledge graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables keyboard stroke control of knowledge graphs.
Groups objects of the same type together in the knowledge graph.
Improves graph behavior for filtered items with overall graph enhancements.

Supports SVG export and higher-resolution image export from the knowledge graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables keyboard stroke control of knowledge graphs.
Groups objects of the same type together in the knowledge graph.

1 more in Everything

advisory CVE-2026-104258 Oct 22, 2026 · issue 128

CVE-2026-104258: SSRF via webhook notifier allows authenticated users to reach internal services (CVSS 5.5, affects <= 7.260722.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-114505 Oct 22, 2026 · issue 128

CVE-2026-114505: Acceptance of GraphQL Operations via HTTP GET Method (affects < 7.260722.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.261021.1 Oct 21, 2026 · issue 116

OpenCTI 7.261021.1 adds Ask Ariane deck/report/video downloads, a config-preset export module, and graph surface upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261021.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261021.1

└──▷ HOW TO FIND IT

Export your OpenCTI configuration as a preset bundle to share or back up platform settings via the Filigran Experience UI.

📍In the OpenCTI UI, go to Filigran Experience › Export Configuration, select the types to include, and click Export — OpenCTI generates and stores a config bundle ZIP you can download.

Adds ability to view and download decks, reports, and videos generated by XTM One directly inside the Ask Ariane chatbot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a config-preset module with an export configuration drawer (in the Filigran Experience UI) that bundles and stores configuration as a downloadable ZIP, backed by a bypass-only storage root and an exportable types query.
Adds a parameter to XTM Hub browser messages for additional control over hub interactions.
Enables updating a manual security coverage result.
Adds custom field value management in playbooks and mass operations (chunk 7 of custom-fields rollout).

+1 more show less

Elevates the graph experience across every graph surface.

Adds ability to view and download decks, reports, and videos generated by XTM One directly inside the Ask Ariane chatbot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a config-preset module with an export configuration drawer (in the Filigran Experience UI) that bundles and stores configuration as a downloadable ZIP, backed by a bypass-only storage root and an exportable types query.

4 more in Everything

7.261019.0 Oct 19, 2026 · issue 114

OpenCTI 7.261019.0 adds dashboard variables management UI and XTM One chatbot content proxying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261019.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261019.0

Adds dashboard variables management UI and usage in widget filters for dynamic dashboard customization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Proxies decks, reports, and videos from XTM One into the embedded chatbot interface.

Adds dashboard variables management UI and usage in widget filters for dynamic dashboard customization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

advisory CVE-2026-104253 Oct 19, 2026 · issue 128

CVE-2026-104253: Profile page reflects MFA secret in response (CVSS 5.2, affects < 7.260715.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Oct 17, 2026 · issue 111

OpenCTI adds APP__ARTIFACT_ZIP_MAX_EXTRACTED_SIZE to cap the extracted size of archive artifacts on upload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Cap ZIP extraction at 500 MB to prevent runaway disk usage when analysts upload large archive artifacts.

yaml

app:
  artifact_zip_max_extracted_size: 524288000

7.261016.0 Oct 16, 2026 · issue 111

OpenCTI 7.261016.0 adds entity merging in knowledge view, Attack Pattern Matrix expand/collapse, defanged search, and conditional Fintel HTML generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261016.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261016.0

└──▷ HOW TO FIND IT

Find defanged indicators (e.g., hxxp://evil[.]com) in global search without manual reformatting.

📍In the OpenCTI top-bar global search, type a defanged indicator such as hxxp://evil[.]com — OpenCTI now resolves it against fanged equivalents automatically.

Collapse or expand the full MITRE ATT&CK matrix in one click to focus on relevant techniques.

📍In OpenCTI, open an Intrusion Set or Campaign › Knowledge › Attack Pattern Matrix, then click Expand all or Collapse all to toggle all technique rows at once.

Supports defanged as a search term in global search filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Allows merging entities directly from the knowledge view.
Enables automatic removal of HTML sections in generated Fintel reports when template variables are empty.
Improves layout of the description field on key objects such as Intrusion Sets, Malware, and Tools.

Supports defanged as a search term in global search filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Allows merging entities directly from the knowledge view.

2 more in Everything

docs update Oct 15, 2026 · issue 109

OpenCTI adds app:max_upload_file_size and app:max_upload_files config keys to cap file upload size and batch count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Harden a deployment that handles only small threat-intel reports by capping uploads to 50 MB and 5 files per request.

yaml

app:
  max_upload_file_size: 50mb
  max_upload_files: 5

Raise the upload ceiling on a platform that ingests large malware samples, using environment variables in a container deployment.

$ APP__MAX_UPLOAD_FILE_SIZE=2gb
APP__MAX_UPLOAD_FILES=20

Adds app:max_upload_file_size / APP__MAX_UPLOAD_FILE_SIZE config key (default 1gb) to set the maximum size of a single file uploaded to the platform (files, imports, artifacts); accepts a byte count or a unit suffix (kb, mb, gb) — a larger file is rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds app:max_upload_files / APP__MAX_UPLOAD_FILES config key to cap the maximum number of files uploaded in a single request.

2 details in Everything

7.261014.0 Oct 14, 2026 · issue 109

OpenCTI 7.261014.0 adds custom fields, dashboard variable foundations, enrichment from investigation graphs, and manual security-coverage results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261014.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261014.0

Adds dashboard variables manifest foundations, including a GraphQL API and token resolution, enabling dynamic, parameterized dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a Status variable to FINTEL report templates.
Adds external-ref, object-covered, and result-of ref relationship types to in regards of filters.
Supports manual creation of security coverage results from within the platform.
Adds custom fields capability to entities.

+1 more show less

Enables enrichment from the investigation graph via a dev enrichment connector.

Adds dashboard variables manifest foundations, including a GraphQL API and token resolution, enabling dynamic, parameterized dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports manual creation of security coverage results from within the platform.
Adds custom fields capability to entities.
Enables enrichment from the investigation graph via a dev enrichment connector.

2 more in Everything

docs update Oct 2, 2026 · issue 092

OpenCTI telemetry gains S3 storage-size metric and cluster-wide usage metrics, gated by a new env var.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable cluster-wide usage metrics collection so all nodes report a consistent, platform-wide figure rather than per-node observations.

.env

PLATFORM_USAGE_METRICS_MANAGER__ENABLED=true

Adds s3_used_size metric that reports total platform file storage (imports, exports, embedded, support, template-generated, and draft files) summed from indexed sizes rather than by listing the S3/MinIO bucket directly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a dedicated usage-metrics manager that computes cluster-wide platform metrics once per interval and shares results via Redis so every node reports a consistent value; enable with PLATFORM_USAGE_METRICS_MANAGER__ENABLED=true.

2 details in Everything

docs update Oct 2, 2026 · issue 092

OpenCTI adds SMTP timeout controls and a toggleable usage-metrics manager with Prometheus export support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Prevent SMTP hangs in high-latency environments by capping both the TCP connect and greeting phases.

yaml

smtp:
  connection_timeout: 5000
  greeting_timeout: 10000

Adds smtp:connection_timeout / SMTP__CONNECTION_TIMEOUT config key to cap the TCP connection wait to the SMTP server (in milliseconds).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds smtp:greeting_timeout / SMTP__GREETING_TIMEOUT config key to cap the SMTP server greeting wait after connection opens (in milliseconds).
Adds a manager that collects storage and ingestion usage metrics, disabled by default; when disabled, metrics are reported as null and not exported to Prometheus.

3 details in Everything

advisory CVE-2026-63477 Oct 2, 2026 · issue 128

CVE-2026-63477: Organization administrator can escalate to global administrator via unvalidated grantable_groups write (incomplete fix of CVE-2026-44730) (CVSS 8.8, affects < 7.260624.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.261002.0 Oct 2, 2026 · issue 092

OpenCTI 7.261002.0 adds chatbot quota visibility, 1-click investigation duplication, and a unified alerts/triggers notifications page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.261002.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.261002.0

Shows quota, prompts, and persisted message feedback in the embedded chatbot UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables 1-click duplication of investigations.
Splits alerts and triggers into separate sections within the notifications page.
Remaps user references held in stored filters when users are merged.

Shows quota, prompts, and persisted message feedback in the embedded chatbot UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables 1-click duplication of investigations.

2 more in Everything

advisory CVE-2026-76823 Sep 30, 2026 · issue 128

CVE-2026-76823: Elasticsearch credentials disclosed to connector tokens through logsWorkerConfig (affects < 7.260706.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260811.0-lts.1 Sep 30, 2026 · issue 091

OpenCTI 7.260811.0-lts.1 switches map rendering to local PMTiles and adopts a FIPS 140-3 validated Docker base image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260811.0-lts.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260811.0-lts.1

Replaces the external map tile server with local PMTiles rendering, eliminating the outbound dependency for map widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 30, 2026 · issue 090

OpenCTI adds XTM One integration with mutual request signing via short-lived tokens and internal/public URL split support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports an internal XTM One URL (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ http://xtm-one:4000 in Docker): OpenCTI reads XTM One's public identity and signing keys from /xtm/auth/metadata on that address, allowing the internal and public URLs to differ.

1 detail in Everything

7.260930.0 Sep 30, 2026 · issue 090

OpenCTI 7.260930.0 adds manual security coverage entities, TTP/vulnerability re-linking, and TAXII Client error visibility in the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260930.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260930.0

Adds manual security coverage entity creation with entity selection, enabling practitioners to build and track coverage posture directly in the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables manual re-linking of behaviors (TTPs), vulnerabilities, and related entities to assess and refine security coverage.
Surfaces TAXII Client ingestion errors within the UI so operators can diagnose feed failures without leaving the platform.
Adds min_version and max_version fields to the V1 catalog schema to constrain connector compatibility by platform version.
Merging users now disables the source account, emits a merge trace, and closes accesses held by the merged-away account.

Adds manual security coverage entity creation with entity selection, enabling practitioners to build and track coverage posture directly in the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables manual re-linking of behaviors (TTPs), vulnerabilities, and related entities to assess and refine security coverage.

3 more in Everything

docs update Sep 29, 2026 · issue 089

OpenCTI can now receive Enterprise Edition licensing from XTM One via xtm:xtm_one_url and xtm:xtm_one_token, and adds redis:tls_cluster_node_mode for per-node TLS cert⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable XTM One-based Enterprise Edition licensing so OpenCTI automatically receives and renews its EE license from the XTM One server every 5 minutes.

yaml

xtm:
  xtm_one_url: "https://common.xtm1.filigran.io"
  xtm_one_token: "<your-xtm-one-registration-token>"

Enforce individual TLS certificate validation for each Redis cluster node instead of a single shared check.

yaml

redis:
  tls_cluster_node_mode: true

Adds xtm:xtm_one_url (env: XTM__XTM_ONE_URL, default https://common.xtm1.filigran.io) and xtm:xtm_one_token (env: XTM__XTM_ONE_TOKEN) config keys to register OpenCTI with XTM One every 5 minutes and receive a Filigran-signed Enterprise Edition license from the XTM license server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds redis:tls_cluster_node_mode (env: REDIS__TLS_CLUSTER_NODE_MODE) config key that, when set, validates each Redis cluster node certificate individually rather than globally.
Adds a Settings > Filigran Experience page showing Enterprise Edition license source (OpenCTI license or XTM One license), customer, type, and validity dates — with XTM One license status rechecked every 5 minutes and 90-day grace period for expired licenses (no grace for trial or ci license types).

3 details in Everything

└──▷ BREAKING ON UPGRADE

!XTM One-based Enterprise Edition licensing requires XTM One release #3831 or later; against an older XTM One the XTM license grants nothing and OpenCTI logs a warning — upgrade XTM One before OpenCTI.

7.260928.0 Sep 28, 2026 · issue 089

OpenCTI 7.260928.0 adds SSVC vulnerability prioritization, Indicator-to-Security-Platform sightings, ingestion logs, and investigation duplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260928.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260928.0

Adds number_seen and max_distinct_count counters to the Observed Data data model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds ingestion logs across all ingestion types (feature flag removed, now always active).
Adds SSVC risk-based prioritization metrics aligned to CISA BOD 26-04 for vulnerability objects.
Supports sighting relationships between an Indicator and a Security Platform entity.
Supports duplicating an investigation.

+1 more show less

Verifies Filigran-signed XTM licenses returned by XTM One registration and grants Enterprise Edition from the verified license.

Adds number_seen and max_distinct_count counters to the Observed Data data model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds SSVC risk-based prioritization metrics aligned to CISA BOD 26-04 for vulnerability objects.
Supports sighting relationships between an Indicator and a Security Platform entity.
Supports duplicating an investigation.
Verifies Filigran-signed XTM licenses returned by XTM One registration and grants Enterprise Edition from the verified license.

1 more in Everything

advisory CVE-2026-76822 Sep 23, 2026 · issue 128

CVE-2026-76822: Authorisation vulnerability in case creation (CVSS 4.3, affects < 7.260701.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Sep 22, 2026 · issue 082

OpenCTI adds four new Prometheus metrics and a background health monitor with configurable refresh intervals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Set health monitoring refresh intervals so Prometheus scrapes never trigger live dependency probes — tune dependency checks and expensive usage scans independently.

yaml

app:
  health_monitoring:
    dependency_check_interval: 30
    usage_metrics_interval: 120

Adds opencti_dependency_up metric reporting connectivity state (up/down) for each platform dependency (elasticsearch, storage, rabbitmq, redis) as a Boolean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds opencti_elasticsearch_used_size_bytes metric reporting total ElasticSearch/OpenSearch primary store size in bytes, replicas excluded.
Adds opencti_storage_used_size_bytes metric reporting total size of objects stored in the S3/MinIO bucket in bytes.
Adds opencti_queue_consumers metric reporting the number of active consumers on push queues, broken down by connector type (EXTERNAL_IMPORT, INTERNAL_ENRICHMENT, INTERNAL_IMPORT_FILE, INTERNAL_EXPORT_FILE, or UNKNOWN).
Adds app:health_monitoring:dependency_check_interval and app:health_monitoring:usage_metrics_interval config keys to control how frequently health and usage metrics are refreshed.

5 details in Everything

docs update Sep 22, 2026 · issue 082

OpenCTI adds health-monitoring intervals, Redis TLS SNI, usage-metrics manager, and exponential missing-reference retry tuning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable exponential back-off for missing-reference retries in a connector environment where referenced entities often arrive within a second, reducing unnecessary wait time on early retries.

$ OPENCTI_MISSING_REF_RETRY_EXPONENTIAL=true
OPENCTI_MISSING_REF_RETRY_INITIAL_DELAY=0.5
OPENCTI_MISSING_REF_RETRY_FACTOR=2

Configure health-monitoring check cadence and enable the usage-metrics manager in a multi-node OpenCTI deployment so each node refreshes dependency status every 10 s and collects storage/ingestion metrics every 60 s.

config/production.yml

app:
  health_monitoring:
    dependency_check_interval: 10000
    usage_metrics_interval: 60000
platform_usage_metrics_manager:
  enabled: true
  lock_key: platform_usage_metrics_manager_lock

Add a Redis TLS server name for SNI validation when all cluster nodes share the same certificate CN, without per-node overrides.

config/production.yml

redis:
  tls_servername: redis.internal.example.com

Adds app:health_monitoring:dependency_check_interval / APP__HEALTH_MONITORING__DEPENDENCY_CHECK_INTERVAL config key to set the interval in milliseconds between dependency health checks for ElasticSearch/OpenSearch, S3/MinIO, RabbitMQ, and Redis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds app:health_monitoring:usage_metrics_interval / APP__HEALTH_MONITORING__USAGE_METRICS_INTERVAL config key to control how often storage and ingestion usage metrics are collected and shared across the cluster via Redis; set to 0 to disable collection.
Adds redis:tls_servername / REDIS__TLS_SERVERNAME config key to supply an optional shared server name for TLS SNI and certificate validation in Redis cluster mode.
Adds platform_usage_metrics_manager:enabled / PLATFORM_USAGE_METRICS_MANAGER__ENABLED config key to enable or disable the manager that collects storage and ingestion usage metrics.
Adds platform_usage_metrics_manager:lock_key / PLATFORM_USAGE_METRICS_MANAGER__LOCK_KEY config key (default platform_usage_metrics_manager_lock) to control the distributed lock used by the usage metrics manager.

+3 more show less

Adds OPENCTI_MISSING_REF_RETRY_EXPONENTIAL environment variable to switch missing-reference retries from a flat random 1-3 s delay to an exponential back-off schedule (averages 0.5 s, 1 s, 2 s, 4 s with jitter); applies to workers and connectors via the pycti library.
Adds OPENCTI_MISSING_REF_RETRY_INITIAL_DELAY environment variable to set the average wait in seconds before the first retry under the exponential schedule (minimum 0).
Adds OPENCTI_MISSING_REF_RETRY_FACTOR environment variable to set the back-off multiplier applied at each missing-reference retry (minimum 1; 1 = constant wait).

8 details in Everything

7.260921.0 Sep 21, 2026 · issue 082

OpenCTI 7.260921.0 adds News Feed integration support, Fintel column selection, and user-merge history reattribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260921.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260921.0

Adds column selection for entity attributes in Fintel reports, letting analysts customize which fields appear in generated tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds News Feed support for OCTI integrations (excluding connectors), surfacing a new integration resource type in the feed.
Extends user merge to re-point assignee and participant relations to the target user.
Extends user merge to rewrite history and activity attribution to the target user.

Adds column selection for entity attributes in Fintel reports, letting analysts customize which fields appear in generated tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

7.260917.0 Sep 17, 2026 · issue 078

OpenCTI 7.260917.0 adds multi-OpenAEV security coverage, SSVC vulnerability prioritization, user-merge framework, and direct Fintel PDF export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260917.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260917.0

Adds multi-OpenAEV security coverage results, enabling security coverage analysis across multiple OpenAEV sources simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Lands SSVC risk-based prioritization metrics for vulnerabilities behind a feature flag, introducing exploit-driven risk scoring to the vulnerability workflow.
Introduces a user-merge framework with dry-run/run modes, a handler registry, scalar user reference rewriting, RBAC rights merging, and union/strict merge options.
Simplifies Fintel export by generating PDF directly from HTML without an intermediate step, streamlining intelligence report delivery.
Exposes lock acquisition wait and contention metrics via telemetry to surface backend lock pressure.

+1 more show less

Adds workflow publish actions that create and resolve Status objects on state transitions.

Adds multi-OpenAEV security coverage results, enabling security coverage analysis across multiple OpenAEV sources simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Lands SSVC risk-based prioritization metrics for vulnerabilities behind a feature flag, introducing exploit-driven risk scoring to the vulnerability workflow.
Introduces a user-merge framework with dry-run/run modes, a handler registry, scalar user reference rewriting, RBAC rights merging, and union/strict merge options.
Exposes lock acquisition wait and contention metrics via telemetry to surface backend lock pressure.

2 more in Everything

docs update Sep 14, 2026 · issue 074

OpenCTI now supports custom PMTiles map files uploaded by admins and stored in S3-compatible storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260914.0 Sep 14, 2026 · issue 074

OpenCTI 7.260914.0 adds configurable keep-alive/headers timeout to prevent intermittent 502s behind ALB/ECS load balancers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260914.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260914.0

7.260910.0 Sep 10, 2026 · issue 070

OpenCTI 7.260910.0 adds ingestion logs for RSS, JSON, and stream feeds plus S3 offload metrics for event streams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 7.260910.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260910.0

Adds metrics and logging for stream events offloaded to S3, giving operators visibility into event offload activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds ingestion logs for RSS feed ingestion, enabling operators to audit and troubleshoot RSS-based data pulls.
Adds ingestion logs for JSON feed ingestion, enabling operators to audit and troubleshoot JSON-based data pulls.
Adds ingestion logs for stream feed ingestion, enabling operators to audit and troubleshoot stream-based data pulls.
Integrates the Filigran design system V1 into the UI, introducing updated visual components including a Slider input.

Adds metrics and logging for stream events offloaded to S3, giving operators visibility into event offload activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds ingestion logs for RSS feed ingestion, enabling operators to audit and troubleshoot RSS-based data pulls.
Adds ingestion logs for JSON feed ingestion, enabling operators to audit and troubleshoot JSON-based data pulls.
Adds ingestion logs for stream feed ingestion, enabling operators to audit and troubleshoot stream-based data pulls.

1 more in Everything

docs update Sep 7, 2026 · issue 067

OpenCTI now provides FIPS 140-3 compliant container images for regulated deployments.

7.260907.0 Sep 7, 2026 · issue 067

OpenCTI 7.260907.0 adds entity creation inside investigation graphs, FIPS 140-3 Docker images, ingestion logs for CSV feeds, and connector activity logging.

└──▷ GET THIS VERSION

$ git clone --branch 7.260907.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260907.0

└──▷ HOW TO FIND IT

When building an investigation graph and you realize a relevant entity is missing, use the new Create Entity button to add and link it without navigating away.

📍In the investigation graph, open the Add entity drawer, then click Create Entity to define a new entity directly and have it added to the current investigation.

Adds a Create Entity button to the investigation graph and the add-entity drawer, enabling analysts to create new entities without leaving an investigation.
Adopts the FIPS 140-3 validated python-nodejs-fips base image for the Docker deployment.
Adds ingestion logs for CSV feeds, surfacing feed-level activity for operators monitoring data ingestion.
Adds activity logging for managed connector configuration updates.
Adds a new workflow UI applied across all entity types.

+2 more show less

Adds a revoked filter option in technical views for Courses of Action and related entities.
Adds CURRENT ENTITY option in ID filters of 'in regards of (dynamic)' sub-filters, enabling self-referential dynamic filter rules.

Adds a Create Entity button to the investigation graph and the add-entity drawer, enabling analysts to create new entities without leaving an investigation.
Adds ingestion logs for CSV feeds, surfacing feed-level activity for operators monitoring data ingestion.
Adds activity logging for managed connector configuration updates.
Adds a revoked filter option in technical views for Courses of Action and related entities.

3 more in Everything

advisory CVE-2026-76820 Sep 7, 2026 · issue 128

CVE-2026-76820: Synchronizer SSRF: stream fetch has no URL validation (CVSS 7.7, affects < 7.260701.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260904.0 Sep 4, 2026 · issue 064

OpenCTI 7.260904.0 derives session signature keys from the app encryption key for stronger session security.

└──▷ GET THIS VERSION

$ git clone --branch 7.260904.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260904.0

Session signature key is now derived from the app encryption key, tying session integrity to the platform's existing encryption configuration.

1 detail in Everything

7.260902.0 Sep 2, 2026 · issue 063

OpenCTI 7.260902.0 adds a merge-users capability with feature flag, API surface, and bypass enforcement.

└──▷ GET THIS VERSION

$ git clone --branch 7.260902.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260902.0

7.260901.0 Sep 2, 2026 · issue 062

OpenCTI 7.260901.0 adds workflow status sync via streams, built-in Filigran themes, and a new vulnerability module.

└──▷ GET THIS VERSION

$ git clone --branch 7.260901.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260901.0

Adds workflow release status synchronization by name through streams, enabling cross-instance status propagation without manual mapping.
Introduces built-in Filigran themes, giving teams out-of-the-box branded UI options without custom theme configuration.
Adds a new vulnerability module to the data model, expanding structured tracking of vulnerability entities.

3 details in Everything

docs update Aug 28, 2026 · issue 058

OpenCTI now renders maps locally via bundled PMTiles, with admin upload for custom tiles and no external tile server required.

└──▷ TRY IT

Generate a compact planet extract suitable for OpenCTI (zoom 0–6, ~30–80 MB) without downloading the full 137 GB source file.

$ pmtiles extract https://build.protomaps.com/20260722.pmtiles world.pmtiles --maxzoom=6

Override the bundled PMTiles file path when using a custom Docker image or non-standard layout.

.env

APP__MAP_BUNDLED_FILE_PATH=/data/maps/custom-world.pmtiles

Upload a custom high-resolution PMTiles file to replace the bundled map for all users.

📍1. Go to Settings › Parameters › Map configuration. 2. Click Upload and select your .pmtiles file. 3. The custom file is applied immediately with no restart required.

Serves map tiles from a backend endpoint /maps/world.pmtiles using HTTP Range requests, eliminating any external map server dependency — including for air-gapped deployments.
Adds app:map_bundled_file_path config key (APP__MAP_BUNDLED_FILE_PATH, default ./static/maps/world.pmtiles) to override the bundled PMTiles file location on disk.
Administrators can upload a custom .pmtiles file via Settings > Parameters > Map configuration to replace bundled tiles with higher-resolution or region-specific data, stored in S3/MinIO.
Map rendering automatically adapts to the platform's dark or light theme.
Compatible with low-zoom PMTiles extracts (zoom 0–6, ~30–80 MB) generated with the go-pmtiles CLI using pmtiles extract and --maxzoom=6.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The map_tile_server_dark and map_tile_server_light configuration parameters are no longer used — external raster tile servers (e.g., klokantech/openmaptiles-server) can be removed from your deployment.

docs update Aug 28, 2026 · issue 058

OpenCTI adds app:map_bundled_file_path config key to serve maps from a local PMTiles file on disk.

└──▷ USE IT

Point OpenCTI at an air-gapped or self-hosted PMTiles map file so the platform renders maps without external network access.

yaml

app:
  map_bundled_file_path: '/opt/opencti/static/maps/world.pmtiles'

7.260828.0 Aug 28, 2026 · issue 058

OpenCTI 7.260828.0 adds human-in-the-loop AI approval, new vulnerability propagation rules, a Score field on key entities, and map widget export.

└──▷ GET THIS VERSION

$ git clone --branch 7.260828.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260828.0

Adds human-in-the-loop tool approval in Ask Ariane, requiring analyst confirmation before the chatbot executes tool calls.
Adds new inference rule deriving System has Vulnerability from System uses Software + Software has Vulnerability relationships.
Adds new inference propagation rule linking vulnerabilities to Infrastructure through used software.
Adds a Score field to Threat Actor, Intrusion Set, Malware, Incident, and Event entities.
Replaces the external map tile server with local PMTiles rendering, removing the external network dependency for map display.

+1 more show less

Enables export of map widgets from dashboards.

6 details in Everything

advisory CVE-2026-76821 Aug 26, 2026 · issue 128

CVE-2026-76821: User-Controlled ReDoS in JSON Ingestion Mapper (affects < 7.260706.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Aug 25, 2026 · issue 056

OpenCTI adds redis:max_event_length to cap stream event size and offload large events to file storage.

└──▷ USE IT

Cap Redis stream events at 1 MB to prevent oversized payloads from bloating the stream — content exceeding the limit is offloaded to file storage automatically.

yaml

redis:
  max_event_length: 1048576

7.260824.0 Aug 24, 2026 · issue 056

OpenCTI 7.260824.0 adds One-Pager mode for Fintel reports, score fields on Incidents and Events, S3 offloading for large stream events, and experimental cross-platform Status sync.

└──▷ GET THIS VERSION

$ git clone --branch 7.260824.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260824.0

Adds experimental Status sync between OpenCTI platforms via live streams, laying groundwork for cross-platform workflow state propagation.
Stores large stream event messages to S3 instead of Redis, removing Redis size constraints for high-volume stream deployments.
Splits STIX bundles in Node.js before pushing to the worker queue, reducing worker-side processing overhead for large bundle imports.
Adds a score field to the Incident data model, enabling confidence/severity scoring on Incident objects.
Adds a score field to the Event data model, enabling confidence/severity scoring on Event objects.

+1 more show less

Introduces One-Pager mode for Fintel reports, making first and back cover pages optional for single-page intelligence products.

6 details in Everything

7.260817.0 Aug 17, 2026 · issue 049

OpenCTI 7.260817.0 adds score field to Threat Actor Group, Intrusion Set, and Malware entity types.

└──▷ GET THIS VERSION

$ git clone --branch 7.260817.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260817.0

Adds score field to the Threat Actor Group data model entity type.
Adds score field to the Intrusion Set data model entity type.
Adds score field to the Malware data model entity type.

3 details in Everything

7.260811.0 Aug 11, 2026 · issue 043

OpenCTI 7.260811.0 adds mass-operation support for updating relation start/stop times via background tasks.

└──▷ GET THIS VERSION

$ git clone --branch 7.260811.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260811.0

Enables bulk updating of relation start_time and stop_time fields via mass background-task operations.

1 detail in Everything

7.260807.0 Aug 7, 2026 · issue 039

OpenCTI 7.260807.0 adds shareable saved searches, reusable saved filters in dashboards, XTMHub integration, and Lucene wildcard/fuzzy search.

└──▷ GET THIS VERSION

$ git clone --branch 7.260807.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260807.0

Adds TAXII feed tabs to the ingestion UI for improved feed management.
Adds Admin UI (Settings) for custom fields configuration (Chunk 2 of custom-fields feature).
Enables shareable and reusable saved searches across the platform.
Enables reusable saved filters inside dashboards and custom views.
Adds XTMHub connectivity — connect to Hub directly from the OpenCTI interface.

+2 more show less

Adds support for Lucene advanced search syntax including wildcard prefix (*) and fuzzy search (~) operators.
Preserves user-defined label casing, removing automatic text-transform: capitalize on labels.

7 details in Everything

docs update Aug 4, 2026 · issue 035

OpenCTI Map gains updated dark and light mode styles via new filigran-dark3.json and filigran-light3.json files.

Adds filigran-dark3.json dark mode map style for the OpenCTI Map view.
Adds filigran-light3.json light mode map style for the OpenCTI Map view.

2 details in Everything

docs update Aug 4, 2026 · issue 035

OpenCTI releases now ship a CycloneDX SBOM asset (sbom-opencti-platform-<version>.cdx.json) per Docker image base starting from 7.260728.0.

Adds a CycloneDX JSON SBOM file (sbom-opencti-platform-<release version>.cdx.json) to each release's assets, generated by .github/workflows/cd-build-rolling-images-on-merge.yml, enabling component verification, compliance reviews, and supply chain transparency.
Provides one SBOM asset per Docker image base (standard, FIPS, and UBI9), with a nested component structure covering platform, frontend, GraphQL API, and worker sub-components.

2 details in Everything

7.260803.0 Aug 3, 2026 · issue 035

OpenCTI 7.260803.0 adds stop-operation control for data sanity tasks and improved HTTP header management.

└──▷ GET THIS VERSION

$ git clone --branch 7.260803.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260803.0

Improves HTTP header management in the Express layer.

1 detail in Everything

docs update Jul 29, 2026 · issue 029

OpenCTI adds UI-based SMTP configuration and a forced-sender override, both without requiring a deployment restart.

└──▷ USE IT

Lock outbound email to a specific sender address and prevent operators from overriding it via the UI.

ini

SMTP__ENABLED=true
SMTP__FORCED_SENDER_EMAIL=security-alerts@example.com

Switch to live UI-managed SMTP settings without restarting the platform.

📍In the console, go to Settings › Security › SMTP configuration and enable the Use configuration in interface toggle.

Supports configuring SMTP entirely from the Settings > Security > SMTP configuration interface, eliminating the need for a deployment restart when changing email settings.
Adds smtp:forced_sender_email / SMTP__FORCED_SENDER_EMAIL parameter to force all outbound emails to use a fixed sender address and disable UI-based SMTP configuration.
Adds smtp:enabled / SMTP__ENABLED parameter to explicitly enable or disable SMTP email sending.

3 details in Everything

7.260728.0 Jul 28, 2026 · issue 029

OpenCTI 7.260728.0 ships a full draft approval workflow engine, XTM Hub integration, TAXII error visibility, OAuth SMTP dynamic tokens, and audit log session tracking.

└──▷ GET THIS VERSION

$ git clone --branch 7.260728.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260728.0

└──▷ HOW TO FIND IT

Enable XTM Hub connection so integrations can be pushed directly from the Hub into your OpenCTI instance.

📍In the console, go to Settings › Filigran Experience and click the XTM Hub card to connect your OpenCTI instance to the Hub.

Introduces a complete draft approval workflow engine: define, visualize, and apply workflows via a ReactFlow graph UI, with filter-based conditions, async task actions, schema validation on save, auto-save/publish, and synchronous/asynchronous transition reactions.
Adds draft workspace metadata (participants, assignees, description, creator) and the ability to filter, edit, and visualize draft details directly in the drafts list.
Connects OpenCTI to XTM Hub, enabling integrations to be discovered and connected directly from the Hub into OpenCTI.
Reworks the integrations UI with a pipeline ribbon, aligned lines view, config import, facets, sorting, and next-run visibility.
Reworks the Filigran Experience settings screen with hero-style Enterprise Edition and XTM Hub cards.

+9 more show less

Surfaces TAXII Client ingestion errors directly in the UI so operators can diagnose feed failures without inspecting backend logs.
Records user session IDs in user_metadata within audit logs for improved session-level traceability.
Adds ability to read audit and log entities via the Python client (pycti).
Supports dynamic token refresh for OAuth-based SMTP authentication.
Enables SSO IdPs to use a hybrid Group and Organization mapping strategy.
Restricts workflow restrictions and actions to Enterprise Edition.
Allows administrators to define a default template for Fintel exports.
Adds info logs to support packages for richer diagnostics.
Workflow actions can now run asynchronous tasks.

14 details in Everything

advisory CVE-2026-104840 Jul 28, 2026 · issue 128

CVE-2026-104840: No rate limiting on authentication endpoint allows credential brute-forcing (affects < 7.260428.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-102892 Jul 24, 2026 · issue 128

CVE-2026-102892: TAXII Public Collection Incorrect Authorization & Data Leak (CVSS 5.3, affects < 7.260416.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Jul 22, 2026 · issue 022

OpenCTI adds app:uri_deny_list config option to block specific URIs at the application level.

└──▷ USE IT

Block specific URIs at the application level to restrict access to sensitive or unwanted endpoints.

yaml

app:
  uri_deny_list:
    - /unwanted-path
    - /restricted-endpoint

docs update Jul 22, 2026 · docs issue 004

OpenCTI adds app:uri_deny_list config option to block specific URIs at the application level.

└──▷ USE IT

Block specific URIs at the application level to restrict access to sensitive or unwanted endpoints.

yaml

app:
  uri_deny_list:
    - /unwanted-path
    - /restricted-endpoint

docs update Jul 22, 2026 · issue 022

OpenCTI adds APP__URI_DENY_LIST config option to block specific URIs at the application level.

└──▷ USE IT

Block specific URIs at the application level to prevent access to unwanted endpoints.

yaml

app:
  uri_deny_list:
    - "https://malicious.example.com"
    - "http://internal-only.corp"

New APP__URI_DENY_LIST configuration parameter lets operators block specific URIs from being accessed within OpenCTI.

1 detail in Everything

docs update Jul 22, 2026 · docs issue 004

└──▷ USE IT

Block specific URIs at the application level to prevent access to unwanted endpoints.

yaml

app:
  uri_deny_list:
    - "https://malicious.example.com"
    - "http://internal-only.corp"

7.260722.0 Jul 22, 2026 · issue 022

OpenCTI 7.260722.0 adds a faceted connector marketplace, workflow reset, webhook deny-lists, admin-forced password changes, and auto-reloading public dashboards.

└──▷ GET THIS VERSION

$ git clone --branch 7.260722.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260722.0

└──▷ HOW TO FIND IT

Block webhooks from calling internal or sensitive URIs by configuring a deny-list at the platform level.

📍In the console, go to Settings › Customization › Webhook and add URIs to the deny list to prevent outbound webhook calls to those destinations.

Force a specific user to reset their password on next login — useful after an account compromise or routine credential rotation.

📍In the console, go to Settings › Security › Users, select the target user, and use the Force password change action.

Enable auto-reload on a public dashboard so external stakeholders always see up-to-date intelligence without manually refreshing.

📍In the console, open a dashboard, go to its settings, and set a refresh_interval value to enable auto-reload for the public link.

Redesigns the connector catalog into a faceted marketplace experience for easier discovery and filtering.
Adds ability to fully reset a workflow to its initial state.
Adds a configurable deny-list of URIs for webhooks to block outbound calls to restricted endpoints.
Enables admins to force a password change for any user account.
Adds auto-reload support for public dashboards so shared views stay current without manual refresh.

+3 more show less

Improves CSV export with selectable visible columns, filtering the export to only those columns.
Adds light mode support in the GraphQL playground.
Replaces the legacy HTML editor with the current editor, removing associated feature flags.

8 details in Everything

7.260715.0 Jul 15, 2026 · issue 020

OpenCTI 7.260715.0 adds connector log TTL and ingestion history in Redis, plus authentication validity policy improvements.

└──▷ GET THIS VERSION

$ git clone --branch 7.260715.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260715.0

Adds connector logs TTL and ingestion history storage in Redis for improved connector observability.
Improves the authentication validity policy update workflow.

2 details in Everything

7.260710.0 Jul 10, 2026 · issue 020

OpenCTI 7.260710.0 adds admin-forced password resets, Custom Views date ranges & attribute widgets, OAuth SMTP dynamic tokens, and security coverage custom views.

└──▷ GET THIS VERSION

$ git clone --branch 7.260710.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260710.0

└──▷ HOW TO FIND IT

Narrow a Custom View on an entity page to a specific investigation window without changing global filters.

📍In the console, open any entity page, navigate to a Custom View tab, and use the new date range picker in the view configuration to set a start and end date.

Force a user to reset their password at next login for account hygiene or after a suspected compromise.

📍In the console, go to Settings › Security › Users, select the target user, and use the new Force password change action.

Enables admins to force a password change for users via a new authentication capability.
Adds date range configuration directly within Custom Views on entity pages.
Adds an attribute widget for Custom Views.
Extends Custom Views to the security coverage section.
Supports dynamic token (OAuth) for SMTP email configuration.

+3 more show less

Renames connector catalog statuses from Verified/'Unverified' to Supported by Filigran/'Supported by Community'.
Adds telemetry for shared saved filters.
Adds search-engine crawler blocking to prevent web-site indexing of the platform.

8 details in Everything

7.260309.0-lts.6 Jul 9, 2026 · issue 020

OpenCTI 7.260309.0-lts.6 improves automatic enrichment on element creation/update and enhances JSON mapper regex extraction.

└──▷ GET THIS VERSION

$ git clone --branch 7.260309.0-lts.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260309.0-lts.6

Improves automatic enrichment triggered on creation or update of elements.
Enhances JSON mapper extraction with improved regexp support.

2 details in Everything

7.260706.0 Jul 6, 2026 · issue 020

OpenCTI 7.260706.0 ships a native MCP server, STIX security-coverage export, custom newsfeed views, and richer telemetry.

└──▷ GET THIS VERSION

$ git clone --branch 7.260706.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260706.0

└──▷ HOW TO FIND IT

Find your MCP server connection details to integrate OpenCTI with AI assistants via XTM One.

📍In the OpenCTI console, go to your User Profile and locate the XTM One MCP server section to retrieve the Streamable HTTP endpoint URL and credentials.

Adds a native Model Context Protocol (MCP) server with Streamable HTTP transport, exposed through XTM One and surfaced in the user profile.
Enables export of security coverage data to STIX format.
Supports custom views as a resource type in the newsfeed.
Adds TELEMETRY_TAGS deployment dimensions and tracks active connectors by catalog identity.
Extends telemetry to cover full AI usage and product adoption metrics, including workflow publish counts.

+5 more show less

Maintains telemetry visibility for managed connectors absent from the catalog using a registry-stripped image identity.
Introduces a data sanity manager as an alternative to certain database migrations.
Improves JSON mapper extraction with enhanced regexp support.
Enhances notification access control for workflow recipients.
Improves the engine retry mechanism for greater resilience.

10 details in Everything

7.260701.0 Jul 1, 2026 · issue 020

OpenCTI 7.260701.0 adds XTM Hub custom view deployment, stream URI deny lists, ES health monitoring, and workflow transition comments.

└──▷ GET THIS VERSION

$ git clone --branch 7.260701.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260701.0

Enables deploying custom views received from XTM Hub directly into OpenCTI.
Adds a configurable deny list of URIs to block during stream ingestion.
Adds an Elasticsearch engine health monitor to surface ES issues proactively.
Supports adding comments on workflow transitions and viewing them in the UI, with notifications sent to assignees and participants.

4 details in Everything

advisory CVE-2026-35211 Jul 1, 2026 · issue 128

CVE-2026-35211: Elasticsearch Painless Script Injection via GraphQL script filter operator allows authenticated user to exfiltrate data and cause DoS (CVSS 6.5, affects < 7.260401.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260626.0 Jun 26, 2026 · release notes

OpenCTI 7.260626.0 adds drafts to dashboard filtering and restricts AI agent run as selection.

└──▷ GET THIS VERSION

$ git clone --branch 7.260626.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260626.0

playbook now restricts the AI agent run as selection option to only current users and service accounts.
Dashboards can now filter entities by draft status, exposing DraftWorkspace in visualisations.

2 details in Everything

7.260626.0 Jun 26, 2026 · issue 020

OpenCTI 7.260626.0 adds draft filtering in dashboards, a new text editor, and tightened AI playbook agent controls.

└──▷ GET THIS VERSION

$ git clone --branch 7.260626.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260626.0

└──▷ HOW TO FIND IT

Track draft workspace activity across your team by adding a dashboard widget filtered to draft entities.

📍In the console, go to Dashboards › (your dashboard) › Add Widget, then in the entity filter select Draft Workspace as the entity type to scope the visualization to draft data.

Limit which identities an AI playbook component can impersonate when running automated enrichment, reducing privilege-escalation risk.

📍In the console, go to Automation › Playbooks › (your playbook) › AI Agent component › Run as field, and select from the restricted list of the current user or available service accounts.

Adds drafts as filterable entities in dashboard widgets, enabling visualizations and metrics over draft workspaces.
Restricts the AI agent run as selection in playbooks to the current user and service accounts only, tightening execution scope.
Replaces the legacy text editor with a new editor solution across the platform.
Enables entity lookup with on-the-fly creation in form intakes for users who have only create/update-in-draft permissions, without triggering a full creation process.

4 details in Everything

advisory CVE-2026-35210 Jun 26, 2026 · issue 128

CVE-2026-35210: Authorization Bypass via synchronized-upsert HTTP Header Injection (CVSS 7.1, affects < 7.260326.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260624.0 Jun 24, 2026 · release notes

OpenCTI 7.260624.0 adds trust proxy config, CTEM shortcut, bulk playbook enrollment, and streaming filters

└──▷ GET THIS VERSION

$ git clone --branch 7.260624.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260624.0

└──▷ HOW TO FIND IT

Add many entities to an existing playbook at once instead of enrolling them individually.

📍Navigate to Playbooks › [Playbook Name] › Bulk Enrollment and select your target entities.

Adds TRUST_PROXY environment variable to control IP whitelisting behavior when behind a reverse proxy.
Adds a new CTEM Command Center shortcut in the top bar for users with an XTM One connection.
Enables bulk enrollment of entities into playbooks via the UI.

3 details in Everything

7.260624.0 Jun 24, 2026 · issue 020

OpenCTI 7.260624.0 adds bulk playbook enrollment, has/not-changed stream filters, CTEM shortcut, and trust-proxy IP whitelisting config.

└──▷ GET THIS VERSION

$ git clone --branch 7.260624.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260624.0

└──▷ HOW TO FIND IT

Use the has/not-changed operator in a playbook filter to trigger actions only when a specific attribute on an entity has changed since the last event.

📍In the Playbook or Stream filter editor, add a filter condition, select the desired attribute, and choose the has changed or not changed operator from the operator dropdown.

Bulk-enroll a large set of existing entities into a playbook using smart filtering instead of enrolling one at a time.

📍In the Playbooks UI, open a playbook, click Bulk enrollment, apply the desired entity filters, and confirm to enroll all matching entities at once.

Adds trust proxy configuration for IP whitelisting, enabling accurate client IP resolution when OpenCTI sits behind a reverse proxy.
Adds a CTEM Command Center shortcut to the top bar when XTM One is connected.
Adds a feature flag to revert to the old rich text editor alongside the new @filigran/rich-text-editor component.
Adds dynamic user resolution in the playbook send to notifier component, allowing recipients to be resolved at runtime.
Adds has/not-changed attribute filtering operators for playbook and stream filtering components.

+3 more show less

Enables bulk enrollment of entities into a playbook with smart filtering.
Streamlines Autonomous System creation by auto-populating the AS number from the Autonomous-System name during ingestion.
Renames validated draft's status label to Validation progress in the draft workflow UI.

8 details in Everything

7.260619.0 Jun 19, 2026 · release notes

OpenCTI 7.260619.0 adds IP allow-list config, playbook run as user, saved filter sharing, bulk limit to 150, and Hub import CTA

└──▷ GET THIS VERSION

$ git clone --branch 7.260619.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260619.0

Adds security.cidr_allow_list configuration key to control access for login and public information
Adds a run as user selection option on AI agent playbook components to specify the execution identity
Adds the ability to share saved filters with other users, groups, or organizations via the UI
Increases the bulk creation object limit to 150 objects per operation
Adds an import from Hub call-to-action button on the Playbooks library screen in the Hub interface

5 details in Everything

7.260615.0 Jun 16, 2026 · release notes

OpenCTI 7.260615.0 adds auto-reload to custom dashboards, News Feed playbooks, security coverage metrics in has-covered view, and multi-conversation history for Ask Ariane

└──▷ GET THIS VERSION

$ git clone --branch 7.260615.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260615.0

Adds auto-reload for custom dashboards so they refresh automatically without manual page reloads.
Enables News Feed as a playbook source type, allowing playbooks to trigger on incoming feed entries.
Adds security coverage metrics to the has-covered relationship view for deeper analysis of security controls.
Adds multi-conversation history and mid-run steering support for the Ask Ariane feature in XTM One.

4 details in Everything

7.260609.0 Jun 9, 2026 · release notes

New UI options for SSL feed verification, password policy display, and custom no-access error messages.

└──▷ GET THIS VERSION

$ git clone --branch 7.260609.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260609.0

└──▷ HOW TO FIND IT

Verify SSL for feeds by default or override it per feed via the UI.

📍OpenCTI Feed settings › enable rejectUnauthorized toggle

Customize the access denied message for users without group membership.

📍Admin › Configuration › xtm-hub › set custom error message

Adds rejectUnauthorized=true as the default for feeds and a new UI option to enable SSL verification control
Displays the active password policy on the reset password screen
Allows customization of the error message shown when a user has no group access

3 details in Everything

7.260604.0 Jun 4, 2026 · release notes

OpenCTI 7.260604.0 adds configurable ingestion deny lists, retention policy activity tracking, form intake default values, and XTM One file downloads.

└──▷ GET THIS VERSION

$ git clone --branch 7.260604.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260604.0

Adds active/inactive status to Retention Policies with telemetry for monitoring rule activity

1 detail in Everything

advisory CVE-2026-35212 Jun 1, 2026 · issue 128

CVE-2026-35212: XSS in the rendering of email-message observable body data (CVSS 6.1, affects < 7.260227.0 )⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260529.0 May 29, 2026 · release notes

OpenCTI 7.260529.0 adds XTM Hub newsfeed integration, one-click playbook deployment, and Send to AI playbook component.

└──▷ GET THIS VERSION

$ git clone --branch 7.260529.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260529.0

Adds ability for users to receive newsfeeds from the XTM Hub for new custom dashboards uploads
Integrates XTM Hub Newsfeed into the platform
Adds one-click deployment of playbooks from the XTM Hub
Adds Send to AI as a playbook component to transform STIX bundles with an AI agent

4 details in Everything

7.260527.0 May 27, 2026 · release notes

OpenCTI 7.260527.0 adds per-IP/user-agent rate limiting and bulk playbook enrollment

└──▷ GET THIS VERSION

$ git clone --branch 7.260527.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260527.0

Adds rate limit threshold configuration applied per IP and per user-agent for API requests
Enables bulk enrollment of entities into playbooks via the new bulk_enroll mutation

2 details in Everything

7.260522.0 May 22, 2026 · release notes

OpenCTI 7.260522.0 adds news-feed toast notifications and saved filters API sharing

└──▷ GET THIS VERSION

$ git clone --branch 7.260522.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260522.0

Adds automatic cleanup of old XTMHub news feed items (older than 6 months)
Adds toast notifications for new unread items in the news feed

2 details in Everything

7.260520.0 May 20, 2026 · release notes

OpenCTI 7.260520.0 adds custom views, knowledge manipulation target scope, and sharing filters for cyber tooling workflows

└──▷ GET THIS VERSION

$ git clone --branch 7.260520.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260520.0

Adds targetScope field to Playbook knowledge manipulation components to specify whether changes apply to all elements, main element only, or 'all except main element'
Extends decay rule filtering with new pattern type, author, and marking criteria options

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The CUSTOM_VIEW feature flag has been removed; custom views are now always enabled

7.260513.0 May 13, 2026 · release notes

OpenCTI 7.260513.0 adds paginated XTMHub news feed tab and parallel initial checks

└──▷ GET THIS VERSION

$ git clone --branch 7.260513.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260513.0

└──▷ HOW TO FIND IT

Navigate to the new XTMHub news feed tab to view paginated updates.

📍In the OpenCTI UI, go to the XTMHub section and click the new News Feed tab.

Adds a new UI tab displaying paginated news feed items for XTMHub subscribers
Improves performance by running initial validation checks in parallel during startup

2 details in Everything

7.260512.0 May 12, 2026 · release notes

OpenCTI 7.260512.0 adds structured agents instructions, interruptible managers, skips ES recovery for filtered live streams, and removes a security coverage feature flag

└──▷ GET THIS VERSION

$ git clone --branch 7.260512.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260512.0

Adds structured_agents_instructions to the AI configuration for customizing LLM system prompts.
Enables manager interruption during shutdown via a new interruptible timer mechanism.
Skips Elasticsearch recovery logic when live streams are configured with origin filters.
Removes the feature flag gating the security coverage result page, making it permanently available.

4 details in Everything

7.260507.0 May 7, 2026 · release notes

OpenCTI 7.260507.0 adds origin-based filtering to live streams and UBI 9 container support.

└──▷ GET THIS VERSION

$ git clone --branch 7.260507.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260507.0

origin parameter added to live stream subscriptions for filtering events
Platform and worker Docker images now support UBI 9 as the base OS

2 details in Everything

7.260506.0 May 6, 2026 · release notes

OpenCTI 7.260506.0 adds an API endpoint for SCO consistency cleanup, XTM Hub newsfeeds support, and Security Coverage relations for Indicators/Artifacts

└──▷ GET THIS VERSION

$ git clone --branch 7.260506.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260506.0

Adds Add XTM Hub newsfeeds preferences to user profile, enabling users to configure their newsfeed subscriptions via the UI
Adds has-covered relations between Security-Coverage entities and both Indicator and Artifact objects

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The user profile key mapping now uses publicJWK instead of the previous publicKey format.

advisory CVE-2026-44730 May 5, 2026 · issue 128

CVE-2026-44730: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd (CVSS 7.2, affects < 6.9.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-27960 May 4, 2026 · issue 128

CVE-2026-27960: Priviledge escalation and unauthenticated access using default admin (CVSS 9.8, affects >= 6.6.0, < 6.9.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260430.0 Apr 30, 2026 · release notes

OpenCTI 7.260430.0 adds STIX 2.0 SMO support in the converter and XTM One integration for AI Insights

└──▷ GET THIS VERSION

$ git clone --branch 7.260430.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260430.0

STIX 2.0 converter now supports Security Missing Object (SMO) types
Integrates XTM One agent selection and summary generation into AI Insights

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The pysigma library has replaced the deprecated sigmatools library for SIGMA rule validation

7.260428.0 Apr 28, 2026 · release notes

OpenCTI adds STIX 2.0 SRO conversion support and improves security coverage result display

└──▷ GET THIS VERSION

$ git clone --branch 7.260428.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260428.0

Adds SRO handling in the STIX 2.0 converter for serialized reference objects
Removes feature flag to permanently enable enhanced security coverage results on the result page

2 details in Everything

7.260422.0 Apr 22, 2026 · release notes

OpenCTI 7.260422.0 adds STIX 2.0 conversion for indicators/infrastructures and JWT auth with JWKS

└──▷ GET THIS VERSION

$ git clone --branch 7.260422.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260422.0

STIX 2.0 converter now handles Infrastructures and Indicators entities, enabling bidirectional conversion workflows for these data types.
Platform now supports JWT authentication using trusted issuers and a JWKS endpoint for verifying external identity providers.
Fintel feature coverage is expanded to other entity types beyond the original scope.

3 details in Everything

7.260417.0 Apr 17, 2026 · release notes

Playbook list now displays creator and date columns; adds option to hide listen knowledge playbooks from manual enrollment

└──▷ GET THIS VERSION

$ git clone --branch 7.260417.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260417.0

Playbook list table now shows creator, creation date, and modification date columns for better tracking of playbook provenance.

1 detail in Everything

7.260416.0 Apr 16, 2026 · release notes

OpenCTI 7.260416.0 adds part-of Intrusion Set relationships, communicates_with IPv4 relationships, Locations in STIX 2.0 converter, and improved public data sharing.

└──▷ GET THIS VERSION

$ git clone --branch 7.260416.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260416.0

Part-of relationship between Intrusion Sets
relationship type communicate with between 2 IPV4
Improve data sharing in public mode
STIX 2.0 converter now supports Locations

4 details in Everything

7.260409.0 Apr 9, 2026 · release notes

OpenCTI 7.260409.0 adds @ff GraphQL directive, belongs to relationship type, and TAXII polling frequency setting

└──▷ GET THIS VERSION

$ git clone --branch 7.260409.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260409.0

└──▷ TRY IT

Restrict a GraphQL query result to users who have a specific feature flag enabled in their profile.

$ query {
  incidents @ff(featureFlag: "NEW_INTEL_VIEW") {
    id
    name
  }
}

Create a relationship linking an Infrastructure entity to its owning Organization.

$ mutation {
  relationAdd(
    input: [
      {
        fromId: "infrastructure--xxxx"
        toId: "organization--yyyy"
        relationship_type: "belongs to"
      }
    ]
  ) {
    id
  }
}

Configure the interval at which a TAXII feed connector polls for new data.

$ # In your connector's configuration file or environment variables
TAXII_POLLING_FREQUENCY: 300

Adds @ff GraphQL directive to restrict access based on feature flag value
Adds new relationship type belongs to between Infrastructure and Organization entities
Adds configurable polling frequency setting for TAXII feeds

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Removes the FINTEL_FOR_ENTITY feature flag, making its underlying functionality permanent

advisory CVE-2026-39980 Apr 9, 2026 · issue 128

CVE-2026-39980: RCE via notifier template (CVSS 9.1, affects < 6.9.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260401.0 Apr 1, 2026 · release notes

OpenCTI 7.260401.0 adds STIX 2.0 technique conversion and draft filtering

└──▷ GET THIS VERSION

$ git clone --branch 7.260401.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260401.0

Adds STIX 2.0 converter: Techniques to convert MITRE ATT&CK techniques into the STIX 2.0 format
Adds filters on drafts accessible via the frontend/backend API

2 details in Everything

7.260326.0 Mar 26, 2026 · release notes

OpenCTI 7.260326.0 adds RSS feed import/export, rulesRescanAsync API for async rescans, and new mobile carrier observables.

└──▷ GET THIS VERSION

$ git clone --branch 7.260326.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260326.0

Adds the rulesRescanAsync backend function to enable asynchronous rule rescanning without timeout errors
Adds import/export functionality for RSS Feeds with XTMHub integration
Adds new IMEI, ICCID, and IMSI Observable types to StixDomainObject
Enables organization sharing within Drafts workflow items

4 details in Everything

7.260318.0 Mar 18, 2026 · release notes

Adds pre-configured Copilot agents for technical documentation access in OpenCTI 7.260318

└──▷ GET THIS VERSION

$ git clone --branch 7.260318.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260318.0

└──▷ HOW TO FIND IT

Access built-in technical documentation via the new Copilot agents interface.

📍In the OpenCTI UI, navigate to the AI assistant or Copilot section and select from the pre-configured technical documentation agents.

7.260317.0 Mar 17, 2026 · release notes

OpenCTI 7.260317.0 adds description filtering in Live streams, Notifiers, and Playbooks; introduces a customView module.

└──▷ GET THIS VERSION

$ git clone --branch 7.260317.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260317.0

Adds description filter support to Live Streams, Notifiers, and Playbooks
Introduces the new customView module for organizing views

2 details in Everything

advisory CVE-2026-21886 Mar 17, 2026 · issue 128

CVE-2026-21886: GraphQL Mutations Allow Deletion of Unrelated Entities (CVSS 6.5, affects < 6.9.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-21887 Mar 12, 2026 · issue 128

CVE-2026-21887: Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature (CVSS 7.7, affects < 6.8.16)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

7.260306.0 Mar 6, 2026 · release notes

Adds XTM One registration and ping mechanism as a Proof of Concept integration.

└──▷ GET THIS VERSION

$ git clone --branch 7.260306.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260306.0

Introduces XTM One registration and ping mechanism (PoC) for backend/frontend interaction.

1 detail in Everything

7.260305.0 Mar 5, 2026 · release notes

OpenCTI 7.260305.0 adds Only equals to filter operator and relationship-based neighbor resolution in CSV Feed

└──▷ GET THIS VERSION

$ git clone --branch 7.260305.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260305.0

└──▷ HOW TO FIND IT

Export data where the CSV Feed column dynamically pulls neighbor entities connected via relationships, not just direct attributes.

📍# In OpenCTI UI: Go to Data › Feeds › Configure a CSV Feed. In the column configuration, select Relationship-based neighbor resolution and choose the target relationship type and entity filter.

Adds Only equals to operator to filters, allowing exact match comparisons beyond standard equality.
Enables relationship-based neighbor resolution in CSV Feed columns for deeper entity context in exports.

2 details in Everything

7.260227.0 Feb 27, 2026 · release notes

OpenCTI 7.260227 adds Python lib no_split option and custom login/RHS background images

└──▷ GET THIS VERSION

$ git clone --branch 7.260227.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260227.0

Adds no_split argument to the Python library's send_stix_bundle function to control SDO/SCO batching
Adds custom right-hand side background image configuration for login pages

2 details in Everything

7.260224.0 Feb 24, 2026 · release notes

OpenCTI 7 adds UI-based SSO auth management, draft workspace capabilities, browser extension, and manual playbook enrollment.

└──▷ GET THIS VERSION

$ git clone --branch 7.260224.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 7.260224.0

└──▷ HOW TO FIND IT

Manually trigger an automated playbook on a specific entity via the UI without writing code or configuring webhooks.

📍In the OpenCTI Enterprise Edition interface, open any entity detail page and click the new Enroll in playbook button to select and run a workflow.

Configure SSO authentication settings directly in the platform interface without restarting the service or editing external files.

📍Navigate to Authentication Strategies in the OpenCTI Enterprise Edition UI to add or modify SSO configurations.

Use the new browser extension to automatically detect IOCs on a webpage and create a STIX 2.1 report in OpenCTI.

📍Install Filigran Threat Management from the Chrome Web Store, open a threat intelligence page, and use the one-click enrichment/ingestion feature provided by the extension sidebar.

Adds Authentication Strategies section in the Enterprise Edition UI to manage SSO configurations without editing config files or reloading the platform
Introduces granular capability controls in Draft Mode for Enterprise Edition users to restrict analysts to creating and updating data only within drafts
Releases a new Filigran Threat Management browser extension for Firefox, Chrome, Edge, and Safari that detects IOCs on web pages, enriches them with platform data, and creates STIX 2.1 reports via one-click ingestion
Adds User visibility policy settings to enforce organization-level segregation of user lists and prevent data leakage across different organizations
Updates API token management to require explicit token generation, supports multiple tokens per user with expiration dates, and tracks last used activity for each token

+2 more show less

Enables playbooks in Enterprise Edition to definitively remove specific labels and markings from entities regardless of their origin
Adds a manual Enroll in playbook button in the Enterprise Edition interface to trigger automated workflows on-demand for any compatible entity type

7 details in Everything

└──▷ BREAKING ON UPGRADE

!SSO authentication is now restricted to the Enterprise Edition; Community Edition platforms cannot login using previously configured SSO

6.9.19 Feb 17, 2026 · release notes

Adds realtime priority option for playbook connectors

└──▷ GET THIS VERSION

$ git clone --branch 6.9.19 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.19

└──▷ USE IT

Use the new API method programmatically to apply rules asynchronously within a client workflow.

code

// Using the ruleApplyAsync method on the OpenCTI client
const result = await opencti.ruleApplyAsync({ id: 'ruleId' });

ruleApplyAsync method available in the client/backend API.
Playbook connectors can now be configured with Realtime priority instead of the default.

2 details in Everything

6.9.16 Feb 5, 2026 · release notes

Adds Python stream processing helper, playbook manual incident enrollment, and platform cryptographic service

└──▷ GET THIS VERSION

$ git clone --branch 6.9.16 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.16

Adds batch event consumption method to the Python client for stream processing to handle events in batches rather than one by one
Enables manual enrollment of Incidents into playbooks directly from the frontend interface
Creates a new platform-level cryptographic service for centralized crypto operations

3 details in Everything

6.9.14 Feb 2, 2026 · release notes

OpenCTI 6.9.14 adds retention policies for contextual workbenches and noTriggerImport file upload option

└──▷ GET THIS VERSION

$ git clone --branch 6.9.14 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.14

└──▷ HOW TO FIND IT

Configure data lifecycle for a specific entity's contextual workspace using the new retention policy support.

📍In the OpenCTI UI, navigate to an Entity › Contextual Workbench and configure the new retention settings available in the panel.

Adds support for setting retention policies on contextual (in entity) workbenches to control how long associated data persists.
Enables passing the noTriggerImport flag during file upload in entities to prevent automatic ingestion triggers.

2 details in Everything

6.9.12 Jan 28, 2026 · release notes

OpenCTI 6.9.12 adds one-click stream deployment via XTM Hub and updates integration library links

└──▷ GET THIS VERSION

$ git clone --branch 6.9.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.12

└──▷ HOW TO FIND IT

Deploy a Stream connector directly from the XTM Hub interface without manual configuration.

📍In the XTM Hub, locate your desired Stream and select Deploy (1-click)

Adds ability to deploy streams in 1 click from XTM Hub for Stream connectors

1 detail in Everything

6.9.10 Jan 24, 2026 · release notes

OpenCTI 6.9.10 adds S3 Diode support and backend alias resolution helpers

└──▷ GET THIS VERSION

$ git clone --branch 6.9.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.10

Adds S3 Diode support as an additional ingestion target alongside existing folder-based Diodes
Adds backend helper to resolve correct aliases attribute for incoming entities
Adds upsert fallback logic when auto-merging with mismatched confidence levels

3 details in Everything

6.9.9 Jan 22, 2026 · release notes

OpenCTI 6.9.9 adds one-click Taxii feed deployment from XTM Hub and Live Streams import/export.

└──▷ GET THIS VERSION

$ git clone --branch 6.9.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.9

└──▷ HOW TO FIND IT

Deploy a new Taxii feed directly from the XTM Hub dashboard without manual configuration steps.

📍In the console, go to XTM Hub › Feeds and select Deploy Taxii Feed in 1 click.

Backup or migrate your current Live Streams setup using the new export feature.

📍In the console, go to Live Streams › Configuration and select Export. To restore, use Import from the same menu.

Adds ability to deploy a Taxii feed in 1 click from the XTM Hub UI
Adds ability to import and export Live Streams configurations

2 details in Everything

6.9.8 Jan 16, 2026 · release notes

OpenCTI 6.9.8 adds stream import/export and playbook label removal

└──▷ GET THIS VERSION

$ git clone --branch 6.9.8 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.8

└──▷ HOW TO FIND IT

Automate threat intelligence updates by stripping existing labels during playbook execution.

📍Configure a playbook action to remove labels from entities.

Ability to remove labels using automation/playbook

1 detail in Everything

6.9.7 Jan 12, 2026 · release notes

OpenCTI 6.9.7 adds new Rules Engine inference rules, multi-file upload at entity creation, and file download during import.

└──▷ GET THIS VERSION

$ git clone --branch 6.9.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.7

Adds new Rules Engine inference rule: if a Report contains an IP address and that IP belongs to an ASN, the Report is inferred to contain that ASN.
Adds a new inference rule on attribution relationships in the Rules Engine.
Supports uploading multiple files simultaneously at the time of entity creation.
Supports file download during the import process.

4 details in Everything

6.9.6 Jan 7, 2026 · release notes

OpenCTI 6.9.6 adds Taxii feed import/export, form intake auto-defanging, and playbook file support

└──▷ GET THIS VERSION

$ git clone --branch 6.9.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.6

TaxiiFeeds import/export capability allows importing and exporting TAXII feeds directly within the platform.
Form Intakes now automatically defang and de-sanitize observables during ingestion.
Playbook container wrapper now supports passing files as inputs to containerized tasks.
Users are limited to a configurable maximum number of concurrent sessions.

4 details in Everything

advisory CVE-2025-61782 Jan 7, 2026 · issue 128

CVE-2025-61782: Open Redirect in OpenCTI's SAML Authentication Flow (CVSS 5.4, affects < 6.8.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2025-61781 Jan 5, 2026 · issue 128

CVE-2025-61781: GraphQL IDOR allows authenticated user to delete workspace content of other users (CVSS 7.1, affects < 6.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

6.9.5 Jan 4, 2026 · release notes

OpenCTI 6.9.5 adds official OID and grace period support to license management, plus Prometheus metrics documentation.

└──▷ GET THIS VERSION

$ git clone --branch 6.9.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.5

Improve license management supporting official OIDs and grace period
Document prometheus exposed metrics

2 details in Everything

6.9.4 Dec 23, 2025 · release notes

OpenCTI 6.9.4 adds created field upsert logic and configurable manifest fetch URLs for air-gapped builds.

└──▷ GET THIS VERSION

$ git clone --branch 6.9.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.4

└──▷ TRY IT

Use when a threat actor's profile already exists in OpenCTI but needs its creation timestamp corrected to reflect actual first appearance.

$ PATCH /api/v4/stix-domain-objects/Threat-Actor--<ID> 
{
  "data": { "created": "2023-01-01T00:00:00Z" }
}

Configure a proxy or internal registry for manifest fetches to support air-gapped CI pipelines.

shell

export MANIFEST_URL="https://internal-registry.com/manifests"
export MANIFEST_HEADERS='Authorization: Bearer <token>'

Enables conditional upsert of the created field when updating an existing object
Allows customizing the URL and headers for connector manifest downloads during build

2 details in Everything

6.9.3 Dec 19, 2025 · release notes

OpenCTI 6.9.3 adds ability to run a given database migration from the API

└──▷ GET THIS VERSION

$ git clone --branch 6.9.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.3

Adds migrate endpoint to allow running a specific database migration directly via the API

1 detail in Everything

6.9.1 Dec 16, 2025 · release notes

OpenCTI 6.9.1 adds auto service account creation for connectors and resolve_result_indicators API parameter

└──▷ GET THIS VERSION

$ git clone --branch 6.9.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.1

└──▷ USE IT

Resolve indicators when creating a new observable via the Python client, linking it to existing threat intelligence.

python

from pycti import OpenCTIApiClient
# Inside your observable creation call:
observable = api.stix_cyber_observable.create(
    type='IPv4-Addr',
    value='192.168.1.1',
    resolve_result_indicators=True
)

Adds the ability to configure connectors to automatically create their associated service account.
Adds resolve_result_indicators parameter to the opencti_stix_cyber_observable.create() client method.

2 details in Everything

6.9.0 Dec 12, 2025 · release notes

OpenCTI 6.9.0 adds PIR playbooks, Security Coverage entity, Decay Exclusion Rules, Form Intake, SSH keys, and new connectors

└──▷ GET THIS VERSION

$ git clone --branch 6.9.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.9.0

Threat Map widget in Priority Intelligence Requirements (EE)
Priority Intelligence Requirements are now actionable within playbooks via threat filtering and scores (EE)
New Security coverage entity type for CTI-driven assessment with OpenAEV (CE)
Security coverage creation and generation can be automated through the playbook engine (CE)
Authorize Members on Drafts feature to restrict draft validation/modification (CE)

+19 more show less

Service Account bypass of Authorize Members permissions as default behavior (CE)
Form Intake framework for importing data via structured forms (CE)
Bulk search module improvement with differentiated management for known and unknown entities (CE)
Floating action button replacement for creating relationships on entity tabs (CE)
Custom themes support for corporate branding alignment (CE)
New SSH key observable type (CE)
Markdown to HTML conversion in email notifier for consistency (CE)
Pattern matching filter now available for indicators in playbooks, Live streams, CSV Feeds, and TAXII Collection (CE/EE)
Global HTTP/HTTPS proxy configuration for Composer (EE)
Playbook capability split into Manage playbooks and Use playbooks capabilities (EE)
Merge and delete separated into distinct capabilities (CE)
Entity history logs now show initial value and new one for each change line (CE)
Send email from template box in playbooks with dynamic object variables (EE)
Prepopulated onboarding email template for new platforms (EE)
Support for CVSS 3.0 vector strings (CE)
New Import Connectors: DShield.org, Criminal IP C2 Daily Feed, TeamT5, FT3, SPARTA
New Enrichment Connectors: ESET, Kaspersky
New Stream Connector: MISP Intel
New Stream Connector: Splunk SOAR Push

24 details in Everything

└──▷ BREAKING ON UPGRADE

!Playbook capability split into Manage playbooks and Use playbooks capabilities (EE)

6.8.17 Dec 10, 2025 · release notes

OpenCTI 6.8.17 adds Security Coverage via Playbooks and API client provider identification.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.17 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.17

└──▷ TRY IT

Identify which external threat intel provider generated data by setting the worker's API client identifier.

$ # Set environment variable for the worker to identify its source in logs/user-agent
export CONNECTOR_API_CLIENT_USER_AGENT_PROVIDER='my_threat_intel_provider'

Use the new playbook component to automatically generate and manage Security Coverage records based on your tooling.

📍# In OpenCTI Console: # 1. Navigate to Playbooks # 2. Create a new playbook # 3. Add action: Create Security Coverage # 4. Configure duration, type_affinity, and platforms_affinity fields

Adds ability to specify a provider in the API client user agent for workers
Creates Security Coverage entities through playbooks
Introduces duration, type_affinity, and platforms_affinity fields to Security Coverage for scenario generation

3 details in Everything

6.8.16 Dec 9, 2025 · release notes

OpenCTI 6.8.16 adds x_opencti_modified_at field for update events and customizable API timeout via client config.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.16 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.16

Introduces x_opencti_modified_at as a triggerable update event field
Adds customizable API request timeout to the OpenCTIApiClient initialization and worker configuration

2 details in Everything

6.8.15 Dec 1, 2025 · release notes

OpenCTI 6.8.15 adds platform sender email restriction option

└──▷ GET THIS VERSION

$ git clone --branch 6.8.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.15

6.8.14 Nov 26, 2025 · release notes

OpenCTI 6.8.14 adds CVSS V3.0 support and upsert on the modified field

└──▷ GET THIS VERSION

$ git clone --branch 6.8.14 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.14

└──▷ TRY IT

Ingest a vulnerability with its specific CVSS v3.0 score vector.

$ {
  input: {
    description: "Example vulnerability"
    cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  }
}

Update an existing entity by matching its modified timestamp to ensure the latest version is persisted.

$ mutation {
  vulnerabilityEdit {
    upsert(input: { id: <entity_id>, modified: "<iso_timestamp>" }) {
      standard_id
    }
  }
}

Adds CVSS_V3 vector string support for vulnerability data ingestion
Enables upsert operations on the modified field for existing entities

2 details in Everything

6.8.13 Nov 19, 2025 · release notes

OpenCTI 6.8.13 introduces managed connectors proxy support and STIX 2.0 toStix API updates.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.13 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.13

Adds managed_connectors_proxy_support configuration for backend-managed connectors
Updates the toStix API endpoint in the STIX 2.0 converter

2 details in Everything

6.8.12 Nov 17, 2025 · release notes

OpenCTI 6.8.12 adds security coverage telemetry points and XTM Hub trial auto-registration.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.12

Enables Auto Register OpenCTI from xtm hub provided trials

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!pythonjsonlogger.jsonlogger has been moved to pythonjsonlogger.json

6.8.10 Oct 30, 2025 · release notes

OpenCTI 6.8.10 adds SSH key SCO support for threat intelligence modeling

└──▷ GET THIS VERSION

$ git clone --branch 6.8.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.10

Adds SSH Key as a new Supported Cyber Object (SCO) type within the platform.

1 detail in Everything

6.8.9 Oct 29, 2025 · release notes

OpenCTI 6.8.9 adds OpenAEV integration, dedicated worker queues, and splits delete/merge permissions.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.9

Integrates security coverage with OpenAEV for enhanced detection capabilities.
Splits the Delete / Merge Knowledge capability into two separate permissions for finer-grained access control.
Adds support for dedicating workers to specific queues via a new configuration option.

3 details in Everything

6.8.7 Oct 21, 2025 · release notes

OpenCTI 6.8.7 adds worker task cancellation, dead letter queue for large bundles, and PIR threat map visualization

└──▷ GET THIS VERSION

$ git clone --branch 6.8.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.7

Adds ability to cancel the processing of tasks by the worker after the task has been provisioned
Add a way to send objects from bundles with too many refs to a dead letter queue
[PIR] Add a TheatMap type visualization to PIRs

3 details in Everything

6.8.5 Oct 13, 2025 · release notes

OpenCTI 6.8.5 adds Original creation date to list widget columns and improves Form Intake reliability.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.5

└──▷ HOW TO FIND IT

View the original creation date in a list view by selecting it as a column.

📍In the console, go to a List widget, click Columns, and enable Original creation date (created).

Adds created (Original creation date) as a selectable column in list widgets
Improves stability of the Form Intake feature

2 details in Everything

6.8.4 Oct 10, 2025 · release notes

OpenCTI 6.8.4 adds the KNOWLEDGE_KNUPLOAD capability to workers and fixes several UI bugs

└──▷ GET THIS VERSION

$ git clone --branch 6.8.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.4

Adds KNOWLEDGE_KNUPLOAD capability flag to workers to enable guessMimeType logic
Adds Indicator section to Incident knowledge page in the frontend

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The LIVE_CATALOGS environment variable/feature flag is removed; live catalog mode is no longer available as a feature flag

6.8.1 Sep 30, 2025 · release notes

OpenCTI 6.8.1 adds customizable form intakes for knowledge input and supports financial/infrastructure relationship definitions

└──▷ GET THIS VERSION

$ git clone --branch 6.8.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.1

Extends relationships usage and definition for financial and infrastructure contexts, adding transferred-to, owns, and supports relationship types

1 detail in Everything

6.8.0 Sep 25, 2025 · release notes

OpenCTI 6.8.0 adds PIRs, Ariane AI chatbot, Connector Manager, Service Accounts, bulk user ops, and new connectors.

└──▷ GET THIS VERSION

$ git clone --branch 6.8.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.8.0

Priority Intelligence Requirements (PIR) allows defining criteria to flag relevant threats with a relevance score.
Connector Catalog and Manager enables deploying and configuring verified connectors directly from the UI, requiring the xtm-composer component.
Ariane Agentic AI assistant provides natural language interaction via an MCP server (xtm-mcp).
Import AI document now recognizes Organization, Sector, Channel, Tool, Individual, Region entities and specific relationships (Uses, Targets, etc.).
New Service Accounts user type restricted to API-based integrations with no UI login access.

+19 more show less

Bulk operations on user accounts allow mass activating, deactivating, or updating multiple users.
Create email templates for your users with dynamic variables for EE administrators.
Activity logs now include Source IP and User-Agent information (EE).
Audit logs can now be streamed to console or files via a new capability.
Manage Taxonomies is removed; replaced by Manage Tags, Manage Vocabularies, Manage Case Models, Manage Status Models, Manage Kill Chain Phases.
Vulnerability model adds first seen active attribute; Software model adds product attribute.
UI shows nested objects in the overview of observables and allows expanding fields within observables.
Create draft from an entity directly within the entity view.
Export, Import, and Duplicate Playbooks capability is now available (EE).
XTM Hub enables one-click deploy for Dashboard & CSV feeds.
New GLIMPS Enrichment connector added.
New Splunk SOAR App connector added.
New Elastic Security Incidents connector added.
New Elastic Security Intel Stream connector added.
New Sumo Logic Intel Stream connector added.
New Doppel connector added.
New Microsoft Sentinel Intel connector added.
New Cognyte LUMINAR connector added.
New CrowdSec connector added.

24 details in Everything

└──▷ BREAKING ON UPGRADE

!The Manage Taxonomies capability is removed; use Manage Tags, Manage Vocabularies, Manage Case Models, Manage Status Models, Manage Kill Chain Phases instead.

6.7.20 Sep 19, 2025 · release notes

OpenCTI 6.7.20 introduces configurable SSO payload size and CSV import performance fixes.

└──▷ GET THIS VERSION

$ git clone --branch 6.7.20 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.20

Adds SAML_MAX_BODY_LENGTH environment variable to configure the maximum SSO/SAML payload body size for handling large enterprise envelopes.

1 detail in Everything

6.7.18 Sep 9, 2025 · release notes

OpenCTI 6.7.18 adds support for embedded files in documents and restricts can use permissions to organizations.

└──▷ GET THIS VERSION

$ git clone --branch 6.7.18 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.18

Enhancements section lists Support embedded files and enhance the content section behavior as a new capability
Enhancements section lists restricting 'can use' permission to organization level under a feature flag

2 details in Everything

6.7.17 Sep 3, 2025 · release notes

OpenCTI 6.7.17 adds playbook member management, FIMI SROs, and Redis Sentinel auth improvements

└──▷ GET THIS VERSION

$ git clone --branch 6.7.17 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.17

Adds a new playbook component to manage authorized members for automated workflows.
Introduces two new SROs (Stix Relationship Object) for FIMI support.
Adds new authentication options when using Redis Sentinel in the backend configuration.
Introduces the resolves-to relationship between Hostname and Domain-Name entities.

4 details in Everything

6.7.15 Aug 27, 2025 · release notes

OpenCTI 6.7.15 adds authorized members on organizations and relationship name tooltips

└──▷ GET THIS VERSION

$ git clone --branch 6.7.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.15

└──▷ HOW TO FIND IT

Interact with the graph by hovering over relationship lines to identify the specific type of connection.

📍In the OpenCTI UI, navigate to a Stix Domain Object or Stix Cyber-Observable Object page. Hover the mouse cursor over any line connecting two nodes in the relationship graph to display the relationship name tooltip.

Adds authorized_members attribute to organization entities for fine-grained access control
Enables hovering over relationships in the UI to view the relationship's name

2 details in Everything

6.7.13 Aug 22, 2025 · release notes

OpenCTI 6.7.13 introduces org-scoped user search and Hub integration checks.

└──▷ GET THIS VERSION

$ git clone --branch 6.7.13 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.13

└──▷ HOW TO FIND IT

When you need to assign a task or include a participant but want to restrict the available users to your own organization.

📍1. Open an incident, playbook, or report in the OpenCTI UI. 2. Click into the Assignee or Participant field. 3. Observe that only members of your current organization are listed for selection.

assignee and participant fields now filter to show only users from the current organization

1 detail in Everything

6.7.10 Aug 12, 2025 · release notes

OpenCTI 6.7.10 adds XTM Hub registration and new vulnerability management relationships

└──▷ GET THIS VERSION

$ git clone --branch 6.7.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.10

Adds XTM Hub platform registration connectivity check via a backend feature
Introduces new relationships for Vulnerability management purposes

2 details in Everything

6.7.9 Jul 31, 2025 · release notes

OpenCTI 6.7.9 maps .yara extensions to text/yara+plain MIME type by default

└──▷ GET THIS VERSION

$ git clone --branch 6.7.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.9

6.7.6 Jul 22, 2025 · release notes

OpenCTI 6.7.6 adds product field to Software and first_seen_active to Vulnerability entities

└──▷ GET THIS VERSION

$ git clone --branch 6.7.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.6

Adds the product field to the Software entity type for more granular software tracking.
Adds the first_seen_active field to the Vulnerability entity type to capture the initial date of observed activity.
Enables enrollment of an OpenCTI instance with XTM Hub.

3 details in Everything

6.7.4 Jul 10, 2025 · release notes

OpenCTI 6.7.4 adds a Prometheus metric for sent emails and allows setting the platform ID.

└──▷ GET THIS VERSION

$ git clone --branch 6.7.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.4

Adds opencti_emails_sent_total Prometheus metric to monitor the number of sent emails
Adds backend support to set or update the platform ID via the API

2 details in Everything

6.7.3 Jul 3, 2025 · release notes

OpenCTI 6.7.3 adds AUTH0_LOGOUT_URI env var and audit log transports plus .pif download block

└──▷ GET THIS VERSION

$ git clone --branch 6.7.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.3

Adds the AUTH0_LOGOUT_URI environment variable to configure the remote logout URL for Auth0 SSO
Enables pushing all audit logs to the console or file via new transport settings
Blocks direct downloads of files with the .pif extension

3 details in Everything

6.7.1 Jun 25, 2025 · release notes

OpenCTI 6.7.1 adds CSV feed import/export and on-the-fly user creation for feeds

└──▷ GET THIS VERSION

$ git clone --branch 6.7.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.1

Adds the ability to import and export CSV feeds directly within OpenCTI.
Adds the ability to create a user of a CSV Feed on the fly during import.

2 details in Everything

6.7.0 Jun 23, 2025 · release notes

OpenCTI 6.7 adds Security Platform entities, JSON Feed/Mapper, sub-technique support, and new connectors.

└──▷ GET THIS VERSION

$ git clone --branch 6.7.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.7.0

└──▷ USE IT

Configure notification batching duration to reduce spam during bulk updates.

env

PUBLISHER_MANAGER__ENABLE_BUFFERING=true
PUBLISHER_MANAGER__BUFFERING_SECONDS=60

PUBLISHER_MANAGER__ENABLE_BUFFERING and PUBLISHER_MANAGER__BUFFERING_SECONDS config keys allow tuning or disabling default notification batching.
Adds Security Platform entity type for mapping detection tool coverage against MITRE ATT&CK techniques.
Adds Dynamic From, Dynamic To, and In regards of (dynamic) filters on relationship screens for precise traversal queries.
Adds JSON Feed and JSON Mapper capabilities for ingesting JSON-formatted intelligence sources.
Adds support for MITRE ATT&CK sub-techniques in the MITRE ATT&CK Matrix view.

+13 more show less

Adds Fintel design customization options (logo and colors) for PDF exports.
Adds Reset Password flow accessible from the login page.
Adds ability to apply a case template directly within Playbooks when wrapping elements into a Case container.
Adds CVSSV2, CVSSV4 metrics and native CVSS vector string parsing to the data model.
Adds remediates relationship linking software versions to vulnerabilities they fix.
Adds a risk score field to Organizations for supply chain use cases.
Adds belongs-to relationship between Threats and Channels for counter-disinformation modeling.
Adds Dragos connector for importing intelligence from the Worldview API.
Adds Flashpoint connector support for Compromised Credentials Monitoring (CCM) data.
Adds Email Intel IMAP Connector for ingesting CTI reports via email.
Adds Email Intel Microsoft Connector for ingesting CTI reports via Microsoft Graph API.
Adds Cofense ThreatHQ connector for phishing threat data ingestion.
Adds ServiceNow connector for importing Security Incidents as Case Incident Response objects.

18 details in Everything

6.6.15 Jun 9, 2025 · release notes

OpenCTI 6.6.15 adds Italian i18n support and a backend API for marking direct marking deletion

└──▷ GET THIS VERSION

$ git clone --branch 6.6.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.15

6.6.12 May 20, 2025 · release notes

OpenCTI 6.6.12 adds country descriptions and telemetry for draft & workbenches

└──▷ GET THIS VERSION

$ git clone --branch 6.6.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.12

└──▷ HOW TO FIND IT

View or edit the description for a country entity in the interface.

📍In the Knowledge graph, select a Country entity and check the Description field in the details panel.

/health API no longer fails with Cannot set headers after they are sent to the client in all cases.
Countries can now have a description field populated via the frontend.

2 details in Everything

advisory CVE-2025-26621 May 19, 2025 · issue 128

CVE-2025-26621: Denial of Service through web hook (CVSS 7.6, affects < 6.5.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

6.6.7 Apr 23, 2025 · release notes

OpenCTI 6.6.7 adds an update stream event signaling when background container sharing has completed

└──▷ GET THIS VERSION

$ git clone --branch 6.6.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.7

└──▷ HOW TO FIND IT

Trigger external actions or sync downstream systems only after data-sharing for containers has fully propagated.

📍// Subscribe to the stream/Org-sharing channel // Filter events where event_type === update // The payload indicates the background sharing task has completed

6.6.6 Apr 18, 2025 · release notes

OpenCTI 6.6.6 adds cron format to playbook triggers, report enrichment, and a quick Assign to me UI action

└──▷ GET THIS VERSION

$ git clone --branch 6.6.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.6

└──▷ HOW TO FIND IT

Configure a playbook trigger to run on a specific schedule using cron syntax.

📍In the Playbook editor, select Scheduled as the trigger type and enter your expression (e.g., 0 9 * * 1-5) in the cron format input field.

Adds cron format input to the Playbook scheduled trigger configuration

1 detail in Everything

6.6.4 Apr 13, 2025 · release notes

OpenCTI 6.6.4 adds two Prometheus metrics and custom HTTP headers for the worker.

└──▷ GET THIS VERSION

$ git clone --branch 6.6.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.4

6.6.0 Apr 8, 2025 · release notes

OpenCTI 6.6.0 introduces Natural Language Query (Arianne AI), Draft workspaces, Request Access, and new connectors

└──▷ GET THIS VERSION

$ git clone --branch 6.6.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.6.0

└──▷ HOW TO FIND IT

Use the new AI assistant to quickly find entities via natural language instead of complex filter syntax.

📍Type 'find indicators seen in last 24h' into the top search bar

Work on a batch of extracted data without affecting production records using Draft workspaces.

📍Create a new Draft, import files, enrich entities, and apply bulk operations before converting the Draft

Filter case management lists to only show cases you are directly involved with.

📍Apply the @Me filter in the Case Management view

Adds the @Me filter to case management views for filtering by user ownership
Introduces Draft workspaces that allow users to enrich entities and apply bulk operations without impacting the main database
Adds a Natural Language Query capability in the top search bar powered by Arianne AI (Enterprise Edition)
Adds Request Access feature (Enterprise Edition) for requesting access to corelated cases across organizational boundaries
Enables importing multiple files at once into a single draft during the import workflow

+7 more show less

Supports filtering playbooks on any container sub-type (e.g., incident, report, RFi)
Adds All view to knowledge views gathering all entities and relations without filters
Introduces relative date range filtering capabilities for queries like 'cases created within the last week'
Adds reset connector state option in the Danger Zone UI
Supports disseminating any file type via dissemination features
Allows importing YARA rules in bulk
Enables updating Indicators massively through mass operations and playbooks

12 details in Everything

6.5.11 Apr 7, 2025 · release notes

OpenCTI 6.5.11 adds hashes to indicator observable values and file type restrictions for exclusion lists.

└──▷ GET THIS VERSION

$ git clone --branch 6.5.11 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.11

Adds hash attributes to indicator observable values created via STIX pattern
Adds file type restriction for text files in Exclusion List uploads

2 details in Everything

6.5.10 Mar 28, 2025 · release notes

OpenCTI 6.5.10 adds Azure OpenAI support and a new is inferred filter for relationships.

└──▷ GET THIS VERSION

$ git clone --branch 6.5.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.10

Adds Azure as a supported OpenAI provider in the platform configuration
Introduces the is_inferred filter to refine relationship queries

2 details in Everything

6.5.7 Mar 17, 2025 · release notes

OpenCTI 6.5.7 adds api protocol support for listening connectors

└──▷ GET THIS VERSION

$ git clone --branch 6.5.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.7

6.5.6 Mar 11, 2025 · release notes

OpenCTI 6.5.6 allows overriding the OpenBAS API URL via environment variable.

└──▷ GET THIS VERSION

$ git clone --branch 6.5.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.6

OPENBAS_API_URL environment variable added to override the default OpenBAS API endpoint
Updates vulnerability detail grid layout

2 details in Everything

6.5.3 Feb 24, 2025 · release notes

OpenCTI 6.5.3 adds custom script snippet support in the HTML index

└──▷ GET THIS VERSION

$ git clone --branch 6.5.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.3

└──▷ HOW TO FIND IT

Inject custom JavaScript into the OpenCTI HTML index for enhanced dashboard or page functionality.

📍Navigate to the settings or configuration section for the html index and insert your <script> content in the designated field.

6.5.2 Feb 17, 2025 · release notes

OpenCTI 6.5.2 adds markings support for workbench and changes invalid access handling to display 404.

└──▷ GET THIS VERSION

$ git clone --branch 6.5.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.2

Adds markings support for the Workbench interface, allowing users to apply data markings to artifacts created within the workbench
Changes the behavior for invalid access attempts in the UI to display a 404 page instead of redirecting to login

2 details in Everything

6.5.0 Feb 5, 2025 · release notes

OpenCTI 6.5.0 adds TAXII 2.1 Push ingester, outcome template support, exclusion lists, and EE license key enforcement.

└──▷ GET THIS VERSION

$ git clone --branch 6.5.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.5.0

TAXII Push ingester enables exposing TAXII 2.1 data collections for pushing STIX-formatted data
New capability to create customizable finished intelligence templates with container variables and entities (Enterprise Edition)
Ability to import and export outcome templates across platforms
Managements of dissemination lists for sending PDF documents via email (Enterprise Edition)
Restrict access to a container using the authorized member mechanism (Enterprise Edition)

+11 more show less

Revamped AI module available across all platform entities with activity summaries and logs
Correlation views redesigned to allow correlation between all container types
List widgets in dashboards now support selecting and reordering columns in knowledge & entity perspective
Notifications can be filtered on the trigger via label click or filter selection
Enhanced Knowledge views for Attack Patterns with a relation view
OpenBAS integration updated to specify architecture when creating injects, replacing deprecated mutations
Integration of GraphQL playground for testing and interacting with the GraphQL API
Performance improvements through worker thread pool control and relocating lock handling to a separate process
New connectors: Tenable Security Center, Google SecOps SIEM, Proofpoint ET Pro Rep List, Spycloud, Zvelo, YARA Import Files, Loader Insight Agency File Feed, Intel471-V2, Zscaler ZIA, IBM XTI, Hunt.io, Wiz
Enhanced connectors: Hatching triage, Sentinel-Intel, RecordedFuture, Mandiant, Crowdstrike, ImportDocument, Harfanglab, Flashpoint, TAXII2-connector, MISP connector, Feedly, Tagger, crtsh, Orange Cyber Defense, Zerofox, TheHive, Greynoize, VirusTotal, ShadowServer, ransomware.live
Docker containers now accessible via GitHub Container Registry in addition to Docker Hub

16 details in Everything

└──▷ BREAKING ON UPGRADE

!Upgrading a platform with Enterprise Edition activated and without a valid license key will result in the full de-activation of all EE features due to the new license key system.
!The obasContainerGenerateScenario, obasThreatGenerateScenario, and obasVictimGenerateScenario mutations are deprecated and replaced by obasContainerGenerateScenarioWithInjectPlaceholders, obasThreatGenerateScenarioWithInjectPlaceholders, and obasVictimGenerateScenarioWithInjectPlaceholders respectively.
!The signature and response format of the deprecated OpenBAS GenerationScenario mutations have changed, introducing new SimulationConfig and GenerationResponse objects.

6.4.11 Feb 4, 2025 · release notes

OpenCTI 6.4.11 adds configurable taxii feed pagination to prevent large content errors

└──▷ GET THIS VERSION

$ git clone --branch 6.4.11 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.11

6.4.10 Jan 29, 2025 · release notes

OpenCTI 6.4.10 adds meEdit mutation key checking and upgrades Mistral AI client to 1.3.6.

└──▷ GET THIS VERSION

$ git clone --branch 6.4.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.10

backend upgrades the Mistral AI client library to version 1.3.6

1 detail in Everything

6.4.8 Jan 17, 2025 · release notes

OpenCTI 6.4.8 adds support for AMBER+STRICT markings across connectors

└──▷ GET THIS VERSION

$ git clone --branch 6.4.8 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.8

AMBER+STRICT marking is now supported by multiple connectors

1 detail in Everything

6.4.7 Jan 13, 2025 · release notes

OpenCTI 6.4.7 adds GitHub Container Registry image hosting and log streaming efficiency.

└──▷ GET THIS VERSION

$ git clone --branch 6.4.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.7

Docker images are now built and pushed to ghcr.io alongside existing registries
Log lines are efficiently streamed to log visualization tools via the backend

2 details in Everything

6.4.6 Jan 8, 2025 · release notes

OpenCTI 6.4.6 adds static MIME resolution for uploads, playbook severity editing, and TAXII push endpoints

└──▷ GET THIS VERSION

$ git clone --branch 6.4.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.6

Adds TAXII push endpoints to support publishing indicators via the TAXII protocol
Enables modifying the severity field of entities directly through Playbooks
Allows deletion of Playbook background tasks to manage long-running operations

3 details in Everything

6.4.5 Dec 19, 2024 · release notes

New public Wordcloud dashboard and improved load file access restrictions in OpenCTI 6.4.5

└──▷ GET THIS VERSION

$ git clone --branch 6.4.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.5

└──▷ HOW TO FIND IT

View a public wordcloud on your OpenCTI instance.

📍Steps: In the dashboard settings, select Add widget and choose Wordcloud Public Dashboard.

Adds Wordcloud Public Dashboard widget to the UI for displaying frequency of terms.
Improves load file access restrictions to tighten who can access uploaded files.

2 details in Everything

6.4.4 Dec 11, 2024 · release notes

OpenCTI 6.4.4 adds ability to set an assignee via automation playbooks.

└──▷ GET THIS VERSION

$ git clone --branch 6.4.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.4

Adds assignee field support in automation playbook actions

1 detail in Everything

6.4.3 Dec 6, 2024 · release notes

OpenCTI 6.4.3 adds credential redaction in ingester audit logs for password and private key fields.

└──▷ GET THIS VERSION

$ git clone --branch 6.4.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.3

6.4.2 Nov 28, 2024 · release notes

OpenCTI 6.4.2 adds streaming CSV mapper imports and a rolling deployment strategy

└──▷ GET THIS VERSION

$ git clone --branch 6.4.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.2

Adds streaming support to the CSV mapper for importing entities present in multiple rows with various data.
Adds dev rolling deployment configuration option.

2 details in Everything

6.4.0 Nov 18, 2024 · release notes

OpenCTI 6.4 adds Tenable vulnerability management, danger zone protections, conditional CSV mapping, and bulk case actions.

└──▷ GET THIS VERSION

$ git clone --branch 6.4.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.4.0

└──▷ HOW TO FIND IT

Map confidence scores from a TAXII feed to the OpenCTI score field using the new ingestion option.

📍In the TAXII Feed connector configuration, enable map_confidence_to_x_opencti_score for Indicators/Observables.

Revoke a potentially leaked user token and generate a new one via the management interface.

📍In User Management, select the user and use Revoke & Recreate Token to invalidate old credentials.

Direct in-UI bulk operations for updating creator, assignee, priority, severity, and type on cases via list view
Playbook step Available for manual enrollment / trigger to allow specific entity enrollment into automated workflows
Graph layout persistence when forces are disabled, allowing static manipulation of knowledge graphs
Bulk removal of relationships from a container by selecting parent or child nodes in the graph UI
Conditional mapping capability in CSV mappers to map columns based on specific data conditions

+12 more show less

Duplicate feature for CSV mappers and feeds across ingestion and data sharing
x_opencti_score confidence level mapping option in TAXII feed ingestion config
New system has vulnerability relationship type and knowledge view for System entities
Tenable Vulnerability Management connector for asset vulnerability monitoring
RiskIQ Passive Total enrichment connector
GreyNoise Vulnerability enrichment connector
Filter on system user in activity logs to trace platform actions
"Can use web interface export functions (PDF, PNG, etc.)" capability controlling dashboard/knowledge graph image downloads
Static disable_trash parameter to globally disable the trash functionality
Cloud of Words widget for dashboards
Opinion distribution widgets based on average entity opinions
Clickable opinions across all entities with comment dialog

17 details in Everything

6.3.12 Nov 15, 2024 · release notes

OpenCTI 6.3.12 adds file marking definitions to the stream and integrates react-timeline-range-slider.

└──▷ GET THIS VERSION

$ git clone --branch 6.3.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.12

Adds file marking definitions to the data stream, ensuring they are present during synchronization rather than being dropped.
Integrates react-timeline-range-slider into the frontend UI components.

2 details in Everything

6.3.7 Oct 29, 2024 · release notes

OpenCTI 6.3.7 adds dynamic configurable required fields via settings and lets security admins revoke user tokens

└──▷ GET THIS VERSION

$ git clone --branch 6.3.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.7

└──▷ HOW TO FIND IT

Configure which fields are mandatory for custom entities via the customization settings panel.

📍Navigate to Settings › Customization › Required Fields and add the new dynamic rules.

Adds support for dynamic configurable required fields via the settings customization interface, allowing organizations to tailor form validation rules without code changes.
Updates the YARA rule validation engine by replacing the plyara dependency with yara-python, improving support for text string escape sequences.

2 details in Everything

6.3.6 Oct 15, 2024 · release notes

OpenCTI 6.3.6 adds Vulnerabilities view for Systems and has relationship support

└──▷ GET THIS VERSION

$ git clone --branch 6.3.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.6

└──▷ HOW TO FIND IT

View all known vulnerabilities affecting a specific server system directly from its entity page.

📍Navigate to System › <system_name> › Knowledge tab › Vulnerabilities view

Adds Vulnerabilities view in the knowledge tab of a System entity to directly browse associated CVEs
Supports the has relationship between a System and a Vulnerability

2 details in Everything

6.3.5 Oct 4, 2024 · release notes

OpenCTI 6.3.5 adds SAML email attribute mapping and improves retention policy deletion speed

└──▷ GET THIS VERSION

$ git clone --branch 6.3.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.5

[Backend] Add SAML option to get email from attribute
Enhance retention_policy deletion performances / speed

2 details in Everything

6.3.4 Sep 29, 2024 · release notes

OpenCTI 6.3.4 adds logout_remote OpenID option and Microsoft ADFS SSO support.

└──▷ GET THIS VERSION

$ git clone --branch 6.3.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.4

Adds logout_remote value to the OpenID connect configuration options for remote logout handling
Enables Microsoft ADFS as an OpenID Connect provider, extracting user claims from the id_token

2 details in Everything

6.3.0 Sep 17, 2024 · release notes

OpenCTI 6.3 introduces bulk creation, custom mandatory field bypass, EPSS/KEV vulnerability support, Splunk app, and retention rules.

└──▷ GET THIS VERSION

$ git clone --branch 6.3.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.3.0

└──▷ HOW TO FIND IT

Install the new Splunk integration to ingest indicators and trigger actions.

📍Install the OpenCTI Add-on for Splunk from Splunkbase: https://splunkbase.splunk.com/app/7485

Use the new EPSS enrichment connector to populate vulnerability data.

📍Deploy the EPSS enrichment connector which integrates with the FIRST API to retrieve values for specific vulnerabilities.

Adds a new Splunk App to seamlessly ingest indicators via OpenCTI live stream and trigger actions
Adds dedicated RabbitMQ queues for playbooks, synchronizers, and CSV Mapper import instead of shared queues
Adds bulk creation of entities by copy-pasting a list directly into the platform
Adds bulk creation of relations even for entities that do not yet exist in the platform
Allows connectors to bypass custom mandatory attributes by default via role configuration

+9 more show less

Extends the Vulnerability model to support EPSS and CISA KEV attributes
Enables use of EPSS and CISA KEV fields in playbook components for vulnerability decision trees
Adds configurable retention rules for Files and Workbenches to automatically delete outdated data
Adds a new tab in the dashboard menu to view public dashboards as a list without entering each one
Adds list views for Threat Actors, Intrusion Sets, Campaigns, and Malware alongside card views
Adds massive operations to Arsenal entities (Malware, Channels, Tools, Vulnerability), Narratives, and Attack Patterns
Introduces new data tables with proper pagination, column resizing, and click-to-filter on column titles
Adds an enrichment connector for EPSS values by integrating with the FIRST API
Delivers new connectors: Jira, Infoblox, Cisco SMA, Group IB, and Cofense

14 details in Everything

└──▷ BREAKING ON UPGRADE

!The RabbitMQ queues push_sync, listen_sync, listen_playbook and push_playbook are deprecated and will be removed in version 6.6

6.2.15 Aug 23, 2024 · release notes

OpenCTI 6.2.15 adds custom overview layouts for most entities and fixes several UI issues

└──▷ GET THIS VERSION

$ git clone --branch 6.2.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.15

Enables custom overview layout option for most entities in the UI

1 detail in Everything

6.2.14 Aug 20, 2024 · release notes

OpenCTI 6.2.14 lets you define the time unit for retention policies.

└──▷ GET THIS VERSION

$ git clone --branch 6.2.14 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.14

6.2.12 Aug 7, 2024 · release notes

OpenCTI 6.2.12 adds EPSS vulnerability data, active users count feature flag, and connector backpressure

└──▷ GET THIS VERSION

$ git clone --branch 6.2.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.12

EPSS support for Vulnerability Entity allows displaying Exploit Prediction Scoring System data alongside vulnerability indicators.
Connector queuing now implements auto backpressure to manage load when connectors are overwhelmed.

2 details in Everything

6.2.9 Jul 31, 2024 · release notes

Adds Bypass mandatory fields backend capability to relax validation requirements.

└──▷ GET THIS VERSION

$ git clone --branch 6.2.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.9

Adds the Bypass mandatory fields backend capability to allow creating entities without required attributes.
Removes the attributes field from the CSV Mapper configuration.

2 details in Everything

6.2.8 Jul 29, 2024 · release notes

OpenCTI 6.2.8 adds scheduled playbook triggers, user history log correlation, and Korean i18n support

└──▷ GET THIS VERSION

$ git clone --branch 6.2.8 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.8

schedule field allows playbook triggers to be set for specific times instead of only reacting to criteria
User history overview now displays logs related to the specific user being viewed
ko locale added for Korean language support in i18n

3 details in Everything

6.2.7 Jul 23, 2024 · release notes

OpenCTI 6.2.7 adds bulk creation to more entities and improves content mapping views

└──▷ GET THIS VERSION

$ git clone --branch 6.2.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.7

Adds bulk creation support for entities beyond Channels in the frontend

1 detail in Everything

6.2.6 Jul 18, 2024 · release notes

Adds SKIP_FRONTEND deployment option to disable UI, new GraphQL API for STIX bundle ingestion

└──▷ GET THIS VERSION

$ git clone --branch 6.2.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.6

SKIP_FRONTEND deployment option allows disabling the user interface during installation.
New GraphQL API endpoint send_stix_bundle enables sending STIX bundles into the ingestion process programmatically.

2 details in Everything

6.2.5 Jul 15, 2024 · release notes

OpenCTI 6.2.5 adds Channel entity bulk creation and extends organizational segregation to System/Individual levels.

└──▷ GET THIS VERSION

$ git clone --branch 6.2.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.5

└──▷ HOW TO FIND IT

Create multiple Channel entities at once via the bulk import feature.

📍steps: In the OpenCTI UI, navigate to Import › Bulk creation and select Channel as the entity type.

Configure organizational segregation boundaries for System users or Individual accounts.

📍steps: In the platform settings or user management screens, expand the segregation options to choose between System and Individual scopes.

Adds the Channel entity type for modeling communication channels
Enables organization-level segregation by introducing System and Individual scope options in the UI

2 details in Everything

6.2.4 Jul 10, 2024 · release notes

OpenCTI 6.2.4 adds AWS Signature Version 4 support for OpenSearch integration

└──▷ GET THIS VERSION

$ git clone --branch 6.2.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.4

Adds AWS_SIGNATURE_VERSION_4 configuration to enable SigV4 authentication for the OpenSearch client

1 detail in Everything

6.2.3 Jul 9, 2024 · release notes

OpenCTI 6.2.3 adds Redis Sentinel configuration options (failoverDetector, updateSentinels)

└──▷ GET THIS VERSION

$ git clone --branch 6.2.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.3

Adds failoverDetector and updateSentinels configuration keys to control Redis Sentinel behavior
CSV Mapper now supports adding Kill chain phase references to Uses relationships

2 details in Everything

6.2.2 Jul 8, 2024 · release notes

OpenCTI 6.2.2 adds Malware-Analyses and Tasks creation from the knowledge tab, allows sharing inferred relationships with organizations, and improves UI tooltips.

└──▷ GET THIS VERSION

$ git clone --branch 6.2.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.2

└──▷ HOW TO FIND IT

Contextually create a malware analysis from an indicator's knowledge page.

📍In the console, navigate to a Knowledge object, open its tabs, and select Malware-Analyses to create a new entry.

Share an inferred relationship with a specific organization in the UI.

📍In the console, locate an inferred relationship in the list view and use the Share action to select organizations.

Adds Malware-Analyses and Tasks creation options directly from the knowledge tab
Adds tooltips to marking chips for truncated text

2 details in Everything

6.2.1 Jul 3, 2024 · release notes

OpenCTI 6.2.1 adds bulk SDO/SCO creation via copy/paste and updates data tables with new filters

└──▷ GET THIS VERSION

$ git clone --branch 6.2.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.1

Adds POC on Bulk creation of SDO/SCO with Copy/Pasting allowing bulk creation of relationship
Introduces new data tables to replace Cards views, controlled by a feature flag in PR #5405
Adds source and target filters for sightings entity type column in the relationship list widget

3 details in Everything

6.2.0 Jun 28, 2024 · release notes

OpenCTI 6.2 adds Diamond Model view, auto Workbenches for RSS External References, connector queue clearing, and granular RBAC split.

└──▷ GET THIS VERSION

$ git clone --branch 6.2.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.2.0

Introduces the Diamond Model analytic view automatically generated in the Knowledge tab for Threats and Incidents
Adds automatic creation of Analyst Workbenches from RSS Feed External References to automate ingestion workflows
Allows administrators to clear a connector's stuck queue via a new button in the connector settings
Splits the Settings capability into granular controls, allowing management of labels/marking without interface access
Adds the Access security activity capability to view logs related to security events separately from knowledge modifications

+5 more show less

Enables adding Indicators generated from container Observables during massive operations via the toolbar
Allows relationships created from inference rules to be shared in TAXII collections when creating a new one
Supports Organization sharing through massive operations directly, letting users select entities and click share
Enhances CSV Feed Ingester to use default marking values from the CSV Mapper for data classification
Introduces Auto Map content mapping in the Content tab that recognizes existing platform entities

10 details in Everything

└──▷ BREAKING ON UPGRADE

!SAML Document signatures are now required by default; must set want_authn_response_signed=false or configure signed certificates
!Require all SAML assertions be signed; must set want_assertions_signed=false or configure signed identity provider
!Environment variables PROVIDERS__SAML__CONFIG__WANT_AUTHN_RESPONSE_SIGNED and PROVIDERS__SAML__CONFIG__WANT_ASSERTIONS_SIGNED can now be set to false to disable the new secure defaults

6.1.12 Jun 20, 2024 · release notes

OpenCTI 6.1.12 splits ingestion capabilities, adds askAnalysis mutation, and shares inference results via TAXII.

└──▷ GET THIS VERSION

$ git clone --branch 6.1.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.12

└──▷ TRY IT

Request AI analysis on specific file or field data from a STIX object using the new mutation.

$ mutation {
  askAnalysis(input: { id: "<stix_object_id>", type: "file", fields: ["hash"] }) {
    id
    status
  }
}

Filter activity events by specific users or groups using the expanded context filter values.

📍# In the Dashboard activity widget, use the User or Group dropdown to narrow event logs

Splits 'data sharing and ingestion' capability into three distinct operational surfaces
Adds askAnalysis GraphQL mutation to request file or fields analysis via AI
Shares inference rule results in TAXII collections
Add User and Group values to context activity filters

4 details in Everything

6.1.11 Jun 13, 2024 · release notes

OpenCTI 6.1.11 adds per-group max shareable markings, entity-specific confidence overrides, and pattern filters for Stored Filters

└──▷ GET THIS VERSION

$ git clone --branch 6.1.11 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.11

Adds Max shareable marking definitions in groups limit for exports and public dashboards
Adds ability to Override of confidence level per Entity per Group
Adds pattern filter operator (starts with) for Indicator in Stored Filters

3 details in Everything

6.1.7 May 31, 2024 · release notes

OpenCTI 6.1.7 adds external ID mapping in CSV Mapper and improves alias resolution

└──▷ GET THIS VERSION

$ git clone --branch 6.1.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.7

Allow external ID to be mapped in CSV mapper
Improve alias generation and resolution to improve data ingestion

2 details in Everything

6.1.6 May 29, 2024 · release notes

OpenCTI 6.1.6 adds PDF export for lists and search results

└──▷ GET THIS VERSION

$ git clone --branch 6.1.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.6

└──▷ HOW TO FIND IT

Export a saved list or search query as a PDF document via the UI.

📍In the UI, select the list or search results and choose Export to PDF.

6.1.5 May 29, 2024 · release notes

OpenCTI 6.1.5 adds start-with filtering for representatives in playbooks/streams and improves CSV mapper reliability.

└──▷ GET THIS VERSION

$ git clone --branch 6.1.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.5

representatives filter now supports prefix matching in playbook and stream rules
CSV mapper now tracks record count and failures explicitly

2 details in Everything

6.1.4 May 23, 2024 · release notes

OpenCTI 6.1.4 adds stateless session option, default home dashboard selection, and audit logging capabilities.

└──▷ GET THIS VERSION

$ git clone --branch 6.1.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.4

└──▷ HOW TO FIND IT

Configure a user profile to use stateless sessions via the settings UI.

📍Navigate to User Settings and toggle the Force stateless session option.

Set a specific dashboard as the landing page when users log in.

📍Open the home screen configuration and select your preferred dashboard from the list.

Adds an option in user settings to force stateless session
Allows selecting the default dashboard for home screen

2 details in Everything

6.1.3 May 21, 2024 · release notes

OpenCTI 6.1.3 adds telemetry directory chmod and logger option for error data.

└──▷ GET THIS VERSION

$ git clone --branch 6.1.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.3

Add chmod permissions to .support and telemetry directories created by docker files
Adds logger backend option to enable logging of data from Error

2 details in Everything

6.1.2 May 16, 2024 · release notes

OpenCTI 6.1.2 adds Redis family option for IPv6 and test automation

└──▷ GET THIS VERSION

$ git clone --branch 6.1.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.2

Adds family configuration option to connect OpenCTI via IPv6 domains over Redis
Implements automated test coverage for the CRUD operations

2 details in Everything

6.1.0 May 13, 2024 · release notes

OpenCTI 6.1.0 adds OpenBAS integration, Public Dashboards, and deletion rollback

└──▷ GET THIS VERSION

$ git clone --branch 6.1.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.1.0

└──▷ HOW TO FIND IT

Generate a BAS campaign from a Threat overview to evaluate current posture against real threats

📍In the Overview of the Threat, click Generate Breach and Attack Simulation to open OpenBAS

Share a dynamic dashboard view with external stakeholders without granting platform access

📍Navigate to Public Dashboards, create a snapshot, and share the generated permalink

Restore an accidentally deleted Knowledge entity within the 7-day retention window

📍Go to the Trash collector in the UI, locate the deleted entity, and click Restore

Integrates OpenCTI with OpenBAS to generate Breach and Attack simulations directly from Reports, Cases, and Threats Overview pages
Adds Public Dashboards that provide dynamically updated snapshots of custom dashboards via permalink for non-accessed users
Enables maximum marking definition controls for sharing data through Public Dashboards and applying markings to exported file contents
Introduces a Trash collector allowing rollback of deleted Knowledge entities and relations for up to 7 days by default
Adds per-entity-type overrides for the Max Confidence level to tailor connector impact on specific entity types like Intrusion Sets or Reports

+2 more show less

Adds automatic notifications for Assignee/Participant assignments on Cases and allows users to define default notification preferences in their Profile
Enables administrators to generate a Support Package archive containing log files from all nodes for diagnostics via a button click

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Ingesting objects with a name containing less than 3 characters is no longer possible (spaces at the beginning or end are not included in the count)

6.0.10 Apr 18, 2024 · release notes

OpenCTI 6.0.10 adds TrackingNumber and Credential observables plus Redis Sentinel support for high availability.

└──▷ GET THIS VERSION

$ git clone --branch 6.0.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.10

Adds TrackingNumber and Credential observable types to the data model
Introduces Redis Sentinel support for HA deployments

2 details in Everything

6.0.9 Apr 3, 2024 · release notes

OpenCTI 6.0.9 adds sorting groups by max confidence and entity_type filters in Victimology tabs

└──▷ GET THIS VERSION

$ git clone --branch 6.0.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.9

└──▷ HOW TO FIND IT

Sort groups by confidence level in the OpenCTI UI

📍In the Groups view, click the max confidence column header to sort.

Filter entity types in the Victimology tab for an entity's knowledges

📍Navigate to an entity's Knowledge tab › Victimology section and select entity_type from the filter dropdown.

Allows sorting groups by max confidence level in the UI.
Adds an entity_type filter to the Victimology tab for entities' knowledges.

2 details in Everything

6.0.8 Mar 24, 2024 · release notes

OpenCTI 6.0.8 adds samples field to Malware via API and supports searching STIX indicators by pattern

└──▷ GET THIS VERSION

$ git clone --branch 6.0.8 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.8

└──▷ USE IT

Retrieve malware records including their associated sample data via GraphQL.

shell

curl -X POST https://<opencti-host>/graphql \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{ "query": "{ malwares { edges { node { id name samples } } } }"}'

Search for entities matching a specific STIX indicator pattern, such as an IP address.

shell

curl -X POST https://<opencti-host>/graphql \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{ "query": "{ indicators(filter: { key: "pattern", values: ["[ipv4-addr:value = \'192.168.1.1\']"]) { edges { node { id name } } } }"}'

Adds samples attribute to the Malware entity in the GraphQL API
Enables searching OpenCTI using an STIX indicator pattern

2 details in Everything

6.0.6 Mar 13, 2024 · release notes

OpenCTI 6.0.6 adds observables creation from context and schema validation for patching attributes

└──▷ GET THIS VERSION

$ git clone --branch 6.0.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.6

Adds the ability to create observables and indicators directly from other observables or indicators when the select all operation is not possible in a container context.
Enforces input validation against the schema when patching object attributes, preventing invalid data from being indexed.

2 details in Everything

6.0.3 Mar 2, 2024 · release notes

OpenCTI 6.0.3 adds PAP marking definition by default and improves STIX filtering path resolution

└──▷ GET THIS VERSION

$ git clone --branch 6.0.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.3

Adds PAP marking definition by default in fresh images to control access permissions for new deployments
Improves STIX filtering resolution to handle complex object paths consistently

2 details in Everything

6.0.0 Feb 28, 2024 · release notes

OpenCTI 6.0 adds Generative AI content generation, CSV feed ingester, indicator decay, and filter operators.

└──▷ GET THIS VERSION

$ git clone --branch 6.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 6.0.0

Adds Generative AI integration to craft textual content, summarize files, and generate STIX knowledge
Introduces CSV Feed ingester for automatic ingestion from URL-exposed CSV files with mapper support
Adds Indicator decay algorithm with configurable rules based on observable type, lifetime, and acceleration factor
Enables filtering on any object's attributes in lists and dashboards using the new filter UI
Adds In regards of, Contains, and Search operators to the filter system

+4 more show less

Improves Recorded Future connector to import Malwares and Threat Actors
Updates Greynoise, Shodan, and Malbeacon enrichment connectors for automation playbook compatibility
Renames NetworkTraffic src and dst creation attributes to networkSrc and networkDst in GraphQL queries
Adds OpenID Proxy configuration capability

9 details in Everything

└──▷ BREAKING ON UPGRADE

!NetworkTraffic src and dst creation attributes are renamed to networkSrc and networkDst in GraphQL queries.
!The confidence level system for connectors, feeds, and streams now uses the max confidence level of their associated user.

5.12.24 Jan 29, 2024 · release notes

Adds confidence level controls for groups and users

└──▷ GET THIS VERSION

$ git clone --branch 5.12.24 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.24

admin_tools now include managing max_confidence_level for Groups and Users
max_confidence_level can be managed at the Group level to filter entity visibility
confidence_level attribute is now available directly on Users

3 details in Everything

5.12.22 Jan 26, 2024 · release notes

OpenCTI 5.12.22 adds main observable type filter for Triggers and Widgets, plus configurable node-saml auth response signing.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.22 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.22

└──▷ HOW TO FIND IT

Restrict a Trigger or Widget to only process events where the primary observable matches a specific type (e.g., IP address).

📍In the Triggers or Widgets UI configuration, select main observable type from the new filter dropdown.

Control whether the SAML integration expects signed authentication responses for enhanced security posture.

📍Set the wantAuthnResponseSigned parameter in the node-saml configuration section of your environment variables.

main observable type filter available in Triggers and Widget configuration UIs
Configurable wantAuthnResponseSigned parameter for node-saml integration

2 details in Everything

5.12.21 Jan 22, 2024 · release notes

OpenCTI 5.12.21 adds authenticated headers to audit logs and lets admins view user subscriptions at the entity level

└──▷ GET THIS VERSION

$ git clone --branch 5.12.21 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.21

Adds information from authentication (headers) in audit logging
Enable administrators to view subscriptions made by users directly at the entity level

2 details in Everything

5.12.18 Jan 16, 2024 · release notes

OpenCTI 5.12.18 adds a UI for creating relations in the Knowledge Graph.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.18 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.18

5.12.16 Jan 15, 2024 · release notes

OpenCTI 5.12.16 adds SSO via reverse proxy headers, /health endpoint, and nested contains_ref on Email Message

└──▷ GET THIS VERSION

$ git clone --branch 5.12.16 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.16

Introduces /health endpoint for platform health checks
Adds support for contains_ref (nested relationship) on Email Message entities

2 details in Everything

5.12.14 Dec 26, 2023 · release notes

OpenCTI 5.12.14 adds support for indexing HTML, Markdown, and JSON files.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.14 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.14

Supports HTML, Markdown, and JSON file indexation

1 detail in Everything

5.12.12 Dec 24, 2023 · release notes

OpenCTI 5.12.12 adds entity statuses to the dashboard view.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.12

└──▷ HOW TO FIND IT

Check current entity status directly from the dashboard without navigating to detailed views.

📍In the console, go to the Dashboard and view the Entity statuses panel

5.12.10 Dec 22, 2023 · release notes

OpenCTI 5.12.10 introduces Vite HMR for developers and search enhancements

└──▷ GET THIS VERSION

$ git clone --branch 5.12.10 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.10

Introduce Vite as the development builder to bring back Hot Module Replacement (HMR)
Add Search all possible values capability in identity filters
Redirect from user Overview to all entities and relations created by the user

3 details in Everything

5.12.9 Dec 17, 2023 · release notes

OpenCTI 5.12.9 improves observable merging for multi operations and handles special MIME types during export.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.9

5.12.6 Dec 15, 2023 · release notes

OpenCTI 5.12.6 adds filtering incident/event by name, targets filter in Threat Knowledge view, and user entity listing in overview.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.6

└──▷ HOW TO FIND IT

Filter incidents in the UI by typing a name to narrow down the list of recent events.

📍Go to Incidents › Filters › Name and enter your search term.

View Threat Knowledge entities and apply a filter for specific target groups or regions.

📍Go to Threat Knowledge › Entities › Filters › targets.

List all assets, indicators, and relationships created by your account in the User Overview.

📍Go to User › Overview › All entities created by me.

Adds the ability to filter incidents and events by name.
Adds an optional default value for attributes missing mapping values from files during CSV import.
Enables listing all entities created by the current user in the User Overview screen.

3 details in Everything

5.12.5 Dec 10, 2023 · release notes

OpenCTI 5.12.5 adds scoped platform notifications and customizable relationship de-deduplication time range

└──▷ GET THIS VERSION

$ git clone --branch 5.12.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.5

└──▷ HOW TO FIND IT

Limit platform-wide notifications to only specific security teams or organizational units.

📍In the Settings › Notifications section, use the scope filter to select target groups or organizations instead of leaving it global.

Adjust how far back the platform looks when de-duplicating relationships to balance accuracy vs performance.

📍In Settings, locate the Relationship De-deduplication configuration and set the new time range parameter.

Adds ability to scope platform notifications to specific groups or organizations via the settings interface
Introduces a configurable time range for the relationship de-deduplication mechanism

2 details in Everything

5.12.0 Dec 4, 2023 · release notes

OpenCTI 5.12 adds dashboard export/import, audit log CSV export, raw document indexing (Enterprise), and ACL on Feedbacks

└──▷ GET THIS VERSION

$ git clone --branch 5.12.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.12.0

Direct full-text indexing of raw documents (PDF, HTML, DOCX) is available in the Enterprise Edition, making content immediately searchable without prior extraction.
authorized_members ACL system extended to support Feedback objects, allowing entity-level permission control on user feedback.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The list filters API schema has changed from the previous version; Python library and GraphQL API users must follow the new filter grouping syntax described in the migration documentation.

5.11.13 Nov 8, 2023 · release notes

Playbooks support first-level relationships and artifacts can be downloaded as password-protected zip.

└──▷ GET THIS VERSION

$ git clone --branch 5.11.13 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.11.13

MINIO__USE_AWS_ROLE environment variable now accepts defaultProvider value for AWS EKS authentication
Artifacts can be downloaded as a password-protected zip archive via UI steps
First-level relationships and associated entities are now usable in playbooks

3 details in Everything

5.11.11 Oct 25, 2023 · release notes

OpenCTI 5.11.11 adds tabs for streams, feeds, and Taxii list items

└──▷ GET THIS VERSION

$ git clone --branch 5.11.11 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.11.11

└──▷ HOW TO FIND IT

View the details of a Stream or Feed without losing your place in the Lists interface.

📍In the Lists view, click any Open stream, feed, or Taxii item.

Clicking items in the Lists view for Open streams, feeds, and Taxii now opens them in a new browser tab instead of replacing the current page.

1 detail in Everything

5.11.9 Oct 24, 2023 · release notes

OpenCTI 5.11.9 adds user disable and expiration date support to identity management

└──▷ GET THIS VERSION

$ git clone --branch 5.11.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.11.9

5.11.1 Oct 16, 2023 · release notes

OpenCTI 5.11.1 adds main_observable_type filtering for TAXII and state reset for collections

└──▷ GET THIS VERSION

$ git clone --branch 5.11.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.11.1

main_observable_type filter available in Taxii server to constrain ingestion sources
New option to reset/clear the state of a TAXII collection during ingestions

2 details in Everything

5.11.0 Oct 16, 2023 · release notes

OpenCTI 5.11.0 introduces built-in CSV import, GA automation engine for Enterprise Edition, public feeds for non-stream types, and analytics pixel tracking.

└──▷ GET THIS VERSION

$ git clone --branch 5.11.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.11.0

Adds a built-in CSV parser/mapper that supports flexible column mapping, multiple entities or relationships in a single column, and relationships defined in columns
Makes the automation engine generally available in OpenCTI Enterprise Edition to create playbooks and scenarios based on any event type for actions like triggering connectors or sending indicators
Allows all types of feeds (CSV, TAXII, etc.) to be set as public, not just OpenCTI streams, while consolidating marking definitions by keeping only the highest level per type
Enables quick creation of containers (reports or grouping) directly from an investigation via a new UI button
Displays the number of entities available for extension on the investigation graph and extends the list of extendable entities

+4 more show less

Adds biographic/demographic capabilities to ThreatActorIndividuals and allows adding Analytics pixels tracking systems for demographics
Implements rolling time-based attribute selection (created_at, updated_at) for time-based filters
Allows customizing the pagination window in the native TAXII server
Enables automatic sharing to organizations based on specific criteria within automation rules

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Restricts marking definitions to only one marking per type, keeping only the highest level instead of cumulating them

5.10.3 Sep 25, 2023 · release notes

OpenCTI 5.10.3 adds custom dashboard headline widgets and modified/updated_at filter fields to Reports

└──▷ GET THIS VERSION

$ git clone --branch 5.10.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.10.3

ReportsFilter gains modified and updated_at fields for filtering reports by time.
Custom Dashboard Headline Widget allows adding a headline element to dashboards.

2 details in Everything

5.10.2 Sep 12, 2023 · release notes

OpenCTI 5.10.2 adds bulk operations and checkboxes for Infrastructures observations

└──▷ GET THIS VERSION

$ git clone --branch 5.10.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.10.2

└──▷ HOW TO FIND IT

Select multiple infrastructure entities to perform bulk actions like deletion or tagging via the new checkbox interface.

📍In the Observations => Infrastructures view, use the new checkboxes to select multiple entries and apply mass operations.

5.10.1 Sep 1, 2023 · release notes

OpenCTI 5.10.1 adds security login for admin users when local strategy is deactivated.

└──▷ GET THIS VERSION

$ git clone --branch 5.10.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.10.1

5.10.0 Aug 26, 2023 · release notes

OpenCTI 5.10 adds a built-in RSS client, webhook notifications, and account lockout by expiration date

└──▷ GET THIS VERSION

$ git clone --branch 5.10.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.10.0

SAML configuration now supports the SkipRequestCompression option for debugging SAML assertions
Built-in RSS client consumes data from configured feeds without external infrastructure
Notification manager includes webhooks as a delivery target for events
Accounts are automatically locked based on expiration dates, improving account security posture
UI views allow selecting objects directly in the Report's Correlation View for faster investigation workflows

5 details in Everything

5.9.1 Jul 12, 2023 · release notes

OpenCTI 5.9.1 adds Domain-Name to Identity relationships and fixes bulk search additional names

└──▷ GET THIS VERSION

$ git clone --branch 5.9.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.9.1

Adds support for Domain-Name belongs-to Identity (WHOIS) relationships in the knowledge graph.

1 detail in Everything

5.9.0 Jul 10, 2023 · release notes

OpenCTI 5.9.0 adds custom widgets on audit logs, analyst workbenches per entity, investigation export to STIX/CSV, group default dashboards, and automatic ES rollover at init

└──▷ GET THIS VERSION

$ git clone --branch 5.9.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.9.0

ElasticSearch / OpenSearch rollover policies are now created and enabled automatically when initializing a new platform (previously required manual ILM setup).
New custom widgets that visualize audit log and activity monitoring data on the Settings screen.
New notification triggers based on user activity, managed per group/organization in the Settings screen's triggers & digests section.
Ability to define default dashboards for specific groups or organizations in the Settings screen.
Customizable Header/Footer banner and Idle Time Screen Masking settings added to the platform administration screens.

+7 more show less

Platform announcements (broadcast messages) with dismiss feature, including color customization, accessible from administration.
New icon on entity overview allowing quick subscription to activity for that entity.
Threat-Actor split into two sub-types: threat_actor_group and threat_actor_individual in the data model.
Ability to create an analyst workbench directly from any entity's data tab.
Investigations can now be exported as a STIX report (JSON) or CSV format.
opinion_custom_vocab and scale supported for opinions within opinion radars.
Participants field added alongside assignees for cases and other entities.

12 details in Everything

5.8.7 Jun 29, 2023 · release notes

OpenCTI 5.8.7 allows observable creation from selected text in the UI

└──▷ GET THIS VERSION

$ git clone --branch 5.8.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.8.7

└──▷ HOW TO FIND IT

Quickly create an observable from highlighted text on a page without typing manually.

📍In the OpenCTI UI, highlight text and use the context menu to create an observable.

Observable creation now takes into account the currently selected text in the UI

1 detail in Everything

5.8.4 Jun 26, 2023 · release notes

OpenCTI 5.8.4 adds a Description field to entity updates and a confirmation popup for external links

└──▷ GET THIS VERSION

$ git clone --branch 5.8.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.8.4

└──▷ HOW TO FIND IT

Trigger the safety check when clicking an external URL.

📍Click any link in the Entities view or Container details to see the warning popup.

Adds a Description field when updating entities via the platform
Adds a warning popup before browsing an external link in the UI

2 details in Everything

5.8.3 Jun 23, 2023 · release notes

OpenCTI 5.8.3 adds T-number display for attack patterns and customizable distribution widget N values

└──▷ GET THIS VERSION

$ git clone --branch 5.8.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.8.3

└──▷ HOW TO FIND IT

View Attack Patterns in Add Entities with their STIX IDs for precise mapping.

📍In the UI, go to Add Entities and select an Attack Pattern.

Add Entities screen now displays the T-number (or CAPEC ID) for Attack Pattern entities to aid identification.
Distribution widgets now support configuring the top N results instead of the default fixed value of 10.

2 details in Everything

5.8.1 Jun 19, 2023 · release notes

OpenCTI 5.8.1 adds the ability to attach associated files when creating a Malware Analysis.

└──▷ GET THIS VERSION

$ git clone --branch 5.8.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.8.1

└──▷ TRY IT

Create a new malware analysis object and upload the binary sample directly during creation.

$ # Use the Malware Analysis creation API endpoint with an attached file payload.
# Example using curl:
curl -X POST \
  'https://<opencti_host>/api/graphql' \
  -H 'Authorization: Bearer <token>' \
  -F 'query={ "mutation": { "MalwareAnalysisAdd(input: { name: \"sample.exe\", description: \"Initial upload\" }) { id } } }' \
  -F 'file=@./sample.exe'

5.8.0 Jun 19, 2023 · release notes

OpenCTI 5.8.0 adds malware analysis STIX entity, workspace ACLs, case tasks/templates, and dashboard chart exports

└──▷ GET THIS VERSION

$ git clone --branch 5.8.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.8.0

Adds a new Malware-Analysis STIX object type to the platform's knowledge graph.
New per-workspace (investigation & dashboard) ACL layer allowing private, shared with group, or all users access control.
Supports tasks and case templates within cases, configurable in Settings.
Enables exporting any dashboard widget/APEX chart as PNG, SVG, or CSV via the UI.
Allows attaching files to all entity creation forms across the platform.

+2 more show less

Introduces lasso selection for graph nodes in investigation systems alongside existing rectangle selection.
Adds default values by entity type for mandatory attributes (e.g., default marking definition).

7 details in Everything

5.7.5 May 19, 2023 · release notes

OpenCTI 5.7.5 adds organization-based stream filters and dashboard time fields

└──▷ GET THIS VERSION

$ git clone --branch 5.7.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.5

Adds start_time / stop_time parameters to the timeseries field for dashboards
Adds support for creating stream filters based on organization

2 details in Everything

5.7.4 May 4, 2023 · release notes

OpenCTI 5.7.4 adds local password policies and fixes stream filtering for SCOs.

└──▷ GET THIS VERSION

$ git clone --branch 5.7.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.4

Adds configurable local password policies for user accounts
Improves stream filtering to handle System Context Object (SCO) extensions

2 details in Everything

5.7.3 Apr 29, 2023 · release notes

OpenCTI 5.7.3 adds Case Rfi and Case Rft entities plus a default Connector group at init.

└──▷ GET THIS VERSION

$ git clone --branch 5.7.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.3

Add Case-Rfi entity type to model Request-for-Information cases.
Add Case-Rft entity type to model Request-for-Testing cases.
Create a default Group for Connector at initialization.

3 details in Everything

5.7.2 Apr 20, 2023 · release notes

OpenCTI 5.7.2 enables SCOs sharing to organizations and fixes group default membership initialization

└──▷ GET THIS VERSION

$ git clone --branch 5.7.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.2

Verifies that Shared Components (SCOs) can be shared with organizations, either standalone or as part of a container

1 detail in Everything

5.7.1 Apr 18, 2023 · release notes

OpenCTI 5.7.1 adds kill chain phase display in relationship overviews and includes creator data for basic objects.

└──▷ GET THIS VERSION

$ git clone --branch 5.7.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.1

└──▷ HOW TO FIND IT

Inspect the attack lifecycle context for a specific relationship in the UI.

📍In the console, navigate to a STIX Core Relationship and view the Kill chain phases in the overview section.

Kill chain phases are now displayed in the overview of a STIX Core Relationship

1 detail in Everything

5.7.0 Apr 17, 2023 · release notes

OpenCTI 5.7.0 brings RBAC group mapping, customizable confidence scales, case container management in workbench, and interactive dashboard horizontal bars

└──▷ GET THIS VERSION

$ git clone --branch 5.7.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.7.0

Add customizable confidence scale configuration by entity type (colors, labels, min/max, ticks)
Enable clicking on horizontal bars in dashboards to navigate directly to the target entity
Add case container management capabilities within the analyst workbench

3 details in Everything

5.6.2 Mar 11, 2023 · release notes

OpenCTI 5.6.2 adds HTTPS-proxy support for the Synchronizer platform process.

└──▷ GET THIS VERSION

$ git clone --branch 5.6.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.6.2

Adds HTTP_PROXY and HTTPS_PROXY environment variable support to configure proxy settings for the Synchronizer component.

1 detail in Everything

5.6.0 Mar 7, 2023 · release notes

OpenCTI 5.6 adds public streams, lasso selection in the knowledge graph, mandatory entity attributes, and workflow dashboard filters.

└──▷ GET THIS VERSION

$ git clone --branch 5.6.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.6.0

└──▷ HOW TO FIND IT

Browse externally shared intelligence feeds available to the platform.

📍Navigate to /public in the web console

Select multiple entities rapidly in the knowledge graph for batch operations.

📍Click and drag to lasso-select entities on the graph panel

Add Address and Postal Code fields to Position entities in the knowledge base.

📍Open a Position entity -> Edit -> Enter values in Address / Postal Code fields

/public page lists all public streams for consumption
Streams can be turned public to share data externally
Knowledge graph supports lasso selection of entities
Cumulated creator_id on entities tracks all sources over time
indicator_types filter added to the indicators list

+2 more show less

Custom dashboards gain a workflow status filter
Position GUI supports Address and Postal Code fields

7 details in Everything

5.5.4 Feb 9, 2023 · release notes

OpenCTI 5.5.4 adds Microsoft Sentinel connector and indicates relationship support for Indicators/Infrastructure

└──▷ GET THIS VERSION

$ git clone --branch 5.5.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.5.4

Microsoft Sentinel connector released
Ability to relate an Indicator and Infrastructure via indicates relationship

2 details in Everything

5.5.3 Feb 6, 2023 · release notes

OpenCTI 5.5.3 introduces case management, negative filtering, a notification system, and MFA enforcement via platform settings.

└──▷ GET THIS VERSION

$ git clone --branch 5.5.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.5.3

Case entity type introduced for incident response workflows
Negative filtering operators supported in the search bar
Platform-wide notifications with customizable triggers and digests added
Mandatory multi-factor authentication enforceable from Platform Settings
Export feature allows selection of entities directly from list checkboxes without filters

+3 more show less

Location entities now support state fields for administrative zones
Redis cluster deployment supported for backend scalability
Entity type settings reorganized into a dedicated platform section

8 details in Everything

5.5.2 Jan 12, 2023 · release notes

OpenCTI 5.5.2 adds an enrichment button in ContainerHeader and advanced filters for threats by sector.

└──▷ GET THIS VERSION

$ git clone --branch 5.5.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.5.2

└──▷ HOW TO FIND IT

Enrich an entity directly from its parent container without leaving the current context.

📍Steps: Open a container (e.g., Incident). Locate the enrichment button in the ContainerHeader. Click to start enrichment.

Filter threats targeting specific sectors or regions using advanced filters.

📍Steps: Navigate to Threats. Click Filters. Select Sector or Country/Region. Apply filter.

Adds an enrichment button to the ContainerHeader component for quick entity enrichment from any container view
Enables navigation on external references in-place instead of opening a new browser link
Allows filtering threats by sector or country/region via advanced filters in the Targets view

3 details in Everything

5.5.1 Dec 29, 2022 · release notes

OpenCTI 5.5.1 adds entities list views, notes attributes, global feedback, and creator filtering

└──▷ GET THIS VERSION

$ git clone --branch 5.5.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.5.1

└──▷ HOW TO FIND IT

Switch any knowledge view (e.g., Malwares, Indicators) to the new sortable entity list table instead of the default graph or timeline.

📍In a knowledge view panel, toggle the view mode to entities and sort by any column header.

Pin frequently accessed entities (like specific STIX Objects) to your dashboard for quick access without searching.

📍Create a custom dashboard › Add Widget › Select favorite type › Save.

Filter the platform's object list (e.g., all Indicators) to show only those created by a specific user account.

📍In the Global view filters, select Creator and choose the desired username from the dropdown.

Adds entities view to all knowledge sections for sortable entity lists.
Adds favorite widget for custom dashboards to bookmark entities.
Adds Likelihood attribute to notes via API schema update.
Adds note_types field to notes for categorization.
Adds global feedback feature allowing users to submit free-text feedback to platform owners.

+1 more show less

Adds ability to filter objects by creator across the platform.

6 details in Everything

5.5.0 Dec 16, 2022 · release notes

OpenCTI 5.5.0 adds Custom Ontologies, MITRE Data Source/'Data Component' entities, heatmaps, dynamic dashboards, and bulk operations.

└──▷ GET THIS VERSION

$ git clone --branch 5.5.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.5.0

└──▷ HOW TO FIND IT

Define a custom ontology for Phishing categories to map internal taxonomy to STIX.

📍In the console, go to Settings › Custom Ontology and enable alias management

Create a new MITRE Data Source entity for tracking detection data.

📍In the console, go to Knowledge › Entities and select Data Source as the type

Visualize density of observables in a dashboard using heatmaps.

📍Add widget -> Select Heatmap from the widget list

Adds Data Source and Data Component entity types to handle MITRE data components, data sources, and detection courses of action
Adds dynamic filtering capabilities to the dashboarding engine with multi-data support
Adds ability to SHIFT+select multiple objects for bulk editing across screens
Adds toolbar button to copy observables in bulk from the Observations page
Adds background task capability to massively add entities to a container

+1 more show less

Adds automatic creation of external references when a file is uploaded to an entity

6 details in Everything

5.4.1 Nov 24, 2022 · release notes

OpenCTI 5.4.1 adds indicator sharing organizations and file-based export queries

└──▷ GET THIS VERSION

$ git clone --branch 5.4.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.4.1

└──▷ USE IT

Export data for a large set of entities using a file to avoid URL length limits

shell

curl -X POST 'https://<host>/api/graphql' -H 'Authorization: Bearer <token>' -F 'query={exportEntities(task_id: "<task_id>")}' -F 'file=@ids.txt'

Adds sharing_organization capability to indicators, allowing entities to be shared with specific organizations
Enables exporting findings via a file containing IDs or Stix-Match-Query strings instead of inline parameters

2 details in Everything

5.4.0 Nov 18, 2022 · release notes

OpenCTI 5.4.0 adds organization data segregation, analyst workbench, bulk search, and inference rules.

└──▷ GET THIS VERSION

$ git clone --branch 5.4.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.4.0

Adds the organizations capability to restrict data visibility by assigning users to organizations and setting a default platform-wide organization
Introduces an analyst workbench for mass modeling of entities and relationships before committing them to the platform
Adds bulk search capability for SDOs and SCOs (entities and observables) in the platform
Adds the STIX 2.1 Grouping entity type to cluster information without creating a report
Adds new inference rules to propagate reports to parent entities such as sectors and locations

+4 more show less

Allows denying connectors from creating new labels and keeping a set of pre-defined labels in the platform
Enables querying Retention Policy Rules with Score less than filter criteria
Adds country flag icons to IPv4/IPv6 observables when the located-at relationship is set to a specific country
Separates feedback capabilities into Opinions and Notes access controls, allowing read-only users to provide feedback

9 details in Everything

└──▷ BREAKING ON UPGRADE

!internal-export-file connectors now require a user with the Administrator role because they impersonate the requesting user during export
!Existing technical creators of entities are no longer mapped to history and display as SYSTEM; use the mass operations toolbar Update => Replace => Creator to recover creator information

5.3.17 Oct 9, 2022 · release notes

OpenCTI 5.3.17 adds entity merging controls, CVE alias support, and advanced report filters

└──▷ GET THIS VERSION

$ git clone --branch 5.3.17 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.17

Adds the ability to control how entities are merged during ingestion or manual operations
Adds aliases field support for CVE indicators to link multiple identifiers to a single CVE entry
Adds pre-export image filters allowing users to filter which objects appear in exported report images
Adds tree-view mode for Knowledge Graph objects when Force-directed layout is disabled
Adds filtering options for entity types within the Incident Global Kill Chain and Timeline views

+2 more show less

Adds relationships between observables directly within the context of a Report
Adds the ability to view Reports as nodes in the master graph

7 details in Everything

5.3.16 Oct 1, 2022 · release notes

OpenCTI 5.3.16 adds media content SCO support for social media and web articles.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.16 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.16

Adds MediaContent observable (SCO) type to model Twitter, Facebook, Telegram, and website article entities
Adds ability to export observables from an SDO's Knowledge page
Adds Rust to the default list of malware programming languages

3 details in Everything

5.3.15 Sep 23, 2022 · release notes

OpenCTI 5.3.15 adds manual enrichment control in the built-in editor

└──▷ GET THIS VERSION

$ git clone --branch 5.3.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.15

Adds Avoid automatic enrichment when editing in the built-in editor to prevent auto-triggered data collection

1 detail in Everything

5.3.12 Sep 11, 2022 · release notes

OpenCTI 5.3.12 adds STIX ID validation on ingestion and migrates GraphQL connector types

└──▷ GET THIS VERSION

$ git clone --branch 5.3.12 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.12

Extends the supported entity types for CSV feed imports.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!GraphQL connectors calling the API directly must update query definitions from string type to StixId type or face ingestion errors.

5.3.11 Sep 8, 2022 · release notes

OpenCTI 5.3.11 adds Spanish translation to the UI

└──▷ GET THIS VERSION

$ git clone --branch 5.3.11 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.11

└──▷ HOW TO FIND IT

Switch the platform interface to Spanish to assist Spanish-speaking analysts.

📍Navigate to Settings › Profile and select Spanish from the language dropdown.

Adds Spanish language support for the front-end user interface

1 detail in Everything

5.3.9 Sep 2, 2022 · release notes

OpenCTI 5.3.9 adds a Token auth bypass for 2FA and offline playground deployment.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.9 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.9

Enables local, offline deployment of the playground environment via new container configurations

1 detail in Everything

5.3.8 Aug 31, 2022 · release notes

OpenCTI 5.3.8 adds FIMI modeling, built-in 2FA, new observable types, bulk enrichment, worker-based sync, and several new connectors.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.8 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.8

└──▷ HOW TO FIND IT

Use the new built-in 2FA support for securing user accounts.

📍Enable via User Settings › Security › Two-factor authentication in the platform UI.

Adds rabbitmq:vhost config option for RabbitMQ configuration
Implements built-in two-factor authentication (2FA)
Migrates TLP support to TLPv2 Standard
Introduces Disinformation entity types (channel, event, language, narrative) and relationships for FIMI modelization
Adds new observable types: Payment Cards, Bank Accounts, and Phone numbers

+17 more show less

Enables bulk enrichment of compatible elements as a massive operation
Promotes observables to indicators via a new massive operation
Migrates the synchronization engine from background process to workers for performance gains
Adds data segregation in the history/audit log displayed in entities
Adds ability to filter on Observable type in the Knowledge view on a specific object
Adds ability to filter on relationship type in subscriptions
Enables displaying only reports in the latest analysis section on the dashboard
Adds Expand labels functionality in Investigations view
Allows clicking on TTPs matrix to create a new relationship
Increases the maximum number of results in global search
Renames attribute to column in CSV feed configuration for observables export
Includes all information about exported observables (including file name(s), hashes, etc)
Adds a search bar in graphs display
Enables filtering on reports in the latest analysis section on the dashboard
Adds new connectors for standalone MISP Feeds (JSON), Intel471, URLScan, Maltiverse, MWDB, Orange Cyberdefense
Improves ImportDocument connector
Improves VirusTotal and Splunk connectors

22 details in Everything

5.3.7 Jun 20, 2022 · release notes

OpenCTI 5.3.7 adds AWS IAM role support for MinIO and improved timestamp precision in UI forms

└──▷ GET THIS VERSION

$ git clone --branch 5.3.7 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.7

└──▷ USE IT

Configure MinIO integration to automatically retrieve credentials from an ECS task's IAM role.

shell

export MINIO_AWS_ARN_ROLE=arn:aws:iam::123456789012:role/my-minio-role

Enable EC2 metadata service for MinIO authentication when running on an EC2 instance.

shell

export EC2_METADATA_CREDENTIALS=true

Adds MINIO_AWS_ARN_ROLE environment variable to fetch MinIO credentials from an attached AWS ECS IAM Execution Role.
Adds EC2_METADATA_CREDENTIALS support for EC2 instance metadata service-based authentication with MinIO.
Enhances timestamp input fields in the UI to allow higher resolution entry (beyond just date selection).

3 details in Everything

5.3.6 Jun 15, 2022 · release notes

OpenCTI 5.3.6 adds RabbitMQ Quorum Queue support via RABBITMQ_QUORUM_ENABLED env var.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.6

Allow RABBITMQ_QUORUM_ENABLED environment variable to enable RabbitMQ Quorum Queues for increased fault tolerance
Revoked attack-pattern entities are now highlighted in the platform UI

2 details in Everything

5.3.3 Jun 10, 2022 · release notes

OpenCTI 5.3.3 enables artifact dependency resolution in the live stream

└──▷ GET THIS VERSION

$ git clone --branch 5.3.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.3

Adds artifact dependencies to the live stream when running in live mode

1 detail in Everything

5.3.2 Jun 3, 2022 · release notes

OpenCTI 5.3.2 adds configurable HTTP feed quotes, useful links in global knowledge, and double-click extension

└──▷ GET THIS VERSION

$ git clone --branch 5.3.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.2

Adds quotes configuration option to the HTTP Feed connector to allow removing quotes from ingested data
Extends Global Knowledge view with a new useful links section for quick navigation

2 details in Everything

5.3.1 May 26, 2022 · release notes

OpenCTI 5.3.1 adds Elastic EQL as an indicator type and improves CSV hash feed handling

└──▷ GET THIS VERSION

$ git clone --branch 5.3.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.1

Adds Elastic EQL as a new Indicator type for threat detection rules
Enhances CSV feeds to handle hashes attributes more effectively

2 details in Everything

5.3.0 May 23, 2022 · release notes

OpenCTI 5.3.0 adds custom CSV feeds, STIX 2.1 extension support in streams, and automatic observable extraction from indicators.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.3.0

x_opencti_* attributes are now mapped to a STIX 2.1 extension in the stream, replacing the previous flat attribute format for entities and relationships
Supports all object references in import and export operations, including resolves-to_refs, bcc_refs, and custom SROs
Adds a new global relationships list accessible under the data section of the UI for viewing inferred elements

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The SimpleObservable class is removed from the Python library; connectors must use native STIX 2.1 classes for observables
!All x_opencti_* attributes have moved into a STIX 2.1 extension in stream consumers (connectors/scripts); direct attribute access on entity/relationship objects will break
!The external history connector is removed and replaced by an internal history manager; it must be uninstalled from OpenCTI stacks

5.2.4 Mar 30, 2022 · release notes

OpenCTI 5.2.4 reintroduces custom MITRE and OpenCTI SROs and enforces lowercase hashes

└──▷ GET THIS VERSION

$ git clone --branch 5.2.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.2.4

Adds support for custom MITRE and OpenCTI Standard Reference Objects (SROs), restoring functionality removed in earlier minor versions.
Enforces lowercase normalization on hash values at the moment of creation, ensuring consistent casing for subsequent lookups.

2 details in Everything

5.2.3 Mar 25, 2022 · release notes

OpenCTI 5.2.3 adds missing STIX relationships and fixes confidence editing UX.

└──▷ GET THIS VERSION

$ git clone --branch 5.2.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.2.3

5.2.2 Mar 24, 2022 · release notes

OpenCTI 5.2.2 adds Splunk SPL to Indicator Pattern Type and enables deletion live stream publishing by default

└──▷ GET THIS VERSION

$ git clone --branch 5.2.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.2.2

Publish deletions by default in the live streams for connectors consuming OpenCTI events

1 detail in Everything

5.2.0 Mar 3, 2022 · release notes

OpenCTI 5.2.0 adds wantAssertionsSigned SAML option, campaign first_seen precision, and customizable dark/light themes

└──▷ GET THIS VERSION

$ git clone --branch 5.2.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.2.0

Adds wantAssertionsSigned configuration option in SAML settings to enforce signed SAML assertions.
Allows setting a precise first_seen timestamp when creating a Campaign entity via the API or UI.
Introduces fully customizable dark and light theme systems with label color controls in the UI.
Enables clicking on Knowledge timelines directly within the platform interface.

4 details in Everything

5.1.4 Feb 7, 2022 · release notes

OpenCTI 5.1.4 adds a VirusTotal download connector, stale work purge button, dynamic Elastic/OpenSearch loading, and OpenID first/last name support

└──▷ GET THIS VERSION

$ git clone --branch 5.1.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.1.4

Adds a new VirusTotal Download connector to ingest files from VirusTotal.
Introduces a Purge all stale works button in the connectors overview page to release Redis pressure.
Enables dynamic loading of ElasticSearch or OpenSearch clients based on the backend type detected at runtime.
Adds support for retrieving given_name and family_name fields from OpenID Connect identity providers.

4 details in Everything

5.1.3 Dec 27, 2021 · release notes

OpenCTI 5.1.3 adds multi-OIDC providers and performance fixes for massive reports.

└──▷ GET THIS VERSION

$ git clone --branch 5.1.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.1.3

Adds support for multiple OpenID Connect strategy providers to allow connecting to several identity sources simultaneously
Improves ingestion speed for massive reports containing large numbers of entities or observables

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The platform UI setting Base URL has been removed; use the base_url configuration key in your config file or the APP__BASE_URL environment variable instead.

5.1.2 Dec 7, 2021 · release notes

OpenCTI 5.1.2 adds revoked filter for indicators and freetext-to-txt import feature.

└──▷ GET THIS VERSION

$ git clone --branch 5.1.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.1.2

Add a revoked filter everywhere allows filtering indicators by the revoked attribute across all OpenCTI views

1 detail in Everything

5.1.0 Nov 29, 2021 · release notes

OpenCTI 5.1.0 adds retention policies, STIX bundle pre-validation, two new global config params, and custom dashboards.

└──▷ GET THIS VERSION

$ git clone --branch 5.1.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.1.0

Adds validate_before_import parameter to enable STIX 2.1 bundle pre-validation during manual or connector imports
Introduces two new optional global parameters (app:enforce_references and app:reference_attachment) to enforce external reference usage
Provides the ability to create retention policies based on filters in the settings workbench with a dedicated garbage collector system
Allows users to customize home dashboards using dashboards created in the workspaces workbench
Adds a new rule in the Rule manager for part-of relationships

+1 more show less

Enables search keyword filtering when exporting from list screens along with current page filters

6 details in Everything

5.0.3 Oct 21, 2021 · release notes

OpenCTI 5.0.3 displays full entity names in the UI.

└──▷ GET THIS VERSION

$ git clone --branch 5.0.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.0.3

Display the full name of an entity

1 detail in Everything

5.0.2 Oct 20, 2021 · release notes

OpenCTI 5.0.2 adds external reference enforcement config, Prometheus metrics endpoint, optional subscription scheduler, and UI enhancements.

└──▷ GET THIS VERSION

$ git clone --branch 5.0.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.0.2

└──▷ TRY IT

Verify that the metrics endpoint is exposed for Prometheus scraping.

$ curl -s http://<opencti-host>:80/api/metrics | head -n 5

Add reports to the master knowledge graph visualization to trace findings.

📍In the UI, open Knowledge › Graph and select Reports in the visualization settings.

Expose express server metrics for prometheus via a new metrics endpoint
Make subscription scheduler optional by default so SMTP configuration is no longer mandatory
Enforce external references on creation or modification via configuration for traceability
Add Reports to the master knowledge graph visualization
Enable datetime filtering in dashboards and timelines

5 details in Everything

5.0.1 Sep 27, 2021 · release notes

OpenCTI 5.0.1 adds SightingIncident rule, observable sorting via ElasticSearch runtime fields, and multitenancy support.

└──▷ GET THIS VERSION

$ git clone --branch 5.0.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.0.1

└──▷ HOW TO FIND IT

Use the UI to view or edit x_opencti_stix_ids on an entity, leveraging the new management capability.

📍In OpenCTI, navigate to the entity details page and look for the Manage x_opencti_stix_ids action in the sidebar menu.

Adds SightingIncident rule to automatically create incidents based on sightings for future case management.
Enables sorting observables by value, author, or marking definition using new ElasticSearch runtime fields (requires ES >= 7.12).
Adds UI capability to manage x_opencti_stix_ids for entities.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Requires ElasticSearch >= 7.12; OpenSearch/AWS are not compatible with this version due to the observables sorting feature.

5.0.0 Sep 14, 2021 · release notes

OpenCTI 5.0 adds feed subscriptions, custom dashboard widgets, and a configurable subscription scheduler config key

└──▷ GET THIS VERSION

$ git clone --branch 5.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 5.0.0

└──▷ TRY IT

Disable the new default subscription scheduler if no SMTP server is available.

$ SUBSCRIPTION_SCHEDULER__ENABLED=false

Disable the subscription scheduler via YAML configuration file.

json

{
  "subscription_scheduler": {
    "enabled": false
  }
}

Introduces feed subscription, bulletin, and digest capabilities for threat intelligence synchronization.
Adds subscription_scheduler.enabled config key in YAML format to control the default-enabled subscription manager feature.
Adds environment variable SUBSCRIPTION_SCHEDULER__ENABLED=false to disable the subscription scheduler on startup.
Adds dashboard widget support for listing entities, including an indicator lifecycle view.
Adds Tree Mode toggle in the Knowledge Graph UI when all forces are disabled.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The subscription manager is enabled by default; platforms without SMTP access must configure subscription_scheduler.enabled: false or set SUBSCRIPTION_SCHEDULER__ENABLED=false to prevent startup errors.

4.5.5 Jun 18, 2021 · release notes

OpenCTI 4.5.5 adds SAML SSO authentication and configurable LDAP group import.

└──▷ GET THIS VERSION

$ git clone --branch 4.5.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.5.5

Adds SAML standard support for Single Sign-On (SSO) authentication.
Adds LDAP attribute mapping configuration capability to sync user attributes from LDAP directories.
Adds LDAP Group import v2 for mapping LDAP groups to OpenCTI roles during synchronization.

3 details in Everything

4.5.4 May 31, 2021 · release notes

OpenCTI 4.5.4 adds global light theme with customization, moves enrichment to Stix-Core-Object, and adds bulk relationship creation

└──▷ GET THIS VERSION

$ git clone --branch 4.5.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.5.4

└──▷ HOW TO FIND IT

Customize the appearance of your OpenCTI instance by applying the light theme and configuring brand assets

📍1. In the UI, go to Settings › Appearance 2. Select light as the theme 3. Upload custom logo files and set primary color values in the Branding section

Export a visualization with a specific theme and transparent background for integration into reports

📍1. Open any visualization panel 2. Click Export 3. In the export dialog, select light theme 4. Toggle Transparent background on 5. Select output format (e.g., PNG/PDF)

Adds global availability of the light theme and allows organizations to customize colors and logos via UI settings for all instances
Adds ability to select theme and set transparent backgrounds for visualizations in export dialogs
Moves enrichment APIs and screens to the global meta entity Stix-Core-Object, covering both STIX Cyber observables and STIX Domain Objects
Adds bulk creation of relationships between similar objects

4 details in Everything

4.5.3 May 19, 2021 · release notes

OpenCTI 4.5.3 adds ARM/PPC Docker images, PNG/PDF UI exports, No Label filters, bulk report edits, and severity updates

└──▷ GET THIS VERSION

$ git clone --branch 4.5.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.5.3

└──▷ HOW TO FIND IT

Export your Kill Chain graph to PDF for offline reporting.

📍In the OpenCTI UI, navigate to a View or Graph and select Export as PDF from the menu.

Edit multiple indicator objects within a specific report context in bulk.

📍Open a Report, enter Edit mode, select multiple indicators, and use the bulk edit panel to update properties.

Adds Docker image support for ARM and PPC architectures
Enables exporting views, graphs, and dashboards to PNG and PDF from the OpenCTI UI
Adds ability to filter by No Label in the UI
Allows updating Vulnerability Severity and Availability Impact via the GUI
Allows editing Indicator valid_until field via the GUI

+1 more show less

Enables bulk editing of objects within a report context

6 details in Everything

4.5.1 May 13, 2021 · release notes

OpenCTI 4.5.1 adds a live streaming system with new Splunk KV Stores and ElasticSearch SIEM connectors.

└──▷ GET THIS VERSION

$ git clone --branch 4.5.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.5.1

└──▷ HOW TO FIND IT

Connect OpenCTI to a Splunk instance to stream observables for external analysis.

📍# Configure the splunk_kv_stores connector in your environment using the new live_streaming subsystem export CONNECTOR_ID=<connector_id> export CONNECTOR_NAME=splunk_kv_stores # Follow the connector README for specific KV store credentials and endpoint configuration

Push indicators to ElasticSearch using the new streaming architecture.

📍# Configure the elasticsearch_siem connector in your environment export CONNECTOR_ID=<connector_id> export CONNECTOR_NAME=elasticsearch_siem # Follow the connector README for ES cluster connection details

View the aggregated knowledge graph for a specific Threat Actor entity.

📍# Navigate to the Threat-Actor menu, select an actor, and view the Global Graph of Knowledge tab # This graph displays all entities and relationships from associated reports

Introduces the live_streaming subsystem enabling creation of event streams compatible with TAXII 2.1 collection semantics.
Adds the splunk_kv_stores connector to ingest data into a live stream via the new streaming system.
Adds the elasticsearch_siem connector to push observables to ElasticSearch through the new streaming infrastructure.
Refactors the tanium connector to utilize the new live streaming subsystem instead of its previous mechanism.
Enhances the synchronizer connector with support for true exchange communities built on top of OpenCTI instances.

+1 more show less

Adds global graphs of knowledge for each entity, gathering all associated entities and relationships from linked reports.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!MITRE and OpenCTI connector scopes have been modified; connectors may need re-authentication or scope updates in the target service.

4.5.0 Apr 29, 2021 · release notes

OpenCTI 4.5.0 adds artifacts upload, expandable external references panel, observable merging, and more TAXII filters

└──▷ GET THIS VERSION

$ git clone --branch 4.5.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.5.0

Expandable external references panel added to entity views
Merge Observables of the same type capability added to UI
Infrastructure added to Knowledge section of Threat Actors, Intrusion Sets and Malware
Detection attribute automatically disabled when an indicator has expired
Filter indicators by Detection value and by Score range in views

+6 more show less

Display of attribute Detection in entity details
TAXII module supports additional filters for exports
Incidents migrated to STIX 2.1 official entity standard
Azure AD integration supported for LDAP Group import
Bookmark items capability added
Configurable logon banner setting available

11 details in Everything

4.4.0 Apr 15, 2021 · release notes

OpenCTI 4.4.0 adds bulk actions, observable-to-indicator conversion, TTPs matrix viz, RabbitMQ SSL, client cert auth, and audit logs.

└──▷ GET THIS VERSION

$ git clone --branch 4.4.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.4.0

Adds app > app_logs > logs_level configuration key under the app_logs section to set application log level
Adds selectable date types in Advanced Search filters
Adds Top CVE Widget for monitoring recent vulnerabilities
Adds Export Indicators/Observables from Reports functionality
Adds checkbox to select all information in Data Curation module

+7 more show less

Adds login and administration audit log Activity view
Adds TTPs (Tactics, Techniques, Procedures) matrix visualization for entities and reports
Allows conversion of any observable to a STIX indicator via the interface
Enables editing Malware attributes directly in the interface
Supports bulk delete, labeling, and modification actions with monitorable background tasks
Adds Client Certificate Authentication as an authentication method
Adds support for RabbitMQ over SSL connections

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The application log level configuration path is now app > app_logs > logs_level instead of the previous location

4.3.5 Apr 7, 2021 · release notes

OpenCTI 4.3.5 adds user sessions management (view/kill) in the platform UI

└──▷ GET THIS VERSION

$ git clone --branch 4.3.5 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.3.5

Adds confirmation dialog when suppressing an entity from a graph panel.

1 detail in Everything

4.3.4 Mar 30, 2021 · release notes

OpenCTI 4.3.4 adds COOKIE_SECURE config handling, indicator sidebar actions, and graph hover details

└──▷ GET THIS VERSION

$ git clone --branch 4.3.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.3.4

Adds route to redirect any ID to the correct dashboard
Adds one-click clear and reverse election functions in the indicator type selection sidebar
Adds additional object details display when hovering over objects in the Knowledge Graph
Adds Display as view mode for reports created by an organisation in the UI
Makes organization display mode a user choice in the UI

5 details in Everything

└──▷ BREAKING ON UPGRADE

!If cookie:secure (COOKIE_SECURE) was configured to true, you must remove this configuration or set it to false.

4.3.2 Mar 29, 2021 · release notes

OpenCTI 4.3.2 adds TLS cert handling, session timeouts, workspaces for investigation graphs, and timeline filtering in knowledge graphs

└──▷ GET THIS VERSION

$ git clone --branch 4.3.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.3.2

Adds Basic Auth support for the TAXII API endpoint to allow authenticated data ingestion from TAXII servers
Adds configurable session timeout (default 20 minutes) as a new operational control over authentication sessions
Enables native TLS certificate handling allowing direct HTTPS connections without proxy workarounds
Introduces workspaces as a new UI feature for conducting investigations and pivots on platform knowledge
Adds timeline slider control to filter nodes and edges in the Knowledge graph visualizations

+1 more show less

Adds ability to disable or enable force-directed layout algorithms in the Knowledge graph via UI controls

6 details in Everything

4.3.1 Mar 23, 2021 · release notes

OpenCTI 4.3.1 adds Redis stream size limits, nested report graphs, and validity flags for indicators.

└──▷ GET THIS VERSION

$ git clone --branch 4.3.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.3.1

Adds a configurable option to limit the size of the OpenCTI Redis stream
Implements nested relations in report-generated knowledge graphs
Adds an external reference section to Threat Actor entities that is not clickable
Enables flagging objects (indicators, relationships) as invalid via the platform UI

4 details in Everything

4.3.0 Mar 11, 2021 · release notes

OpenCTI 4.3.0 adds force graph visualization and configurable entity position persistence

└──▷ GET THIS VERSION

$ git clone --branch 4.3.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.3.0

Adds save_graph_position capability to persist knowledge graph layout across page reloads

1 detail in Everything

4.2.4 Feb 25, 2021 · release notes

OpenCTI 4.2.4 adds TAXII 2.1 API endpoints and allows creating custom collections via the UI

└──▷ GET THIS VERSION

$ git clone --branch 4.2.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.2.4

└──▷ HOW TO FIND IT

Define a new custom collection filtered by specific entity types.

📍Navigate to Settings › Data Sources › TAXII, then click Create Collection and configure filters.

Adds TAXII 2.1 compliant API endpoints to expose OpenCTI as a TAXII server
Adds ability to create custom TAXII collections based on filters directly in the user interface

2 details in Everything

4.2.3 Feb 17, 2021 · release notes

OpenCTI 4.2.3 adds Countries and Sectors links to Organisation detail page right menu

└──▷ GET THIS VERSION

$ git clone --branch 4.2.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.2.3

└──▷ HOW TO FIND IT

Quickly navigate from an organisation record to view associated countries or sectors without searching.

📍In the console, go to any Organisation page and look for Countries and Sectors in the right-side menu.

Adds Countries and Sectors items to the right-side navigation menu on Organisation entity pages

1 detail in Everything

4.2.2 Feb 15, 2021 · release notes

OpenCTI 4.2.2 adds TAXII2, TheHive, AbuseIPDB, Malbeacon and URLhaus connectors.

└──▷ GET THIS VERSION

$ git clone --branch 4.2.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.2.2

Adds TAXII2 connector for production use.
Adds TheHive connector for production use.
Adds AbuseIPDB connector for production use.
Adds Malbeacon connector for production use.
Adds URLhaus (Abuse.ch) connector for production use.

5 details in Everything

4.2.0 Feb 11, 2021 · release notes

OpenCTI 4.2.0 adds marking-based data segregation, auto indicator lifecycle management, and advanced search operators.

└──▷ GET THIS VERSION

$ git clone --branch 4.2.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.2.0

Adds MarkingDefinition restriction to domain queries (data segregation) to isolate entity access by group
Adds automatic expiration of indicators when valid_until < now for out-of-the-box lifecycle management
Adds logical operators (OR, AND, etc.) in all filters for advanced search with tags

3 details in Everything

4.1.2 Feb 3, 2021 · release notes

OpenCTI 4.1.2 adds a Most Active Threats by Sector view to enhance threat intelligence analysis.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.1.2

└──▷ HOW TO FIND IT

Use this new view to quickly spot the most prevalent threat groups affecting a specific business sector within OpenCTI.

📍In the OpenCTI UI, navigate to the Threats section and select the Most active threats by sector widget or view.

4.1.0 Feb 1, 2021 · release notes

OpenCTI 4.1.0 adds custom dashboards, visualization widgets, and improved Elasticsearch index management.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.1.0

└──▷ HOW TO FIND IT

Visualize the most frequently observed malware in your platform.

📍Create a new dashboard via WebUI › Dashboards and add the Most Active Malware Widget.

Monitor threat actors driving activity in your environment.

📍Add the Top Actor Widget to your custom dashboard view.

Top Actor Widget for visualizing primary threat actors
Most Active Malware Widget to track the most frequently observed malware
Top CVE Widget to identify the most referenced vulnerabilities
Heat map widget for victimology analysis
Pin/Docking Navigation in WebUI for persistent dashboard layouts

+1 more show less

Custom dashboards and visualization widgets for following threats, victims, and entities

6 details in Everything

└──▷ BREAKING ON UPGRADE

!pagination now uses search_after instead of from, which may break queries relying on offset-based pagination behavior

4.0.6 Jan 11, 2021 · release notes

OpenCTI 4.0.6 adds configurable API max memory and exposes usage metrics in /about

└──▷ GET THIS VERSION

$ git clone --branch 4.0.6 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.0.6

└──▷ TRY IT

Increase OpenCTI's data ingestion capacity by raising the NodeJS memory limit before starting the API service.

$ API_MAX_MEMORY=8192000 docker-compose up -d opencti

Adds environment variable API_MAX_MEMORY to configure the NodeJS process memory limit for increased ingestion capacity
Exposes current memory usage metrics on the /about page for operational visibility

2 details in Everything

4.0.4 Dec 31, 2020 · release notes

OpenCTI 4.0.4 adds x_opencti_additional_names to File SCOs and fixes indexation merging for heavy loads.

└──▷ GET THIS VERSION

$ git clone --branch 4.0.4 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.0.4

Adds x_opencti_additional_names field to STIX Cyber Observable (SCO) Files
Enhances indexing and merging performance on platforms under heavy load

2 details in Everything

4.0.3 Dec 20, 2020 · release notes

OpenCTI 4.0.3 adds ISO 3166-1 country code support for entity linking

└──▷ GET THIS VERSION

$ git clone --branch 4.0.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.0.3

4.0.0 Dec 15, 2020 · release notes

OpenCTI 4.0 introduces STIX 2.1 data model migration, auto-enforcement control for Observables, and geographic mapping capabilities

└──▷ GET THIS VERSION

$ git clone --branch 4.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 4.0.0

auto-enrichment setting added to disable automatic enrichment of Observables via connector options.
Geographic maps and geo codes support for enhanced visualization of entity locations.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The data model and schema are updated to STIX 2.1; you cannot upgrade directly from V3.X data without running the migration procedure.
!Grakn Core Server is removed from the dependency stack and must no longer be deployed.
!ElasticSearch >= 7.10.X is now required.

3.3.1 Jun 5, 2020 · release notes

OpenCTI 3.3.1 adds MITRE Mobile ATT&CK support and Grakn 1.7.2 compatibility

└──▷ GET THIS VERSION

$ git clone --branch 3.3.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.3.1

3.3.0 May 28, 2020 · release notes

OpenCTI 3.3.0 adds indicator syntax validation, custom observable types, and vulnerability filtering to the UI

└──▷ GET THIS VERSION

$ git clone --branch 3.3.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.3.0

customized observable type field now available in admin settings when creating an observable, allowing users to define new types for their platform
Syntax validation is automatically applied to all imported or created indicators, rejecting invalid STIX patterns, YARA rules, SIGMA rules, Suricata signatures, and SNORT rules
Score and Severity fields are now filterable in the vulnerabilities view via the UI
Victimology views now include persons entities to enhance threat actor profiling

4 details in Everything

└──▷ BREAKING ON UPGRADE

!OpenCTI is no longer compatible with Grakn Core Server 1.6.2; the database must be upgraded to version 1.7.1

3.2.2 May 5, 2020 · release notes

OpenCTI 3.2.2 adds sightings for observables and indicators plus API pagination in client-python

└──▷ GET THIS VERSION

$ git clone --branch 3.2.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.2.2

Adds Sighting entities for observables and indicators, allowing origin attribution to an organization, person, or location per the STIX 2 standard.
Enables API pagination directly within *.list methods in the OpenCTI Python client library.

2 details in Everything

3.2.1 Apr 30, 2020 · release notes

OpenCTI 3.2.1 adds pre-schema migration directory and improves LDAP error logging

└──▷ GET THIS VERSION

$ git clone --branch 3.2.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.2.1

Introduces a new migrations directory for pre-schema initialization.
Improves LDAP authentication error logging.

2 details in Everything

3.2.0 Apr 28, 2020 · release notes

OpenCTI 3.2.0 adds knowledge history, granular filtering/export for indicators, and a refreshed UI with functional logs.

└──▷ GET THIS VERSION

$ git clone --branch 3.2.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.2.0

Adds a global knowledge history view available in all screens to track modifications and new relations using STIX 2 logging and dedicated connector tokens
Enables exporting indicators based on additional filters via the API
Introduces functional logs (comments) for all objects including relations, using the corresponding STIX 2.1 entity
Allows filtering indicators by name in the GraphQL API
Adds date filters to lists and exports everywhere in the platform

+4 more show less

Improves filtering and sorting capabilities for reports
Adds support for multiple authors for reports
Refreshes the global user interface across all screens
Implements syntax validation for observables

9 details in Everything

3.0.3 Mar 9, 2020 · release notes

OpenCTI 3.0.3 adds bulk data manager, indicator filter fields, tag ordering, duplicate merging, and CrowdStrike connector

└──▷ GET THIS VERSION

$ git clone --branch 3.0.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.0.3

Adds bulk data management for entities/relations (delete, merge, split, etc.) via GraphQL mutations.
Adds additional fields available for filtering indicators in the UI/API.
Adds support for sorting/tag ordering in list views.
Adds duplicate entity merging capability.
Introduces a new CrowdStrike (Falcon CTI platform) connector.

5 details in Everything

3.0.2 Feb 23, 2020 · release notes

OpenCTI 3.0.2 adds a first-release VirusTotal connector and enhances vulnerability entities with new attributes.

└──▷ GET THIS VERSION

$ git clone --branch 3.0.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.0.2

Adds first version of the VirusTotal connector for platform integration
Enhances vulnerability entities with CVSS3 attribute and external information support

2 details in Everything

3.0.0 Feb 19, 2020 · release notes

OpenCTI 3.0.0 adds RBAC system, LDAP/AD and OpenID auth strategies, max TLP config for connectors, and kill chain view

└──▷ GET THIS VERSION

$ git clone --branch 3.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 3.0.0

Adds Role-Based Access Control (RBAC) system allowing creation of roles with capabilities such as read knowledge, update knowledge, import, and manage accesses
Adds LDAP/AD and OpenID authentication strategies to enable enterprise-grade identity management
Introduces max TLP configuration option for enrichment connectors to prevent leakage of sensitive information
Adds Kill Chain view and implements Lockheed Martin Cyber Kill Chain in the data model

4 details in Everything

2.1.3 Jan 24, 2020 · release notes

OpenCTI 2.1.3 adds CSV/STIX2 entity export, logical filter operators, tagging, and Python API methods

└──▷ GET THIS VERSION

$ git clone --branch 2.1.3 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 2.1.3

└──▷ HOW TO FIND IT

Export campaign indicators in CSV format for offline analysis or reporting.

📍Use the UI to select a list of entities (e.g., campaigns) and choose Export -> CSV.

Filter indicators that match multiple criteria using logical operators.

📍In the Observables/Indicators filter panel, add filters and select OR or AND between them.

Adds the ability to export lists of entities (e.g., campaigns, intrusion sets, malwares) in STIX2 or CSV format.
Adds OR/AND boolean options to filters for Observables and Indicators.
Adds tagging support for Tools, Vulnerabilities, Observables, Reports, and other entity types.
Completes the refactoring of the Python library by adding previously missing methods on various entity types and introducing a file upload feature.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The Grakn Core Server dependency is upgraded from 1.5.9 to 1.6.2; the existing data migration process cannot be performed automatically even when using the Grakn Docker container.

2.1.2 Dec 21, 2019 · release notes

OpenCTI 2.1.2 adds indicator format support (STIX Pattern, Snort, Sigma, YARA), observables expiration/scoring, and inferences rules toggle via UI

└──▷ GET THIS VERSION

$ git clone --branch 2.1.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 2.1.2

Adds a new settings screen at /dashboard/settings/inferences to enable or disable inference rules globally, with inferences disabled by default.
Enables creation of indicators from observables across multiple detection formats: STIX Pattern, Snort, Sigma, YARA, and others.
Adds expiration date support for observables.
Adds scoring/rating capability to observables.
Switches all graphics and visuals to use ElasticSearch queries instead of the previous engine, improving performance.

+1 more show less

Improves relation search performance by using ElasticSearch where possible.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Inference rules are now disabled by default on the platform; users must explicitly enable them via the settings screen.

2.1.0 Dec 5, 2019 · release notes

OpenCTI 2.1 introduces observable relations, tags on creation, connector state reset, STIX2 export, global search param, and Att&CK code search.

└──▷ GET THIS VERSION

$ git clone --branch 2.1.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 2.1.0

└──▷ HOW TO FIND IT

Export your current OpenCTI data for bulk processing or backup.

📍# Triggered via UI: Dashboard › Export › All entities to STIX2 JSON

Jump directly to global search results from a bookmark or link.

📍https://your-opencti-instance.com/dashboard?search=malicious-domain.com

Search for ATT&CK techniques using their standardized codes (e.g., T1059).

📍# In the UI search bar or API query, simply type T1059 to find the technique.

Adds relation field to observables for linking hashes or IPs directly
Adds a tags field on all entity creation forms
Adds UI control to reset connector state
Adds export of all entities to STIX2 JSON format
Adds search parameter to global search URL

+1 more show less

Adds the id field to Attack Pattern entities in queries and UI

6 details in Everything

2.0.1 Oct 27, 2019 · release notes

OpenCTI 2.0.1 adds persistent state to connectors and improves search capacity

└──▷ GET THIS VERSION

$ git clone --branch 2.0.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 2.0.1

Adds simple state management for external import connectors like MITRE and CVE to retain state across restarts
Improves search engine capacity to handle larger datasets

2 details in Everything

2.0.0 Oct 24, 2019 · release notes

OpenCTI 2.0.0 introduces global tagging, standalone observables, file storage via Minio, and observable enrichment.

└──▷ GET THIS VERSION

$ git clone --branch 2.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 2.0.0

Add Global tagging system for applying tags across all entities
Introduce standalone observables as first-class entities
Implement observable enrichment to automatically enrich data from available connectors
Require Minio (S3-compatible) as the new file storage backend for imports, exports, and entity-linked files
Deprecate the standalone export worker; configuration now relies solely on OpenCTI API hostname and token for RabbitMQ parameters

+3 more show less

Redesign connector status page in the UI
Add Kill Chain Phase selection when creating or adding an observable
Support file attachment to reports

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Minio must be deployed and configured as a required component in the OpenCTI stack for file storage
!The export worker is deprecated and should be removed; use only one worker writing from RabbitMQ
!Connectors no longer accept RabbitMQ parameters in their configuration; these are now fetched via the OpenCTI API

1.1.2 Sep 5, 2019 · release notes

OpenCTI 1.1.2 adds relative path support for reverse proxies and Person overview details

└──▷ GET THIS VERSION

$ git clone --branch 1.1.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 1.1.2

Support of reverse proxy with relative path is added to enable deployment behind proxies using sub-paths
Adds Person overview details view to expose individual profile information in the UI

2 details in Everything

1.1.1 Aug 4, 2019 · release notes

OpenCTI 1.1.1 introduces ES 7 support and remembers view parameters.

└──▷ GET THIS VERSION

$ git clone --branch 1.1.1 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 1.1.1

ElasticSearch 6.X is no longer supported.
Remember views parameters for listing, sorting and searching
Speed-up statistics numbers on the dashboard

3 details in Everything

└──▷ BREAKING ON UPGRADE

!ElasticSearch 6.X is no longer supported.

1.1.0 Jul 22, 2019 · release notes

OpenCTI 1.1.0 introduces a new connector architecture, customizable report classes, and custom played roles.

└──▷ GET THIS VERSION

$ git clone --branch 1.1.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 1.1.0

└──▷ USE IT

Configure mandatory credentials to ensure OpenCTI starts successfully after upgrading to v1.1.0

yaml

docker-compose.yml
environment:
  PLATFORM_DEFAULT_PASSWORD: 'your_secure_password'
  PLATFORM_DEFAULT_TOKEN: 'your_secure_token'

Introduces docker-compose.yml environment variables or production.json configuration file to set the default password and token for platform startup
Adds Customizable report classes feature allowing users to define their own report class structures

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The integration process connectors_scheduler.py and the Docker image opencti/integration have been deleted and are no longer used
!Connectors are no longer configured and enabled in the user interface; they must be launched independently
!The platform will not start if the default password and default token are not configured in docker-compose.yml environment variables or production.json

1.0.2 Jul 7, 2019 · release notes

OpenCTI 1.0.2 adds expanding to report descriptions and more observable types

└──▷ GET THIS VERSION

$ git clone --branch 1.0.2 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 1.0.2

└──▷ HOW TO FIND IT

Navigate the expanded report description view in the OpenCTI UI.

📍In the console, go to Reports › [Report Name] and expand the description section.

Adds expanding functionality to the report description view
Extends import support to additional Observable types

2 details in Everything

1.0.0 Jun 28, 2019 · release notes

OpenCTI 1.0.0 adds first MISP connector, CSV export, subscriptions, and basic observables management

└──▷ GET THIS VERSION

$ git clone --branch 1.0.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:
$ git checkout 1.0.0

Adds ability to create a MISP connector via the new Create a MISP connector feature (#47)
Introduces connector template support (Create a connector template) for building new integrations (#46)
Enables CSV export of all entity lists via the implemented CSV export of all lists of entities (#23)
Adds subscription capability on any entity view with the subscriptions on any entity view feature (#17)
Implements basic observables management including schema implementation and unicity rules (#45, #54)

+1 more show less

Introduces observable scoring/rating functionality for entities (#57)

6 details in Everything

OpenCTI

Summary

How OpenCTI helps

Languages

Features

What OpenCTI offers you

release

release

example

release

example

release

release

release

example

release 36 total

example

release

release

release

example

example

release

release 11 total

docs

example

release

example

release

docs

example

release 111 total

docs

example 12 total

release 53 total

docs

example 8 total

release 30 total

example

release 28 total

example

release 22 total

example

release 25 total

release 17 total

example

release 11 total

docs

example

release 16 total

example

release 14 total

docs

example

release 14 total

example

release 13 total

example

release 15 total

example

release 10 total

docs

release 13 total

docs

release 13 total

example

release 10 total

example

release 10 total

example

release 11 total

example

release 12 total

release 11 total

release 9 total

example

release 8 total

example

release 8 total

example