https://cybertoolchain.io/tools/opencti New releases and features in OpenCTI, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 16:50:16 GMT https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261103.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261103.0 Tue, 03 Nov 2026 16:50:16 GMT OpenCTI adds Elasticsearch 9 support, global TLS verification switches, custom fields, mass workflow operations, and ingestion health checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control TLS certificate verification globally with new switches added to platform configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • OpenCTI now accepts a Filigran license installed as the platform license, in addition to the native OpenCTI license format. • OpenCTI now supports Elasticsearch 9 servers via a dual Elastic client. • Enable custom fields on entities through a new custom fields feature. • Apply mass operations on workflow status and playboks across multiple objects at once. • Form intake now supports deferred creation of objects — objects prepared in a form are not created until the form is submitted. • Ingestion health checks now include health settings and validation of users with incorrect capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261030.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261030.0 Fri, 30 Oct 2026 14:53:30 GMT OpenCTI adds dashboard variable restriction modes, Hub import for custom views, theme export, and manual security coverage updates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add dashboard variable restriction modes to control how variables can be used within dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Import custom views directly from the Hub using the new import-from-Hub button in custom views. • Export themes as part of configuration presets, allowing platform appearance settings to be packaged and shared. • Import a configuration bundle from the bootstrap wizard, enabling faster initial platform setup. • Manually update security coverage results, giving analysts direct control over coverage data without waiting for automated runs. • Use `pingConnector` in pycti to report connector errors back to OpenCTI for better connector health visibility. • Show full timestamps (date and time) instead of date-only in table views, with configurable display. • Restrict management of custom-field definitions to Enterprise Edition instances. • Prepare ingestion health monitoring (event type and scope filter values, email notifications, guards, service account checks, and UI) behind a feature flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261023.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261023.0 Fri, 23 Oct 2026 13:07:58 GMT OpenCTI 7.261023.0 upgrades the knowledge graph with SVG export, keyboard control, grouped nodes, and ingestion health monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports SVG export and higher-resolution image export from the knowledge graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables keyboard stroke control of knowledge graphs. • Groups objects of the same type together in the knowledge graph. • Improves graph behavior for filtered items with overall graph enhancements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261021.1 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261021.1 Wed, 21 Oct 2026 20:18:48 GMT OpenCTI 7.261021.1 adds Ask Ariane deck/report/video downloads, a config-preset export module, and graph surface upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ability to view and download decks, reports, and videos generated by XTM One directly inside the Ask Ariane chatbot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `config-preset` module with an export configuration drawer (in the Filigran Experience UI) that bundles and stores configuration as a downloadable ZIP, backed by a bypass-only storage root and an exportable types query. • Adds a parameter to XTM Hub browser messages for additional control over hub interactions. • Enables updating a manual security coverage result. • Adds custom field value management in playbooks and mass operations (chunk 7 of custom-fields rollout). • Elevates the graph experience across every graph surface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261019.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261019.0 Mon, 19 Oct 2026 15:07:28 GMT OpenCTI 7.261019.0 adds dashboard variables management UI and XTM One chatbot content proxying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds dashboard variables management UI and usage in widget filters for dynamic dashboard customization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Proxies decks, reports, and videos from XTM One into the embedded chatbot interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261016.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261016.0 Fri, 16 Oct 2026 11:41:13 GMT OpenCTI 7.261016.0 adds entity merging in knowledge view, Attack Pattern Matrix expand/collapse, defanged search, and conditional Fintel HTML generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports `defanged` as a search term in global search filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Allows merging entities directly from the knowledge view. • Enables automatic removal of HTML sections in generated Fintel reports when template variables are empty. • Improves layout of the description field on key objects such as Intrusion Sets, Malware, and Tools. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261014.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261014.0 Wed, 14 Oct 2026 14:47:20 GMT OpenCTI 7.261014.0 adds custom fields, dashboard variable foundations, enrichment from investigation graphs, and manual security-coverage results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds dashboard variables manifest foundations, including a GraphQL API and token resolution, enabling dynamic, parameterized dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Status` variable to FINTEL report templates. • Adds `external-ref`, `object-covered`, and `result-of` ref relationship types to 'in regards of' filters. • Supports manual creation of security coverage results from within the platform. • Adds custom fields capability to entities. • Enables enrichment from the investigation graph via a dev enrichment connector. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261002.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.261002.0 Fri, 02 Oct 2026 09:57:15 GMT OpenCTI 7.261002.0 adds chatbot quota visibility, 1-click investigation duplication, and a unified alerts/triggers notifications page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shows quota, prompts, and persisted message feedback in the embedded chatbot UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables 1-click duplication of investigations. • Splits alerts and triggers into separate sections within the notifications page. • Remaps user references held in stored filters when users are merged. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260811.0-lts.1 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260811.0-lts.1 Wed, 30 Sep 2026 14:27:14 GMT OpenCTI 7.260811.0-lts.1 switches map rendering to local PMTiles and adopts a FIPS 140-3 validated Docker base image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Replaces the external map tile server with local PMTiles rendering, eliminating the outbound dependency for map widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260930.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260930.0 Wed, 30 Sep 2026 07:43:49 GMT OpenCTI 7.260930.0 adds manual security coverage entities, TTP/vulnerability re-linking, and TAXII Client error visibility in the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds manual security coverage entity creation with entity selection, enabling practitioners to build and track coverage posture directly in the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables manual re-linking of behaviors (TTPs), vulnerabilities, and related entities to assess and refine security coverage. • Surfaces TAXII Client ingestion errors within the UI so operators can diagnose feed failures without leaving the platform. • Adds `min_version` and `max_version` fields to the V1 catalog schema to constrain connector compatibility by platform version. • Merging users now disables the source account, emits a merge trace, and closes accesses held by the merged-away account. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260928.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260928.0 Mon, 28 Sep 2026 14:05:38 GMT OpenCTI 7.260928.0 adds SSVC vulnerability prioritization, Indicator-to-Security-Platform sightings, ingestion logs, and investigation duplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `number_seen` and `max_distinct_count` counters to the Observed Data data model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ingestion logs across all ingestion types (feature flag removed, now always active). • Adds SSVC risk-based prioritization metrics aligned to CISA BOD 26-04 for vulnerability objects. • Supports 'sighting' relationships between an Indicator and a 'Security Platform' entity. • Supports duplicating an investigation. • Verifies Filigran-signed XTM licenses returned by XTM One registration and grants Enterprise Edition from the verified license. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260921.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260921.0 Mon, 21 Sep 2026 18:38:12 GMT OpenCTI 7.260921.0 adds News Feed integration support, Fintel column selection, and user-merge history reattribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds column selection for entity attributes in Fintel reports, letting analysts customize which fields appear in generated tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds News Feed support for OCTI integrations (excluding connectors), surfacing a new 'integration' resource type in the feed. • Extends user merge to re-point assignee and participant relations to the target user. • Extends user merge to rewrite history and activity attribution to the target user. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260917.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260917.0 Thu, 17 Sep 2026 15:28:39 GMT OpenCTI 7.260917.0 adds multi-OpenAEV security coverage, SSVC vulnerability prioritization, user-merge framework, and direct Fintel PDF export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds multi-OpenAEV security coverage results, enabling security coverage analysis across multiple OpenAEV sources simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Lands SSVC risk-based prioritization metrics for vulnerabilities behind a feature flag, introducing exploit-driven risk scoring to the vulnerability workflow. • Introduces a user-merge framework with dry-run/run modes, a handler registry, scalar user reference rewriting, RBAC rights merging, and union/strict merge options. • Simplifies Fintel export by generating PDF directly from HTML without an intermediate step, streamlining intelligence report delivery. • Exposes lock acquisition wait and contention metrics via telemetry to surface backend lock pressure. • Adds workflow publish actions that create and resolve Status objects on state transitions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260914.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260914.0 Mon, 14 Sep 2026 13:41:08 GMT OpenCTI 7.260914.0 adds configurable keep-alive/headers timeout to prevent intermittent 502s behind ALB/ECS load balancers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds configurable keep-alive and headers timeout settings for deployments behind a load balancer (ALB/ECS) to prevent intermittent 502 errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260910.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260910.0 Thu, 10 Sep 2026 13:59:26 GMT OpenCTI 7.260910.0 adds ingestion logs for RSS, JSON, and stream feeds plus S3 offload metrics for event streams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds metrics and logging for stream events offloaded to S3, giving operators visibility into event offload activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ingestion logs for RSS feed ingestion, enabling operators to audit and troubleshoot RSS-based data pulls. • Adds ingestion logs for JSON feed ingestion, enabling operators to audit and troubleshoot JSON-based data pulls. • Adds ingestion logs for stream feed ingestion, enabling operators to audit and troubleshoot stream-based data pulls. • Integrates the Filigran design system V1 into the UI, introducing updated visual components including a Slider input. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260907.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260907.0 Mon, 07 Sep 2026 13:19:29 GMT OpenCTI 7.260907.0 adds entity creation inside investigation graphs, FIPS 140-3 Docker images, ingestion logs for CSV feeds, and connector activity logging. • Adds a 'Create Entity' button to the investigation graph and the add-entity drawer, enabling analysts to create new entities without leaving an investigation. • Adopts the FIPS 140-3 validated `python-nodejs-fips` base image for the Docker deployment. • Adds ingestion logs for CSV feeds, surfacing feed-level activity for operators monitoring data ingestion. • Adds activity logging for managed connector configuration updates. • Adds a new workflow UI applied across all entity types. • Adds a `revoked` filter option in technical views for Courses of Action and related entities. • Adds `CURRENT ENTITY` option in ID filters of 'in regards of (dynamic)' sub-filters, enabling self-referential dynamic filter rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260904.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260904.0 Fri, 04 Sep 2026 11:09:56 GMT OpenCTI 7.260904.0 derives session signature keys from the app encryption key for stronger session security. • Session signature key is now derived from the app encryption key, tying session integrity to the platform's existing encryption configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260902.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260902.0 Wed, 02 Sep 2026 16:07:46 GMT OpenCTI 7.260902.0 adds a merge-users capability with feature flag, API surface, and bypass enforcement. • Adds merge-users feature with a feature flag, API surface, and bypass enforcement for user account consolidation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260901.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260901.0 Wed, 02 Sep 2026 08:20:07 GMT OpenCTI 7.260901.0 adds workflow status sync via streams, built-in Filigran themes, and a new vulnerability module. • Adds workflow release status synchronization by name through streams, enabling cross-instance status propagation without manual mapping. • Introduces built-in Filigran themes, giving teams out-of-the-box branded UI options without custom theme configuration. • Adds a new vulnerability module to the data model, expanding structured tracking of vulnerability entities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260828.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260828.0 Fri, 28 Aug 2026 12:21:15 GMT OpenCTI 7.260828.0 adds human-in-the-loop AI approval, new vulnerability propagation rules, a Score field on key entities, and map widget export. • Adds human-in-the-loop tool approval in Ask Ariane, requiring analyst confirmation before the chatbot executes tool calls. • Adds new inference rule deriving 'System has Vulnerability' from 'System uses Software' + 'Software has Vulnerability' relationships. • Adds new inference propagation rule linking vulnerabilities to Infrastructure through used software. • Adds a `Score` field to Threat Actor, Intrusion Set, Malware, Incident, and Event entities. • Replaces the external map tile server with local PMTiles rendering, removing the external network dependency for map display. • Enables export of map widgets from dashboards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260824.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260824.0 Mon, 24 Aug 2026 17:57:14 GMT OpenCTI 7.260824.0 adds One-Pager mode for Fintel reports, score fields on Incidents and Events, S3 offloading for large stream events, and experimental cross-platform Status sync. • Adds experimental Status sync between OpenCTI platforms via live streams, laying groundwork for cross-platform workflow state propagation. • Stores large stream event messages to S3 instead of Redis, removing Redis size constraints for high-volume stream deployments. • Splits STIX bundles in Node.js before pushing to the worker queue, reducing worker-side processing overhead for large bundle imports. • Adds a `score` field to the Incident data model, enabling confidence/severity scoring on Incident objects. • Adds a `score` field to the Event data model, enabling confidence/severity scoring on Event objects. • Introduces One-Pager mode for Fintel reports, making first and back cover pages optional for single-page intelligence products. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260817.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260817.0 Mon, 17 Aug 2026 13:37:04 GMT OpenCTI 7.260817.0 adds score field to Threat Actor Group, Intrusion Set, and Malware entity types. • Adds `score` field to the Threat Actor Group data model entity type. • Adds `score` field to the Intrusion Set data model entity type. • Adds `score` field to the Malware data model entity type. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260811.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260811.0 Tue, 11 Aug 2026 15:56:02 GMT OpenCTI 7.260811.0 adds mass-operation support for updating relation start/stop times via background tasks. • Enables bulk updating of relation `start_time` and `stop_time` fields via mass background-task operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260807.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260807.0 Fri, 07 Aug 2026 12:49:02 GMT OpenCTI 7.260807.0 adds shareable saved searches, reusable saved filters in dashboards, XTMHub integration, and Lucene wildcard/fuzzy search. • Adds TAXII feed tabs to the ingestion UI for improved feed management. • Adds Admin UI (Settings) for custom fields configuration (Chunk 2 of custom-fields feature). • Enables shareable and reusable saved searches across the platform. • Enables reusable saved filters inside dashboards and custom views. • Adds XTMHub connectivity — connect to Hub directly from the OpenCTI interface. • Adds support for Lucene advanced search syntax including wildcard prefix (`*`) and fuzzy search (`~`) operators. • Preserves user-defined label casing, removing automatic `text-transform: capitalize` on labels. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260803.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260803.0 Mon, 03 Aug 2026 16:18:17 GMT OpenCTI 7.260803.0 adds stop-operation control for data sanity tasks and improved HTTP header management. • Improves HTTP header management in the Express layer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260728.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260728.0 Tue, 28 Jul 2026 16:34:19 GMT OpenCTI 7.260728.0 ships a full draft approval workflow engine, XTM Hub integration, TAXII error visibility, OAuth SMTP dynamic tokens, and audit log session tracking. • Introduces a complete draft approval workflow engine: define, visualize, and apply workflows via a ReactFlow graph UI, with filter-based conditions, async task actions, schema validation on save, auto-save/publish, and synchronous/asynchronous transition reactions. • Adds draft workspace metadata (participants, assignees, description, creator) and the ability to filter, edit, and visualize draft details directly in the drafts list. • Connects OpenCTI to XTM Hub, enabling integrations to be discovered and connected directly from the Hub into OpenCTI. • Reworks the integrations UI with a pipeline ribbon, aligned lines view, config import, facets, sorting, and next-run visibility. • Reworks the Filigran Experience settings screen with hero-style Enterprise Edition and XTM Hub cards. • Surfaces TAXII Client ingestion errors directly in the UI so operators can diagnose feed failures without inspecting backend logs. • Records user session IDs in `user_metadata` within audit logs for improved session-level traceability. • Adds ability to read audit and log entities via the Python client (`pycti`). • Supports dynamic token refresh for OAuth-based SMTP authentication. • Enables SSO IdPs to use a hybrid Group and Organization mapping strategy. • Restricts workflow restrictions and actions to Enterprise Edition. • Allows administrators to define a default template for Fintel exports. • Adds info logs to support packages for richer diagnostics. • Workflow actions can now run asynchronous tasks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260722.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260722.0 Wed, 22 Jul 2026 13:17:36 GMT OpenCTI 7.260722.0 adds a faceted connector marketplace, workflow reset, webhook deny-lists, admin-forced password changes, and auto-reloading public dashboards. • Redesigns the connector catalog into a faceted marketplace experience for easier discovery and filtering. • Adds ability to fully reset a workflow to its initial state. • Adds a configurable deny-list of URIs for webhooks to block outbound calls to restricted endpoints. • Enables admins to force a password change for any user account. • Adds auto-reload support for public dashboards so shared views stay current without manual refresh. • Improves CSV export with selectable visible columns, filtering the export to only those columns. • Adds light mode support in the GraphQL playground. • Replaces the legacy HTML editor with the current editor, removing associated feature flags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260715.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260715.0 Wed, 15 Jul 2026 19:14:51 GMT OpenCTI 7.260715.0 adds connector log TTL and ingestion history in Redis, plus authentication validity policy improvements. • Adds connector logs TTL and ingestion history storage in Redis for improved connector observability. • Improves the authentication validity policy update workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260710.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260710.0 Fri, 10 Jul 2026 13:27:03 GMT OpenCTI 7.260710.0 adds admin-forced password resets, Custom Views date ranges & attribute widgets, OAuth SMTP dynamic tokens, and security coverage custom views. • Enables admins to force a password change for users via a new authentication capability. • Adds date range configuration directly within Custom Views on entity pages. • Adds an attribute widget for Custom Views. • Extends Custom Views to the security coverage section. • Supports dynamic token (OAuth) for SMTP email configuration. • Renames connector catalog statuses from 'Verified'/'Unverified' to 'Supported by Filigran'/'Supported by Community'. • Adds telemetry for shared saved filters. • Adds search-engine crawler blocking to prevent web-site indexing of the platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260309.0-lts.6 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260309.0-lts.6 Thu, 09 Jul 2026 11:44:12 GMT OpenCTI 7.260309.0-lts.6 improves automatic enrichment on element creation/update and enhances JSON mapper regex extraction. • Improves automatic enrichment triggered on creation or update of elements. • Enhances JSON mapper extraction with improved regexp support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260706.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260706.0 Mon, 06 Jul 2026 16:46:11 GMT OpenCTI 7.260706.0 ships a native MCP server, STIX security-coverage export, custom newsfeed views, and richer telemetry. • Adds a native Model Context Protocol (MCP) server with Streamable HTTP transport, exposed through XTM One and surfaced in the user profile. • Enables export of security coverage data to STIX format. • Supports custom views as a resource type in the newsfeed. • Adds `TELEMETRY_TAGS` deployment dimensions and tracks active connectors by catalog identity. • Extends telemetry to cover full AI usage and product adoption metrics, including workflow publish counts. • Maintains telemetry visibility for managed connectors absent from the catalog using a registry-stripped image identity. • Introduces a data sanity manager as an alternative to certain database migrations. • Improves JSON mapper extraction with enhanced regexp support. • Enhances notification access control for workflow recipients. • Improves the engine retry mechanism for greater resilience. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260701.0 Wed, 01 Jul 2026 14:44:20 GMT OpenCTI 7.260701.0 adds XTM Hub custom view deployment, stream URI deny lists, ES health monitoring, and workflow transition comments. • Enables deploying custom views received from XTM Hub directly into OpenCTI. • Adds a configurable deny list of URIs to block during stream ingestion. • Adds an Elasticsearch engine health monitor to surface ES issues proactively. • Supports adding comments on workflow transitions and viewing them in the UI, with notifications sent to assignees and participants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260626.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260626.0 Fri, 26 Jun 2026 17:58:21 GMT OpenCTI 7.260626.0 adds drafts to dashboard filtering and restricts AI agent 'run as' selection. • `playbook` now restricts the AI agent `run as` selection option to only current users and service accounts. • Dashboards can now filter entities by draft status, exposing `DraftWorkspace` in visualisations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260626.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260626.0 Fri, 26 Jun 2026 17:58:21 GMT OpenCTI 7.260626.0 adds draft filtering in dashboards, a new text editor, and tightened AI playbook agent controls. • Adds drafts as filterable entities in dashboard widgets, enabling visualizations and metrics over draft workspaces. • Restricts the 'AI agent run as' selection in playbooks to the current user and service accounts only, tightening execution scope. • Replaces the legacy text editor with a new editor solution across the platform. • Enables entity lookup with on-the-fly creation in form intakes for users who have only create/update-in-draft permissions, without triggering a full creation process. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260624.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260624.0 Wed, 24 Jun 2026 13:43:39 GMT OpenCTI 7.260624.0 adds trust proxy config, CTEM shortcut, bulk playbook enrollment, and streaming filters • Adds `TRUST_PROXY` environment variable to control IP whitelisting behavior when behind a reverse proxy. • Adds a new "CTEM Command Center" shortcut in the top bar for users with an XTM One connection. • Enables bulk enrollment of entities into playbooks via the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260624.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260624.0 Wed, 24 Jun 2026 13:43:39 GMT OpenCTI 7.260624.0 adds bulk playbook enrollment, has/not-changed stream filters, CTEM shortcut, and trust-proxy IP whitelisting config. • Adds trust proxy configuration for IP whitelisting, enabling accurate client IP resolution when OpenCTI sits behind a reverse proxy. • Adds a CTEM Command Center shortcut to the top bar when XTM One is connected. • Adds a feature flag to revert to the old rich text editor alongside the new @filigran/rich-text-editor component. • Adds dynamic user resolution in the playbook 'send to notifier' component, allowing recipients to be resolved at runtime. • Adds has/not-changed attribute filtering operators for playbook and stream filtering components. • Enables bulk enrollment of entities into a playbook with smart filtering. • Streamlines Autonomous System creation by auto-populating the AS number from the Autonomous-System name during ingestion. • Renames validated draft's status label to 'Validation progress' in the draft workflow UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260619.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260619.0 Fri, 19 Jun 2026 13:19:20 GMT OpenCTI 7.260619.0 adds IP allow-list config, playbook 'run as' user, saved filter sharing, bulk limit to 150, and Hub import CTA • Adds `security.cidr_allow_list` configuration key to control access for login and public information • Adds a 'run as' user selection option on AI agent playbook components to specify the execution identity • Adds the ability to share saved filters with other users, groups, or organizations via the UI • Increases the bulk creation object limit to 150 objects per operation • Adds an 'import from Hub' call-to-action button on the Playbooks library screen in the Hub interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260615.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260615.0 Tue, 16 Jun 2026 07:48:23 GMT OpenCTI 7.260615.0 adds auto-reload to custom dashboards, News Feed playbooks, security coverage metrics in has-covered view, and multi-conversation history for Ask Ariane • Adds auto-reload for custom dashboards so they refresh automatically without manual page reloads. • Enables 'News Feed' as a playbook source type, allowing playbooks to trigger on incoming feed entries. • Adds security coverage metrics to the 'has-covered' relationship view for deeper analysis of security controls. • Adds multi-conversation history and mid-run steering support for the Ask Ariane feature in XTM One. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260609.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260609.0 Tue, 09 Jun 2026 18:44:10 GMT New UI options for SSL feed verification, password policy display, and custom no-access error messages. • Adds `rejectUnauthorized=true` as the default for feeds and a new UI option to enable SSL verification control • Displays the active password policy on the reset password screen • Allows customization of the error message shown when a user has no group access Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260604.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260604.0 Thu, 04 Jun 2026 10:28:56 GMT OpenCTI 7.260604.0 adds configurable ingestion deny lists, retention policy activity tracking, form intake default values, and XTM One file downloads. • Adds active/inactive status to Retention Policies with telemetry for monitoring rule activity Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260529.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260529.0 Fri, 29 May 2026 20:31:02 GMT OpenCTI 7.260529.0 adds XTM Hub newsfeed integration, one-click playbook deployment, and 'Send to AI' playbook component. • Adds ability for users to receive newsfeeds from the XTM Hub for new custom dashboards uploads • Integrates XTM Hub Newsfeed into the platform • Adds one-click deployment of playbooks from the XTM Hub • Adds 'Send to AI' as a playbook component to transform STIX bundles with an AI agent Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260527.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260527.0 Wed, 27 May 2026 17:08:03 GMT OpenCTI 7.260527.0 adds per-IP/user-agent rate limiting and bulk playbook enrollment • Adds rate limit threshold configuration applied per IP and per user-agent for API requests • Enables bulk enrollment of entities into playbooks via the new `bulk_enroll` mutation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260522.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260522.0 Fri, 22 May 2026 12:20:17 GMT OpenCTI 7.260522.0 adds news-feed toast notifications and saved filters API sharing • Adds automatic cleanup of old XTMHub news feed items (older than 6 months) • Adds toast notifications for new unread items in the news feed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260520.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260520.0 Wed, 20 May 2026 14:22:55 GMT OpenCTI 7.260520.0 adds custom views, knowledge manipulation target scope, and sharing filters for cyber tooling workflows • Adds `targetScope` field to Playbook knowledge manipulation components to specify whether changes apply to 'all elements', 'main element only', or 'all except main element' • Extends decay rule filtering with new pattern type, author, and marking criteria options Breaking changes: • The `CUSTOM_VIEW` feature flag has been removed; custom views are now always enabled Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260513.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260513.0 Wed, 13 May 2026 14:58:19 GMT OpenCTI 7.260513.0 adds paginated XTMHub news feed tab and parallel initial checks • Adds a new UI tab displaying paginated news feed items for XTMHub subscribers • Improves performance by running initial validation checks in parallel during startup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260512.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260512.0 Tue, 12 May 2026 16:39:51 GMT OpenCTI 7.260512.0 adds structured agents instructions, interruptible managers, skips ES recovery for filtered live streams, and removes a security coverage feature flag • Adds `structured_agents_instructions` to the AI configuration for customizing LLM system prompts. • Enables manager interruption during shutdown via a new interruptible timer mechanism. • Skips Elasticsearch recovery logic when live streams are configured with origin filters. • Removes the feature flag gating the security coverage result page, making it permanently available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260507.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260507.0 Thu, 07 May 2026 15:05:56 GMT OpenCTI 7.260507.0 adds origin-based filtering to live streams and UBI 9 container support. • `origin` parameter added to live stream subscriptions for filtering events • Platform and worker Docker images now support UBI 9 as the base OS Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260506.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260506.0 Wed, 06 May 2026 16:02:28 GMT OpenCTI 7.260506.0 adds an API endpoint for SCO consistency cleanup, XTM Hub newsfeeds support, and Security Coverage relations for Indicators/Artifacts • Adds `Add XTM Hub newsfeeds preferences to user profile`, enabling users to configure their newsfeed subscriptions via the UI • Adds `has-covered` relations between Security-Coverage entities and both Indicator and Artifact objects Breaking changes: • The user profile key mapping now uses `publicJWK` instead of the previous `publicKey` format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260430.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260430.0 Thu, 30 Apr 2026 18:56:27 GMT OpenCTI 7.260430.0 adds STIX 2.0 SMO support in the converter and XTM One integration for AI Insights • `STIX 2.0 converter` now supports Security Missing Object (SMO) types • Integrates `XTM One` agent selection and summary generation into `AI Insights` Breaking changes: • The `pysigma` library has replaced the deprecated `sigmatools` library for SIGMA rule validation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260428.0 https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260428.0 Tue, 28 Apr 2026 15:03:22 GMT OpenCTI adds STIX 2.0 SRO conversion support and improves security coverage result display • Adds `SRO` handling in the STIX 2.0 converter for serialized reference objects • Removes feature flag to permanently enable enhanced security coverage results on the result page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/opencti