Version 7.260901.0

Enhancements:

• #7462 feat(macadress): add macadress.com MAC address enrichment connector
• #7442 feat(intel471-hunt): add Intel 471 Hunter internal enrichment connector
• #7347 feat(scanmalware): add ScanMalware external import connector
• #7346 feat(scanmalware-enrichment): add ScanMalware internal enrichment connector
• #7282 feat(group-ib): migrate connector to be "manager_supported"
• #7183 feat(pan-cortex-xdr-intel): implement settings and minimal listen_stream runtime wiring
• #7182 feat(pan-cortex-xdr-intel): bootstrap bare skeleton and freeze concrete class contracts
• #7130 feat(qualys-cve-enrichment): migrate connector to be "manager_supported"

Bug Fixes:

• #7494 fix(import-document): connector fails to start in INTERNAL_ANALYSIS mode due to strict CONNECTOR_TYPE validation
• #7480 fix(intel471-hunt): bump pycti to 7.260828.0
• #7393 fix(import-document): unresolvable created_by_ref resolved to literal "Restricted" breaks bundle construction — import fails instead of omitting the optional ref
• #7178 fix(mitre-attack): connector silently drops all entities as entities_types=connect_scope is used as a STIX type filter
• #7133 fix(connector-cve): CVSS 3.0 vectors not visible after 15 June fix (example CVE-2025-0182)
• #7012 fix(connectors-sdk): ListFromString parser doesn't filter empty values
• #5835 fix(recorded-future): email address indicators not mapped and missing after ingestion

---

Pull Requests:

• feat(qualys-cve-enrichment): migrate connector to manager-supported mode (#7130) by Hugo Dupras (@jabesq) in #7341
• feat(group-ib): migrate connector to manager-supported mode (#7282) by Hugo Dupras (@jabesq) in #7330
• fix(connectors-sdk): ListFromString parser doesn't filter empty values (#7012) by Sanjay Santhanam (@Sanjays2402) in #7145
• feat(intel471-hunt): add Intel 471 Hunter internal enrichment connector (#7442) by Marcin Molenda (@mmolenda) in #7443
• feat(scanmalware-enrichment): add ScanMalware internal enrichment connector (#7346) by Jonas Lejon (@jonaslejon) in #7348
• feat(scanmalware): add ScanMalware external import connector (#7347) by Jonas Lejon (@jonaslejon) in #7349
• feat(macadress): add macadress.com MAC address enrichment connector (#7462) by Samy (@samymassoud) in #7463
• fix(import-document): replace 'Restricted' with 'None' when processing a STIX entity associated with a 'Restricted' organization' (#7393) by Romain GUIGNARD (@romain-filigran) in #7479
• fix(deps): update dependency pycti to v7.260828.0 by renovate[bot] in #7482
• fix(intel471-hunt): bump pycti to version 7.260828.0 (#7480) by Romain GUIGNARD (@romain-filigran) in #7481
• fix(cve): preserve cvss 3.0 vector string so cvss3 filters match (#7133) by Thibaut Rouxel (@throuxel) in #7440
• fix(mitre-attack): stop overriding CONNECTOR_SCOPE with invalid STIX type value (#7178) by Hugo Dupras (@jabesq) in #7459
• fix(recorded-future): map email address indicators to STIX email-addr observables (#5835) by Hugo Dupras (@jabesq) in #7432
• fix(import-document): allow INTERNAL_ANALYSIS connector type (#7494) by Helene Nguyen (@helene-nguyen) in #7496

New Contributors:

• Sanjay Santhanam (@Sanjays2402) made their first contribution in #7145
• Jonas Lejon (@jonaslejon) made their first contribution in #7348
• Samy (@samymassoud) made their first contribution in #7463

Full Changelog: 7.260828.0...7.260901.0