Skip to content

Version 5.12.0
Compare
Choose a tag to compare
@Filigran-Automation Filigran-Automation released this 04 Dec 14:56
· 1061 commits to master since this release
5.12.0
e45ce6d
This commit was signed with the committer’s verified signature.
Filigran-Automation Filigran Automation
GPG key ID: C708FDB840E80D34
Learn about vigilant mode.

Dear community, we're delighted to announce the release of OpenCTI 5.12.0 🥳! This milestone marks a turning point for the platform, both in terms of the new features it brings and the bugs it fixes, as well as the improvements in system resource utilization and performance 🚀.

⚠️Breaking change in the list filters system in the API (and the Python library) ⚠️

First of all, in order to support more complex search and filtering use cases such as grouping, this version introduces a major breaking change in the way list filters are built 🔍. If you have specific integrations that use the Python library or the GraphQL API, please read the migration documentation carefully 👁️‍🗨️.

This filters enhancement will continue in future versions, but now allows you to switch logical operators (AND and OR) between two groups or within a group. Also, on several text fields it is now possible to use new modes such as "starts with / ends with" 🎉. The new filter syntax unlocks the most advanced uses of knowledge retrieval, including the ability, for example, to filter threats according to country AND sector (targeting both) 🧬.

OpenCTI 5.12 also introduces the import / export of dashboards and widgets within dashboards, as well as the export of audit logs in CSV format🗄️. Generally speaking, the data export experience has been greatly enhanced, with the introduction of several buttons to make it more fluid. You can easily convert a graph into an investigation and vice-versa, add entities to a report with their relationships, and so on 🗜️.

In OpenCTI Enterprise Edition, a new feature now enables direct indexing of raw documents (PDF, HTML, DOCX, etc.), whose content becomes immediately accessible in the global search 🚄. This is a long awaited feature which definitely solves multiple challenges if the data is not correctly extracted / modelized. It also paves the way for the platform's future integrated NLP system 🎊.

We also have started to introduce a new ACL system at the entity level (like in dashboards and investigations) for Feedback and will expand it in the future to all STIX objects. Finally, this version contains various user experience enhancement on colors usage, light theme and overall navigation. We will carry on the hard work to make the platform more accessible and user friendly all over the upcoming releases ✈️.

Last but not least many connectors have been developed and enhanced in 5.12, especially HarfangLab, Tanium, Microsoft Sentinel, Mandiant and Recorded Future but also a bunch of community additions. Thank you everyone for your help, your feedback and your great contributions 🙏.

Enhancements:

  • #5029 Improve CPU usage of elastic/open.search results parsing
  • #5005 Improve auditing to split file read and file download
  • #4982 Move top menu of entities in tabs
  • #4913 [Dashboard] The colours of the labels do not match
  • #4902 Improve the "click to download file" in lists
  • #4883 Add the possibility to download a file as an Encrypted archive in the Export list panel
  • #4804 Avoid upserting an filled attribute with something null
  • #4765 Display a "By Filigran" logo on login page and on all pages of the app
  • #4636 Why is there a limit of 5000 entities in a csv feed?
  • #4536 Modifying Schema for filter of feed/taxii/stream
  • #4505 CSV column mapping when a column can have different representations
  • #4494 Enrich activity logging capabilities to cover more use cases
  • #4484 In the live stream, add NOT operator filter for “observable type”
  • #4455 Align search panel in Investigation with others in the platform
  • #4405 Searching in knowledge graph should not make nodes disappearing but just grey them
  • #4201 Add a "Indicators propagation in reports" rule in the rule engine
  • #4124 Implement checkboxes on "Observations / Infrastructure" list
  • #3631 Be able to download user analytics (audit / history) in JSON or CSV
  • #3532 Harmonize behavior of fields in the Settings => Activity => Configuration
  • #3242 Export/Import Custom Dashboard (and Widget)
  • #3181 Extend authorized_members ACL system to Feedbacks
  • #3165 Refactor filters display everywhere.
  • #2695 Add dst_ref and src_ref properties in networktraffic or networktrafficadd object.
  • #2686 Full refactor of filtering and searching using grouping / operators / fuzzy filters
  • #2515 Enhance export buttons
  • #2510 In users overview, create an analytics table with KPIs and data stats / health
  • #1680 Information on how the research field works needed
  • #1483 Full text search for documents

Bug Fixes:

  • #5062 When opening a filter for the first time, focus is not taken
  • #5039 Can't remove search keyword from Global Search
  • #5015 Error: Enabling photo on for image carousel on Threat Actor
  • #5014 No more relationship redirection in Data>relationships
  • #4992 Fail to remove element with unfinished works
  • #4981 Rules engine use 100% CPU in some circumstances
  • #4969 Activity audit update events for the same entity are mixed up
  • #4965 In Knowledge views, clicking on the "Entities view" button or the "Relationships view" when active make the UI disappeared
  • #4938 The list of available triggers does not appear when creating a regular digest
  • #4933 Missing icon for users in Ingestion Creation
  • #4930 Page "group" not updated when adding users
  • #4926 In Knwoledge overview, when "free select" is enabled and the user wants to add an entity by search through it, the search box does not allow to enter text
  • #4916 Investigations Entities Limit
  • #4911 [Case to Invest to Case] Cyclic relationship bug
  • #4899 Logo for relationship creation suggested stays green
  • #4894 logout Page Not foud using APP__BASE_PATH
  • #4891 Error when sending objects from an Investigation to a Container
  • #4889 Error when export list
  • #4880 Version 5.11.13 packages have not been generated correctly
  • #4872 [Dashboard] Area and Line view don't seem to retrieve the data correctly
  • #4869 [Dashboard] Adding a "related entity" filter results in an error
  • #4868 [Dashboard] The donuts and radar view don't take dynamic filters into account
  • #4863 Adding a tag to a dashboard is not working
  • #4860 Cannot trigger a background task on Campaign => Knowledge => Indicators
  • #4845 One Organisation on my platform can no longer be added as an "Author"
  • #4832 Add threat actor location: can't create a location + bad design
  • #4827 Investigation Entity Display
  • #4798 Cannot modify the name of an entity if already present in the alias of the same entity
  • #4735 Relationship popup window closes by itself when reverse the direction
  • #4693 Table text does not change color after switching from dark theme to light theme
  • #4501 A table too large is cut off in the pdf export
  • #4476 Network Traffic refs fail to be updated / upserted by integration
  • #4431 Correlation View not Identifying all correlations

Pull Requests:

New Contributors:

Full Changelog: 5.11.14...5.12.0

New Contributors

Full Changelog: 5.11.13...5.12.0

Contributors

richard-julien, SouadHadjiat, and 16 other contributors
Assets 4