0.1.5

0.1.5 — ATT&CK and MISP vocabulary ingest

13 September 2026. Patch on the public 0.1.4 beta.

Install

pip install opentide==0.1.5
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide validate --strict

Added

• Weekly (and workflow_dispatch) ingest for MITRE ATT&CK STIX and MISP threat actors. Vocabularies merge with RFC 0003 per-key versions; schema pins for techniques, actors, and datasources bump in the same PRs (#174).

uv run python scripts/vocabulary/sync_upstream.py --check
uv run python scripts/vocabulary/sync_upstream.py --apply

Fixed

• ATT&CK groups are catalog-only (att&ck.groups); live objects pin them via threat.actors.name → actors::*.
• Later weekly ingest cycles fetch chore/vocab-upstream before git push --force-with-lease so the specifications branch can update after the first cycle.

Verify

python -c "import opentide; print(opentide.__version__)"
opentide validate --strict

Expect 0.1.5.

Links

• PyPI
• GitHub Release
• CHANGELOG
• Usage → Releases

License: EUPL-1.2. Issues: OpenTideHQ/opentide.