Skip to content

0.13.0 — vocabulary scoping, validate output, safe CI

Choose a tag to compare

View all tags
@behemothsecurity behemothsecurity released this 12 Oct 16:50
v0.13.0
668946c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.13.0 — vocabulary scoping, validate output, safe CI

12 October 2026. Minor on 0.12.1.

Four things need action after upgrading. threat.surface values are now stage-scoped, so Windows::Desktop becomes OS::Windows::Desktop. Platform configuration blocks now require status. opentide --json validate --check <x> returns the same document as a bare validate, and its legacy errors map is gone. Re-run opentide setup ci — generated pipelines previously deployed to the staging tenant and pushed to your default branch from any pull request.

Install

pip install opentide==0.13.0
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide generate schemas templates vocabs snippets
opentide validate --strict

Breaking

  • threat.surface is stage-scoped. An authored value is <stage>::<key>. The vocabulary groups keys under 8 stages and defines the same key under two of them, so a bare key name was ambiguous and five values (VPN, VPN::OpenVPN, VPN::WireGuard, Wireless, Industrial — each both Infrastructure and Protocol) were unreachable. The enum carried 895 values where the vocabulary defines 900; it now carries all 900.
  • Platform configuration requires status. A rule missing configurations.<platform>.status previously passed validate, failed the published JSON Schema, and then crashed the deployer. Validation now reports status: Field required with the field path.
  • opentide --json validate emits one shape. The report is always at report; checks maps each check that ran to its verdict. --check <x> narrows checks and adds check instead of relocating the report to issues. The duplicate legacy errors map is removed — read report.issues.
  • Local vocabulary extension is removed. The CoreTIDE-era [vocabulary] block in schema.toml no longer injects entries. Vocabularies are canonical in specifications; a missing entry is added upstream.

Fixed

  • Generated CI gated staging deployment and default-branch pushes on "is this a PR" and never on "does it target the default branch" — so a PR between two feature branches deployed detections to a live staging tenant and landed a commit on the default branch. Six jobs across GitLab, GitHub and Azure. Re-run opentide setup ci.
  • threat.actors.name is pinned to actors::1.1. 220 threat-actor galaxy clusters were present in the bundled vocabulary but invisible behind the actors::1.0 pin, so a correctly-authored MISP cluster UUID was reported as an unknown vocabulary value. The actors enum goes from 1029 to 1249 values.
  • opentide setup skills --install opentide-detection-rule no longer fails as an unknown slug. Three of the four wheel-bundled authoring skills were absent from the discovery catalogue while remaining in the default starter set, so the CLI installed a slug it refused to name.
  • The weekly vocabulary refresh workflow had never completed a run since it was introduced: the OpenTide pull-request step was not gated on the App credential the specifications step already required, so it fell back to GITHUB_TOKEN, force-pushed the branch, and then failed at gh pr create. It now fails fast, before any mutation, with a message naming the missing secrets.

Verify

python -c "import opentide; print(opentide.__version__)"

Expect 0.13.0.

Links

Assets 2
Loading