Skip to content

0.9.0

Choose a tag to compare

View all tags
@cursor cursor released this 05 Oct 16:44
· 94 commits to development since this release
v0.9.0
ef7547b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.9.0 — Rule review dates and ATT&CK 1.1

5 October 2026. Minor on 0.8.2.

Upgrade and regenerate schemas with opentide generate so rule::1.1 can record metadata.reviewed and technique and logsource checks use att&ck::1.1 and datasources::1.1. opentide rules unreviewed lists rules with no review, or a review older than the window. It does not require regenerating CI.

Install

pip install opentide==0.9.0
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide validate --strict

Regenerate editor schemas and templates with opentide generate. rule::1.0 still rejects metadata.reviewed.

Added

  • rule::1.1 accepts optional metadata.reviewed (ISO 8601 date or datetime). rule::1.0, threats, and objectives still reject the field. Validate, deploy, share, and template generation do not write it (#437, #438).
  • opentide rules unreviewed --older-than 90d (also 12h, 30m, or a bare positive day count) lists rule::1.0 as schema, a rule::1.1 with no review as absent, and a review strictly earlier than now minus the window as stale. A review equal to the window boundary is fresh. Exit code is 0 when the window parses (#437).

Changed

  • Technique pins are att&ck::1.1 on threats, objectives, rule::1.0, and rule::1.1. Objective logsources pin datasources::1.1. Bundled ATT&CK, groups, datasources, and mitigations match upstream 19.2 (#392, #445).
  • orjson 3.12.0 (#443), azure-identity 1.26.0 (#444), and mcp 1.30.0 inside the existing <2 pin (#442). Transitive oauthlib 4.0.0, urllib3 2.8.0, and virtualenv 21.14.5 (#435).

Fixed

  • CrowdStrike auth no longer logs the token response. Defender no longer logs the bearer token or a client-secret prefix (#441).
  • share push publishes a retracted object again. A matching content hash skips the push only when the ledger line is synced (#385).
  • Deploy commit loading records the immediate parent, so a deep history no longer raises RecursionError during the diff (#369).

Verify

python -c "import opentide; print(opentide.__version__)"
opentide rules unreviewed --help

Expect 0.9.0.

Links

Assets 2
Loading