Skip to content

AdversaryGraph v2.5.0

Choose a tag to compare

View all tags
@anpa1200 anpa1200 released this 18 Jun 14:13
v2.5.0
41d6fb1

AdversaryGraph v2.5.0 Release Notes

Release date: 2026-06-18

AdversaryGraph v2.5.0 adds a practical IOC Library and expands enrichment,
exchange, and source synchronization workflows.

Major Changes

IOC Library

  • Added /ioc-library as the central observable workspace.
  • Added full-text IOC search across indicator value, description, malware
    family, campaign, source, tags, and actor context.
  • Added filters for IOC type, source, and ATT&CK group/actor.
  • Added searchable multi-select group filtering with selected-group chips.
  • Added sorting by last seen, first seen, type, value, source, confidence, and
    group/attacker.
  • Added per-IOC enrichment action.

IOC Exchange and Source Connections

  • Added STIX 2.1 export from filtered IOC Library views.
  • Added STIX bundle import for IOC ingestion.
  • Added TAXII 2.1 collection object pull support.
  • Added MISP JSON export connection as a custom IOC feed.
  • Added custom JSON, CSV, and TXT IOC feed registration from the IOC Library.

Enrichment

  • Added VirusTotal IOC lookup with structured verdicts, detection context,
    extracted ATT&CK technique evidence, local actor matches, rules, sandbox
    context, DNS/resolution context, and pivot links.
  • Added IOC-to-TTP mapping from imported reports, enrichment metadata, OTX,
    Malpedia, and custom feeds.
  • Added sandbox behavior feed synchronization for malware behavior context.
  • Added YARA and Sigma rule-feed synchronization for detection context.

Reliability and Operations

  • Fixed manual POST /api/sync/dynamic-db so the FastAPI route awaits an async
    helper instead of calling the Celery wrapper that uses asyncio.run().
  • Kept the Celery scheduled task path intact by wrapping the same async helper
    from the synchronous task function.
  • Improved IOC Library dropdown sizing so the group selector shows at least
    seven visible rows and is not clipped by the surrounding panel.

Licensing

  • Replaced the MIT license with the AdversaryGraph Personal Use License.
  • Personal/private use is free.
  • Business, commercial, organizational, client-delivery, production, or
    government use requires prior written approval from Andrey Pautov.

Upgrade Notes

For a fresh or existing Docker deployment:

git pull
docker compose up -d --build

Then verify:

curl http://localhost:8000/api/health
curl http://localhost:8000/api/system/selftest

For enrichment features, configure API keys in .env where needed:

VIRUSTOTAL_API_KEY=
OTX_API_KEY=
THREATFOX_AUTH_KEY=

Verification

  • npm run build passed.
  • git diff --check passed.
  • Docker API and frontend rebuilt successfully.
  • Focused Docker API tests passed:
tests/integration/test_ioc_routes.py::test_ioc_library_accepts_multiple_actor_filters
tests/integration/test_attack_routes.py::test_dynamic_db_sync_runs_from_async_route
  • Live checks returned HTTP 200:
GET  /api/health
GET  /api/ioc/library?actor=G0006&actor=G0049&limit=5
POST /api/sync/dynamic-db?days=7&force_attack=false
Assets 2
Loading