Release v1.2.2

• get_credentials_stream(...).to_stix() now maps a full page into one deduplicated STIX bundle.
• New STIXMapperSettings.credentials_include_plain_password (default True) controls whether plaintext passwords are written to UserAccount.credential, in credentials stream and in alerts stream.

Release v1.2.1

STIX Alerts:

• Fetch report targets with inline images
• Less verbose logs on known unsupported type
• Reduce HTML-bearing summary fields to plain text
• Quiet 404 target-not-found to a one-line warning

Release 1.2.0

• Alerts → STIX: StreamingAlertsResponse.to_stix(settings) resolves each alert's target, maps it, and wraps it in an Incident (alert / data-breach) with watcher labels + portal reference. Needs api_client; toggle with alerts_create_incident.
• New mappers (standalone or via alerts): forum posts, private messages, chat messages, data-leak-site posts, credentials & occurrences, credential sets, malware events, malware families.
• Generated descriptions (defanged links/emails/domains) and verity471:* type labels for filtering.
• Sender/recipient distinguished on PMs; first_seen/last_seen on malware, C2 infra, and incidents.

Release v1.1.12

Errors (7):

• Intel Reports (malware) — version property became optional on both stream and {id} endpoints
• Data Leak Sites — size default changed 1000 → 100; post/message became optional
• Messaging Services — size default changed 1000 → 250
• Watchers Alerts — new defaults added: is_trashed_included=false, size=1000

Warning (1):

• Data Leak Sites — thread_id query parameter removed (should have been deprecated first)

Additions (info)

• Intel Reports (breach-alert, fintel, geopol, info, malware, spot, stream) — added optional version_id and version_number on reports and their related_reports
• GIRs tree — added 429 and 503 non-success responses
• Data Leak Sites {id} — added required website property
• Forums posts (stream + {post_id}) — added optional first_post, thread_source_id, and required source_id
• Watcher Groups — added optional subscription_type

Release v1.1.11

• Added endpoint /credential-sets/accessed-domains/stream (get_credential_sets_accessed_domains_stream)
• Deprecated endpoint /credential-sets/accessed-urls/stream
• Creds:
  • added accessed_domain to CredDataResponse and CredentialOccurrenceDataResponse
  • added accessed_domains_count to CredStatisticsResponse and CredSetStatisticsResponse
  • deprecated accessed_url / accessed_urls_count (kept as mirrors for backwards compatibility)
• Alerts helper
  • added AlertTargetStatus enum and status/status_reason fields on AlertTarget
  • added skip_missing_targets parameter to fetch_alert_targets
  • unfetchable targets (incl. marketplace hits) now returned with target=None and a status by default;
  • target_summary falls back to the alert envelope when no target

Release v1.1.9

• Renamed endpoint /reports/vulnerabilities/{id}/download-as-pdf -> /reports/vulnerability/{id}/download-as-pdf
• Added Helpers module

Release v1.1.7

• Added STIX mapper for bulletproof-hosting indicators
• Added methods for following endpoints:
  • /reports/fintel/{report_id}/attachments/{attachment_id}
  • /reports/geopol/{report_id}/attachments/{attachment_id}
  • /reports/info/{report_id}/attachments/{attachment_id}
  • /reports/malware/{report_id}/attachments/{attachment_id}
  • /reports/{id}/download-as-pdf
  • /reports/vulnerabilities/{id}/download-as-pdf

Release v1.1.4

Added support for bulletproof hosting indicators

Release v1.1.3

• Added endpoint /malware/files/{file_name}/download
• Fixed validation error for AuthorActor1 - user_name_id

Release v1.1.2

Updating APIs:

actors: 1.0.2
malware: 1.0.1
reports: 1.0.1
sources: 1.0.3