ThreatStream Documentation Updates

Updated the activation process in Integrating with Zscaler.

Added Anomali PDRP Takedown Service.

Added Activating the Anomali PDRP Enhanced Feed.

Added the ja4_tls_fingerprint indicator type to Indicator Types in ThreatStream.

Added the URLhaus Hostlife open-source feed to Available Open Source Feeds.

Added PIR system roles to Using System Roles.

Added PIR permissions to Managing Roles .

Added the Cognyte: Luminar IOCs, Leaked Credentials and AI Cyber Feeds premium feed to Available Premium Feeds.

Intel 471 - Breach Alerts, Intel 471 - FINTEL Reports, Intel 471 - Geopolitical Reports, Intel 471 - Information Reports, Intel 471 - Malware Intelligence, Intel 471 - Spot Reports, Intel 471 -Vulnerability Reports, Intel 471 Verity - Credential Intelligence, Intel 471 Verity - Watcher Alerts, Check Point Exposure Management IoC Intelligence, Doppel, Added the Anomali C2 Detection, Anomali Credential Monitoring, and Anomali Early Warning.

Added the Ransomfeed - Real-Time Ransomware Intelligence open-source feed to Available Open Source Feeds.

Updated the integration process in Integrating with Zscaler.

Updated the activation process in Activating the Anomali PDRP Enhanced Feed.

Updated the integration process in Integrating with Zscaler.

Added the Anomali Threat Briefings and Anomali Dark Web Intelligence open-source feeds to Available Open Source Feeds.

Updated Guidelines for Ingesting Phishing Emails.

Updated Submitting Password Protected Archive Files to Joe Sandbox.

Added information about the OCSF Filter field to Managing Roles .

Added Exporting Investigations to Existing Threat Models.

Added RansomLook.io - Ransomware OSINT Feed to Available Open Source Feeds.

Updated the Intelligence and Threat Model Search API documentation about the new full_count parameter.

Added Workgroup API Resources.

Added the search_filter attribute to Threat Model Search.

Added information about the following new indicator types: mal_port, compromised_port, and compromised_password to Indicator Types in ThreatStream.

Updated General Guidelines for Importing Observables.

Added information about the beta login page for signing in with SSO directly. For details, see Signing In to ThreatStream Using SSO.

Updated Anomali Takedown Service to address the Takedown service enhancements.

Added information about EPSS Score and EPSS Percentile to Viewing Vulnerability Details and Accessing Threat Models.

Added the Anomali PDRP Enhanced section for the new PDRP service.

Added Anomali Release Notes – 2026.07.R2.

Added information about wildcard observables Guidelines for Structured Data.

Added Wildcard Observables.

Added the DomainTools - Iris Detect premium feed to Available Premium Feeds.

Added CERT.PL Malicious Domain Blocklist, Binary Defense, and Phishing Army open source feeds to Available Open Source Feeds.

Added the ThreatStream API section to Online Help. See ThreatStream API.

Added the new_domain itype to Indicator Types in ThreatStream.

Updated the integration activation process in Integrating with ServiceNow SecOps and Integrating with ServiceNow ITSM.

Updated Information in a Sandbox Report.

Added GreyNoise - Benign IPv4 Scanner and GreyNoise Suspicious IPv4 Scanner premium feeds to Available Premium Feeds.

Updated the note in Importing RSS Feeds.

Added information about MITRE ATT&CK v18.0 support to Using MITRE ATT&CK Frameworks in ThreatStream.

Updated Receiving Rules Email Notifications.

Added information about the Lock SSO Configuration feature to Configuring Single Sign On (SSO).

Added the VMRAY - UniqueSignal - Essentials premium feed to Managing Premium Feeds.

Removed the Anomali Adversary Intelligence and Anomali Vulnerability & Exploit Intelligence intelligence channels from Managing Anomali Intelligence Channels.

Removed Anomali Botnets & C2 Intelligence premium feed from Managing Premium Feeds.

Added information about the What's New Panel to Navigating ThreatStream.

Added information about the Integrator Cloud link to Navigating ThreatStream.

Updated Enabling User Management with Active Directory Federation Services and Azure Entra ID and Enabling User Management with SAML 2.0 IdP Services.

Added a note to Importing RSS Feeds.

Added Google Threat Intelligence to Managing Premium Feeds.

Added Enriching Data with Google Threat Intelligence.

Removed references to the Blueliv premium feed due to removal of the feed from the APP store.

Updated User Activity Audit.

Updated ThreatStream Integrations.

Updated Enriching Data with Tenable Vulnerability Management.

Updated Enriching Data with Tenable Security Center.

Added information about the Attack Flow Layout in Managing Investigation Entities.

Added Exporting Attack Flows from Investigations .

Added the following indicator types to Indicator Types in ThreatStream and Threat Types in ThreatStream: mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url.

Updated Guidelines for Importing Observables Through STIX Data Import.

Added Integrating with Google Threat Intelligence.

Added the phish_file_name and fraud_file_name indicator types to Indicator Types in ThreatStream.

Added information about MITRE v17.0 and v17.1 support to Using MITRE ATT&CK Frameworks in ThreatStream.

Added the Flexera Software Vulnerability Research premium feed to the list of available premium feeds. See Managing Premium Feeds.

Updated notes in Exporting Threat Model Entities in STIX Format.

Removed references to the SEKOIA.IO Threat Intelligence premium feed due to deactivation of the feed.

Jun 5, 2025

Updated information about detonating malware on Polyswarm in Submitting Malware for Detonation.

Added the User and Role Management on the Anomali Platformsection.

Removed the OpenPhish.com feed from Available Open Source Feeds.

Removed the TeamT5 APT feed from Managing Premium Feeds.

Added the ThaiCert and MITRE Attack feeds to Available Open Source Feeds.

Added Integrating with Microsoft Defender Threat Intelligence.

Updated partner documentation to Enriching Data with IPQS Fraud and Risk Scoring.

Updated Anomali ThreatStream Integrator Release History.

Added new indicator types to Indicator Types in ThreatStream.

Added new threat types to Threat Types in ThreatStream.

Added c2_dns_name, freq_abused_dns_provider, mal_relay_server_ip, mal_relay_server_ipv6, suspected_c2_dns_name to the list of supported indicator types. See Indicator Types in ThreatStream for details.

Updated Threat Types in ThreatStream.

Added information about ServiceNow UI drop-down menu allowing you to select a ServiceNow user interface during the activation process of the ServiceNow integration. See Integrating with ServiceNow SecOps and Integrating with ServiceNow ITSM for more information.