ThreatStream AirGap Release History

In this ThreatStream AirGap release, the following features and enhancements have been added:

• Latest security updates for Ubuntu 22

• Database upgrade

• CSV feed integration.

• MITRE v15.1, v16.1, v17.0, and v17.1 support

• Improvements and fixes for the following issues found in ThreatStream v5.5:

  • OP-37003: Import jobs stuck in the processing state.

  • OP-37150: Bulk editing of observable tags coming from import jobs fails.

  • OP-37003: Data import issue discovered in ThreatStream AirGap 5.5.1.

  • OP-37310: Added support for the multi-queue feature allowing you to configure the number of workers for imports.

  • OP-38163: Half of the screen turns black when trying to view the Entities section of an investigation in full-screen mode.

  • OP-38112, OP-38867: Vulnerability issues.

  • OP-38169: Improper alignment of entities within a group in investigations.

  • OP-38753: Threat Models are not populated in the UI due to a scheduled task.

In this ThreatStream AirGap release, the following features and enhancements have been added:

• Ubuntu 22 LTS support: Upgraded the OS of the ThreatStream AirGap virtual machine to Ubuntu 22 LTS.

• Upgrading: Updated the upgrading process.

• Appliance health check: Added a command to run ThreatStream AirGap appliance health check.

• Package export script: Added a package export script.

• Postgres password management: Added support for Postgres password management.

• System time: System time is now managed with chrony.

• Security: Added a security update.

In this ThreatStream AirGap release, the following feature has been added:

• Support of Ubuntu 20.04 LTS: The OS of the ThreatStream AirGap virtual machine has been upgraded, and now it is Ubuntu 20.04 LTS.

In this ThreatStream AirGap release, the following feature has been added:

• Custom EULA: Keep your users informed about specifics and limitations of using your ThreatStream AirGap instance with a custom end-user license agreement (EULA). You can set it up in the configuration wizard.

This patch release includes enhanced upgrade scripts and the following bug fix:

OP-29576 This error displayed when setting up multihoming: No such file or directory: 'etc/network/interfaces'

This release includes the following features and enhancements. See the Anomali ThreatStream AirGap Deployment & Administration Guide for more information.

1. Automated Creation of Trusted Circles: Automatically create a set of trusted circles on ThreatStream instances that contain multiple organizations.

2. Configuring Organizations and Users to Ingest MITRE Attack Patterns: Enable your users to ingest MITRE ATT&ACK techniques and sub-techniques associated with v7.2 and later for more security coverage.

3. Configuring ThreatStream Using a Configuration File:ThreatStream can now be configured using a configuration file. Configuration files can be used across multiple ThreatStream deployments, thus enabling quick and easy configuration for use cases involving more than one ThreatStream.

4. Custom Branding: Customize your ThreatStream instance according to your brand requirements. In the configuration wizard, you can set a logo, change the name of your organization, as well as provide customer support and legislation information.

5. Disabling DNS Lookups: When configuring ThreatStream, make DNS lookups on intelligence inactive during intelligence synchronization .

6. Enabling Users to Share Intelligence with Trusted Circles: Add another layer to the visibility of threat intelligence by enabling users to share intelligence with trusted circles.

7. Enhanced Backup and Restore Procedure: The procedure for backing up and restoring your ThreatStream appliance has been optimized.

8. Information Classification Banner: Show the level of information classification with a corresponding banner on the ThreatStream UI.

9. Information Misuse Warning: Inform the users about legislation on unauthorized access to your information and misuse penalties using a setting in the configuration wizard.

10. Reverse Proxy Support: Securely route your users to the ThreatStream UI that is hosted in an isolated environment.

11. Single Sign On: Configure single sign on (SSO) and ThreatStream user administration through integration with any SAML 2.0 compliant identity provider.

12. ThreatStream Cloud Scoring: Enable this enrichment to get the confidence score of the observables calculated by Anomali ThreatStream's threat intelligence engine based on machine learning.

This release includes the following features and enhancements:

1. Trusted Circle Mapping: Synchronize trusted circle or feed data from ThreatStream Cloud to trusted circles on ThreatStream AirGap.

2. FQDN and System ID Migration: Update the FQDN or System ID of your ThreatStream AirGap appliance.

3. External Image Handling: In cases where ThreatStream AirGap does not have cloud connectivity, an External Image Link button in displayed in place of external images on Threat Model entity details pages.

4. Enrichments: The Ciphertrace, Deloitte Codex, Greynoise, HYAS, Polyswarm, Recorded Future, Splunk Sightings, Spur, and VirusTotal v3 are now available on ThreatStream. All other enrichments have been updated to their latest compatible versions.

5. Custom Dashboards: Create custom dashboard widgets based on saved observable or Threat Model search fiters.

6. MITRE ATT&CK: Configure a representation of your organization security controls using the MITRE ATT&CK Framework. After configuring your security controls, you can overlay them on MITRE ATT&CK models within investigations to get a snapshot of your coverage for a particular threat.

7. Search:

   - Advanced search functionality has been added to the Anomali Threat Model. With advanced search, you can construct search filters for specialized searches. Search filters can be saved for later use.

   - A Key Filters section has been added to the left filter for the Observable and Threat Model basic search screens. These filters enable you to quickly locate data created by your organization or open source feeds. Additionally, the character limit for saved observable search filters has been increased to 2,000.

8. Threat Model:

   - Generate PDFs based on customizable templates for sharing with a wider audience outside of ThreatStream.

   - Import STIX 2.1 compatible custom objects through the STIX tab of the import assistant.

9. Investigations:

   - Create private investigations that are visible only to you.

   - To enable collaboration within investigations, ThreatStream locks investigations when edits are made. Other users with access to the investigation are prevented from making edits until the editor saves the investigation or leaves the page.

   - Leverage contextual data enrichments within from the Explore pivoting tool within investigations. Contextual enrichments, which are also available in the Enrichments section on observable details pages, provide qualitative information from third-party sources on individual observables.

   - A Bulk Add option has been added to the Explore pivoting chart and the table view on the investigations user interface. Bulk Add enables you to add candidate observables to the investigation from a PDF or TXT file at any time.

   - Export a list of investigations in CSV format from the investigations list view screen.

   - The Explore pivoting tool on the investigations user interface has been enhanced with a new Selection Details panel. The panel enables you to search nodes on the chart and view more details about selected nodes without drilling down to entity details pages.

10. Overview Dashboard: The Indicators by Type dashboard widget has been enhanced with Deselect All and Select All options, granting you greater control over the indicator types displayed on the chart.

11. Rules: An Enabled switch allows you to toggle whether the rule is enabled. If switched off, the rule is disabled and no longer matches for keywords in new intelligence.

12. Organization Administration:

    - Org Admins can restrict the email domains with which Threat Model entities can be shared.

    - Add Read Only users to workgroups. Previously, Read Only users could not be added to workgroups.

This release includes the following features and enhancements:

• Enrichments: Added the AbuseIPDB, DomainTools Iris, Farsight DNSDB, Have I Been Pwned?, Pastebin Dump Collection, ReversingLabs, RiskIQ, Shodan, URLScan.io, and Web of Trust enrichments. Updated the AlienVault ThreatCrowd, Cisco Umbrella Investigate, Hybrid Analysis, and Virus Total enrichments. See Activating Enrichments for more information.

• Customizable Support Links: Configure custom support links to be included in emails sent from the platform.
• Multihoming: Added the ability to monitor ThreatStream AirGap on an additional interface separate from the production network.

• Reverse Proxy Support: Configure ThreatStream AirGap to run behind a reverse proxy.

• Malware: Added the Malware threat model entity. For more information, see Viewing Malware Details in the ThreatStream online help center.
• Notifications List View: View a complete list of the notifications sent to you by ThreatStream on the Notifications List View. For more information, see Viewing Notifications on the Notifications List View in the ThreatStream online help center.

• Rules:

  - Rules can be configured to search for keyword matches in signatures. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured based on the exclusion specific indicator types. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured to search for keyword matches in vulnerabilities. See Rules in the ThreatStream online help center for more information.

• User Export: Org Admins can export user information in CSV format. See Managing Organization Users in the ThreatStream online help center for more information.
• Import Whitelist: Associate contextual notes to import whitelist entries. See Updating Organization Exclude List in the ThreatStream online help center for more information.
• Overview Dashboard: Added the Investigation Task List dashboard widget, enabling you to view all investigation tasks assigned to you from the Overview dashboard. See A Tour of the ThreatStream Overview Dashboard in the ThreatStream online help center for more information.

• Observables:

  - A "View details" link in the Intelligence section of observable details pages enables you to view changes to individual instances of an observable from observable details pages. See Observables in the ThreatStream online help center for more information.

  - Added urlscan.io to the list of Analysis Links on observable details pages for Domain, IP address, and URL observables. See Observablesin the ThreatStream online help center for more information.

  - Remove observable tags in bulk from the Observables search page. See Bulk Tag Management of Observables in the ThreatStream online help center for more information.

  - Filter observable search results by observable value type. See Filtering Search Results in the ThreatStream online help center for more information.

• Observables:

  - A "View details" link in the Intelligence section of observable details pages enables you to view changes to individual instances of an observable from observable details pages. See Observables in the ThreatStream online help center for more information.

  - Added urlscan.io to the list of Analysis Links on observable details pages for Domain, IP address, and URL observables. See Observablesin the ThreatStream online help center for more information.

  - Remove observable tags in bulk from the Observables search page. See Bulk Tag Management of Observables in the ThreatStream online help center for more information.

  - Filter observable search results by observable value type. See Filtering Search Results in the ThreatStream online help center for more information.

• Import:

  - Edit the expiration date of individual observables while reviewing import sessions. See Approving Import Jobs in the ThreatStream online help center for more information.

  - Users with Approve Import privileges can approve and reject import jobs in bulk from the Import list view screen. See Approving Import Jobs in the ThreatStream online help center for more information.

• Read Only Users: Added the ability to create Read Only users on ThreatStream. See Read Only User Privileges in the ThreatStream online help center for more information.

• Threat Model:

  - Import existing content in the form of threat model entities. You can paste in rich text or upload PDF or TXT files which will serve as the basis for a new threat model entity. See Adding New Threat Model Entities in the ThreatStream online help center for more information.

  - Filter threat model search results by signature type. See Accessing Threat Models in the ThreatStream online help center for more information.

  - The ability to export observables associated with threat model entities has been extended to actors, campaigns, incidents, signatures, TTPs, and vulnerabilities.

• Password Administration: Configure the number of days before expiration at which users receive notification to reset their passwords. See Notify users before password expiration in the ThreatStream online help center for more information.

• Password Administration: Configure the number of days before expiration at which users receive notification to reset their passwords. See Notify users before password expiration in the ThreatStream online help center for more information.

• Permitted CIDRs: Increased the number of CIDRs to which you can grant exclusive access to your organization on ThreatStream to 1000. See Permitted CIDRs in the ThreatStream online help center for more information.

• Investigations: Added the ability to delete investigation tasks. See Understanding User Interface of Investigations in the ThreatStream online help center for more information.

• This release includes the following fixed issue:

  • OP-18047: An Elasticsearch issue prevented newly imported observables and recently created threat model entities from appearing in search results.

This release includes the following fixed issue:

OP-16508: An internal issue caused log files to continuously grow in size and exhaust disk space. In these cases, ThreatStream AirGap could not synchronize intelligence to ThreatStream.

This release includes the following features and enhancements:

• Ubuntu Upgrade:ThreatStream AirGap has been upgraded to Ubuntu 16.04 LTS.
• Threat Model Support: Download campaigns, incidents, signatures, and vulnerabilities to ThreatStream using ThreatStream AirGap.
• Attachments: Files attached to threat model entities are synchronized through ThreatStream AirGap and can be leveraged on ThreatStream.
• Indicator Types:ThreatStream supports all indicator types supported by ThreatStream Cloud.
• Observable Associations: Observable to observable associations created on ThreatStream Cloud are now synchronized to ThreatStream AirGap.
• Upstream Associations: Associations created or updated on ThreatStream Cloud are now synchronized to ThreatStream AirGap.
• Investigations: Investigations has been updated with a new user interface. See Viewing and Editing Organization Settings for more information.
• Enrichments SDK: Develop third-party enrichments using the Anomali Enrichments SDK for use on ThreatStream AirGap. Enrichments developed using the Anomali Enrichments SDK can be used for external and internal data sources. Contact your Anomali support representative for more information on the Anomali Enrichments SDK.
• Third Party Enrichments:ThreatStream AirGap ships with a set of enrichments developed by Anomali using the Anomali Enrichments SDK. These enrichments include: Anomali Whois History, Cisco Umbrella Investigate, Hybrid Analysis, Silobreaker, ThreatCrowd, and VirusTotal. See Activating Enrichments for more information.
• Delete Observables: Observables can be deleted from observable details pages. Search "Deleting Observables" in the ThreatStream online help center for more information.
• Permitted CIDRs: Added the ability to restrict access to your organization on ThreatStream AirGap to IP addresses that fall within specified CIDRs. See Permitted CIDRs for more information.
• User Reports: Added ability to generate reports on user activity. See Generating User Activity Reports in the ThreatStream online help center for more information.
• Mailbox Proxy User: Added the ability to specify a Proxy User for threat intelligence mailboxes. See Mailboxes for Receiving Observables in the ThreatStream online help center for more information.
• Observable TLP: Added the ability to assign a TLP color to observables during import and from observable details pages. Observable TLP settings configured on ThreatStream Cloud are synchronized to ThreatStream through ThreatStream AirGap. See Importing Observables or Editing Observable Details in the ThreatStream online help center for more information.
• Bulk Edit Observables: Added the ability to edit observables in bulk. See Editing Observable Details in the ThreatStream online help center for more information.

This release includes the following fixed issues:

• OP-12652: An internal issue prevented ThreatStream from creating data snapshots.
• OP-12518: In cases where ThreatStream serves as a data source for a ThreatStream OnPrem deployment, specified values for certain environment variables were ignored.
• OP-12437: Re-running user setup resulted in unexpected behavior if the same System ID used for initial setup was entered.

This release includes the following features and enhancements:

• Threat Model Synchronization: Retrieve actor, threat bulletin, and TTP information from the ThreatStream Cloud platform using ThreatStream AirGap 3.0.
• Custom Indicator Types: Create custom indicator types for use on ThreatStream. See "Adding Custom Indicator Types" in the ThreatStream Deployment & Administration Guide for more information.
• Overview Dashboard Enhancement: The overview dashboard has been updated with a new user interface, which enables you to view graphical renderings of the latest data available to you on ThreatStream, in addition to recent organization activity and notifications for open tasks assigned to you. See A Tour of the ThreatStream Overview Dashboard in the online help center for more information.
• Message of the Day: Add a message that is displayed in a banner across the top of the screen to all organization users on ThreatStream. Search "Message of the Day" in the online help center for more information.

• Preferred Tags: Create a list of frequently used tags that can be quickly selected from any Tags field in ThreatStream. See Adding Preferred Tags to Intelligence in the online help center for more information.

• Delete Investigations: Delete investigations that belong to your organization from the UI. Search "Deleting Investigations" in the online help center for more information.

• Vulnerabilities: View vulnerabilities imported by from trusted sources on the UI. Additionally, you can create vulnerabilities as part of the Threat Model on ThreatStream. See Using the Anomali Threat Model in the online help center for more information.

• Rules: New and improved keyword match functionality that offers greater customization, searchability, and increased granularity. You can add up to 100 distinct keywords to a single rule. Rules trigger when any configured keywords are matched. See Rules in the online help center for more information.
• Threat Model Enhancement: The Anomali Threat Model has been updated with a new user interface and streamlined publication workflow. See Using the Anomali Threat Model in the online help center for more information.
• Password History Retention: Org Admins can set the number of previous passwords ThreatStream retains and blocks users from using as new passwords. See Use Password Requirements in the online help center for more information.

• SSO Logout URL: Configure an alternate URL to which ThreatStream will direct you upon logout—including logouts that occur due to system timeouts. If your organization leverages a third party single sign-on (SSO) service for ThreatStream, you can enter the URL for the portal of your SSO provider. See SSO Logout URL in the online help center for more information.

• Word Doc Support: Copy and paste content—including images—from .doc, docx, and .pdf files into rich text editors for all threat model entities and investigations. All formatting is preserved.

• Import using URL: Import observables from ad-hoc scrapes of plain text intelligence feeds or direct links to CSV, HTML, JSON, PDF, TXT, or XML files. See Importing Observables in the online help center for more information.

• Observable Export: Export observable search results in CSV, OpenIOC, PDF, Snort, and STIX v1.1.1, v1.2, and v2 formats. See Exporting Search Results in the online help center for more information.

• Observable Associations: Create bidirectional associations between observables from the ThreatStream user interface. See Associating an Observable with Other Observables in the online help center for more information.

• Resubmit Excluded Observables: When observables are excluded from import jobs due to typos in observable values, you can edit observable values and resubmit the import job. See Editing Observable Values Before Approval in the online help center for more information.
• Resubmit Excluded Observables: When observables are excluded from import jobs due to typos in observable values, you can edit observable values and resubmit the import job. See Editing Observable Values Before Approval in the online help center for more information.
• Re-import Observables: As a means of updating details of existing observables or changing an observable's status from Inactive to Active, ThreatStream enables you to re-import observable values. See Re-importing Observable Values in the online help center for more information.