Anomali ThreatStream Integrator Release History

ThreatStream Integrator v8.5.8 includes the following improvements:

• SSL certificate verification for source synchronizations: Added an option to enable or disable SSL certificate verification during ThreatStream Integrator source synchronizations. This can be useful for environments using custom or self-signed certificates.

• Authentication for Integrator file endpoints: File endpoints now support optional authentication that can be configured per destination to improve security for on-premises deployments.

• Expanded MISP integration: The MISP integration now supports TLP ratings and severity.

• Security improvements: A number of security improvements have been added in this release.

In addition, this release fixes the following issues in the previous release: 

INTS-13249: Updated cryptography and SSL components to address OpenSSL vulnerabilities CVE-2025-15467 and CVE-2025-68160 in Integrator version 8.5.7.

INTS-13369: Resolved an issue where Integrator could display a blank page when the appliance was under heavy connection load, such as during frequent Nessus scans or sustained firewall polling. Additionally, the destination web server has been upgraded from HTTP/1.0 to HTTP/1.1 with persistent connections, reducing connection churn and improving throughput.

ThreatStream Integrator v8.5.7 includes the following improvements:

• Supported OS: Ubuntu 24.x is added to the list of supported Linux OS.

• Deprecated OS Support: Ubuntu 18.x and 20.x have been removed from the list of supported Linux OS.

• Security improvements: A number of security improvements have been added in this release.

In addition, this release fixes the following issues in the previous release: 

INTS-13180: QRadar sync to tag-based reference sets fails when the restricted iTypes are

missing.

INTS-13205: SDK/Extension based destinations show success status even if sync gets ignored

due to previous sync failure.

INTS-13211: Integrator remote login and snapshot API auth checks incorrectly use the proxy when

it’s configured but not enabled for source sync, risking connectivity failures.

ThreatStream Integrator v8.5.6 includes the following improvements:

• Wildcard indicator types: The following wildcard indicator types are now supported for the Palo Alto Networks ThreatStream Integrator integration destination:

  • mal_wildcard_domain

  • mal_wildcard_url

  • sus_wildcard_domain

  • sus_wildcard_url

• UUID field support: The UUID output field can now be included in CSV output files for custom destinations.

• Security improvements: A number of security improvements have been added in this release.

ThreatStream Integrator v8.5.4 includes the following improvements:

• Security: A number of security improvements have been added to this release.

• Full Refresh Sync: The processing of deleted indicators has been improved for a sync performed during a full refresh, speeding up the sync process.

• Supported Versions: Trellix NitroSecurity versions 11.6.10-11.6.14 are now supported.

• CIDR Indicators: For customers that have access to CIDR indicators in ThreatStream support has beenaddedtothePaloAlto Networks destination for the following itypes:

  • suspicious_ipcidr

  • suspicious_ipv6cidr

  • mal_ipcidr

  • mal_ipv6cidr

    Note: The new indicator types are added as restricted itypes on ThreatStream and must be enabled on the ThreatStream Settings page before they are visible.

    The sync process for the source and the Palo Alto Networks destination has been updated to cater for the new indicator types. Ingested CIDR indicators will be part of the file specified in the File name to output IP indicators field (default pa-dbl.txt).

ThreatStream Integrator v8.5.2 includes the following improvements:

• Security: A number of security improvements have been added to this release.

• Indicator Deletion: Integrator has been updated to support changes made on Forcepoint for deleting indicators.

• Field Renamed: The Use SSL field in Forcepoint has been renamed to Verify SSL to provide a more accurate description of the field.
  

• Deprecated Support: Forcepoint version 8.5.4 is no longer supported.

• Supported versions: Forcepoint versions 8.5.5 and 8.5.6 are now supported.

ThreatStream Integrator v8.5.1 includes the following improvements:

• Security: A number of security improvements have been added in this release.

• Performance: A number of performance improvements (memory and speed optimization) have been added in this release.

• Intelligence API: For new installations, by default, version 2 of the Intelligence API is used. Version 2 uses the same filter language as ThreatStream and allows you to use the same filters on both ThreatStream and Integrator. However, the version 2 data format is larger and this may result in an increase in sync times.
  

  Note: If you are upgrading to Integrator 8.5.1, then the existing version of the Intelligence API is retained. For example, if you are currently using version 1 and upgrade to Integrator 8.5.1, then the Intelligence API version after the upgrade will still be version 1. Similarly, if you have already upgraded to version 2, then the Intelligence API version after the upgrade will still be version 2.

• Destination renamed: FireEye HX is now called Trellix HX.

• Supported versions: Trellix HX version 10.x is now supported.

ThreatStream Integrator v8.5.0 includes the following improvements:

• Security Improvements
  A number of security improvements have been added in this release.

• Source Filter
  The default setting for the source filter in the setup wizard, * (all indicators visible to the Authorized User), has been removed and replaced with a placeholder sample filter to remind users to specify a filter.

  It has been removed as most users do not want/require all indicators to be downloaded. In addition, previously if users forgot to set a filter, downloading all indicators if they were not required was time-consuming.

• MISP Destination
  An option has been added to include informational data in the MISP integration.

• Threat Model Enrichment
  The Enrich indicator matches with associated threat models option has been removed from the QRadar destination to improve sync timing. You can view the threat model enrichment for indicator matches directly in ThreatStream from the QRadar app. See information on the Indicator Matches List in the Anomali ThreatStream QRadar App documentation for details.

• Integrator Setup
  The time before checking if Integrator has started/restarted successfully has been increased to 60 seconds. If it has not started by this time you are given the option to continue waiting for Integrator to start.

  Integrator is yet to start successfully, Do you want to keep waiting? [y/n]

  Input Y to wait for another 60 seconds.

  Input N to display the Integrator failed to start message and it stops waiting for the Integrator

  service to start.

• Integrator Extensions/SDK Destinations
  Currently, if an extension/SDK destination that syncs in incremental mode fails during a sync, it may be skipped in future syncs. An option that, if enabled, ensures the extension/SDK destination is included in future syncs. The extensions affected are Azure Sentinel, CrowdStrike Falcon, FireEye Helix, Trellix DXL, Microsoft Defender for Endpoint LogRhythm, and Cofense Vision.

• Alert Validation
  This has been enhanced to improve the reliability of configuration testing.

• Supported Versions
  Infoblox version 9.0 is now supported.

• Deprecated Support
  The following operating systems are no longer supported: CentOS, Red Hat 7.x.

In addition, this release fixes the following issues in the previous release: 

INTS-12837: In Maintenance Mode, opening and closing the manual instructions may have caused the Upgrade Now button to b enabled when no extensions had been selected for upgrade during Auto Upgrade.

INTS-12811: Using an AWS SES (Simple Email Service) for an SMTP server when sending alerts generated an error if using an on-premise Integrator instance.

INTS-12796: When using the Alerts option, the details were shown but disappeared leaving a blank page if the alert emails contained any user emails that became read-only user or inactive.

INTS-12747: In previous versions, the remote threat model count was not included in the total listed in the Integrator user interface.

ThreatStream Integrator v8.4.2 includes a number of security improvements.

ThreatStream Integrator v8.4.1 fixes the following issue in the previous release:

INTS-12687 - There was an issue using trusted_circle_id in the source filter if you were using version 1 of the Intelligence API.

This has been fixed in this release.

ThreatStream Integrator v8.3.4 includes the following enhancements/improvements:

• Security Improvements
  A number of security improvements have been added in this release.

• Settings Page
  The loading time for the settings page has been improved.

In addition, this release fixes the following issues in the previous version:

• INTS-12560: Where duplicate indicators with different tags were encountered, the indicator with the highest priority tag was not taken into account when ingesting the indicators. This meant that duplicates with the highest priority tag could be missed when there were limits on the number of indicators ingested.

  This issue has been fixed in this release and duplicate indicators with different tags are now ordered by tag priority.

• INTS-12532: There was an issue with the source sync for indicators with associated threat models. For these indicators, if they no longer met the source filter criteria because the indicator OR the source filter were updated then, on sync:

  • If the indicator was set to inactive, the information on Integrator was not updated. This meant that indicators with associated threat models that were marked as inactive on ThreatStream were not deleted from Integrator and, subsequently, not removed from destinations.

  • If the indicator or source filter was updated so that the indicator no longer met the filter criteria, the information on Integrator was not updated and, subsequently, the indicator was not removed from destinations.

  This has been fixed in this release. If the indicator status changes to inactive then it is deleted from Integrator and, on sync, from the destination.

  Where the indicator is active but no longer meets the source filter criteria then theindicator is deleted from the destination.

• INTS-12509: The API used to retrieve the list of users needed to generate alert emails equired the user, specified in the ThreatStream source settings, to have admin privileges. Where users did not have admin privileges, a 401 error was generated, and the alert emails were not sent.

  The API used to retrieve the addresses has been changed to one that does not require admin privileges.

ThreatStream Integrator v8.3.1 fixes the following issues in the previous release:

• INTS-12489: When configuring Integrator to send an email alert if a synchronization error occurs, a test email is generated and sent to Anomali to test the configuration. As some customers have their SMTP server configured to allow only permitted recipients, an error can be generated when the alert is tested.

  This issue has been fixed in this release with the test message now sent to the customer's email.

• INTS-12458: STIX indicator validation was failing for some URLs due to a special character, for example, a single quote character in the URL.

  This issue has been fixed in this release.

ThreatStream Integrator v8.3 includes the following enhancements/improvements:

• Synchronization Failure Alerts

  Email alerts are sent to specified recipients when a source or destination sync failure occurs.

• Extension Upgrade Notification

  A notification pop-up displays when an upgrade to an existing Integrator extension is available.

• Minimum Integrator Version

  When installing an SDK extension by uploading to Integrator, or upgrading an existing extension, a check is made to ensure the current Integrator version meets the minimum required by the extension. If Integrator does not meet the version requirement for the extension, then the installation/upgrade is canceled and an error message displays indicating the Integrator version required by the extension.

• Security improvements

  A number of security improvements have been added in this release.

• Palo Alto Networks Endpoint Limitation

  The Palo Alto Networks endpoints are limited to 255 characters. An error message is displayed if the limit is exceeded when configuring the destination.

• Destination Renamed

  McAfee NitroSecurity (ESM) is now called Trellix NitroSecurity (ESM).

• Supported Versions

  Trellix NitroSecurity (ESM) v11.6 is now supported.

  Additionally, the following issues were fixed in this release:

• INTS-12354: The method of deleting indicators on the FireEye HX destination caused some performance issues and slowed sync times. The deletion method has been improved to improve sync performance times.

• INTS-12411: Sync issues coud arise with md5 iTypes if filters were copied from ThreatStream as Integrator did not support the hash alias which is supported by ThreatStream. Integrator now supports the hash alias.

• INTS-12268:  When you upgraded to version 2 of the intelligence API, the source field was incorrectly mapped to the feed ID rather than the indicator source as it did in version 1. This issue has been fixed in this release.

ThreatStream Integrator v8.2 includes the following improvements:

• Single Sign-on (SSO) Authentication

  A new security option, Enable Single Sign-on, has been added which can be enabled during initial setup or through the security settings. When enabled, a Sign in with ThreatStream option is added to the Integrator logon screen that enables you to sign in with your ThreatStream credentials. See "Enable Single Sign-on (SSO)" on page 51 for details.

• Source Filter Message

  When a change is made to the source filter, a message now displays recommending that a full refresh is performed as the source intelligence may have changed. The refresh is not automatic and you must click Confirm in the pop-up to initiate the full refresh.

• Destination Threat Models

  The threat models available at a destination are determined by the source threat model filter. In previous versions all threat models were available.

• STIX Support

  STIX 2.1 is now supported for custom destinations.

• Supported Versions

  The supported versions of these destinations have been updated—Checkpoint, LogRhythm, MicrofocusArcSight ESM, QRadar, and Splunk. The Bro Intel destination is no longer supported and has been removed. It has been replaced by the Zeek extension.

• Destination Renamed

  BlueCoat Proxy SG is now called Broadcom Proxy SG.

• Restore Process

  If you use Restore, you no longer need to delete the optic_link_id entry in the integrator.conf file for the fresh install before starting Integrator.

• Verbosity

  A restart is no longer required to enable a change in the logging level.

In addition, this version also fixes the issue with purging QRadar reference sets (no indication that the purge had

completed) which was causing a problem with the sync process. Integrator now ensures that the purge is complete before proceeding with the sync.

ThreatStream Integrator v8.1.2 fixes a number of issues in the previous release.

The following issues have been fixed:

• INTS-12097: Inactive indicators deleted from the MISP destination were not being deleted from the MISP platform.

• INTS-12074: When using the custom destination with STIX selected as the output format, the same indicators were repeatedly added to the output file. This resulted in an inflated file that caused the ingestion to freeze.

• INTS-11955: When you upgraded an extension, the next sync failed with this message displayed: "Text file is busy".

• INTS-11919: When setting up an extension, if setup or sync failed and the generated error message was too long, then the corresponding destination card could extend beyond its usual width.

ThreatStream Integrator v8.1.1 includes the following improvements:

• Digital Signatures

  Digital signatures have been added to the Integrator Windows installation binary and the Integrator Extensions to prevent the files from being incorrectly marked as malware by endpoint detection software.

• Some issues from the previous version have been fixed in this release.

ThreatStream Integrator v8.1 includes the following features and enhancements:

• SDK Extension Configuration

  There is a new option for adding an SDK extension to Integrator. The extension, provided in a .zip file containing all the required fields for the extension type, can be uploaded to Integrator using a drag-and-drop procedure. Once uploaded, the extension appears in the drop-down list of destinations to be added and configured in the same way as the in-built destinations.

• Saved Search Filtering

  A new option has been added to both source and destination filters that enables you to select filters defined on ThreatStream and apply then on Integrator. The option is only available if a source has been specified.

• Backup and Restore

  This feature enables you to back up essential data from your Integrator system and, if required recreate the system in the event of a major failure. The feature could be used as part of a disaster recovery plan or create a duplicate live system for secure testing.

• Context-aware Error Messages

  In previous versions, error messages were displayed in the top right-hand corner of the screen. Version 8.1 adds context-aware error messages by the field that caused the error. For example, when specifying the source URL, if you mistype the source URL and it starts with htps://, a red line is displayed by the side of the field and the error message Incorrect scheme for ThreatStream URL, please prepend with 'https://' is displayed below the field.

• Priority Filtering

  This option enables you to prioritize the order in which indicators are downloaded to destinations based on indicator tags added to the Indicator filter. Indicators are prioritized in the order tags are listed in the filter using the SORT option.

• Security Enhancement

  Admin credentials must be provided to change the source URL.

ThreatStream Integrator v8.0 includes the following features and enhancements:

• ThreatStream Intelligence API: Intelligence API version 2 is available as an option. By default, version 1 is used. Version 2 allows the flexibility of using the same filter syntax that you use on the ThreatStream platform for filtering intelligence that is downloaded to Integrator. This version also offers an expanded set of fields for filtering.
• User Interface: The user interface has been updated to align with other Anomali products, creating consistency to improve the user experience. Changes include:
  • Converting the Source and Destination tabs to dashboards accessible from the top navigation bar.
  • Making System Settings accessible from the top navigation bar using the gear icon.

  • Destinations are presented as separate tiles on the Destinations dashboard. For each destination, the sync status indicator changes color depending on the success or failure of the last sync. On failure, errors are highlighted and details made available.

• Additional Versions Supported: This release provides additional support for these integrations:
  • Carbon Black Response 7.6.1
  • FireEye HX 5.2
  • Forcepoint 8.5.4
  • FortiSIEM (AccelOps) 6.3
  • Infoblox 8.6
  • LogRhythm 7.8
  • RSA NetWitness 11.7
• Installer: Starting with this release, only the 64-bit versions of Windows OS are supported for Integrator installations.
• Product Name Changes: AccelOps integration is now called Fortinet FortiSIEM. ArcSight ESM integration is now called Microfocus ArcSight ESM.
• End of Support—Destinations: The Hadoop Hive and Cloudera Impala destinations are no longer supported and have been removed from the Integrator binary.
• Deprecated Support: The following are no longer supported:
  • Microsoft NTLM Proxy.
  • CentOS 8.x
  • Internet Explorer 11
• End of Support—Versions: Support for these integration versions has been removed based on the support policy of the vendor:
  • Carbon Black Response 5.0, 6.2, and 6.4
  • FireEye HX 4.8, 4.9, and 5.0
  • Forcepoint 8.3
  • FortiSIEM (AccelOps) 4.4
  • Infoblox 8.2
  • LogRhythm 7.1, 7.2, and 7.4
  • McAfee NitroSecurity 11.2 and 11.1
  • Splunk 7.3 and 7.4
  • RSA NetWitness 11.3

ThreatStream Integrator 7.3.1 provides a fix for a security issue (CVE-2022-0778). It also fixes a bug present in the previous version.

ThreatStream Integrator 7.3 is the next release for the ThreatStream Integrator product line. This release includes the following features and enhancements:

• Granular Proxy Controls: Where a proxy has been defined, an option has been added that allows you to enable/disable proxy for:

  • Downloading intelligence from ThreatStream to Integrator.

  • Forwarding intelligence from Integrator to individual destinations.

    Note: Previously, a proxy server could only be used when downloading intelligence from ThreatStream to Integrator.

• OS Support: Support has been added for Ubuntu 20.x. Ubuntu 16.x is no longer supported.

• QRadar: A new field, QRadar reference set mode, has been added that allows you to specify the reference set to be used. If you select the default option, ThreatStream indicator type based, Integrator pushes intelligence data to reference sets in QRadar that match the iTypes downloaded from ThreatStream. If you select the new option, ThreatStream indicator tag based, Integrator creates reference sets based on the tags associated with the indicators and pushes intelligence to them. Doing so allows you to create rules based on tag-based reference sets. For example, you may want to create a rule for the reference set that contains intelligence about APT-28.

• URL with Parameters: By default, URLs with parameters are not pushed to destinations. A new option, Include URL Parameters, has been added to destinations that can accommodate URLs with parameters. If selected, any URL with associated parameters is passed to the destination along with the parameters.

• Crowdstrike: The built-in Crowdstrike integration has been removed as Crowdstrike no longer supports the API used. The integration has been replaced with the new standalone Crowdstrike SDK extension, available from the ThreatStream Downloads page.

• Supported Versions: This release provides additional support for these integrations: Arcsight ESM 7.2 and 7.5; CheckPoint R80.30 and R81.10; Cisco ASA 8.2.0 and 9.1.6; Cloudera Impala 3.2.0, 2.10.0; LogRhythm 7.4, 7.5, 7.6, and 7.7; QRadar 7.3.3, 7.4.1, 7.4.2, 7.4.3; Tanium Threat Response 2.4.

• Deprecated Versions: Support for these integration versions has been deprecated: Arcsight ESM 6.9; CheckPoint R80.10 and R80.20; Cloudera Impala 1.4.1, 2.5.0, and 2.6.0; LogRhythm 6.3; McAfee NitroSecurity 10.4; QRadar 7.4.0; Splunk 7.2.

ThreatStream Integrator 7.2.4 fixes the following issue (INTS-10443):

If the option to push URLs with parameters to the destination was disabled (default), use of the HEAD or SORT operators in the destination filter caused the filter to fail for Splunk, BlueCoat, Cisco ASA, Forcepoint, and Palo Alto Networks destinations.

ThreatStream Integrator 7.2.3 is the next release for the ThreatStream Integrator product line. This release includes the following enhancements:

• Infoblox: Added an optional integration setting, DNS View name, which enables you to override the default name.

• Crowdstrike: Replaced the Maximum entries (per indicator type) with three new integration settings: Maximum number of Hash indicators, Maximum number of Domain indicators, Maximum number of IP address indicators. The overall maximum number of indicators has been increased to 100,000 and can be distributed among these three indicator types

Version 7.2.2 was a limited availability release that provided targeted fixes for specific customers.

These fixes are rolled up into version 7.2.3.

ThreatStream Integrator 7.2.1 fixes the following issue (INTS-10353):

Setting ”type=ip” in the source filter did not work on Integrator 7.2. When "type=ip" was specified, Integrator did not download any of the IP observables.

ThreatStream Integrator 7.2.0 is the next release for the ThreatStream Integrator product line. This release includes the following enhancements:

• Upgrade: The upgrade process and experience has been improved and includes the following enhancements:
  • Maintenance Mode: This mode puts Integrator into a state to facilitate the upgrade process, such as all jobs are unscheduled, destination webservers are stopped, and all normal Integrator API endpoints become unavailable.
  • Automatic download of upgrades: Integrator automatically checks for new versions and downloads any available upgrades. Note that the upgrade is not applied automatically. You must take an action to apply the upgrade.
  • One-click upgrade option: A single-button upgrade option allows you to automatically install the latest version.

  • Revert to last version: If the upgrade fails, Integrator automatically reverts to the last installed version.

• Documentation: A new setting has been added to automatically download the latest version of the Integrator documentation.
• Supported Versions: This release includes support for these integrations: FireEye HX 5.0, McAfee NitroSecurity ESM 11.3, QRadar 7.4.1.

ThreatStream Integrator 7.1.1 fixes bugs in the previous version.

ThreatStream Integrator 7.1.0 is the next release for the ThreatStream Integrator product line. This release includes the following enhancements:

• LogRhythm: Enriched data is now provided for matches in LogRhythm.
• Limit Indicators associated with Threat Models: Starting with this release, indicator associations are limited to 10,000 per threat model entity downloaded to ThreatStream Integrator. Integrator downloads the most recent indicators in the ThreatStream database when threat model entities contain more than 10,000 associations. Contact Anomali Customer Support if you have different needs for your environment.
• Upgrade: The auto-update feature has been deprecated. ThreatStream Integrator must be updated manually.
• User Interface: The Admin password, set during installation, can now be changed from the ThreatStream Integrator user interface. Previously, admin password was managed exclusively from the command line.
• Crowdstrike: OAuth2 authentication is now required to integrate with Crowdstrike.
• Supported Operating Systems: This version adds support for RedHat 8.x and CentOS 8.x.
• Indicator Types: Integrator now supports the following additional indicator types: compromised_serv_account,fraud_ip, fraud_domain, fraud_email, fraud_md5, fraud_url, and phish_md5. In addition, Integrator supports custom indicator types created on ThreatStream OnPrem.
• Log Files: A new log file has been added to record sync events. Previously, sync events were recorded as part of the main integrator.log file.

ThreatStream Integrator 7.0.2 is the next release for the ThreatStream Integrator product line. This release includes the following enhancement:

SDK Destination: A new parameter has been added to the configuration file that allows you to redact JSON values for specific keys.

• New Interface: The interface has been re-designed to provide a new modern look.

• OS Support: Support for Windows Server 2016 and 2019 has been added. Either Windows Server

  2016 or Windows Server 2019 is required for Integrator v7.

  These operating systems have been deprecated and are no longer supported for:

  Windows Server 2012

  RedHat v6 and CentOS v6

  Note: Integrator 6.9.x, running on these systems, will be supported until the end of 2020.

• Supported Versions: This release provides additional support for these integrations: Carbon Black Response (6.4), FireEye HX (4.8 and 4.9), LogRhythm (7.4), McAfee NitroSecurity ESM (10.4, 11.1, and 11.2), QRadar (7.3.3), RSA NetWitness (11.3) and Splunk (7.3 and 8.0).

• Deprecated Versions: Support for these Integration versions has been deprecated: FireEye HX (3.0, 3.0.1, and 4.0), McAfee NitroSecurity (9.3, 9.5, 9.6, 10.0, and 10.1), QRadar (7.2.8, 7.3.0, and 7.3.1), RSA NetWitness (10.4 and 10.5), and Splunk (6.6 and 7.0).

• Custom Data Location (Windows only): By default, data is stored in the default directory. If you want to store your data in a different directory, you can now specify a custom location where the data is to be stored.

• MISP Destination: These additional fields/options have been added: Intelligence Type, Indicator Event Name and the ability to select Tags to Include.

This patch release fixes bugs (INTS-8004 and INTS-9020) in the previous version. It also fixes a performance issue relating to the Snapshot destination when integrating with Splunk.

Release: 6/30/2020

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

This patch release fixes a bug (INTS-8851) in the previous version.

Release: 1/7/2020

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

This patch release fixes a bug present in the previous version.

Release: 11/28/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

This patch release provides a fix for a security issue.

Release: 11/20/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

This patch is the next release for the ThreatStream Integrator product line.

Release: 11/11/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

• Supported Versions: This release provides additional version support for these integrations: Checkpoint (R80.10, R80.20, and R80.30), BlueCoat (6.7), and QRadar (7.3.2).

• Deprecated Versions: Support for QRadar versions 7.2.6 and 7.2.7 has been deprecated.

• Integrator Login Access: You can now limit login access to Integrator. The new login options allow you to ensure that, if required, you can prevent non-admin users from changing settings on Integrator. Possible options are:

  • Integrator admin and all ThreatStream users (apart from Read Only users)
  • Integrator admin and ThreatStream admin users only
  • ThreatStream admin users only
  Note: ThreatStream Read Only users cannot login to Integrator.

• Carbon Black: The maximum number of indicators that can be downloaded to a Carbon Black integration has been increased.

• Infoblox: An endpoint option has been added to the Infoblox integration that allows the user to fetch intelligence from Integrator. The user can download the files and manually import the data into Infoblox.

• Tanium IOC days range: The range (number of days) of indicator data that is forwarded to the Tanium destination has been increased and is now 1-365 days.

• User Interface: These changes have been made to the user interface to improve the user experience:

  • The Maximum number of indicators field, for Check Point and CrowdStrike destinations, has been renamed to Maximum entries (per indicator type). This change is to clarify that the field indicates the maximum number of each indicators per type and not the total number of indicators.
  • Addition of new fields on the Infoblox integration screen to cater for the new fetch option.
  • Removal of incremental update option from the BroIntel destination. A full refresh (file overwritten) is performed each time there is a sync.
  • Addition of a confirmation message when the Windows password is reset.
  • Removal of the destination filter field from the MISP destination as it is not used by MISP.
  • Addition of text to the Maximum indicator matches to enrich field for the QRadar integration to clarify that the default value indicates that no limit is set.
• Snapshot destination: The function of this feature has been clarified in the documentation.
• Filters: The status field has been removed from the list of available fields when defining filters; the trusted_circle_id field has been added to the list of available fields when defining filters.
• Hostname/IP Address: By default, the endpoint used by integrations (where applicable) is the IP address of the device on which Integrator is installed. An option has been added that enables you to specify a hostname/IP address that can be used instead of the default address. This can be done during the initial setup, or by amending the system settings.

• Destination icons: The icons for the BlueCoat and Carbon Black destinations have been updated on the destinations screen.

Release: 10/31/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2021

This release fixes an issue that caused configured QRadar destinations to display an error message on the dashboard widget.

Release: 10/4/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

This release provides a fix for an issue (INTS-8424) in which Integrator would not process the destination filter containing pipe (|) correctly when both, a source and destination filter, were specified on the Integrator. Additional functionality has been added to correctly handle pipes within the destination indicator filter field and resolve the issue.

Release: 9/4/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

This release adds a new feature, Allowed Tags, to MISP destinations. The new feature enables users to forward events matching the specified tags.

Release: 8/9/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

This release adds a new destination, MISP, to the list of available integrations. The new integration provides a seamless experience with MISP support directly available within Integrator interface.

Release: 7/23/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

• Threat Model Support: This release provides threat model support for Integrator SDK. In addition, threat model support for QRadar is now incorporated into Integrator. Understanding relationships across threat model entities provides additional context around threats and a deeper analysis of observables.

  Note: If you are upgrading from an earlier version, you must edit the threat intelligence source and select the threat models you want to download to enable this feature.

• SDK Updated: The SDK has been updated to cater for the new threat model support. You must upgrade to this version if you want to use the new threat model support functionality.
• Enable/Disable Destination: An option has been added to enable users to easily, temporarily disable/enable specific destinations. This facilitates the creation of multiple instances of a destination which can be used, for example, for testing.
• Platform Support: Support for Ubuntu 14.x has been withdrawn and support for Ubuntu 18.x has been added.

• Destination Support: Support for a number of destinations has been enhanced to take into account both new and deprecated versions:

  • Tanium version 6.5 is no longer supported
  • ThreatStream API version 2.0 has been introduced to provide threat model support
  • Splunk versions 6.4 and 6.5 are no longer supported; support has been added for versions 7.1 and 7.2
• Log Rotation: The capability has been added to define a maximum size for log files. Once the maximum size is reached, the file is automatically rotated by Integrator. You can also specify the maximum number of files in the rotation.

• User Interface: These improvements have been made to the user interface to improve the user experience:

  • Addition of a progress bar when downloading intelligence from ThreatStream
  • Addition of new fields on the QRadar and SDK integration screens to cater for threat model support
  • Addition of enable/disable icon to destination widgets, along with associated messages when the option is selected
  • Update of the icon for the Snapshot destination on the destinations screen

Release: 7/8/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

This patch is the next release for the ThreatStream Integrator product line.

Release: 4/30/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

• Supports a new integration—Forcepoint TRITON AP-WEB versions 8.3 and 8.4
• Introduces ThreatStream Integrator Software Development Kit (SDK)—to provide the flexibility of creating integrations for your network and security products that ThreatStream Integrator does not support out-of-box.
• Enables threat intelligence to be pushed to Splunk from ThreatStream or fetched by Splunk from ThreatStream.

• Removes SuSE Linux as a supported platform for ThreatStream installations

  If you are running ThreatStream Integrator on SuSE Linux, Anomali recommends migrating your ThreatStream Integrator installation to one of the supported platforms. If you wish to stay with SuSE Linux, you must disable auto-update and not upgrade to this or any future releases of ThreatStream Integrator.

This patch is the next release for the ThreatStream Integrator product line.

Release: 1/24/2019

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 2/29/2020

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 2/28/2021

This release is designed to provide a solution to an issue in which large number of matches on the QRadar App were resulting in the subsequent download of threat intelligence to the app being skipped. To fix the issue, ThreatStream Integrator is now configured to allow the app to match event data from the past 30 days only. For most customers this fix will mitigate the issue. However, if the issue persists in your environment, contact Anomali Customer Support for further tuning of your setup.

Release: 10/18/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This release includes support for FireEye HX version 4.x and several bug fixes.

Release: 8/22/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This release includes a back-end fix to an issue experienced by customers using a proxied environment and also has refined the indicator ingest process. Despite this, there is no noticeable difference in the user interface.

Release: 7/11/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This release includes reduced indicator download times, additional integration versions supported (Cloudera) and a minor bug fix.

Release: 5/25/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This limited availability release includes a fix for a destination filters issue affecting a small number of customers.

Release: 4/9/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

• This release includes increased SSL certificate security, enhanced associated signature algorithm and some bug fixes.
• Previous versions of Integrator generated a self-signed SSL certificate with a keysize of 1024 bits, using SHA-1 signature algorithm. From version 6.4.1, ThreatStream Integrator will generate a SSL certificate with a keysize of 4096 bits, using SHA-512 signature algorithm.
  Note: Existing self-signed SSL certificates generated by older versions of ThreatStream Integrator will not be upgraded.
ThreatStream Integrator does not support Tanium 6.2. Therefore, do not migrate to this release if you are running Tanium 6.2.

Release: 3/27/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

ThreatStream Integrator 6.4 is the next release for the ThreatStream Integrator product line. This release includes support for Windows installation.

Release: 2/23/2018

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This release includes support for Cisco ASA firewalls.

Release: 12/7/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

• This release includes support for a new integration destination and expands support for existing destinations:
• Check Point ^New!
• Infoblox 8.2
• McAfee NitroSecurity 10.0 and 10.1
• Additionally, the following destinations can now be enabled for My Attacks: QRadar and LogRhythm. This feature was previously supported on ArcSight ESM and Splunk only.
• The MyAttacks setting controls whether ThreatStream Integrator periodically collects information about observables that were matched in your environment and sends it back to ThreatStream. When this setting is enabled, a daily report of indicator matches called "Daily Outbound Indicator Matches" is auto-generated and sent back to ThreatStream. You can view the information sent to ThreatStream, in the My Recent Attacks dashboard widget on ThreatStream's landing dashboard. Additionally, you can visualize these matches in the MyEvents Map on the ThreatStream Cloud.

Release: 10/3/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This release includes support for the following integration destinations:

• AccelOps
• ArcSight ESM 6.9 and 6.11
• Blue Coat Proxy SG
• BroIntel
• Carbon Black
• Common Event Format (CEF)
• Cloudera Impala
• CrowdStrike Falcon
• FireEye
• Hadoop Hive
• Infoblox
• LogRhythm
• Palo Alto Networks
• QRadar 7.3
• RSA NetWitness
• Syslog
• Tanium

Release: 8/11/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

• A newly designed, intuitive user interface for all your site, destinations, and system management needs.
• Support for concurrent connections from multiple integrated destinations on a single ThreatStream instance.
• Full migration and upgrade support from ThreatStream Integrator to ThreatStream.
• Ability to define a custom destination that makes threat intelligence available in CSV, JSON, or SNORT formats as an endpoint on ThreatStream Integrator.

• Support for the following integration destinations:

  • ArcSight ESM
  • Splunk
  • McAfee NitroSecurity
  • QRadar
  • CSV
  • Custom Destination

Release: 7/13/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

• This patch provides the ability to exclude the header row from the CSV output files for custom destinations.

Release: 6/12/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

This patch provides a fix for an issue in which a proxy server configured to use NTLM authentication was not being used correctly by ThreatStream Integrator.

Release: 5/26/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020

ThreatStream Integrator 6.0 is the first generally available release of ThreatStream Integrator. It includes integration support for Splunk and Custom Destinations. A Custom Destination enables you to access downloaded threat intelligence in CSV, JSON, or SNORT format from an endpoint on ThreatStream Integrator using a utility such as wget.

Release: 5/14/2017

End of Support The last date support is available for a particular Product version. This is the last date Anomali will respond to any support issues with the Product version. After this date, support services for the product will cease, and the product is deemed to be obsolete. Anomali will no longer provide support or maintenance for the product, and in order to retain support, the customer is obliged upgrade to a supported release.: 12/31/2019

End of Life Once a product enters End of Life (EOL) status, all available support, including Extended or Exceptional support, will cease and the product will be deemed beyond use. Applicable products will enter End of Life (EOL) status one calendar year after a product enters EOS status.: 12/31/2020