ThreatStream OnPrem Release History

ThreatStream OnPrem 6.0 Red Hat release is generally available for fresh installations and upgrades.

It includes the following features and enhancements:

Virtual Machine

• Database Upgrade: Upgraded the PostgreSQL database to v16.

• Integration with SIEM: Added support for integrating ThreatStream OnPrem audit logs with SIEM systems.

• Installation & Upgrade: Added support for environments configured with a dedicated data partition.

• User Setup Automation: Added the user setup automation script that enables automatic daily user synchronization through a configurable cron job.

Manage

• MITRE ATT&CK: MITRE ATT&CK techniques and sub-techniques associated with v17.0 and v17.1 are now supported by ThreatStream OnPrem.

• MITRE ATT&CK: Security coverage of MITRE ATT&CK profiles can now be exported in JSON format.

• Rules: The created_ts and source_created fields are now supported for advanced search-based rule matching.

Research

• Sandbox: The following features have been added to malware detonation on Polyswarm: support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm scans.

Settings

• User & Role Management: The User & Role Management enables you to establish role-based access control for the ThreatStream OnPrem.

• OAuth 2.0 Support: ThreatStream OnPrem now supports OAuth 2.0 API Credentials.

• Integrations: The Google Threat Intelligence integration can now be activated on ThreatStream OnPrem. It enables you to include Google Threat Intelligence data in your Passive DNS enrichments.

Miscellaneous

• New Navigation: The navigation menu is now available on the left side of the ThreatStream OnPrem user interface.

• Anomali Copilot: You can now access the Anomali Copilot chat from the ThreatStream OnPrem interface. While available within OnPrem, the Anomali Copilot chat responds to queries using only remotely stored data. The Anomali Copilot chat leverages agentic search techniques, including semantic search, to understand the meaning and intent behind natural language queries. By interpreting context rather than relying solely on exact keyword matches, Anomali Copilot delivers more accurate and relevant results.

• Indicator Types: The benign_domain, phish_file_name , fraud_file_name, mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url indicator types have been added to ThreatStream On Prem.

ThreatStream OnPrem 6.0 Ubuntu release is generally available for fresh installations and upgrades.

It includes the following features and enhancements:

Virtual Machine

• Database Upgrade: The PostgreSQL database has been upgraded to v16.

• Integration with SIEM: You can now integrate ThreatStream OnPrem audit logs with SIEM.

Manage

• MITRE ATT&CK: MITRE ATT&CK techniques and sub-techniques associated with v17.0 and v17.1 are now supported by ThreatStream OnPrem.

• MITRE ATT&CK: Security coverage of MITRE ATT&CK profiles can now be exported in JSON format.

• Rules: The created_ts and source_created fields are now supported for advanced search-based rule matching.

Research

• Sandbox: The following features have been added to malware detonation on Polyswarm: support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm scans.

Settings

• User & Role Management: The User & Role Management enables you to establish role-based access control for the ThreatStream OnPrem.

• OAuth 2.0 Support: ThreatStream OnPrem now supports OAuth 2.0 API Credentials.

• Integrations: The Google Threat Intelligence integration can now be activated on ThreatStream OnPrem. It enables you to include Google Threat Intelligence data in your Passive DNS enrichments.

Miscellaneous

• New Navigation: The navigation menu is now available on the left side of the ThreatStream OnPrem user interface.

• Anomali Copilot: You can now access the Anomali Copilot chat from the ThreatStream OnPrem interface. While available within OnPrem, the Anomali Copilot chat responds to queries using only remotely stored data. The Anomali Copilot chat leverages agentic search techniques, including semantic search, to understand the meaning and intent behind natural language queries. By interpreting context rather than relying solely on exact keyword matches, Anomali Copilot delivers more accurate and relevant results.

• Indicator Types: The benign_domain, phish_file_name , fraud_file_name, mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url indicator types have been added to ThreatStream On Prem.

ThreatStream OnPrem 5.9/5-a Ubuntu release is generally available for fresh installations and upgrades.

It includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• The ThreatStream OnPrem appliance has been upgraded to Ubuntu 22.04.5 LTS.

• ESXi versions 5.5 and 6.0 are no longer supported.

• The primary disk size requirement for fresh installations has been updated.

• The latest Pivoting Chart License patch has been included in the ThreatStream OnPrem 5.9/5.9-a

• release.

Manage menu

• MITRE ATT&CK:

  • MITRE ATT&CK techniques and sub-techniques associated with v15.1 and v16.1 are now supported by ThreatStream OnPrem.

  • ThreatStream OnPrem now allows you to create multiple MITRE ATT&CK profiles with their own respective security coverage representation.

Settings menu

• Integrations: The Can Audit permission control setting is added to the User Admin tab in ThreatStream OnPrem Settings.

  • The bidirectional integration with ServiceNow ITSM is added to ThreatStream OnPrem. It can be enabled on the Integrations tab of the Settings page.

  • The domain drop-down menu items, which allow you to select a ServiceNow domain and user interface, are added to the activation process of the ServiceNow integration.

  • RiskIQ has reached its end-of-life; as a result, the integration with RiskIQ is no longer available on ThreatStream OnPrem.

Miscellaneous

• Advanced Search and Filtering: The character limit for advanced search queries is increased to 4,000 characters.

• Indicator Types: The following indicator types are added to the list of indicator types supported by ThreatStream OnPrem: actor_phone_number, actor_username, ransomware_group, ransomware_victim_domain, ransomware_victim_name, ransomware_victim_urlgaming_device_id, gaming_device_name, gaming_game_id, gaming_game_name, gaming_player_country, gaming_player_email, gaming_player_id, gaming_player_nickname, gaming_player_phone, social_forum_name, social_media_name, social_messaging_services, c2_dns_name, freq_abused_dns_provider, mal_relay_server_ip, mal_relay_server_ipv6, and suspected_c2_dns_name.

ThreatStream OnPrem 5.8 Red Hat 8.10 release is generally available for fresh installations and upgrades. It includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• Added support for Red Hat 8.10 OS.

• Added the script for running appliance health checks.

• Added password authentication to Elastic Search.

• Added support for Postgress password management.

• Added support for Redis password management.

• Added the command enabling you to establish a connection between ThreatStream OnPrem and ThreatStream TAXII server.

Manage menu

• Imports: The Source Locations and Target Locations fields are added to the Import Assistant. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

• Rules: The Add to New (for each rule match) action allowing you to create investigations for every rule match is added to rules.

Analyze menu

• Observables:

  • ThreatStream OnPrem now supports STIX 2.1 Notes.

  • The Source Locations and Target Locations fields are to observable details pages. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

• Threat Model:

  • You can initiate Sigma rule evaluation in AQL Search from a Sigma signature details page.

  • The Source Locations and Target Locations fields are added to Threat Models. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

Research menu

• Investigations:

  • Investigation details pages have a new look and feel.

  • When starting an investigation for observables, you can now view other open investigations associated with selected observables.

  • The Export MITRE ATT&CK to JSON option is added to the Export menu of investigation details pages.

• Sandbox:  Polyswarm is added to ThreatStream OnPrem as one of the sandbox services available for malware detonation.

Settings menu

• User Admin: The Can Audit permission control setting is added to the User Admin tab in ThreatStream OnPrem Settings.

• My Profile: Read Only users can now be granted a permission to view their API Key on the My Profile tab of the Settings page.

Miscellaneous

• Advanced Search and Filtering: The source_locations and target_locations intelligence fields are added to ThreatStream OnPrem for advanced search and filtering of the intelligence.

ThreatStream OnPrem 5.8-a has improvements to the upgrade experience over the earlier ThreatStream OnPrem 5.8 upgrade bundle, but otherwise ThreatStream OnPrem 5.8 and ThreatStream OnPrem 5.8-a are equivalent. If you have already successfully upgraded to 5.8, you do not need to upgrade to 5.8-a.

ThreatStream OnPrem v5.8 release is generally available for fresh installations and upgrades on Ubuntu. It includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• The OS of the ThreatStream OnPrem appliance is upgraded to Ubuntu 22 LTS.

• Password authentication is added to Elastic Search.

• Multihoming support is added to ThreatStream OnPrem.

Manage menu

• Imports: The Source Locations and Target Locations fields are added to the Import Assistant. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

• Rules: The Add to New (for each rule match) action allowing you to create investigations for every rule match is added to rules.

Analyze menu

• Observables:

  • ThreatStream OnPrem now supports STIX 2.1 Notes.

  • The Source Locations and Target Locations fields are to observable details pages. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

• Threat Model:

  • You can initiate Sigma rule evaluation in AQL Search from a Sigma signature details page.

  • The Source Locations and Target Locations fields are added to Threat Models. ThreatStream OnPrem supports 325 locations (as defined by STIX 2.1) including 27 regions, 247 countries, 50 US States, and Washington DC.

Research menu

• Investigations:

  • Investigation details pages have a new look and feel.

  • When starting an investigation for observables, you can now view other open investigations associated with selected observables.

  • The Export MITRE ATT&CK to JSON option is added to the Export menu of investigation details pages.

• Sandbox:  Polyswarm is added to ThreatStream OnPrem as one of the sandbox services available for malware detonation.

Settings menu

• User Admin: The Can Audit permission control setting is added to the User Admin tab in ThreatStream OnPrem Settings.

• My Profile: Read Only users can now be granted a permission to view their API Key on the My Profile tab of the Settings page.

Miscellaneous

• Advanced Search and Filtering: The source_locations and target_locations intelligence fields are added to ThreatStream OnPrem for advanced search and filtering of the intelligence.

ThreatStream OnPrem 5.7 Ubuntu release is generally available for fresh installations. It includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• Added a health check script.

• Added a package export script.

• Added modular upgrade support to allow customers to see the steps of the upgrading process.

• Added support for Postgres password management.

• System time is now managed with chrony.

Dashboard menu

• My Threats/Community Threats dashboard: The Community Threats dashboard and My Threat page are disabled.

Manage menu

• Feeds: The Entry Mappings section on feed details pages is renamed to Fields Mappings, and the Detail observable type on the Advanced Feed Configuration tab is renamed to Tag.

• Rules: The "Dismissed" status of rule matches is renamed to "Resolved".

Analyze menu

• Observables:

  • The Observables list page has a new look and feel.

  • The vuln_risk_score, ja3_md5, and ja3_md5 indicator types have been added to ThreatStream.

  • The ja3_md5 and ja3_md5 threat types have been added to ThreatStream.

  • The target_industry and target_region fields are added to the list of intelligence fields. The fields allow you to search for intelligence based on target regions and industries.

  • Values consisting of less than 3 characters are no longer supported for the contains search operator.

• Threat Model:

  • The MITRE ATT&CK tab is added to Threat Model details pages. The MITRE ATT&CK tab displays the MITRE heat map associated with a Threat Model entity.

  • The behavior of the body contains operator in advanced search queries is changed.

  • Threat Model details pages have a new look and feel.

  • Threat Model edit pages have a new look and feel.

  • You can now label Actors, Malware, Incidents, Tools, and Threat Bulletins with a target region and target industry.

  • Values consisting of less than 3 characters are no longer supported for the contains search operator.

• Attack Flows: You can now import, update, and export MITRE attack flows.

• Attack Surface Management:

  • The Attack Surface Assessment product is renamed to Attack Surface Management.

  • The Asset Inventory tab is added to display the latest information about the state of your organization assets.

  • The asset tagging feature is added to Attack Surface Management.

Research menu

• Investigations: The Export to PDF option is added to the Export menu of investigations.

• Sandbox: 

  • ThreatStream discontinued support for the VMRay Freemium sandbox service.

  • The Cuckoo sandbox service is no longer available for new ThreatStream users.

• Explore: The Explore page has a new look and feel.

Settings menu

• Organization:

  • The Can Use Rules permission control setting is added to the User Admin tab of ThreatStream settings.

  • MITRE ATT&CK techniques and sub-techniques associated with v13.1 and v14.1 are now supported by ThreatStream.

• TAXII: ThreatStream now supports incidents for STIX 2.1/TAXII.

Miscellaneous

• Text Editor: For security reasons, ThreatStream OnPrem discontinued support for image upload by URL in the text editor of comments and descriptions.

ThreatStream OnPrem 5.6 Red Hat release supports Red Hat 8.6 Enterprise and includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• Updated dependent software libraries and applications to recent versions.

• Addressed OS vulnerability scan findings.

• Added support for Postgres password management.

• Added support for FIPS.

Dashboard menu

• Custom Dashboards: The personalization settings such as widget notes, customization of date ranges, and additional editing options have been added to custom dashboards.

• My Threats/Community Threats dashboard: This dashboard displays the most Watched, Starred, Liked, and Commented intelligence from around the ThreatStream community over the last 30 days.

• Most Viewed Threat Models: Added a custom dashboard widget that shows the top 10 most viewed threat models.

Manage menu

• Imports: Tags can now be viewed in the Imports list table under the corresponding import job.

• Streams: The Streams list page and the Stream details pages have a new look and feel.

• Rules:

  • The Rules list page and the Rule details pages have a new look and feel.

  • The filter options are now available above the Rules table by default.

• Source Optimizer: The Source Optimizer page has a new look and feel.

• Intelligence Initiatives: Intelligence Initiative pages have a new look and feel.

Analyze menu

• Threat Models Overview: The Threat Models Overview page available from the Analyze > Overview menu has a new look and feel.

• Advanced Search: In both the Observables and Threat Model search pages, you can use Advanced Search to filter by feed name.

• TLP: To support TLP v2.0, the TLP: Amber+Strict was added to ThreatStream OnPrem, and the TLP:White was replaced with TLP: Clear. However, when creating advanced search queries, TLP:White and TLP: Clear can be used interchangeably.

• Observables:

  • The universal search results page has a new look and feel.

  • The Saved Searches page has a new look and feel.

  • You can perform bulk keyword search to find specific observables.

  • You can use a refresh option to retrieve the latest enrichment data on the observables from external sources and investigation entities.

  • Added phish_victim_email indicator type for emails of phishing attack victims.

• Threat Model:

  • The Threat Models list page has a new look and feel.

  • The Advanced Search filter user interface has a new look and feel.

  • Horizontal scrolling and drag-and-drop functionalities have been added to the Table Settings of list view pages.

  • Tags can now be viewed in the list table under the corresponding threat model entity.

  • Bulk edit (add and remove) tags of selected Threat Models.

  • The font styles and sizes have been added to the description box of Threat Model entities.

  • The Threat Model details pages now have icons to Watch, Star, Like, and Share the page. This icon bar at the top of the page also has a View counter displaying the count of views by your organization's users.

  • The option to include or exclude a description heading has been added to threat model report templates.

  • The clone option has been added to the Actions menu of the Anomali Default Template.

• Attack Surface Assessment: Receive weekly Attack Surface Assessment (ASA) reports to quickly identify vulnerabilities, misconfigured services, out of date software, and other issues that make your organization vulnerable to attacks. The feature requires additional subscription.

Research menu

• Investigations:

  • The Investigations page has a new look and feel.

  • Tags can now be viewed in the Investigations list table under the corresponding investigation.

  • The option to use a mouse wheel for zooming nodes has been added to the user interface of investigations.

  • View node details by hovering over nodes and move the chart around the workspace by right clicking on the chart of investigation entities.

  • The font styles and sizes have been added to the description box of Investigations.

  • The refresh option to retrieve the latest enrichment data on the observables from external sources and investigation entities has been added to ThreatStream.

  • You can now export investigations to a CSV file from Investigation details pages.

• Sandbox: The Sandbox details pages now have icons to Watch, Star, Like, and Share the page.

Notifications menu: The Notifications list page has a new look and feel.

Settings menu

• Mailboxes:

  • The Anomali Community Visibility setting, which was previously available for import mailboxes, is no longer supported.

  • Added Auto Approve and Include low confidence observables options for import sessions initiated from the import mailbox.

  • The number of email import addresses has been increased to 20.

• User Admin: The following improvements have been added to the User Admin page: easier search for accounts, ability to reset a user's API Key, improved look of the actions in the user table, and easier workflow for resetting user passwords.

• TAXII: 

  • Added a setting to skip strict checking of unresolved domains during TAXII imports.

  • Added toggles allowing to control access to API roots of discovery URLs for TAXII v2.0 and v2.1.

  • You can now add additional private tags when importing STIX 1.x XML files or configuring TAXII 1.x sites.

Profile menu

• The Profile page has a new look and feel.

• Email Notifications: The Disabled Rule Notifications setting, which allows Org Admins to receive an immediate email notification when a rule is disabled, has been added to the My Profile page.

The ThreatStream OnPrem 5.6.3 is a patch release aimed at resolving the following issue found in ThreatStream OnPrem 5.6.x Ubuntu releases:

OP - 34744: Resolved an issue that had resulted in an unexpected 'Bug Squasher' notification displayed in the ThreatStream OnPrem notification list.

The ThreatStream OnPrem 5.6a release replaces the ThreatStream OnPrem 5.6 release for new upgrades. If you already successfully upgraded to ThreatStream OnPrem 5.6, you do not need to upgrade to ThreatStream OnPrem 5.6a. For fresh installations, use ThreatStream OnPrem 5.6.

This release includes the following features and enhancements:

ThreatStream OnPrem virtual machine

• Updated dependent software libraries and applications to recent versions.

• Addressed OS vulnerability scan findings.

Dashboard menu

• Custom Dashboards: The personalization settings such as widget notes, customization of date ranges, and additional editing options have been added to custom dashboards.

• My Threats/Community Threats dashboard: This dashboard displays the most Watched, Starred, Liked, and Commented intelligence from around the ThreatStream community over the last 30 days.

• Most Viewed Threat Models: Added a custom dashboard widget that shows the top 10 most viewed threat models.

Manage menu

• Imports: Tags can now be viewed in the Imports list table under the corresponding import job.

• Streams: The Streams list page and the Stream details pages have a new look and feel.

• Rules:

  • The Rules list page and the Rule details pages have a new look and feel.

  • The filter options are now available above the Rules table by default.

• Source Optimizer: The Source Optimizer page has a new look and feel.

• Intelligence Initiatives: Intelligence Initiative pages have a new look and feel.

Analyze menu

• Threat Models Overview: The Threat Models Overview page available from the Analyze > Overview menu has a new look and feel.

• Advanced Search: In both the Observables and Threat Model search pages, you can use Advanced Search to filter by feed name.

• TLP: To support TLP v2.0, the TLP: Amber+Strict was added to ThreatStream, and the TLP:White was replaced with TLP: Clear. However, when creating advanced search queries, TLP:White and TLP: Clear can be used interchangeably.

• Observables:

  • The universal search results page has a new look and feel.

  • The Saved Searches page has a new look and feel.

  • You can perform bulk keyword search to find specific observables.

  • You can use a refresh option to retrieve the latest enrichment data on the observables from external sources and investigation entities.

  • Added phish_victim_email indicator type for emails of phishing attack victims.

• Threat Model:

  • The Threat Models list page has a new look and feel.

  • The Advanced Search filter user interface has a new look and feel.

  • Horizontal scrolling and drag-and-drop functionalities have been added to the Table Settings of list view pages.

  • Tags can now be viewed in the list table under the corresponding threat model entity.

  • Bulk edit (add and remove) tags of selected Threat Models.

  • The font styles and sizes have been added to the description box of Threat Model entities.

  • The Threat Model details pages now have icons to Watch, Star, Like, and Share the page. This icon bar at the top of the page also has a View counter displaying the count of views by your organization's users.

  • The option to include or exclude a description heading has been added to threat model report templates.

  • The clone option has been added to the Actions menu of the Anomali Default Template.

• Attack Surface Assessment: Receive weekly Attack Surface Assessment (ASA) reports to quickly identify vulnerabilities, misconfigured services, out of date software, and other issues that make your organization vulnerable to attacks. The feature requires additional subscription.

Research menu

• Investigations:

  • The Investigations page has a new look and feel.

  • Tags can now be viewed in the Investigations list table under the corresponding investigation.

  • The option to use a mouse wheel for zooming nodes has been added to the user interface of investigations.

  • View node details by hovering over nodes and move the chart around the workspace by right clicking on the chart of investigation entities.

  • The font styles and sizes have been added to the description box of Investigations.

  • The refresh option to retrieve the latest enrichment data on the observables from external sources and investigation entities has been added to ThreatStream.

  • You can now export investigations to a CSV file from Investigation details pages.

• Sandbox: The Sandbox details pages now have icons to Watch, Star, Like, and Share the page.

Notifications menu: The Notifications list page has a new look and feel.

Settings menu

• Mailboxes:

  • The Anomali Community Visibility setting, which was previously available for import mailboxes, is no longer supported.

  • Added Auto Approve and Include low confidence observables options for import sessions initiated from the import mailbox.

  • The number of email import addresses has been increased to 20.

• User Admin: The following improvements have been added to the User Admin page: easier search for accounts, ability to reset a user's API Key, improved look of the actions in the user table, and easier workflow for resetting user passwords.

• TAXII: 

  • Added a setting to skip strict checking of unresolved domains during TAXII imports.

  • Added toggles allowing to control access to API roots of discovery URLs for TAXII v2.0 and v2.1.

  • You can now add additional private tags when importing STIX 1.x XML files or configuring TAXII 1.x sites.

Profile menu

• The Profile page has a new look and feel.

• Email Notifications: The Disabled Rule Notifications setting, which allows Org Admins to receive an immediate email notification when a rule is disabled, has been added to the My Profile page.

The ThreatStream OnPrem 5.5a release replaces the ThreatStream OnPrem 5.5 release for new upgrades. If you already successfully upgraded to ThreatStream OnPrem 5.5, you do not need to upgrade to ThreatStream OnPrem 5.5a.

The release supports upgrade of the host operating system from Ubuntu 18.04 LTS to Ubuntu 20.04 LTS. However, it does not support new installations. To install ThreatStream OnPrem for the first time, install ThreatStream OnPrem 5.4 and then upgrade to 5.5a.

This patch release resolves the issue with the upgrade to ThreatStream 5.5. Postgres found in ThreatStream OnPrem 5.5 Ubuntu.

This is the upgrade only release developed to update the appliance OS to Ubuntu 20.04 LTS.

This patch release resolves the issue with the upgrade to ThreatStream 5.4. Postgres found in ThreatStream OnPrem 5.4 Ubuntu.

This release includes the following features and enhancements:

ThreatStream OnPrem virtual machine

Security updates: The virtual machine operating system has been updated to address the latest vulnerability scan findings. For the upgrade, we provide a separate security update bundle to address the latest vulnerability scan findings.

Dashboard enhancements

• All Dashboards: You can now rearrange the order of the dashboards on your home screen by dragging and dropping the dashboard tabs

• Intelligence Initiatives: Added the following new widgets: Active, Import, Observables and My Investigation by Intelligence Initiative.

• Custom Dashboards: You can now can add up to 20 widgets to your custom dashboards.

• Integrator Status: The Integrator Status widget on the Weekly Summary dashboard has been updated with a new interface and displays additional information on the health of your integrations.

• Manage Dashboards: You can now use a new dashboard management screen to show, hide, and search for your dashboards all in one place.

Manage

• Imports:

  • The Import Job Details page has a new look and feel.

  • The Included tab on the Import Review screen has been enhanced with a Confidence filter and an easy to use Exclude button.

  • When importing observables using the Scrape from URL option, you can use a new setting to automatically exclude email, domain, or URL observables that share a domain with the source URL.

  • You can now delete errored import jobs.

• Trusted Circles: The Trusted Circles page has a new look and feel.

• Streams: New Streams can only be visible to your organization and not to Anomali Community.

• Rules:

  • You can now configure rules based on advanced observable or Threat Model search queries.

  • You can now configure advanced search-based rules to match Campaigns, Courses of Action, Identities, Incidents, Infrastructure, Intrusion Sets, Malware, Tools, and Vulnerabilities.

  • Additionally, email notifications are sent when rules are automatically disabled by ThreatStream, even in cases where the Notify Me setting is disabled.

  • ThreatStream limits rule filters to 100,000 results in the past 24 hours. If the limit is exceeded,local rules are not disabled but remote rules will be disabled to throttle results to the limit.

• MITRE ATT&CK:

  • Mobile and ICS types of MITRE ATT&CK Framework are now supported by ThreatStream and can be leveraged within Investigations.

  • MITRE ATT&CK techniques and sub-techniques associated with v12.1, v11.3, v11.0,v10.1, and v10.0 are available in the Anomali Threat Model.

• Intelligence Initiatives: You can now add intelligence requirements, which function as secondary intelligence initiatives, to open intelligence initiatives. In addition to the Local Observables and Rules previously available, you can now also associate Import Sessions and Threat Models (from the Details view) with intelligence initiatives.

• Manage Dashboards: You can now use a new dashboard management screen to show, hide, and search for your dashboards all in one place.

• Task Automation: When you need to run several checks on an observable, you can use an automated task—a predefined sequence of enrichments applied to a specific type of the observable during the investigation.

Analyze

• Observables:

  • Added the Infected Bot Domain Name (bot_domain), Infected Bot Hash (bot_md5), Infected Bot URL (bot_url), Exploit Hash (exploit_md5), and compromised Username (compromised_username) indicator types. Compromised Usernames are of type String, and are therefore available on ThreatStream only. They are not available on Security Analytics or ThreatStream Integrator.

  • The Matches and My Attacks information (previously known as Sightings) provides a comprehensive view of the attack data received from your Anomali Match on-premise, and integration destinations such as ArcSight ESM, LogRhythm, QRadar, and Splunk that are impacting your infrastructure.

  • Bulk Edit Tags: You can now edit (add and remove) tags from the Observables Advanced search page. Select the elements and then select the Bulk Edit Tags. If you do not select any elements, the Bulk Edit Tags action will be applied to the first 10,000 elements.

  • STIX 2.0 exports now support an additional valid_until field. STIX 2.1 exports now support the following fields: valid_until, labels, confidence, and indicator_types.

• Threat Model:

  • Sigma Signatures: Sigma is added to the list of signature types available in ThreatStream.

  • Threat Model entity attachment uploads can now include up to 15 files at once. Further, all Threat Model entity types besides Signatures and TTPs can contain file attachments.

  • An Investigations tab has been added to Threat Model entity details pages that lists associated investigations.

  • Attack Flow: You can use the Attack Flow Library to visualize the sequence of techniques used in an attack, the relationships betwee techniques, and other information to stop or prevent attacks on your environment at an early stage of an attack flow.

APP Store

• Feed Health: You can view the synchronization history of active feed sources listed in the APP Store from the last 30 days.

• Feed Health Notifications: You can receive an email or in-app notification when a feed is down.

Settings

• Organization: You can use a new setting, Restrict TLP White Comments, to restrict users in your organization from posting TLP White comments in Threat Models, Observables, and Sandbox Reports if you want to prevent your organization’s comments from being shared publicly.

• SSO

  • Added the ability to enable single sign-on (SSO) and ThreatStream user administration through integration with any SAML 2.0-compliant identity provider.

  • User self-provisioning of SSO has been improved to provide better flexibility in the way service or provider details are configured.

• TAXII: The ThreatStream TAXII Client can now receive data from TAXII 2.0 and 2.1 servers. Additionally, collections from specific API Roots on TAXII 2.0 and 2.1 sites can be configured.

• Preferred Tags: You can allow non-admin users to add new tags and choose to include or exclude kill chain tags from the list of preferred tags.

• Description Templates: You can create rich text description templates and manage them from ThreatStream Settings, Threat Models, or investigations.

This is a patch release for ThreatStream OnPrem 5.3 Red Hat 8.4 and ThreatStream OnPrem 5.3

Red Hat 7.9 deployments. It fixes the issue that prevented the Postgres service from starting.

This release includes the following features and enhancements:

• Reverse Proxy Support: Configure ThreatStream to run behind a reverse proxy.

• External Image Handling: In cases where ThreatStream OnPrem cannot access images included in the details pages of Threat Model entities, External Image Link buttons are displayed in place of the images.

• TAXII:

  - ThreatStream now includes a local TAXII server. TAXII clients can connect to this local server and poll data that is stored locally on your ThreatStream appliance.

  - TAXII 1.x, 2.0, and 2.1 discover URLs enable you to poll data from your TAXII feeds on ThreatStream into TAXII clients in TAXII 1.x, 2.0, and 2.1 formats.

• Anomali Lens:ThreatStream is now compatible with the Anomali Lens+ Add-Ins for Office 365. See the Anomali Lens User Guide for information on the latest features available in Anomali Lens.

• Intelligence Initiatives: Attribute organizational efforts to specific goals by centralizing related investigations and Threat Model entities. Intelligence initiatives created on ThreatStream can be associated with local data only.

• Custom Dashboards

  - Create custom dashboard widgets based on saved advanced Threat Model search filters. Custom dashboards can be exported in PDF format. Additionally, individual dashboard widgets can be exported in PNG format.

• Search:

  - Advanced search functionality has been added to the Anomali Threat Model. With advanced search, you can construct search filters for specialized searches. Search filters can be saved for later use.

  - The user interface for constructing advanced search filters on the Observable and Threat Model search pages has been improved.

  - The advanced observable and Threat Model search screens now automatically save the most recent advanced search query you executed. Simply select Last Search from the Search Filter menu to execute the search again.

  - A Key Filters section has been added to the left filter for the Observable and Threat Model basic search screens. These filters enable you to quickly locate data created by your organization or open source feeds.

  - The character limit for saved observable search filters has been increased to 2,000.

• Rules: An Enabled switch allows you to toggle whether the rule is enabled. If switched off, the rule is disabled and no longer matches for keywords in new intelligence.

• SSO Self Service: Provision and manage integration with SAML 2.0 and OKTA Marketplace identity providers to enable single sign-on (SSO) for ThreatStream.

• APP Store: Enrichments are now available for activation from the ThreatStream APP Store. Previously, enrichments were managed from the Integrations tab of ThreatStream Settings.

• Threat Model:

  - Create STIX compliant relationship objects (SROs) that define relationships between entities in the Anomali Threat Model. Additionally, STIX 2.1 compatible custom objects through the STIX tab of the import assistant.

  - View alternate versions of MITRE ATT&CK techniques and sub-techniques associated with v7.2 and later from attack pattern detail pages. Simply click View Alternate Version in the Actions menu of attack pattern details pages to do so.

• Sandbox:

  - The Cuckoo implementation has been updated to a more recent supported platform. Note that the new Cuckoo sandbox supports Windows 7 but does not support Windows XP detonations.

  - The API Endpoint for malware submissions to Joe Sandbox is now configurable. When you activate the Joe Sandbox integration, you are prompted to configure the Joe Sandbox API endpoint setting for your specific subscription.

• User Administration:

  - A new Submit Sandbox user permission can be used to control which users are allowed to submit to a sandbox detonation service.

  - The user interface for the Audit page has been redesigned to make it easy to apply filters and export audit log reports.

• Organization Administration:

  - An Allow Observable Imports from Sandbox setting enables Org Admins to configure whether organization users can automatically import observables discovered during Sandbox detonations. When this setting is enabled, an additional option allows Org Admins to configure whether the Import Observables option is pre-selected on the Sandbox detonation window.

  - An Email Report Distribution setting enables Org Admins to restrict the email domains with which Threat Model entities can be shared.

• Indicator Types: Added the actor_subject, apt_subject, fraud_email_subject, hack_tool_md5, malware_email_subject, phishing_email_subject, spam_email_subject, suspicious_email_subject, email_attachment_subject, and compromised_email_subject indicator types.

• Enrichments: 

  - Added the CipherTrace Sentry, Deloitte Codex, GreyNoise, ReversingLabs, and Symantec Endpoint Security enrichments.

  - The HYAS, Hybrid Analysis, Qualys, and VirusTotal enrichments have been updated.

  - Anomali supports local installation of the Tenable.sc and Splunk Sightings enrichments on ThreatStream. Official support is not extended to other enrichments provided by Anomali.

• STIX Import: A new STIX Imports screen enables you to view the status of STIX import jobs.

• Workgroups Dashboard: Gain insight on the latest activity from your workgroups using the Workgroups Dashboard. Additionally, Read Only users can now be added to to workgroups.

• MITRE ATT&CK: 

  - Configure a representation of your organization security controls using the MITRE ATT&CK Framework. After configuring your security controls, you can overlay them on MITRE ATT&CK models within investigations to get a snapshot of your coverage for a particular threat.

  - Org Admins can specify a default MITRE ATT&CK version for their organization. Specifying a MITRE ATT&CK version determines which version is displayed by default on attack pattern details pages for MITRE ATT&CK techniques associated with v7.2 and later. MITRE ATT&CK techniques associated with v6 and earlier are classified as TTPs in the Anomali Threat Model.

• Investigations:

  - Create investigations that are visible only to you.

  - To enable collaboration within investigations, ThreatStream locks investigations when an edits are made. Other users with access to the investigation are prevented from making edits until the editor saves the investigation or leaves the page.

  - The Explore pivoting tool on the investigations user interface has been enhanced with a new Selection Details panel. The panel enables you to search nodes on the chart and view more details about selected nodes without drilling down to entity details pages.

  - Leverage contextual data enrichments within from the Explore pivoting tool within investigations. Contextual enrichments, which are also available in the Enrichments section on observable details pages, provide qualitative information from third-party sources on individual observables.

  - Export a list of investigations in CSV format from the investigations list view screen.

  - A Bulk Add option has been added to the Explore pivoting chart and the table view on the investigations user interface. Bulk Add enables you to add candidate observables to the investigation from a PDF or TXT file at any time.

  - Add analysis to investigation entities in the Not Imported status.

• Import: Added the ability to delete errored import jobs.

This release includes the following fixed issues:

• OP-26713: Users experienced latency issues during login to the ThreatStream OnPrem user interface.

• OP-25391: This fix disables automated Ubuntu security updates.

• OP-25389: The following error would display when proxy server was configured on ThreatStream OnPrem:

  Host names should be alphanumeric plus dots

  The issue has been fixed. The proxy server field accepts valid host names comprised of alphanumeric characters, minus sign, and dots.

• OP-25208: This fix disables the automated Ubuntu message of the day.

This patch release provides fixes and backend improvements.

This release includes the following enhancement:

Ubuntu Upgrade: ThreatStream OnPrem has been upgraded to Ubuntu 18.04 LTS.

• Dashboards:

  - Create custom dashboards to surface Threat Intelligence data of interest in customizable widgets. When you create a custom dashboard, you choose whether the dashboard is visible only to you or made available to all users in your organization.

  - A new Investigations dashboard widget enables you to view investigations assigned to you or a workgroup to which you belong by status. You can filter Investigations on the widget by Assignee.

  - All four investigation statuses—Unassigned, In Progress, Pending, and Complete—are now displayed on the Investigations widget on the Reporting Dashboard. You can also view counts of investigations created by the user.

• ADFS Support: Added the ability to integrate with Microsoft Active Directory Federation Services (ADFS), thus enabling single sign-on (SSO) and ThreatStream user administration from Microsoft Active Directory (AD) or Azure AD.

• APP Store:

  - FireEye Mandiant subscribers can receive threat intelligence from FireEye on ThreatStream through a dedicated feed.

  - ZeroFOX subscribers can receive threat intelligence from ZeroFOX on ThreatStream through a dedicated feed. You can also subscribe to ZeroFOX on a trial basis.

  - Dragos subscribers can receive threat intelligence from Dragos on ThreatStream through a dedicated feed. You can also subscribe to Dragos on a trial basis.

  - APP Store tiles have been improved for better readability and usability.

  - Recorded Future subscribers can activate the Recorded Future feed from the APP Store.

  - Kaspersky subscribers can activate the Kaspersky APT Intelligence Reporting feed from the APP Store. The feed can be activated by uploading an SSL certificate from the Kaspersky tile.

  - The APP Store has been enhanced with an alternate list view user interface. You can toggle between the traditional tile view and the new list view. Additionally, you can leverage a search function to quickly locate streams by name.

• Threat Model:

  - Attack Patterns, Courses of Action, Identities, Infrastructure, Intrusion Sets, and Tools have been added to the ThreatStream Threat Model.

  - Export STIX 2.0 and STIX 2.1 compatible Threat Model entities and Observables.

  - Import STIX 2.0 and STIX 2.1 compatible Threat Model entities and Indicators. For STIX 2.0 and 2.1 Observable imports, only basic patterns are supported. Basic patterns contain one Observation Expression which consists of a single Comparison Expression.

  - Anomali Lens+ customers can leverage the MITRE ATT&CK Framework within Investigations.

  - Nation State is an available Victim for Actors on ThreatStream.

  - The Threat Model list view has been updated with CVSS 2.0 and CVSS 3.0 columns. These columns are not displayed by default and can be selected by clicking the settings wheel.

  - STIX 2 and 2.1 imports and exports support additional STIX2 Cyber Object types: file (file_name), email-message, mutex, and windows-registry_key.

  - Threat Model search results can be filtered by entity Owner (the user who created the entity). Previously, this information was only visible on Threat Model entity details pages.

  - User information is displayed next to actions listed in Threat Model entity history. Previously, only actions were displayed.

  - Share Threat Model entities with ThreatStream users (within or outside your organization) or non-ThreatStream users through email from the Threat Model List View screen.

  - A new search filter on the Threat Model list view, Show Only Open Source Threat Models, enables you to search Threat Model entities provided by open source intelligence streams exclusively.

  - Added the ability to specify Source Created and Source Modified timestamps during Threat Model entity creation.

  - Add labels to Threat Model and observables associations to track contextual information. Additionally, an Associated Creation Date timestamp is added when you create associations.

  - When you share Threat Model entities through email, you can optionally attach a PDF export of the Threat Model entities to the email. PDFs are generated based on a template of your choosing.

  - Leverage a Default Anomali Template for PDF Report creation.

  - The PDF Report creation window has been updated with a new user interface.

  - Set a default PDF Report template. Default templates are displayed at the top of the template list when you create PDF Reports. Default template is a user-level setting and does not impact other users in your organization.

• Investigations:

  - Observable whitelists are not applied to Not Yet Imported observables in investigations, thus giving you an expanded view of the data under investigation. Previously, whitelists were applied to these observables before explicit action was taken to import them.

  - A new option on the on-board Explore pivoting chart within investigation enables you to automatically add MITRE TTPs associated with entities that result from pivots.

  - Create ad-hoc connections between investigation entities and MITRE ATT&CK TTPs within an investigation. This feature enables you to map investigation entities on the MITRE ATT&CK heatmap at will.

  - The Investigation Entities filter on the MITRE ATT&CK model has been enhanced to include all investigation entity types, including ASNs, metadata, and tags. Additionally, all investigation entities—including those without MITRE TTP associations—now appear in the filter.

  - Pending import sessions associated with investigations are now available from the Entity Overview section of the investigations user interface. You can click the Pending Import Session link to view pending import sessions in a pop-up window, from which you can approve or reject the import sessions.

  - The Imports list on Investigation details pages has been updated with a "Reviewed By" column.

  - Links can now be created between individual nodes and groups. Additionally, when you add a link between a node or group with a group, links are created with each node contained within the group. Thus, if you ungroup nodes in a group, the original link is maintained with each ungrouped node.

  - Added the ability to rename node groups on the on-board Explore pivoting tool within investigations.

  - Investigation and tasks within investigations can now be set to "Unassigned" after being assigned to a specific user or workgroup. Previously, investigations and tasks could only be reassigned to different users or workgroups after initial assignment.

  - The Explore pivoting chart has been enhanced. You can zoom using your mouse wheel by clicking inside the chart and holding the control key on your keyboard. Additionally, zoom centers on specific nodes when you select nodes and zoom in or out.

  - Added the ability to delete investigation attachments.

  - The maximum file size for candidate observable PDF uploads during investigation creation has been increased to 20MB.

  - The search function on the on-board Explore pivoting tool within investigations has been enhanced to display observable sources in the search results. With this enhancement, you can select an instance of the observable based on the source of your choosing.

  - The Explore pivoting chart has been enhanced. When you zoom in on a section of the chart and add a new node, the current zoom setting persists after the node is added.

  - The Explore pivoting chart has been enhanced. A "Search All" pivot has been added to each enrichment pivot menu. When you click this option, all pivots for the enrichment are executed on the selected nodes.

  - The maximum file size for investigation attachments has been increased to 20MB.

• Observables:

  - The subtypes field provides additional metadata on the type of hash associated with hash observables. Possible values include MD5, SHA1, SHA256, SHA512.

  - Added MD5, SHA1, SHA256, and SHA512 hash type filters to the observables search screen. Filters are available when you select Hash in the Type filter section. Filtering hashes with this level of granularity was previously unavailable.

  - Added the Compromised Service Account (compromised_service_account) indicator type.

  - A new observable search filter, Open Source Intelligence, enables you filter on observables provided by open source intelligence feeds aggregated by ThreatStream.

  - Added hash as a valid value for the type field to filter observables on the search screen. Previously, the only acceptable value for this field was md5, which led to user confusion that only hashes of type md5 were being filtered and displayed.

  - Observable Search supports entering defanged domain, email address, IP address, and URL observable queries. When you enter a defanged value, ThreatStream queries and returns non-defanged observable values.

  - Added the fraud_domain, fraud_email, fraud_ip, fraud_md5, and fraud_url indicator types. You can now import Fraud type observables from the Import Assistant on the ThreatStream OnPrem user interface.

  - STIX 1.x Indicator exports now include tags associated with observables in ThreatStream. Tags are exported as Cybox:Keywords in the resulting file. Exports can include up to 250 tags.

• Chat: Leverage instant messaging within ThreatStream to chat with Organization and Trusted Circle members.

• Sandbox:

  - The character limit of URLs supported for submission has been increased to 2000.

  - The maximum number of Sandbox Reports included in CSV exports has been increased to 10,000.

  - Remaining sandbox submissions for the current 24 hour period are listed at the bottom of the sandbox submission windows for all vendors. Previously, this count was not available for Cuckoo sandbox submissions.

• Enrichments:

  - A new Splunk Sightings integration enables you view sightings from your Splunk cloud instance on observable details pages in ThreatStream.

  - Render vulnerable assets in your network from Qualys on details pages of CVE compliant vulnerabilities in ThreatStream.

  - Added the PolySwarm enrichment.

  - Added the HYAS Insight enrichment.

  - Added the Spur IP Context enrichment.

• User Admin: The email notification sent to the organization administrator when a new user is added to the organization now includes permissions that were assigned to the user.
• Streams: Export stream details in CSV format.

• Import:

  - After rejecting an import job, observables listed in the Included and Excluded tables of the import job are maintained for future reference.

  - Associate observables with Vulnerabilities during import.

  - Observables can be associated with Signatures during import by clicking Add Association on the Import Assistant. Previously, Signatures could not be associated with observables during import.

  - The Import list view has been updated with a Reviewed By column, which contains the username of the user who approved the import session. This column is not displayed by default and can be selected by clicking the settings wheel.

  - Added the ability to specify Source Created and Source Modified timestamps for observables during import.

  - Cybox:Keywords are now added as observable tags during STIX 1.2 imports. Cybox:Keywords are not supported for STIX 1.2 exports.

• Rules:

  - Restrict rule email notifications to a specific user workgroup.

  - Email notifications for observable matches now contain timestamps of the most recent import which the rule matched. Previously, only timestamps of initial imports for observables were displayed.

  - Keywords now appear in a comma separated list on the Edit Rule window, thus simplifying the process of modifying existing keywords.

  - The rule configuration workflow has been enhanced with the ability to add multiple keywords in a comma separated or line broken list. Additionally, the indicator type selection workflow has been simplified.

  - Create rules which are visible only to selected workgroups.

  - Matched intelligence can be added to a new or existing investigation. Previously, intelligence could only be added to new investigations. Additionally, you can configure an assignee for investigations created as a result of rule matches and restrict investigation visibility to organization workgroups.

  - Create and edit rules using an intuitive wizard.

  - A new Notify Me setting enables you to opt in or out of email notifications for individual rules. Notify Me is a user level setting and does not impact notification preferences for other users in your organization.

• PDF Reports:

  - Generate PDFs based on customizable templates for sharing with a wider audience outside of ThreatStream.

  - PDF Reports, the template-based PDF export feature for the Anomali Threat Model, has been enhanced. You can now specify colors using hex codes, enjoy a simplified margin configuration experience, and clone templates to create editable versions while preserving the original.

• Sandbox:

  - A new integration with VMRay enables VMRay customers to leverage the VMRay commercial service for malware detonation within the ThreatStream platform.

  - Export Sandbox Reports in CSV format.

  - A new freemium integration with VMRay enables all ThreatStream users to leverage VMRay for malware detonation from the ThreatStream user interface. ThreatStream users can activate the freemium VMRay sandbox service at no additional charge.

  - Cuckoo sandbox detonations are now limited to 150 submissions per 24 hours.

• Anomali Lens in ThreatStream: Use an on board version of Anomali Lens within the ThreatStream platform.

• Notifications: Subscribe to email and in app investigations notifications based on a granular list of events. Previously, a single subscription was available for investigation notifications.

• Integrations: A new integration with JIRA enables you to create and update JIRA tickets from the Investigations user interface within ThreatStream.

• Organization Administration:

  - A new setting enables Org Admins to configure a default timezone for timestamps displayed on the ThreatStream user interface for your organization.

  - A new setting enables Org Admins to configure whether ThreatStream Integrator performs a full intelligence resynchronization each time your organization joins a new Trusted Circle or subscribes to a new intelligence feed.

  - Org Admins can specify a maximum session lifetime for users in their organization. When this setting is enabled, active ThreatStream sessions are terminated after the specified length of time.

  - Org Admins can audit PDF Report creation activity from the Audit screen within ThreatStream settings.

• SSO: Organizations that leverage SSO for ThreatStream authentication can configure a custom error message displayed when users attempt to authenticate using an account that does not exist in ThreatStream.
• Workgroups: Restrict the visibility of observables, Threat Model entities, and investigations to specific workgroups within your organization.

• Streams: The ability to create tags that are private to your organization has been added to the Streams configuration workflow.

Released: 3/22/2021

• Dashboards:

  - Create custom dashboards to surface Threat Intelligence data of interest in customizable widgets. When you create a custom dashboard, you choose whether the dashboard is visible only to you or made available to all users in your organization.

  - A new Investigations dashboard widget enables you to view investigations assigned to you or a workgroup to which you belong by status. You can filter Investigations on the widget by Assignee.

  - All four investigation statuses—Unassigned, In Progress, Pending, and Complete—are now displayed on the Investigations widget on the Reporting Dashboard. You can also view counts of investigations created by the user.

• ADFS Support: Added the ability to integrate with Microsoft Active Directory Federation Services (ADFS), thus enabling single sign-on (SSO) and ThreatStream user administration from Microsoft Active Directory (AD) or Azure AD.

• APP Store:

  - FireEye Mandiant subscribers can receive threat intelligence from FireEye on ThreatStream through a dedicated feed.

  - ZeroFOX subscribers can receive threat intelligence from ZeroFOX on ThreatStream through a dedicated feed. You can also subscribe to ZeroFOX on a trial basis.

  - Dragos subscribers can receive threat intelligence from Dragos on ThreatStream through a dedicated feed. You can also subscribe to Dragos on a trial basis.

  - APP Store tiles have been improved for better readability and usability.

  - Recorded Future subscribers can activate the Recorded Future feed from the APP Store.

  - Kaspersky subscribers can activate the Kaspersky APT Intelligence Reporting feed from the APP Store. The feed can be activated by uploading an SSL certificate from the Kaspersky tile.

  - The APP Store has been enhanced with an alternate list view user interface. You can toggle between the traditional tile view and the new list view. Additionally, you can leverage a search function to quickly locate streams by name.

• Threat Model:

  - Attack Patterns, Courses of Action, Identities, Infrastructure, Intrusion Sets, and Tools have been added to the ThreatStream Threat Model.

  - Export STIX 2.0 and STIX 2.1 compatible Threat Model entities and Observables.

  - Import STIX 2.0 and STIX 2.1 compatible Threat Model entities and Indicators. For STIX 2.0 and 2.1 Observable imports, only basic patterns are supported. Basic patterns contain one Observation Expression which consists of a single Comparison Expression.

  - Anomali Lens+ customers can leverage the MITRE ATT&CK Framework within Investigations.

  - Nation State is an available Victim for Actors on ThreatStream.

  - The Threat Model list view has been updated with CVSS 2.0 and CVSS 3.0 columns. These columns are not displayed by default and can be selected by clicking the settings wheel.

  - STIX 2 and 2.1 imports and exports support additional STIX2 Cyber Object types: file (file_name), email-message, mutex, and windows-registry_key.

  - Threat Model search results can be filtered by entity Owner (the user who created the entity). Previously, this information was only visible on Threat Model entity details pages.

  - User information is displayed next to actions listed in Threat Model entity history. Previously, only actions were displayed.

  - Share Threat Model entities with ThreatStream users (within or outside your organization) or non-ThreatStream users through email from the Threat Model List View screen.

  - A new search filter on the Threat Model list view, Show Only Open Source Threat Models, enables you to search Threat Model entities provided by open source intelligence streams exclusively.

  - Added the ability to specify Source Created and Source Modified timestamps during Threat Model entity creation.

  - Add labels to Threat Model and observables associations to track contextual information. Additionally, an Associated Creation Date timestamp is added when you create associations.

  - When you share Threat Model entities through email, you can optionally attach a PDF export of the Threat Model entities to the email. PDFs are generated based on a template of your choosing.

  - Leverage a Default Anomali Template for PDF Report creation.

  - The PDF Report creation window has been updated with a new user interface.

  - Set a default PDF Report template. Default templates are displayed at the top of the template list when you create PDF Reports. Default template is a user-level setting and does not impact other users in your organization.

• Investigations:

  - Observable whitelists are not applied to Not Yet Imported observables in investigations, thus giving you an expanded view of the data under investigation. Previously, whitelists were applied to these observables before explicit action was taken to import them.

  - A new option on the on-board Explore pivoting chart within investigation enables you to automatically add MITRE TTPs associated with entities that result from pivots.

  - Create ad-hoc connections between investigation entities and MITRE ATT&CK TTPs within an investigation. This feature enables you to map investigation entities on the MITRE ATT&CK heatmap at will.

  - The Investigation Entities filter on the MITRE ATT&CK model has been enhanced to include all investigation entity types, including ASNs, metadata, and tags. Additionally, all investigation entities—including those without MITRE TTP associations—now appear in the filter.

  - Pending import sessions associated with investigations are now available from the Entity Overview section of the investigations user interface. You can click the Pending Import Session link to view pending import sessions in a pop-up window, from which you can approve or reject the import sessions.

  - The Imports list on Investigation details pages has been updated with a "Reviewed By" column.

  - Links can now be created between individual nodes and groups. Additionally, when you add a link between a node or group with a group, links are created with each node contained within the group. Thus, if you ungroup nodes in a group, the original link is maintained with each ungrouped node.

  - Added the ability to rename node groups on the on-board Explore pivoting tool within investigations.

  - Investigation and tasks within investigations can now be set to "Unassigned" after being assigned to a specific user or workgroup. Previously, investigations and tasks could only be reassigned to different users or workgroups after initial assignment.

  - The Explore pivoting chart has been enhanced. You can zoom using your mouse wheel by clicking inside the chart and holding the control key on your keyboard. Additionally, zoom centers on specific nodes when you select nodes and zoom in or out.

  - Added the ability to delete investigation attachments.

  - The maximum file size for candidate observable PDF uploads during investigation creation has been increased to 20MB.

  - The search function on the on-board Explore pivoting tool within investigations has been enhanced to display observable sources in the search results. With this enhancement, you can select an instance of the observable based on the source of your choosing.

  - The Explore pivoting chart has been enhanced. When you zoom in on a section of the chart and add a new node, the current zoom setting persists after the node is added.

  - The Explore pivoting chart has been enhanced. A "Search All" pivot has been added to each enrichment pivot menu. When you click this option, all pivots for the enrichment are executed on the selected nodes.

  - The maximum file size for investigation attachments has been increased to 20MB.

• Observables:

  - The subtypes field provides additional metadata on the type of hash associated with hash observables. Possible values include MD5, SHA1, SHA256, SHA512.

  - Added MD5, SHA1, SHA256, and SHA512 hash type filters to the observables search screen. Filters are available when you select Hash in the Type filter section. Filtering hashes with this level of granularity was previously unavailable.

  - Added the Compromised Service Account (compromised_service_account) indicator type.

  - A new observable search filter, Open Source Intelligence, enables you filter on observables provided by open source intelligence feeds aggregated by ThreatStream.

  - Added hash as a valid value for the type field to filter observables on the search screen. Previously, the only acceptable value for this field was md5, which led to user confusion that only hashes of type md5 were being filtered and displayed.

  - Observable Search supports entering defanged domain, email address, IP address, and URL observable queries. When you enter a defanged value, ThreatStream queries and returns non-defanged observable values.

  - Added the fraud_domain, fraud_email, fraud_ip, fraud_md5, and fraud_url indicator types. You can now import Fraud type observables from the Import Assistant on the ThreatStream OnPrem user interface.

  - STIX 1.x Indicator exports now include tags associated with observables in ThreatStream. Tags are exported as Cybox:Keywords in the resulting file. Exports can include up to 250 tags.

• Chat: Leverage instant messaging within ThreatStream to chat with Organization and Trusted Circle members.

• Sandbox:

  - The character limit of URLs supported for submission has been increased to 2000.

  - The maximum number of Sandbox Reports included in CSV exports has been increased to 10,000.

  - Remaining sandbox submissions for the current 24 hour period are listed at the bottom of the sandbox submission windows for all vendors. Previously, this count was not available for Cuckoo sandbox submissions.

• Enrichments:

  - A new Splunk Sightings integration enables you view sightings from your Splunk cloud instance on observable details pages in ThreatStream.

  - Render vulnerable assets in your network from Qualys on details pages of CVE compliant vulnerabilities in ThreatStream.

  - Added the PolySwarm enrichment.

  - Added the HYAS Insight enrichment.

  - Added the Spur IP Context enrichment.

• User Admin: The email notification sent to the organization administrator when a new user is added to the organization now includes permissions that were assigned to the user.
• Streams: Export stream details in CSV format.

• Import:

  - After rejecting an import job, observables listed in the Included and Excluded tables of the import job are maintained for future reference.

  - Associate observables with Vulnerabilities during import.

  - Observables can be associated with Signatures during import by clicking Add Association on the Import Assistant. Previously, Signatures could not be associated with observables during import.

  - The Import list view has been updated with a Reviewed By column, which contains the username of the user who approved the import session. This column is not displayed by default and can be selected by clicking the settings wheel.

  - Added the ability to specify Source Created and Source Modified timestamps for observables during import.

  - Cybox:Keywords are now added as observable tags during STIX 1.2 imports. Cybox:Keywords are not supported for STIX 1.2 exports.

• Rules:

  - Restrict rule email notifications to a specific user workgroup.

  - Email notifications for observable matches now contain timestamps of the most recent import which the rule matched. Previously, only timestamps of initial imports for observables were displayed.

  - Keywords now appear in a comma separated list on the Edit Rule window, thus simplifying the process of modifying existing keywords.

  - The rule configuration workflow has been enhanced with the ability to add multiple keywords in a comma separated or line broken list. Additionally, the indicator type selection workflow has been simplified.

  - Create rules which are visible only to selected workgroups.

  - Matched intelligence can be added to a new or existing investigation. Previously, intelligence could only be added to new investigations. Additionally, you can configure an assignee for investigations created as a result of rule matches and restrict investigation visibility to organization workgroups.

  - Create and edit rules using an intuitive wizard.

  - A new Notify Me setting enables you to opt in or out of email notifications for individual rules. Notify Me is a user level setting and does not impact notification preferences for other users in your organization.

• PDF Reports:

  - Generate PDFs based on customizable templates for sharing with a wider audience outside of ThreatStream.

  - PDF Reports, the template-based PDF export feature for the Anomali Threat Model, has been enhanced. You can now specify colors using hex codes, enjoy a simplified margin configuration experience, and clone templates to create editable versions while preserving the original.

• Sandbox:

  - A new integration with VMRay enables VMRay customers to leverage the VMRay commercial service for malware detonation within the ThreatStream platform.

  - Export Sandbox Reports in CSV format.

  - A new freemium integration with VMRay enables all ThreatStream users to leverage VMRay for malware detonation from the ThreatStream user interface. ThreatStream users can activate the freemium VMRay sandbox service at no additional charge.

  - Cuckoo sandbox detonations are now limited to 150 submissions per 24 hours.

• Anomali Lens in ThreatStream: Use an on board version of Anomali Lens within the ThreatStream platform.

• Notifications: Subscribe to email and in app investigations notifications based on a granular list of events. Previously, a single subscription was available for investigation notifications.

• Integrations: A new integration with JIRA enables you to create and update JIRA tickets from the Investigations user interface within ThreatStream.

• Organization Administration:

  - A new setting enables Org Admins to configure a default timezone for timestamps displayed on the ThreatStream user interface for your organization.

  - A new setting enables Org Admins to configure whether ThreatStream Integrator performs a full intelligence resynchronization each time your organization joins a new Trusted Circle or subscribes to a new intelligence feed.

  - Org Admins can specify a maximum session lifetime for users in their organization. When this setting is enabled, active ThreatStream sessions are terminated after the specified length of time.

  - Org Admins can audit PDF Report creation activity from the Audit screen within ThreatStream settings.

• SSO: Organizations that leverage SSO for ThreatStream authentication can configure a custom error message displayed when users attempt to authenticate using an account that does not exist in ThreatStream.
• Workgroups: Restrict the visibility of observables, Threat Model entities, and investigations to specific workgroups within your organization.

• Streams: The ability to create tags that are private to your organization has been added to the Streams configuration workflow.

Released: 11/20/2020

• Anomali Lens: Configure the Anomali Lens plugin to work with your ThreatStream OnPrem instance rather
• than ThreatStream Cloud. See "Using Anomali Lens with ThreatStream OnPrem" in the ThreatStream OnPrem Quick Start Guide for more information.

• Enrichments:

  - Added the AbuseIPDB, Pastebin Dump Collection, Farsight DNSDB, Openports, Shodan, URLScan.io, and Web Of Trust enrichments.

  - Updated the AlienVault ThreatCrowd, Hybrid Analysis, Recorded Future, Reversing Labs, RiskIQ, Silobreaker, and VirusTotal enrichments.

  - Updated the Integrations tab within ThreatStream settings to include a filter which improves the experience of browsing available integrations and enrichments. Additionally, the activation process for enrichments available from the screen is more intuitive and provides links to vendor registration resources.

  See Integrating with Third-Party Services for more information.

• Import:

  - Delete import jobs owned by your organization. See Deleting Import Jobs for more information.

  - Users without Approve Import privileges can edit the parameters of import sessions they submit before they are approved. See Managing Import Jobs for more information.

  - URL Observables that contain special characters can now be imported. See Importing Observablesfor more information.

  - Edit the values of observables listed on the Included and Excluded tabs of import jobs while the import job is in Ready to Review status. See Editing Observable Values Before Approval for more information.

  - Add additional observables to import jobs while the import job is in Ready to Review status. See Approving Import Jobs for more information.

  - An Auto-Approve option enables users with Approve Import privileges to automatically approve the import jobs they submit. See Importing Observablesfor more information.

  - All associated investigations are displayed from the import job screen when import jobs are associated with multiple investigations. See Viewing Import Jobs Associated With Your Organization for more information.

  - Moving observables from the Excluded tab to the Included tab on import jobs does not result in the observable becoming active immediately. Observables moved from the excluded tab become active when the import job is approved. See Manually Adding Excluded Observables for more information.

  - Included and Excluded observables contained in import jobs can be filtered by Type of observable (Domain, Email, Hash, IP, IPv6, String, and URL). See Approving Import Jobs for more information.

  - Filter import jobs on the Import page by Owner. See Viewing Import Jobs Associated With Your Organization for more information.

  - Edit the expiration date of individual observables while reviewing import sessions. See Approving Import Jobs in the ThreatStream online help center for more information.

  - Users with Approve Import privileges can approve and reject import jobs in bulk from the Import list view screen. See Approving Import Jobs in the ThreatStream online help center for more information.

• Threat Model:

  - Customize the elements included in threat model entity PDF exports. See Exporting Threat Model Entities in STIX Format for more information.

  - Added a page field to Threat Model entity details pages for entities created through PDF imports, thus improving the browsing experience for PDFs with high page counts.

  - Import existing content in the form of threat model entities. You can paste in rich text or upload PDF or TXT files which will serve as the basis for a new threat model entity. See Adding New Threat Model Entities in the ThreatStream online help center for more information.

  - Filter threat model search results by signature type. See Accessing Threat Models in the ThreatStream online help center for more information.

  - The ability to export observables associated with threat model entities has been extended to actors, campaigns, incidents, signatures, TTPs, and vulnerabilities.

• Observables:

  - Explore pivoting tools on Observable details pages include an additional Export icon, thus enabling you to export charts in PNG format.

  - A "View details" link in the Intelligence section of observable details pages enables you to view changes to individual instances of an observable from observable details pages. See Observables in the ThreatStream online help center for more information.

  - Added urlscan.io to the list of Analysis Links on observable details pages for Domain, IP address, and URL observables. See Observables in the ThreatStream online help center for more information.

  - Remove observable tags in bulk from the Observables search page. See Bulk Tag Management of Observables in the ThreatStream online help center for more information.

  - Filter observable search results by observable value type. See Filtering Search Results in the ThreatStream online help center for more information.

• Search:

  - Added the ability to filter advanced observable searches by Import Source (import_source)—set during observable import from the import assistant—and the user who submitted the import job (created_by). See Intelligence Fields in ThreatStream for more information.

  - Added an Expiration Date column to the observables search screen. The column is not shown by default and must be selected.

• Rules:

  - Rules can be configured to exclude observables that exist in your organization import whitelist. Additionally, notifications can be suppressed for observables imported by your organization. See Creating Rules for more information.

  - Rules can be configured to search for keyword matches in signatures. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured based on the exclusion specific indicator types. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured to search for keyword matches in vulnerabilities. See Rules in the ThreatStream online help center for more information.

• Investigations:

  - Added the ability to edit text fonts in Investigation descriptions.

  - Explore pivoting tools within Investigations include an additional Export icon, thus enabling you to export charts in PNG format.

  - Added the ability to delete investigation tasks. See Understanding User Interface of Investigations in the ThreatStream online help center for more information.

• Import Whitelist:

  - Add entries to your Whitelist from a CSV file. See Adding Exclude List Entries from a CSV File for more information.

  - Associate contextual notes to import whitelist entries. See Updating Organization Exclude List in the ThreatStream online help center for more information.

• Tags:

  - Delete any public tag added to observables or Threat Model entities owned by your organization, regardless of the organization that added the tag. See Bulk Tag Management of Observables for more information.

  - All entity types in ThreatStream are limited to 200 tags per organization. Tags added by other organizations do not count towards this limit.

• User Admin: Org Admins can grant or revoke API key access for individual users from the User Admin tab within ThreatStream settings. SeeManaging Organization Users for more information.

• Malware: Added the Malware threat model entity. For more information, see Viewing Malware Details in the ThreatStream online help center.
• Mailboxes: Added an intuitive Mailbox creation wizard. Phishing mailboxes can be configured to create both investigations and import sessions. For more information, see Mailboxes for Receiving Observables in the ThreatStream online help center.
• Notifications List View: View a complete list of the notifications sent to you by ThreatStream on the Notifications List View. For more information, seeViewing Notifications on the Notifications List View in the ThreatStream online help center.

• Restrict ThreatStream Cloud Access: Org Admins can restrict access to the ThreatStream Cloud user interface for non-admin users. For more information, see Viewing and Editing Organization Settingsin the ThreatStream online help center.

• User Export: Org Admins can export user information in CSV format. See Managing Organization Users in the ThreatStream online help center for more information.

• Overview Dashboard: Added the Investigation Task List dashboard widget, enabling you to view all investigation tasks assigned to you from the Overview dashboard. See A Tour of the ThreatStream Overview Dashboard in the ThreatStream online help center for more information.

• Sightings: Manually manage Sightings data. See Viewing Matches and My Attacks in the ThreatStream online help center for more information.

• Read Only Users: Added the ability to create Read Only users on ThreatStream. See Read Only User Privileges in the ThreatStream online help center for more information.

• Password Administration: Configure the number of days before expiration at which uses receive notification to reset their passwords. See Viewing and Editing Organization Settings in the ThreatStream online help center for more information.

• Permitted CIDRs: Increased the number of CIDRs to which you can grant exclusive access to your organization on ThreatStream to 1000. See Viewing and Editing Organization Settings in the ThreatStream online help center for more information.

Released: 4/30/2020

• Anomali Lens: Configure the Anomali Lens plugin to work with your ThreatStream OnPrem instance rather than ThreatStream Cloud. See "Using Anomali Lens with ThreatStream OnPrem" in the ThreatStream OnPrem Quick Start Guide for more information.

• Enrichments:

  - Added the Pastebin Dump Collection and URLScan.io enrichments.

  - Updated the Recorded Future, Reversing Labs, and RiskIQ enrichments.

  See Integrating with Third-Party Services for more information.

• Import:

  - Delete import jobs owned by your organization. See Deleting Import Jobs for more information.

  - Users without Approve Import privileges can edit the parameters of import sessions they submit before they are approved. See Managing Import Jobs for more information.

  - URL Observables that contain special characters can now be imported. See Importing Observablesfor more information.

  - Edit the values of observables listed on the Included and Excluded tabs of import jobs while the import job is in Ready to Review status. See Editing Observable Values Before Approval for more information.

  - Add additional observables to import jobs while the import job is in Ready to Review status. See Approving Import Jobs for more information.

  - An Auto-Approve option enables users with Approve Import privileges to automatically approve the import jobs they submit. See Importing Observablesfor more information.

  - All associated investigations are displayed from the import job screen when import jobs are associated with multiple investigations. See Viewing Import Jobs Associated With Your Organization for more information.

  - Moving observables from the Excluded tab to the Included tab on import jobs does not result in the observable becoming active immediately. Observables moved from the excluded tab become active when the import job is approved. See Manually Adding Excluded Observables for more information.

  - Included and Excluded observables contained in import jobs can be filtered by Type of observable (Domain, Email, Hash, IP, IPv6, String, and URL). See Approving Import Jobs for more information.

  - Filter import jobs on the Import page by Owner. See Viewing Import Jobs Associated With Your Organization for more information.

• Threat Model:

  - Customize the elements included in threat model entity PDF exports. See Exporting Threat Model Entities in STIX Format for more information.

  - Added a page field to Threat Model entity details pages for entities created through PDF imports, thus improving the browsing experience for PDFs with high page counts.

• Observables: Explore pivoting tools on Observable details pages include an additional Export icon, thus enabling you to export charts in PNG format.

• Search:

  - Added the ability to filter advanced observable searches by Import Source (import_source)—set during observable import from the import assistant—and the user who submitted the import job (created_by). See Intelligence Fields in ThreatStream for more information.

  - Added an Expiration Date column to the observables search screen. The column is not shown by default and must be selected.

• Rules: Rules can be configured to exclude observables that exist in your organization import whitelist. Additionally, notifications can be suppressed for observables imported by your organization. See Creating Rules for more information.

• Investigations:

  - Added the ability to edit text fonts in Investigation descriptions.

  - Explore pivoting tools within Investigations include an additional Export icon, thus enabling you to export charts in PNG format.

• Import Whitelist: Add entries to your Whitelist from a CSV file. See Adding Exclude List Entries from a CSV File for more information.

• Tags:

  - Delete any public tag added to observables or Threat Model entities owned by your organization, regardless of the organization that added the tag. See Bulk Tag Management of Observables for more information.

  - All entity types in ThreatStream are limited to 200 tags per organization. Tags added by other organizations do not count towards this limit.

• User Admin: Org Admins can grant or revoke API key access for individual users from the User Admin tab within ThreatStream settings. SeeManaging Organization Users for more information.

Released: 3/2/2020

ThreatStream OnPrem 4.1.1a is a replacement upgrade bundle for ThreatStream OnPrem 4.1.1.

This release includes the following fixed critical issue:

• OP-18047: A critical Elasticsearch issue prevented newly imported observables and recently created threat model entities from appearing in search results.

Released: 12/6/2019

This release includes the following fixed critical issues:

• OP-18047: A critical Elasticsearch issue prevented newly imported observables and recently created threat model entities from appearing in search results.

• OP-17657: Org Admins did not receive email notifications after adding users to their organizations on ThreatStream OnPrem.

Released: 11/27/2019

This release includes the following fixed critical issue:

• OP-17833: Log rotation settings were not configured correctly.

Released: 11/12/2019

This release includes the following fixed issues:

• OP-17154 and OP-16933: Integrations configured on ThreatStream Integratorby non-admin users could not download organization Import Whitelists. As a result, integrations stopped downloading observables.

• OP-16864 and OP-16745: An internal issue prevented Rules from matching observables as expected and creating Threat Model entity associations when configured to do so.

Released: 10/21/2019

• Malware: Added the Malware threat model entity. For more information, see Viewing Malware Details in the ThreatStream online help center.
• Mailboxes: Added an intuitive Mailbox creation wizard. Phishing mailboxes can be configured to create both investigations and import sessions. For more information, see Mailboxes for Receiving Observables in the ThreatStream online help center.
• Notifications List View: View a complete list of the notifications sent to you by ThreatStream on the Notifications List View. For more information, seeViewing Notifications on the Notifications List View in the ThreatStream online help center.

• Enrichments:

  - Added the AbuseIPDB, Farsight DNSDB, Openports, Shodan, and Web Of Trust enrichments. See Integrating with Third-Party Services in the ThreatStream online help center for more information.

  - Updated the AlienVault ThreatCrowd, Hybrid Analysis, RiskIQ, Silobreaker, and VirusTotal enrichments. SeeIntegrating with Third-Party Services in the ThreatStream online help center for more information.

  - Updated the Integrations tab within ThreatStream settings to include a filter which improves the experience of browsing available integrations and enrichments. Additionally, the activation process for enrichments available from the screen is more intuitive and provides links to vendor registration resources. See Integrating with Third-Party Services in the ThreatStream online help center for more information.

• Restrict ThreatStream Cloud Access: Org Admins can restrict access to the ThreatStream Cloud user interface for non-admin users. For more information, see Viewing and Editing Organization Settingsin the ThreatStream online help center.

• Rules:

  - Rules can be configured to search for keyword matches in signatures. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured based on the exclusion specific indicator types. See Rules in the ThreatStream online help center for more information.

  - Rules can be configured to search for keyword matches in vulnerabilities. See Rules in the ThreatStream online help center for more information.

• User Export: Org Admins can export user information in CSV format. See Managing Organization Users in the ThreatStream online help center for more information.

• Import Whitelist: Associate contextual notes to import whitelist entries. See Updating Organization Exclude List in the ThreatStream online help center for more information.

• Overview Dashboard: Added the Investigation Task List dashboard widget, enabling you to view all investigation tasks assigned to you from the Overview dashboard. See A Tour of the ThreatStream Overview Dashboard in the ThreatStream online help center for more information.

• Observables:

  - A "View details" link in the Intelligence section of observable details pages enables you to view changes to individual instances of an observable from observable details pages. See Observables in the ThreatStream online help center for more information.

  - Added urlscan.io to the list of Analysis Links on observable details pages for Domain, IP address, and URL observables. See Observables in the ThreatStream online help center for more information.

  - Remove observable tags in bulk from the Observables search page. See Bulk Tag Management of Observables in the ThreatStream online help center for more information.

  - Filter observable search results by observable value type. See Filtering Search Results in the ThreatStream online help center for more information.

• Sightings: Manually manage Sightings data. See Viewing Matches and My Attacks in the ThreatStream online help center for more information.

• Import:

  - Edit the expiration date of individual observables while reviewing import sessions. See Approving Import Jobs in the ThreatStream online help center for more information.

  - Users with Approve Import privileges can approve and reject import jobs in bulk from the Import list view screen. See Approving Import Jobs in the ThreatStream online help center for more information.

• Read Only Users: Added the ability to create Read Only users on ThreatStream. See Read Only User Privileges in the ThreatStream online help center for more information.

• Threat Model:

  - Import existing content in the form of threat model entities. You can paste in rich text or upload PDF or TXT files which will serve as the basis for a new threat model entity. See Adding New Threat Model Entities in the ThreatStream online help center for more information.

  - Filter threat model search results by signature type. See Accessing Threat Models in the ThreatStream online help center for more information.

  - The ability to export observables associated with threat model entities has been extended to actors, campaigns, incidents, signatures, TTPs, and vulnerabilities.

• Password Administration: Configure the number of days before expiration at which uses receive notification to reset their passwords. See Viewing and Editing Organization Settings in the ThreatStream online help center for more information.

• Permitted CIDRs: Increased the number of CIDRs to which you can grant exclusive access to your organization on ThreatStream to 1000. See Viewing and Editing Organization Settings in the ThreatStream online help center for more information.

• Investigations: Added the ability to delete investigation tasks. See Understanding User Interface of Investigations in the ThreatStream online help center for more information.

Released: 9/24/2019

This release includes the following fixed issue:

• OP-16708: An internal issue caused log files to continuously grow in size and exhaust disk space.

Released: 9/20/2019

• Ubuntu Upgrade:ThreatStream OnPrem has been upgraded to Ubuntu 16.04 LTS.
• Investigations: Investigations has been updated with a new user interface. For more information, see Investigating Threats in ThreatStream
• Enrichments SDK: Develop third-party enrichments using the Anomali Enrichments SDK for use on ThreatStream OnPrem. Contact your Anomali support representative for more information on the Anomali Enrichments SDK.
• Enrichments: Added the Anomali Whois History, Silobreaker, AlienVault ThreatCrowd, and Hybrid Analysis enrichments. Updated the OpenDNS and VirusTotal enrichments. For more information, see Activating Enrichments
• ServiceNow Integration: Trigger ServiceNow ticket creation directly from an investigation. Investigation details and attachments are sent to ServiceNow. For more information, see Integrating with ServiceNow
• Custom Indicator Types: Create custom indicator types that can be used locally on ThreatStream OnPrem.
• User Activity Reports: Generate reports on organization user activity. For more information, view Generating User Activity Reports

• Observable Import Enhancements:

  - Associate local observables with remote threat model entities during import.

  - View improved error messages for rejected observables.

• SSO Redirection: Configure ThreatStream OnPrem to redirect users to an SSO portal when they navigate to the ThreatStream OnPrem login screen.
• Delete Observables: Delete observables owned by your organization. See for more information.
• Observable TLP: Assign TLP colors to observables during import and from observable details pages. For more information, view Importing Observables and Editing Observable Details
• Bulk Edit: Edit observables in bulk. For more information, see Editing Observable Details in the ThreatStream OnPrem online help center.
• Mailbox Proxy User: Added the ability to specify a Proxy User for threat intelligence mailboxes. When submissions are received from email addresses that are not registered with your organization, this user is listed as the creator of any resulting import sessions, investigations, or threat bulletins. For more information, search Mailboxes for Receiving Observables in the ThreatStream OnPrem online help center.

Released: 4/15/2019

• Email Notifications: A new setting enables all email notifications to be sent from ThreatStream OnPrem rather than ThreatStream Cloud. Additionally, when this setting is enabled, all threat model related email notifications to link to the ThreatStream OnPrem user interface.
• Local Snapshots: The ThreatStream API and Anomali SyncApp can be used to generate snapshots of data stored locally on ThreatStream OnPrem.
• Private Tags: Tags added to threat model entities can be made private to your organization. Additionally, private tags can be added to intelligence created as a result of rule matches.
• Explore: Explore has been updated with a new user interface and the ability to run Passive SSL searches. For more information, see Analyzing Adversary Infrastructure with Explore in the ThreatStream online help center.

Released: 11/9/2018

• Remote Associations: Capabilities for creating associations between local and remote data have been expanded.
• Overview Dashboard: View graphical renderings of the latest data available to you on ThreatStream OnPrem, in addition to recent activity within your organization and notifications for open tasks assigned to you.
• Message of the Day: Add a message that is displayed in a banner across the top of the screen to all organization users on ThreatStream OnPrem.
• SNMP Monitoring: The monitoring of ThreatStream OnPrem systems via SNMP is now supported.
• Cipher Suite Management: Set a customized cipher suite configuration for ThreatStream OnPrem.
• Phishing Email URL Detonation: A new setting enables the detonation of URLs from phishing emails forwarded to ThreatStream for ingestion. See Mailboxes for Receiving Observables in the ThreatStream online help center for more information.

Released: 7/31/2019

This release includes the following fixed issue:

• OP-9470: PDF exports did not work.

Released: 4/30/2018

• Remote Associations: Create associations between data stored locally on ThreatStream OnPrem and data stored remotely on ThreatStreamCloud.
• Preferred Tags: Create a list of frequently used tags that can be quickly selected from any Tags field in ThreatStream. For more information, see Adding Preferred Tags to Intelligence in the ThreatStream online help center.
• Delete Investigations: Delete investigations that belong to your organization from the ThreatStream OnPrem UI. For more information, see Understanding User Interface of Investigations in the ThreatStream online help center.
• DomainTools Integration: DomainTools subscribers can activate an integration that enables them to leverage Whois data provided by DomainTools on observable details pages. For more information, see Integrating with DomainTools in the ThreatStream online help center.

Released: 4/6/2018

• Vulnerabilities: View vulnerabilities imported by ThreatStream from trusted sources on the ThreatStream OnPrem UI. Additionally, you can create local and remote vulnerabilities as part of the Anomali Threat Model on ThreatStream OnPrem. View Using the Anomali Threat Model for more information.
• Rules: Add up to 100 distinct keywords to a single rule. Rules trigger when any configured keywords are matched. View Rules in the ThreatStream online help center for more information.

• Import Assistant: When observables are excluded from import jobs because they already exist in ThreatStream, you can apply the tags from the import job to existing versions of rejected observables. See Applying Tags from Duplicate Observables in the ThreatStream online help center for more information.

• Password History Retention: Org Admins can set the number of previous passwords ThreatStream retains and blocks users from using as new passwords. See Use Password Requirements in the ThreatStream online help center for more information.

• SSO Logout URL: Configure an alternate URL to which ThreatStream OnPrem will direct you upon logout—including logouts that occur due to system timeouts. If your organization leverages a third party single sign-on (SSO) service for ThreatStream OnPrem, you can enter the URL for the portal of your SSO provider. See SSO Logout URL in the ThreatStream online help center for more information.
• Private Tags: Org Admins can set red as the default TLP color for comments left on intelligence. See Use Organization as default Visibility in the ThreatStream online help center for more information.
• Indicator Types: Compromised Service Account and Compromised Host Name have been added as indicator types and are available exclusively on ThreatStream OnPrem.

• Other Enhancements:

  - Previously, web session timeouts would occur in between editing sessions and other actions that resulted in lack of communication between the web interface and ThreatStream. With this release, session timeouts are prevented if actions such as typing or clicking occur on the web interface.

  - Investigations are queried in keyword searches entered in the top navigation bar and included on the Universal Search results page. See Searching Intelligence in ThreatStream in the ThreatStream online help center for more information.

Released: 11/1/2017

• Threat Model: A redesigned threat model user interface and streamlined publication workflow.
• Rules: New and improved keyword match functionality that offers greater customization, searchability, and increased granularity.

• Investigations enhancements:

  • When you attach threat model entities to investigations, you have the option of additionally attaching observables associated with the entities.
  • Ability to add tags to existing investigations and filter investigations by tags on the Investigations dashboard.
• Third Party Integrations: Leverage subscriptions to Risk IQ and PhishMe from the ThreatStream OnPrem UI.

Released: 11/1/2017

• Import via URL: Import observables from ad-hoc scrapes of plain text intelligence feeds or direct links to CSV, HTML, JSON, PDF, TXT, or XML files.
• Word Doc support: Copy and paste content—including images—from .doc, docx, and .pdf files into rich text editors for all threat model entities and investigations. All formatting is preserved.
• Threat model cloning: Ability to create local copies of Actors, Campaigns, Incidents, and Threat Bulletins.

• Feature parity: Already available on ThreatStream Cloud, the Email/Phishing tab is now accessible through the ThreatStream UI. This tab enables you to import observables by sending values to a designated email address and forward potential phishing scams to ThreatStream for observable extraction.

  All observables imported via mailboxes on the Email/Phishing tab are processed and stored remotely on ThreatStream Cloud.

Released: 8/16/2017

• Observable Export: Export observable search results in various formats.
• Resubmit Excluded Observables: When observables are excluded from import jobs due to typos in observable values, you can edit observable values and resubmit the import job.
• ThreatStream OnPrem Setup: During setup, ThreatStream checks for IP addresses on your network that are identical to the Docker IP address. In these cases, you can easily edit the Docker IP address.

• Investigations Enhancements:

  • Ability to assign entities (actors, observables, and so on) within investigations to multiple phases of the same structured model
  Example: A single actor added to the KillChain model could be assigned to both the Reconnaissance and Delivery phases.
  • View all entities while cycling through structured threat models
  • View an improved audit log to track investigation updates
  • ThreatStream runs a check for duplicates when exporting an investigation to a ThreatBulletin
• Taxii Client: Aggregate TAXII data in one location and add it to the intelligence you are already receiving on your ThreatStream Hybrid

Released: 6/16/2017

• Ability to associate observables with related observables
• Use a ThreatStream provided Joe Sandbox service for malware detonation
• View an improved Investigation activity log to track updates
• Recieve threat intelligence from TAXII servers
• Ability to export observable search results in CSV format

Released: 3/31/2017

• Investigations: centrally manage threat investigations

• Source Optimizer: view and compare metrics on open source feeds

• Improved performance loading threat model entities with multiple associations

• Improved threat model entity free text search

• CSV and PDF support for exporting Explorer nodes

• Threat model search now includes Tags and Aliases

Released: 2/21/2017

• Ability to upgrade in-place

• Ability to visualize the geographic location of threats on the MyEvents Map

Released: 11/20/2016

This patch features the ability to configure local keyword alerts

Released: 5/11/2016

• Ability to clone IOCs in bulk directly from the Search page
• Ability to export IOCs, Threat Model entities, and search results in PDF format

Released: 5/2/2016

• Ability to search, correlate, visualize, and alert on fraud-relevant data to quickly detect and respond to fraud incidents

• All new features and updates available on ThreatStream OnPremplatform since the latest ThreatStream OnPremrelease

Released: 12/3/2015

• Support for using ThreatStream OnPrem through a proxy server

• All new features and updates available on ThreatStream OnPremplatform since the last OnPrem Appliance release, such as ThreatStream's Threat Model

• Brand new, context-sensitive online Help and PDF of the ThreatStreamUser Guide

• Updated Downloads page to include latest product documentation and product software

Released: 11/25/2015

ThreatStream OnPrem 1.0 is a generally available release for ThreatStream OnPrem from Anomali.

Released: 9/25/2015