What's New in ThreatStream (2023)

FEATURE

Intelligence Channels: The Anomali Phishing & Fraud intelligence channel is now available for activation in the APP Store.

See Managing Anomali Intelligence Channels for more information.

ANNOUNCEMENT

Search: Values consisting of less than 3 characters are no longer supported for the contains operator.

See Search Operators for more information.

ENHANCEMENT

MITRE ATT&CK: MITRE ATT&CK techniques and sub-techniques associated with v13.1 are now supported by ThreatStream.

See Using MITRE ATT&CK Frameworks in ThreatStream for more information.

FEATURE

Premium Feeds: The Recorded Future Vulnerability Risk List premium feed is available for activation in the APP Store.

See Managing Premium Feeds for more information.

FEATURE

STIX 2.1:ThreatStream now supports incidents for STIX 2.1/TAXII.

See Supported Attributes for STIX Entities for more information.

ANNOUNCEMENT

Cuckoo Sandbox Service: The Cuckoo sandbox service is no longer available for new ThreatStream users.

See Analyzing Malware with the ThreatStream Sandbox for more information.

FEATURE

Intelligence Fields: The target_industry and target_region fields are added to the list of ThreatStream intelligence fields. The fields allow you to search for intelligence based on target regions and industries. Additionally, you can label Actors, Malware, Incidents, Tools, and Threat Bulletins with a target region and target industry.

See Intelligence Fields in ThreatStream and Performing Advanced Threat Model Searches for more information.

ANNOUNCEMENT

Text Editor: For security reasons, ThreatStream discontinued support for image uploads by URL in the text editors of comments and descriptions.

ENHANCEMENT

Threat Models: Threat Model details pages have a new look and feel.

See example Viewing Actor Details.

FEATURE

Intelligence Channels: The Anomali Adversary Intelligence and Anomali Vulnerability & Exploit Intelligence channels powered by Bitdefender are now available for activation in the APP Store.

See Managing Anomali Intelligence Channels for more information.

ENHANCEMENT

Indicator Types: The ja3_md5 indicator type and ja3_md5 threat type are added to ThreatStream.

See Indicator Types in ThreatStream and Threat Types in ThreatStream for more information.

FEATURES

Auto Lens+ Feeds: The following open source Auto Lens+ powered RSS feeds are available for activation in the APP Store: Advisory - AU CERT, Advisory - FI CERT, News - Hackread, News - Heimdal Security Blog, News - Security Affairs, Research - Fox IT, Research - Netlab 360, and Research - Rapid 7.

See Managing Anomali Copilot RSS Feeds for more information.

ENHANCEMENT

Feeds: The Entry Mappings section on feed details pages is renamed to Fields Mappings, and the Detail observable type on the Advanced Feed Configuration tab is renamed to Tag.

See Viewing Feed Details and Importing Feeds Using Advanced Submission for more information.

ENHANCEMENT

Attack Flows: You can now import, update, and export MITRE attack flows.

See Attack Flow Library for more information.

ENHANCEMENT

MITRE ATT&CK: The MITRE ATT&CK tab is added to threat model details pages. The MITRE ATT&CK tab displays the MITRE heat map associated with the threat model entity.

See Using MITRE ATT&CK Frameworks in Threat Models for more information.

ENHANCEMENT

Rule Details: The "Dismissed" status of rule matches is renamed to "Resolved".

See Viewing Rule Details for details.

ENHANCEMENT

TLP: To support TLP v2.0, the TLP: Amber+Strict is added to ThreatStream, and the TLP: White is replaced with TLP: Clear. However, when creating advanced search queries, TLP: White and TLP: Clear can be used interchangeably.

See example Importing Observables.

ENHANCEMENT

Observables: The Observables page has a new look and feel.

See Performing Basic Observable Searches for more information.

FEATURES

Auto Lens+ Feeds: The following open source Auto Lens+ powered RSS feeds are available for activation in the APP Store: Advisory - FR CERT, Advisory - Cisco Talos Intelligence, News - Dark Reading, News - Security Week, News - ZDNet, Research - SecureWorks, Research - F5 Labs, and Research - Sophos.

See Managing Anomali Copilot RSS Feeds for more information.

ENHANCEMENT

Indicator Types: The vuln_risk_score indicator type for a vulnerability risk score has been added to ThreatStream.

See Indicator Types in ThreatStream for more information.

FEATURES

Auto Lens+ Feeds: The following open source Auto Lens+ powered RSS feeds are available for activation in the APP Store: Advisory - JP CERT, News - DataBreach Today, News - Microsoft Security Blogs, News - Threatpost, Research - Cyble, Research - Mandiant, Research - McAfee, and Research - Securelist.

See Managing Anomali Copilot RSS Feeds for more information.

ENHANCEMENT

Feeds: The following terms have been changed in the ThreatStream interface:  "stream" has been changed to "feed", and "source optimizer" has been changed to "feed optimizer". The intelligence field stream_id has been replaced with feed_id, and the stream_name field has been replaced with feed_name.

See Managing Feeds, Comparing Feeds with Feed Optimizer, and Intelligence Fields in ThreatStream for more information.

FEATURES

Auto Lens+ Feeds: The following open source Auto Lens+ powered RSS feeds are available for activation in the APP Store: Advisory - CERT Belgium, Advisory - CERT EU, Advisory - CISA, Advisory - Linux Security, Advisory - NCSC UK, Advisory - US CERT, News - KrebsonSecurity, News - The Hacker News, Research - Checkpoint, Research - Google Project Zero, Research - Malwarebytes, Research - SANS Internet Storm Center, Research - Trend Micro, Research - Unit42, Research - Zero Day Initiative.

See Managing Anomali Copilot RSS Feeds for more information.

ENHANCEMENT

TAXII Feeds: The setting allowing to skip strict checking of unresolved domains during TAXII imports has been added to ThreatStream.

See Managing TAXII Feeds for more information.

FEATURES

Premium Feeds: The Bitdefender Intelligence - Mobile and Bitdefender Intelligence - Ransomware premium feeds are now available for activation in the APP Store.

See Managing Premium Feeds for more information.

ENHANCEMENT

Tags: Tags can now be viewed in tables under corresponding threat model entities, import jobs, and investigations.

See example Viewing Import Jobs Associated With Your Organization.

FEATURE

Intelligence Channels: The Anomali Global Security Event Intel intelligence channel is available for activation in the APP Store. This is a free limited preview offer.

See Managing Anomali Intelligence Channels for more information.

ENHANCEMENT

Threat Model Export Report Templates: The clone option has been added to the Actions menu of the Anomali Default Template.

See Exporting Threat Model Entities in PDF Format for more information.

ENHANCEMENT

Streams: Stream details pages have a new look and feel.

See Viewing Feed Details for more information.

ENHANCEMENT

Intelligence Initiatives: Intelligence Initiative pages have a new look and feel.

See Information in an Intelligence Initiative for more information.

ENHANCEMENT

TAXII: Added toggles allowing to control access to API roots of discovery URLs for TAXII v2.0 and v2.1.

See Managing TAXII Feeds for more information.

ENHANCEMENT

Tables: Horizontal scrolling and drag-and-drop functionalities have been added to the Table Settings of list view pages.

See example Accessing Threat Models.

FEATURE

Enrichments: The WhoisXMLAPI premium enrichment is now available for activation in the APP Store.

See Enriching Data with WhoisXMLAPI for more information.

FEATURE

Premium Feeds: The Dataminr Pulse premium feed is now available for activation in the APP Store.

See Managing Premium Feeds for more information.

ENHANCEMENTS

Attack Surface Assessment: You can now filter issues with a blank status, add up to 10,000 domains for assessment, and select widgets for exporting to a PDF file. The release also includes some UX improvements.

See Attack Surface Assessment for more information.

ENHANCEMENT

Source Optimizer: The Source Optimizer page has a new look and feel now.

See Comparing Feeds with Feed Optimizer for more information.

FEATURES

Premium Feeds: The following premium feeds are now available for activation in the APP Store: Bitdefender Intelligence - APTs, Bitdefender Intelligence - C2 Servers, Bitdefender Intelligence - Phishing and Fraud, Bitdefender Intelligence - Vulnerabilities.

See Managing Premium Feeds for more information.

ENHANCEMENT

Threat Models: The option to include or exclude a description heading has been added to threat model report templates.

See Exporting Threat Model Entities in PDF Format for more information.

ENHANCEMENT

Enrichments: The refresh option to retrieve the latest enrichment data on the observables from external sources and investigation entities has been added to ThreatStream.

See Observables and Managing Investigation Entities for more information.

ENHANCEMENT

Import Mailboxes: Auto-approve and include low confidence observables imported from import mailboxes.

See Mailboxes for Receiving Observables for more information.

DOWNLOADS

ThreatStream Splunk App: The latest version of the ThreatStream Splunk App, v6.6.3, is now available from the Downloads page within ThreatStream.

See Downloads for more information.

ENHANCEMENT

Investigations: View node details by hovering over nodes and move the chart around the workspace by right clicking on the chart of investigation entities.

See Managing Investigation Entities for more information.

ENHANCEMENT

Investigations: The option to use a mouse wheel for zooming nodes has been added to the user interface of investigations.

See Managing Investigation Entities for more information.

DOWNLOADS

ThreatStream OnPrem: The latest release of ThreatStream OnPrem (v5.5) for Ubuntu is available from the Downloads page within ThreatStream.

See Downloads for more information.

ENHANCEMENT

User Admin: The following improvements have been added to the User Admin page: easier search for accounts, ability to reset a user's API Key, improved look of the actions in the user table, and easier workflow for resetting user passwords.

See Managing Organization Users for more information.

FEATURE

Premium Feeds: The Recorded Future Alerts premium feed is now available for activation in the APP Store.

See Managing Premium Feeds for more information.

ENHANCEMENT

Notifications: The Notifications list page has a new look and feel now.

See Receiving In-App Notifications From ThreatStream for more information.

ENHANCEMENT

Threat Models and Investigations: The font styles and sizes have been added to the description box of Investigations and the comment box of Threat Model entities.

See Creating Investigations and Using the Anomali Threat Model for more information.

ENHANCEMENT

Attack Surface Assessment: The Attack Surface Grade widget has been added to Attack Surface Assessment reports.

See Accessing Attack Surface Assessment Reports for more information.

ENHANCEMENT

Attack Surface Assessment: Export to CSV/ PDF and open port banners have been added to Attack Surface Assessment reports.

See Viewing Attack Surface Assessment Report Details for more information.

DOWNLOADS

ThreatStream Splunk App: The latest version of the ThreatStream Splunk App, v6.6.2, is now available from the Downloads page within ThreatStream.

See Downloads for more information.

ENHANCEMENT

Custom Dashboards: The personalization settings such as widget notes, customization of date ranges, and additional editing options have been added to custom dashboards.

See Custom Dashboards for more information.

FEATURE

Premium Feeds: The Recorded Future-Large Risk List premium feed is now available for activation in the APP Store.

See Managing Premium Feeds for more information.

FEATURE

Enrichments: The IPQS Fraud and Risk Scoring enrichment is now available in APP Store.

See Enriching Data with IPQS Fraud and Risk Scoring for more information.

DOWNLOADS

Azure Sentinel Integrator Extension: The latest release of the Azure Sentinel Integrator extension, v1.3.0, is available from the ThreatStream Downloads page.

See Downloads for more information.

ENHANCEMENT

Premium Feeds: The private Recorded Future feed has been removed from the APP Store, and the new premium Recorded Future - Default Risk List feed has been added to APP Store instead.

See Important Update on Recorded Future Intelligence for more information.

FEATURE

Attack Surface Assessment: Receive weekly Attack Surface Assessment (ASA) reports to quickly identify vulnerabilities, misconfigured services, out of date software, and other issues that make your organization vulnerable to attacks. The feature requires additional subscription.

See Attack Surface Assessment for more information.

FEATURE

Premium Feeds: The ZeroFox Cyber Threat Intelligence premium feed is now available for activation in the APP Store.

See Managing Premium Feeds for more information.

ENHANCEMENT

Threat Models: The Threat Models list page has a new look and feel now.

See Accessing Threat Models for more information.