What's New in ThreatStream
ThreatStream is regularly updated with new features and enhancements. You can use this page to track most recent product updates and reference relevant articles in the online help center. For documentation only updates, refer to ThreatStream Documentation Updates.
ThreatStream What's New Archive| Update | Date |
|---|---|
|
ENHANCEMENT Sandbox: The PolySwarm sandbox now supports scanning password-protected PDF files. See Submitting Malware for Detonation for more information. |
Jul 23, 2026 |
|
ENHANCEMENT Sandbox: PolySwarm sandbox detonation recordings now play directly in the browser from the Screenshots tab. Standard playback controls are included, with a download option still available for users who need the file locally. See Information in a Sandbox Report for more information. |
Jul 23, 2026 |
|
ANNOUNCEMENT Enrichments: The Rapid7 InsightVM Vulnerability Management enrichment is deactivated and removed from the App Store. Customers with an active InsightVM configuration do not need to take any actions. Data syncing will stop automatically. |
Jul 8, 2026 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Jun 24, 2026 |
|
FEATURE APP Store: The URLhaus Hostfile open-source feed is now available for activation in the APP Store. See Available Open Source Feeds for more information. |
Jun 24, 2026 |
|
FEATURE PDRP Takedown Service: The Anomali PDRP Takedown Service enrichment enabling you to submit takedown requests for malicious domains, URLs, and IPs detected by the new Anomali PDRP service is now available for activation in the APP Store. See Anomali PDRP Takedown Service for more information. |
Jun 24, 2026 |
|
ENHANCEMENT Anomali PDRP Enhanced: Anomali PDRP Enhanced is the new name for the PDRP premium feed. The feed is now generally available and supports self-service on-boarding experience. See Activating the Anomali PDRP Enhanced Feed for more information. |
Jun 24, 2026 |
|
FEATURE APP Store: The Cognyte: Luminar IOCs, LeakedCredentials and AI Cyber Feeds premium feed is now available for activation in the APP Store. See Available Premium Feeds for more information. |
Jun 24, 2026 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.8, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Jun 24, 2026 |
|
ENHANCEMENT Integrations: Zscaler integration now supports pushing observables to the Custom Malicious URLs list in ZIA. See Integrating with Zscaler for more information. |
Jun 10, 2026 |
|
ENHANCEMENT PDRP: You can now configure assets for your organization on the Assets page within the new PDRP feed. See Activating the Anomali PDRP Enhanced Feed for more information. |
Jun 10, 2026 |
|
FEATURE APP Store: The Check Point Exposure Management IoC Intelligence and Doppel premium feeds are now available for activation in the APP Store. See Available Premium Feeds for more information. |
Jun 10, 2026 |
|
FEATURE APP Store: The following Intel 471 Verity API -based premium feeds are now available for activation in the APP Store: Intel 471 - Breach Alerts, Intel 471 - FINTEL Reports, Intel 471 - Geopolitical Reports, Intel 471 - Information Reports, Intel 471 - Malware Intelligence, Intel 471 - Spot Reports, Intel 471 -Vulnerability Reports, Intel 471 Verity - Credential Intelligence, and Intel 471 Verity - Watcher Alerts. See Available Premium Feeds for more information. |
Jun 10, 2026 |
|
FEATURE APP Store: The Anomali C2 Detection, Anomali Credential Monitoring, and Anomali Early Warning (powered by RedSense) premium feeds are now available in the APP Store. Contact your Customer Success Manager (CSM) for details on activating these feeds. See Available Premium Feeds for more information. |
Jun 10, 2026 |
|
FEATURE APP Store: The Ransomfeed - Real-Time Ransomware Intelligence open-source feed is now available for activation in the APP Store. See Available Open Source Feeds for more information. |
Jun 10, 2026 |
|
ENHANCEMENT Integrations: Zscaler integration now supports OneAPI along with the legacy Zscaler API. See Integrating with Zscaler for more information. |
May 28, 2026 |
|
FEATURE APP Store: The Anomali Dark Web Intelligence and Anomali Threat Briefing open-source feeds are now available for activation in the APP Store. See Available Open Source Feeds for more information. |
May 28, 2026 |
|
FEATURE Role-Based Access Control for Schemas (Limited Availability): Organization administrators can now configure role-based access controls using OCSF schema fields, in addition to the standard eventlog schema, and grant appropriate user permissions for specific use cases. See Managing Roles for more information. |
May 28, 2026 |
|
FEATURE APP Store: The new version of Anomali Premium Digital Risk Protection (PDRP) service is now available, providing continuous monitoring of your external attack surface for exposed credentials, brand impersonation, and data leaks. Contact your Customer Success Manager (CSM) for details on enabling this service for your organization. See Anomali PDRP Enhanced for more information. |
May 13, 2026 |
|
FEATURE APP Store: The RansomLook.io - Ransomware OSINT Feed open source feed is now available for activation in the APP Store. See Available Open Source Feeds for more information. |
May 13, 2026 |
|
FEATURE Export to Threat Model: You can now add investigation entities to an existing threat model. See Exporting Investigations to Existing Threat Models for more information. |
May 13, 2026 |
|
ANNOUNCEMENT ThreatStream Next Gen: ThreatStream Next Gen is now generally available, featuring a modernized platform experience with AI-powered capabilities, automated operations, and unified intelligence workflows that enable faster threat detection and response. See ThreatStream Next Gen Overview for more information. |
Apr 30, 2026 |
|
ENHANCEMENT Threat Model Search API: Added support for the See Threat Model Search for more information. |
Apr 29, 2026 |
|
FEATURE APP Store: The Anomali Curated RSS OSINT, PhishDestroy, PhishHunt.io - Active Phishing Blocklist, ShadowWhisperer Malware Blocklist, and TweetFeed open-source feeds are now available for activation in the APP Store. See Available Open Source Feeds for more information. |
Apr 29, 2026 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Apr 15, 2026 |
|
ENHANCEMENT Anomali Takedown Service: The following Takedown service enhancements have been added: improved the Takedown workflow with real-time, in-app status notifications and automated data refresh; refined the request interface with clearer categories (including a new Email Scam Domain option); removed the dependency on PDRP tags; and enabled independent activation of the Anomali Takedown service enrichment in the App Store for improved accessibility and ease of use. See Anomali Takedown Service for more information. |
Apr 15, 2026 |
|
FEATURE EPSS Vulnerability Scoring: Added EPSS Score and EPSS Percentile to the Vulnerability Details pages, and introduced EPSS-based filtering options in Vulnerability basic search filters. This automatic integration helps you prioritize vulnerabilities based on real-world exploitation likelihood—no setup required. See Viewing Vulnerability Details for more information. |
Apr 15, 2026 |
|
FEATURE SSO-Integrated Login Page (Beta): A beta login page where you can sign in with SSO directly has been added— no need to navigate to your IdP first. See Signing In to ThreatStream Using SSO for more information. |
Apr 15, 2026 |
|
ANNOUNCEMENT ThreatStream OnPrem: The latest release of ThreatStream OnPrem Red Hat, v6.0, is now generally available. Contact Anomali Customer Support for assistance. See ThreatStream OnPrem Release History for more information. |
Apr 15, 2026 |
|
ENHANCEMENT Investigations: The undo and redo chart options have been added to investigation entities, enabling you to reverse node additions, deletions, and position changes, as well as re-apply previously undone actions. See Managing Investigation Entities for more information. |
Mar 17, 2026 |
|
CONTENT ATR Dashboard: The Middle East Conflict - APT & Adversary Activity Monitor out-of-the-box dashboard is now available in ThreatStream. The dashboard tracks nation-state and APT activity tied to Middle East geopolitical developments and activity targeting conflict-relevant regions. See Utilizing Themed Custom Dashboards from the Anomali Threat Research Team for more information. |
Mar 9, 2026 |
|
CONTENT ATR Dashboard: The Middle East Conflict: Iran–Israel–USA Cyber Threat Monitor out-of-the-box dashboard is now available in ThreatStream. It provides real-time threat intelligence coverage of the cyber dimensions of the ongoing military conflict involving Iran, Israel, and the United States. See Utilizing Themed Custom Dashboards from the Anomali Threat Research Team for more information. |
Mar 2, 2026 |
|
FEATURE APP Store: The CERT.PL Malicious Domain Blocklist, Phishing Army, and Binary Defense open source feeds are now available for activation in the APP Store. See Available Open Source Feeds for more information. |
Feb 18, 2026 |
|
FEATURE APP Store: The DomainTools - Iris Detect premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Feb 18, 2026 |
|
ENHANCEMENT APP Store: Google Threat Intelligence premium feed users can now configure their API request limit, allowing them to cap the number of API requests ThreatStream makes per day against their credentials. See GTI Feed Activation for more information. |
Feb 18, 2026 |
|
FEATURE Profile: The Dark theme for the user interface can now be applied to the entire Anomali platform from all modules and pages. See Selecting a User Interface Theme for more information. |
Feb 10, 2026 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Feb 4, 2026 |
|
FEATURE APP Store: The SpyCloud Enterprise Protection premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Jan 28, 2026 |
|
ENHANCEMENT Integrations: Added support for OAuth 2.0 credentials for the ServiceNow integration along with the ability to assign an assignment group and category when creating or updating security incidents. See Integrating with ServiceNow SecOps for more information. |
Jan 26, 2026 |
|
ENHANCEMENT Sandbox: Polyswarm sandbox detonation reports that include both a platform and scan results are now indicated in one column on the Sandbox page. Polyswarm report details pages display both results, including any errors, along with the Polyswarm confidence score and the number of malicious detections identified in the scan. See Information in a Sandbox Report for more information. |
Jan 26, 2026 |
|
FEATURE APP Store: The GreyNoise - Benign IPv4 Scanner and GreyNoise Suspicious IPv4 Scanner premium feeds are now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Jan 21, 2026 |
|
ENHANCEMENT Feeds: The maximum number of custom RSS feeds that can be configured per organization has been increased to 1,000. See Importing RSS Feeds for more information. |
Jan 21, 2026 |
|
ANNOUNCEMENT User & Role Management: The User & Role Management feature, which enables to establish role-based access control for the Anomali platform, is now generally available. Note that role-based access control for some Anomali platform components such as Dashboards, Lookup Tables, and Macros remains in limited availability. See User and Role Management on the Anomali Platform for more information. |
Jan 12, 2026 |
|
FEATURE APP Store: The Ransomware.live open source feed is now available for activation in the APP Store. See Available Open Source Feeds for more information. |
Jan 8, 2026 |
|
ENHANCEMENT MITRE ATT&CK: MITRE ATT&CK techniques and sub-techniques associated with v18.0 are now supported by ThreatStream. See Using MITRE ATT&CK Frameworks in ThreatStream for more information. |
Jan 6, 2026 |
|
ANNOUNCEMENT ThreatStream OnPrem: The latest release of ThreatStream OnPrem Ubuntu, v6.0, is now generally available. Contact Anomali Customer Support for assistance. See ThreatStream OnPrem Release History for more information. |
Dec 22, 2025 |
|
FEATURE SSO: Use the Lock SSO Configuration feature to lock or unlock your SSO settings, preventing accidental or unauthorized changes to the SSO setup. See Lock SSO Configuration for more information. |
Dec 10, 2025 |
|
FEATURE APP Store: The VMRAY - UniqueSignal - Essential premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Dec 10, 2025 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.7, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Dec 2, 2025 |
|
FEATURE APP Store: The Abusix Threat Intelligence premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Nov 19, 2025 |
|
DOWNLOADS Azure Sentinel Extension: The latest release of the Azure Sentinel extension, v2.1.2, is available from the ThreatStream Downloads page. See Downloads for more information. |
Nov 13, 2025 |
|
FEATURE APP Store: The Falconfeeds.io premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Nov 5, 2025 |
|
ENHANCEMENT APP Store: Added support for the Cisco Umbrella API v2 in the Cisco Umbrella Investigate enrichment. See Enriching Data with Cisco Umbrella Investigate for more information. |
Oct 21, 2025 |
|
ANNOUNCEMENT Anomali CDN: To improve performance and reliability, Anomali is introducing two upgrades—Content Delivery Network (CDN) service and HTTP/2 protocol. See Upcoming Enhancements for a Faster Anomali Experience for more information. Watch video. |
Oct 15, 2025 |
|
ENHANCEMENT Feeds: Import observables from custom RSS feeds and view summaries of the ingested RSS articles generated by Anomali Copilot. See Importing RSS Feeds for more information. |
Oct 13, 2025 |
|
ENHANCEMENT What's New: Learn about new features, enhancements, and content added to the Anomali platform from the new What's New side panel. See What's New for more information. |
Oct 9, 2025 |
|
ANNOUNCEMENT Feeds: Custom RSS Feeds are now generally available. You can import and manage custom RSS feeds in ThreatStream. See Importing RSS Feeds for more information. Watch video. |
Oct 8, 2025 |
|
FEATURE Integrator Cloud (Limited Availability): Integrator Cloud is now accessible from the side navigation panel on the Anomali platform. See Anomali Platform Modules for more information. |
Oct 8, 2025 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Oct 7, 2025 |
|
FEATURE APP Store: The Google Threat Intelligence premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Sep 30, 2025 |
|
FEATURE Feeds (Limited Availability): You can now import, configure, and manage custom RSS feeds on ThreatStream. See Importing RSS Feeds for more information. |
Sep 23, 2025 |
|
ANNOUNCEMENT Passive DNS: Anomali now offers the Spamhaus Passive DNS service, providing the ability to investigate how domains, subdomains, and IP addresses have been used over time on observable details pages. This service replaces the Anomali Labs DNS service, requires no additional configuration, and is available to all customers out of the box. See Observables for more information. |
Sep 23, 2025 |
|
FEATURE MITRE ATT&CK: Security coverage of MITRE ATT&CK profiles can now be exported in JSON format. See Exporting MITRE ATT&CK Profiles for more information. |
Sep 8, 2025 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.6, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Sep 2, 2025 |
|
ENHANCEMENT Attack Flows: ThreatStream now supports uploading attack flows in Excel format. See Creating Attack Flows for more information. |
Aug 26, 2025 |
|
FEATURE MSSP Control (Limited Availability): The MSSP (Managed Security Services Provider) feature allowing you to manage Anomali environments of your individual customers has been added to the Anomali platform. See Using the Anomali Platform in an MSSP Environment for more information. Watch video. |
Aug 25, 2025 |
|
FEATURE Integrations (Limited Availability): The CrowdStrike Operator integration is now available in ThreatStream. See Integrating with CrowdStrike for more information. |
Aug 12, 2025 |
|
DOWNLOADS Azure Sentinel Extension: The latest release of the Azure Sentinel extension, v2.1.1, is available from the ThreatStream Downloads page. See Downloads for more information. |
Aug 4, 2025 |
|
FEATURE ThreatStream MCP Server: You can now configure the Claude desktop app to use the ThreatStream MCP server for querying Anomali threat intelligence. See Connecting Claude to ThreatStream MCP Using API Keyfor more information. Watch video. |
Aug 1, 2025 |
|
ENHANCEMENT APP Store: The Threatbook CTI feed has been renamed to SecAI CTI. See Managing Premium Feeds for more information. |
Jul 29, 2025 |
|
FEATURE APP Store: The Google Threat Intelligence enrichment is available for activation in the APP Store. See Enriching Data with Google Threat Intelligence for more information. |
Jul 28, 2025 |
|
ANNOUNCEMENT Feeds: The Blueliv premium feed has been deactivated and removed from the APP Store. |
Jul 28, 2025 |
|
FEATURE Investigations (Limited Availability): The Attack Flow layout, which enables you to add attack flows to investigations is now added to ThreatStream. Attack flows created within investigations can be exported to the attack flow library. See Managing Investigation Entities and Exporting Attack Flows from Investigations for more information. |
Jul 15, 2025 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Jul 14, 2025 |
|
FEATURE Integrations: The Google Threat Intelligence integration can now be activated on ThreatStream. It enables you to include Google Threat Intelligence data in your PassiveDNS enrichments. See Integrating with Google Threat Intelligence for more information. |
Jul 14, 2025 |
|
DOWNLOADS Infoblox Threat Defense Extension: The initial release of the Infoblox Threat Defense extension, v1.0.0, is available from the ThreatStream Downloads page. See Downloads for more information. |
Jul 8, 2025 |
|
FEATURE Indicator Types: The See Indicator Types in ThreatStream for more information. |
Jul 1, 2025 |
|
ENHANCEMENT Rules: The See Guidelines for Advanced Search-Based Rules for more information. |
Jun 30, 2025 |
|
DOWNLOADS QRadar App: The latest release of the Anomali ThreatStream Qradar app, v3.0.2, is available on the ThreatStream Downloads page. See Downloads for more information. |
Jun 18, 2025 |
|
FEATURE Premium Feed: The Flexera Software Vulnerability Research premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Jun 17, 2025 |
|
ENHANCEMENT MITRE ATT&CK: MITRE ATT&CK techniques and sub-techniques associated with v17.0 and v17.1 are now supported by ThreatStream. See Using MITRE ATT&CK Frameworks in ThreatStream for more information. |
Jun 17, 2025 |
|
FEATURE Premium Feed: The Mandiant DTM premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Jun 10, 2025 |
|
ANNOUNCEMENT Feeds: The Mimecast AU/EU/US/ZA Region premium feeds have been deactivated and removed from the APP Store. |
Jun 2, 2025 |
|
DOWNLOADS CrowdStrike Falcon Extension: The latest release of the Crowdstrike Falcon extension, v1.7.1, is available on the ThreatStream Downloads page. See Downloads for more information. |
May 23, 2025 |
|
FEATURE User & Role Management (Limited Availability): The new limited-availability feature, User & Role Management, is now available on the Anomali platform. The feature enables you to establish role-based access control for the Anomali platform. See User and Role Management on the Anomali Platformfor more information. |
May 20, 2025 |
|
ENHANCEMENT Sandbox: The following features have been added to malware detonation on Polyswarm: support for multiple platform submissions, QR code scanning, file password protection, and URL/file artifact submission for Polyswarm scans. See Submitting Malware for Detonation for more information. |
May 20, 2025 |
|
FEATURE APP Store: The MITRE Attack and ThaiCert open source feeds are now available for activation in the APP Store. See Available Open Source Feeds for more information. |
May 19, 2025 |
|
ANNOUNCEMENT Feeds: The TeamT5 APAC Centric APT Intelligence Report (premium feed) and OpenPhish.com (open-source feed) have been deactivated and removed from the APP Store. |
May 19, 2025 |
|
DOWNLOADS ThreatStream OnPrem: The latest release of ThreatStream OnPrem Ubuntu, v5.9-a, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
May 8, 2025 |
|
ANNOUNCEMENT Sandbox: The Cuckoo Sandbox integration has reached end of life on ThreatStream. |
May 6, 2025 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.4, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Apr 30, 2025 |
|
FEATURE Indicator Types: The following indicator types are added to ThreatStream: See Indicator Types in ThreatStream for more information. |
Apr 11, 2025 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.2, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Mar 25, 2025 |
|
DOWNLOADS ThreatStream OnPrem: The latest Pivoting Chart License Patch for ThreatStream OnPrem Ubuntu, ThreatStream OnPrem Red Hat, and ThreatStream AirGap is now available from the Downloads page within ThreatStream. See Downloads for more information. |
Mar 21, 2025 |
|
FEATURE AQL Search: Anomali Query Language (AQL) based search is now available to all ThreatStream customers. AQL is a powerful query language that enables you to search and focus on threat intelligence that matters to you and allows security practitioners to have better visibility and context. See Anomali Search Overview for more information. |
Mar 13, 2025 |
|
DOWNLOADS ThreatStream Splunk App: The latest version of the ThreatStream Splunk App, v6.7.5, is now available from the Downloads page within ThreatStream. See Downloads for more information. |
Mar 10, 2025 |
|
ANNOUNCEMENT APP Store: Due to changes in the terms and conditions of service integration, the Talos Intelligence IP Blacklist open-source feed has been deactivated. |
Feb 25, 2025 |
|
FEATURE Premium Feed: The ShadowServer premium feed is now available for activation in the APP Store. See Managing Premium Feeds for more information. |
Feb 17, 2025 |
|
FEATURE Indicator Types: The following indicator types are added to ThreatStream: See Indicator Types in ThreatStream for more information. |
Feb 11, 2025 |
|
DOWNLOADS ThreatStream Splunk App: The latest version of the ThreatStream Splunk App, v6.7.4, is now available from the Downloads page within ThreatStream. See Downloads for more information. |
Feb 4, 2025 |
|
ANNOUNCEMENT Navigation: Due to the implementation of the new and improved Anomali platform navigation, the classic navigation is no longer available. See Navigating ThreatStream for more information. |
Jan 31, 2025 |
|
ENHANCEMENT APP Store: The Feedly for Threat Intelligence premium feed now allows you to integrate multiple Feedly stream IDs. See Managing Premium Feeds for more information. |
Jan 28, 2025 |
|
DOWNLOADS Crowdstrike Falcon Integrator Extension: The latest version of the Crowdstrike Falcon Integrator extension, v1.7.0, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Jan 24, 2025 |
|
FEATURE Navigation: The new and improved Anomali platform navigation is now generally available. Starting January 31, 2025, the classic navigation will no longer be available, and all users will be automatically switched to the new platform navigation. See Navigating ThreatStream for more information. |
Jan 21, 2025 |
|
FEATURE APP Store: The Microsoft Defender Threat Intelligence enrichment is available for activation in the APP Store. See Enriching Data with Microsoft Defender Threat Intelligence for more information. |
Jan 21, 2025 |
|
ANNOUNCEMENT Integrations: RiskIQ has reached its end-of-life; as a result, the integration with RiskIQ and RiskIQ enrichment are no longer available in ThreatStream. |
Jan 21, 2025 |
|
DOWNLOADS ThreatStream Integrator: The latest release of ThreatStream Integrator, v8.5.1, is available for download on the ThreatStream Downloads page. See Downloads for more information. |
Jan 17, 2025 |
|
DOWNLOADS Azure Sentinel Extension: The latest release of the Azure Sentinel extension, v2.0.5, is available from the ThreatStream Downloads page. See Downloads for more information. |
Jan 9, 2025 |