✨ New Features
4f970be- add Signal and IRC workflow action modules (commit by @adulau)52178a7- [website] redesign enrichment workspace and module settings (commit by @adulau)99ad727- [website] refresh MISP branding and enrichment result cards (commit by @adulau)ea0771b- [website] redesign investigation paths and session history (commit by @adulau)d1e7a62- add MWDB hash query expansion module (commit by @adulau)8e063b6- add RIPEstat expansion module (commit by @adulau)12fd9c0- add configurable Pandora file submission module (commit by @adulau)ae1686e- improve local GeoIP database loading (commit by @adulau)ca7728a- extract inline forwarded emails as linked objects (commit by @adulau)f102110- support legacy OpenIOC imports with native MISP output (commit by @adulau)bf07061- add opt-in per-module query result caching (commit by @adulau)881a338- [anyrun_lookup] add threat intelligence lookups (commit by @adulau)33035e2- [censys_enrichmentapis] add enrichment API support (commit by @adulau)db91878- [criminal_ip] add IP and domain report enrichment (commit by @adulau)8e604b8- [dnslytics] add domain dataset searches (commit by @adulau)78fd620- [greynoise_vuln] add dedicated CVE intelligence lookups (commit by @adulau)61895a1- [triage_query] retrieve existing sandbox reports (commit by @adulau)f167a95- [first_epss] add direct FIRST EPSS lookups (commit by @adulau)0e98cd5- [cape_sandbox] add sample submission and report enrichment (commit by @adulau)aac05f9- [fortisandbox] add hash ratings and sample submissions (commit by @adulau)7570391- [glimps_malware] add analysis lookup and sample submission (commit by @adulau)4e70036- [dnstwist] add domain permutation enrichment (commit by @adulau)45d6308- [eset_report] retrieve threat intelligence PDF reports (commit by @adulau)a894cf7- [doppel_alert_takedown] add alert and takedown workflow actions (commit by @adulau)99e74d4- [domaintools] add Iris adapters using the provider reference (commit by @adulau)
🐛 Bug Fixes
17e1153- expansion: tolerate results with no tags (commit by @elhoim)bb770e7- [eql] initialise attrType before the supported-type loop (commit by @elhoim)5eeccb3- [iprep] reject a config that carries no apikey (commit by @elhoim)01cee99- [backscatter_io] accept ip-dst-only requests and reject empty ones (commit by @elhoim)be2e032- [website] register state-changing routes as POST, not GET (commit by @elhoim)7cb31e9- [sourcecache] validate URLs before archiving to block SSRF (commit by @elhoim)9425dfb- [sourcecache] refuse URLs that the URL parsers split differently (commit by @elhoim)4249b2c- [sourcecache] cover IPv6 targets in the URL check (commit by @elhoim)89880c5- reject Signal acknowledgements with recipient errors (commit by @adulau)24d7669- [mass_eql_export] emit one valid query per event type and escape values (commit by @bacescuandrei)441bdfa- [mwdb] validate uploads and modernize metadata handling (commit by @adulau)b68cf1a- [yara_export] pass attribute dicts to the handlers of combined attributes (commit by @bacescuandrei)7c15244- [website] preserve login inputs during toast initialization (commit by @adulau)3a89562- [threat_connect_export] export ip|port and filename|md5 attributes (commit by @bacescuandrei)0e75470- [cef export] use the defaults for settings MISP sends as null (commit by @bacescuandrei)1feb018- [farsight] infer SOA email domains using the public suffix list (commit by @adulau)a81aecb- [farsight] reject invalid derived SOA email addresses (commit by @adulau)2c14f74- address Pandora password and filename review findings (commit by @adulau)5f6e265- handle X-Force Exchange API failures (commit by @adulau)0202562- crowdsec: update CTI enrichment and classification mapping (commit by @adulau)9697491- guard AssemblyLine submission responses and add regression coverage (commit by @adulau)1a9da7a- deps: select one dateutil version for documentation builds (commit by @adulau)05474d5- reuse forwarded URLs and accept folded headers (commit by @adulau)3b3ef79- [hibp] enable enrichment and harden API requests (commit by @adulau)f39b487- populate Cytomic Orion object first_seen for timelines (commit by @adulau)de3da9d- [ipinfo] support current APIs and retain enrichment context (commit by @adulau)452c917- decode DuckDuckGo redirect links before validating results (commit by @adulau)e8ee174- preserve OpenIOC values rejected by MISP validation (commit by @adulau)aceb1e6- accept DMARC pass dispositions from RFC 9990 (commit by @adulau)0206f77- repair website external-tools API key schema on upgrade (commit by @adulau)eb3cb26- [typo] fixed (commit by @adulau)9bdc022- [anyrun_lookup] address review findings (commit by @adulau)482c544- [censys_enrichmentapis] address review findings (commit by @adulau)6e881a4- [criminal_ip] address review findings (commit by @adulau)6312937- [dnslytics] address review findings (commit by @adulau)4930d91- [greynoise_vuln] address review findings (commit by @adulau)7dbb832- [triage_query] address review findings (commit by @adulau)eaeef64- [cape_sandbox] address review findings (commit by @adulau)e3f8a37- [fortisandbox] address review findings (commit by @adulau)7453aea- [glimps_malware] address review findings (commit by @adulau)52c0535- [dnstwist] address review findings (commit by @adulau)19ae7a5- [eset_report] address review findings (commit by @adulau)5ddf86f- [doppel_alert_takedown] address review findings (commit by @adulau)9dac529- [domaintools_support] address review findings (commit by @adulau)e60fb84- [eset_report] represent downloaded PDFs as report objects (commit by @adulau)a26fe53- keep GreyNoise dependency exports compatible (commit by @adulau)