Enhancements:
- #7462 feat(macadress): add macadress.com MAC address enrichment connector
- #7442 feat(intel471-hunt): add Intel 471 Hunter internal enrichment connector
- #7347 feat(scanmalware): add ScanMalware external import connector
- #7346 feat(scanmalware-enrichment): add ScanMalware internal enrichment connector
- #7282 feat(group-ib): migrate connector to be "manager_supported"
- #7183 feat(pan-cortex-xdr-intel): implement settings and minimal listen_stream runtime wiring
- #7182 feat(pan-cortex-xdr-intel): bootstrap bare skeleton and freeze concrete class contracts
- #7130 feat(qualys-cve-enrichment): migrate connector to be "manager_supported"
Bug Fixes:
- #7494 fix(import-document): connector fails to start in INTERNAL_ANALYSIS mode due to strict CONNECTOR_TYPE validation
- #7480 fix(intel471-hunt): bump pycti to 7.260828.0
- #7393 fix(import-document): unresolvable created_by_ref resolved to literal "Restricted" breaks bundle construction — import fails instead of omitting the optional ref
- #7178 fix(mitre-attack): connector silently drops all entities as entities_types=connect_scope is used as a STIX type filter
- #7133 fix(connector-cve): CVSS 3.0 vectors not visible after 15 June fix (example CVE-2025-0182)
- #7012 fix(connectors-sdk): ListFromString parser doesn't filter empty values
- #5835 fix(recorded-future): email address indicators not mapped and missing after ingestion
Pull Requests:
- feat(qualys-cve-enrichment): migrate connector to manager-supported mode (#7130) by @jabesq in #7341
- feat(group-ib): migrate connector to manager-supported mode (#7282) by @jabesq in #7330
- fix(connectors-sdk): ListFromString parser doesn't filter empty values (#7012) by @Sanjays2402 in #7145
- feat(intel471-hunt): add Intel 471 Hunter internal enrichment connector (#7442) by @mmolenda in #7443
- feat(scanmalware-enrichment): add ScanMalware internal enrichment connector (#7346) by @jonaslejon in #7348
- feat(scanmalware): add ScanMalware external import connector (#7347) by @jonaslejon in #7349
- feat(macadress): add macadress.com MAC address enrichment connector (#7462) by @samymassoud in #7463
- fix(import-document): replace 'Restricted' with 'None' when processing a STIX entity associated with a 'Restricted' organization' (#7393) by @romain-filigran in #7479
- fix(deps): update dependency pycti to v7.260828.0 by @renovate[bot] in #7482
- fix(intel471-hunt): bump pycti to version 7.260828.0 (#7480) by @romain-filigran in #7481
- fix(cve): preserve cvss 3.0 vector string so cvss3 filters match (#7133) by @throuxel in #7440
- fix(mitre-attack): stop overriding CONNECTOR_SCOPE with invalid STIX type value (#7178) by @jabesq in #7459
- fix(recorded-future): map email address indicators to STIX email-addr observables (#5835) by @jabesq in #7432
- fix(import-document): allow INTERNAL_ANALYSIS connector type (#7494) by @helene-nguyen in #7496
New Contributors:
- @Sanjays2402 made their first contribution in #7145
- @jonaslejon made their first contribution in #7348
- @samymassoud made their first contribution in #7463
Full Changelog: 7.260828.0...7.260901.0