Enhancements:
- #8062 feat(taxii-post): Allow identity id remapping as per the MFN requirement
- #8058 feat(netapi): add NetAPI internal-enrichment connector (compromised feed and Top 1M)
- #8049 feat(sochain): add internal enrichment connector for cryptocurrency wallets
- #7920 feat(rosti): add Rösti external-import connector
- #7780 feat(CYFIRMA): add CYFIRMA CTI external import connector
- #7762 feat(sentinelone-intel): Ability to pass the score to SentinelOne Intel connector
- #3849 feat(euvd): create connector for EUVD by ENISA
- #1672 feat(orkl): create the connector
Bug Fixes:
- #8142 fix(dark-web-informer): screenshot external references overload the platform
- #8126 fix(connector): connector S3 - Existing vulnerability notes duplicated after upgrade to 7.261016.0 because note IDs derive from the overridden
- #8108 fix(email-cases-importer): point Pillow's FreeType at the system Brotli (CVE-2026-111497)
- #8091 fix(export-report-pdf): point Pillow's FreeType at the system Brotli (CVE-2026-111497)
- #8070 fix(zscaler): tests fail with pytest 9.2.0 because of pytest-bdd
- #8054 ci(docker): build connector images without a layer cache
- #8051 fix: GreyNoise Feed and IVRE fail to create entities with pycti 7.261014.0 and later
- #8003 fix(microsoft-sentinel-intel): stop dropping the OpenCTI score with the stripped extensions
- #8001 fix(elastic-security-intel): read the OpenCTI score from the stream extension and map it to risk_score
- #7928 fix(virustotal): quota errors (HTTP 429) are reported as successful enrichments and the requests are lost or stuck on quota errors (HTTP 429)
- #7864 fix(cpe): incremental import fails with NIST API 404 "Invalid ISO 8601 date/time format"
- #7861 fix(shodan): enrichment fails with TypeError when Shodan returns the ASN as an integer
- #7671 fix(recorded-future): connector emits non-compliant STIX file-hash patterns for MD5/SHA1
- #7604 fix(taxii2): Infinite loop in TAXII 2.0 pagination when server treats
added_afteras inclusive - #7342 feat(recorded-future): make analyst notes risk threshold filtering transparent
- #5355 fix(infoblox): date parsing and IOC field mapping issues
Community Contributions Highlight:
- fix(taxii2): break pagination loop when added_after does not advance (#7604) by @mattjacksoncello in #7605
- feat(CYFIRMA): add CYFIRMA CTI external import connector (#7780) by @mohanreddy2121 in #7799
- fix(recorded-future): only quote file hash keys that require it in indicator patterns (#7671) by @Gaspardcode in #7866
- feat(rosti): add Rösti external-import connector (#7920) by @baderj in #7921
- feat(sochain): add internal enrichment connector for cryptocurrency wallets (#8049) by @doersf in #8050
- fix(shodan): handle integer ASN values in host enrichment (#7861) by @aliyev-s in #8053
- feat(netapi): add NetAPI internal-enrichment connector (#8058) by @slavaolesik in #8059
- fix(dark-web-informer): drop dwi-screenshot external references (#8142) by @gamezilla19 in #8143
Pull Requests:
- feat(sochain): add internal enrichment connector for cryptocurrency wallets (#8049) by @doersf in #8050
- feat(CYFIRMA): add CYFIRMA CTI external import connector (#7780) by @mohanreddy2121 in #7799
- feat(rosti): add Rösti external-import connector (#7920) by @baderj in #7921
- fix(shodan): handle integer ASN values in host enrichment (#7861) by @aliyev-s in #8053
- fix(zscaler): cap pytest below 9.2 for pytest-bdd compatibility (#8070) by @throuxel in #8071
- fix(deps): update dependency black to v26.10.1 [security] (master) by @renovate[bot] in #8039
- chore(deps): update dependency pillow to v13 [security] (master) by @renovate[bot] in #8033
- chore(deps): update dependency anyrun-sdk to v1.16.0 (master) by @renovate[bot] in #8022
- chore(deps): update dependency starlette to >=1.10.0, <1.11.0 (master) by @renovate[bot] in #8010
- chore(deps): update dependency pytest-mock to v3.17.0 (master) by @renovate[bot] in #8009
- feat(netapi): add NetAPI internal-enrichment connector (#8058) by @slavaolesik in #8059
- fix(taxii2): break pagination loop when added_after does not advance (#7604) by @mattjacksoncello in #7605
- ci(docker): build connector images without a layer cache (#8054) by @xfournet in #8055
- feat(euvd): add ENISA EUVD external-import connector (#3849) by @jabesq in #7754
- chore(renovate): disable group-ib and setup-python python updates (#7731) by @jabesq in #7731
- feat(export-file-csv): export the custom field values in their own columns (#8018) by @ludovic in #8019
- feat(orkl): create the connector (#1672) by @helene-nguyen in #7766
- feat(taxii-post): add identity ID mapping for egress (#8062) by @maximus-debski in #8063
- fix(microsoft-sentinel-intel): add option to send OpenCTI score as confidence (#8003) by @throuxel in #8061
- fix(elastic-security-intel): read the OpenCTI score from the stream extension and map it to risk_score (#8001) by @throuxel in #8016
- feat(sentinelone-intel): send the OpenCTI score as confidence and push indicator updates (#7762) by @throuxel in #8067
- feat(recorded-future): make analyst notes risk threshold filtering transparent (#7342) by @augustin-filigran in #8082
- chore(deps): update dependency azure-identity to v1.27.0 (master) by @renovate[bot] in #8086
- refactor(comlaude): improve HTTP query management (#8105) by @ThibaultLanternierFiligran in #8106
- chore(deps): update dependency googleapis-common-protos to v1.76.0 (master) by @renovate[bot] in #8088
- chore(deps): update dependency mwdblib to v4.8.0 (master) by @renovate[bot] in #8090
- chore(deps): update dependency tenacity to ~=8.5.0 (master) by @renovate[bot] in #8095
- fix(email-cases-importer): point Pillow's FreeType at the system Brotli (#8108) by @xfournet in #8109
- fix(export-report-pdf): point Pillow's FreeType at the system Brotli (#8091) by @xfournet in #8099
- fix(s3): derive the note ids from the created date of the file, not the platform one (#8126) by @SamuelHassine in #8128
- fix(recorded-future): only quote file hash keys that require it in indicator patterns (#7671) by @Gaspardcode in #7866
- fix(infoblox): parse TIDE timestamps with or without fractional seconds (#5355) by @augustin-filigran in #8014
- fix(virustotal): fail the enrichment on exhausted quota instead of stalling (#7928) by @jabesq in #8107
- fix(cpe): send NVD dates with a Z suffix (#7864) by @romain-filigran in #8139
- fix(dark-web-informer): drop dwi-screenshot external references (#8142) by @gamezilla19 in #8143
- fix: pass the GreyNoise Feed and IVRE entity properties as pycti keyword arguments (#8051) by @xfournet in #8052
New Contributors:
- @doersf made their first contribution in #8050
- @mohanreddy2121 made their first contribution in #7799
- @baderj made their first contribution in #7921
- @aliyev-s made their first contribution in #8053
- @slavaolesik made their first contribution in #8059
- @mattjacksoncello made their first contribution in #7605
- @ludovic made their first contribution in #8019
- @Gaspardcode made their first contribution in #7866
Full Changelog: 7.261026.0...7.261030.0