LoginSign Up
← Back to all sparks
O

OpenCTI

ANALYTICS
Velocity5.0

Open cyber threat intelligence platform

filigran.io/solutions/open-cti ↗

OpenCTI imports custom views from Hub and lays the groundwork for ingestion health.

threat-intelligenceingestion-healthcustom-viewsenterprise-editionaccess-control
◆Current state
OpenCTI keeps a weekly-or-faster release cadence. 7.261030.0 adds Hub import to custom views, manual updates to security coverage results, configurable date and time display in tables, and export and bootstrap import of configuration bundles. It also restricts custom-field definitions to Enterprise Edition and fixes Priority Intelligence Requirement access restrictions that were not enforced for organization-scoped users. 7.261030.1 stops low-confidence enrichment from disturbing indicator lifecycle metadata.
◆Where it's heading
After two weeks spent on dashboards and the knowledge graph, attention is turning to platform administration: configuration presets, Hub-distributed views, connector forms and ingestion health, which is being built behind a feature flag. Custom fields now sit on the Enterprise side of the line, so new data-model flexibility is being used as a paid differentiator. Access-control fixes keep appearing, which suggests organization segregation is still being hardened.
◆Prediction
Expect ingestion health to leave its feature flag in a coming weekly, with email notifications already in place. The entries do not indicate when a new LTS line will be cut.

◆Recent moves

  1. 2d ago

    OpenCTI 7.261030.1: indicator lifecycle kept on low-confidence upsert

    A same-day patch: indicators keep their lifecycle metadata when a lower-confidence source enriches them, so decay rules and indicator fields stay consistent. A narrow fix to the 7.261030.0 weekly.

    View source ↗
  2. 3d ago

    OpenCTI 7.261030.0: Hub import for views, manual coverage updates

    The clearest step yet from analyst surfaces to platform administration: Hub import in custom views, manual security coverage results, configuration bundles and ingestion-health groundwork. Custom-field definitions become Enterprise-only, and organization-scoped users are now held to PIR access restrictions.

    View source ↗
  3. 6d ago

    OpenCTI 7.261026.0: bulk-update and dashboard access fixes

    A fix release: bulk-update dates are kept, dashboard group restrictions save, and the Python client accepts dictionary custom properties. The frontend moves to Material UI 9, which users should not notice.

    View source ↗
  4. 9d ago

    OpenCTI 7.261023.1: saved-filter switching fix

    Switching saved filters no longer requires clearing the current ones, and the SMTP settings form is fixed. Small follow-up to the graph release earlier the same day.

    View source ↗
  5. 10d ago

    OpenCTI 7.261023.0: keyboard graph control, grouping, SVG export

    Graphs can be driven from the keyboard, group same-type objects and export at higher resolution or as SVG, closing several long-open requests. Live-stream dependency resolution and heartbeat leaks are fixed too.

    View source ↗
  6. 11d ago

    OpenCTI 7.261021.1: XTM One outputs in Ask Ariane, graph refresh

    Ask Ariane can now show and download the decks, reports and videos XTM One produces, and every graph surface gets a refresh. It continues the 10-19 move of XTM One output into the chat.

    View source ↗