PyPI

pycti

7.261002.0OpenCTI-Platform/opencti ↗New releases in your daily digest, changelog included.

Python API client for OpenCTI.

Last release 2 days ago
02 Oct 2026
Ships on a steady schedule
a new release about every 2 weeks
Most releases are documented
notes for 53 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
7 years old
455 releases · first in 2019

Release timeline

455 releases since 2019

20192020202120222023202420252026

Releases

5.7.017 Apr 2023
Dear community, we're so glad to announce that OpenCTI 5.7.0 has been released 👏! This new version brings major features to the platform and fixes sev
Dear community, we're so glad to announce that OpenCTI 5.7.0 has been released 👏! This new version brings major features to the platform and fixes several bugs 🛸. This milestone also contains important code refactors and underlying enhancements which will allow us to speed-up the delivery of our 2023 strategic roadmap 🚀!

First of all, the RBAC has been reworked to be more adapted to organization composed of users and groups ✍🏻. Roles / marking definitions are now associated to groups so SSO / active directory integrations are now straightforward 🛡️. Also, we are progressively rolling out more capabilities to customize roles with default hidden entities, default dashboards, etc. to address several levels of stakeholders within an organization 🪄.

Also, it is now possible to fully customize confidence scale (colors, labels, min/max, ticks, etc.) by entity type like we did for mandatory attributes in the previous release. This work has triggered so many bugfixes and enhancements on forms and entities display 🌈.

Finally, opinions are now subject to the new capability "Access to collaborative creation" as notes, to allow read-only users to give their opinions and put comments in entities and relationships. Dashboard widgets start to be more interactive and you can click on horizontal bars and case management is now ready for takeoff with tasks / tasks template and requests for information scheduled for the next release 🎆.

📰 Please be sure to read the documentation about the RBAC refactoring to understand what changed and how you should adapt your SSO mappings. Basically, if you are using "roles_mapping", just replace "roles" with "groups". Whether you are using roles or groups on your SSO side, everything should now be mapped to OpenCTI groups.

Enhancements:

#3175 Be able to use assignees in dashboards and implement distribution list

#3136 "Top Labels" text overflows on small screens

#3117 In malware, make 2 fields "upsertable"

#3114 Merging hashes in the analyst workbench

#3098 Improve engine to handle large amount of text to search

#3095 Enforce merging to update elements base on their current index

#3088 Add case container management in Workbench

#3081 Dependabots fix and user edit api protection

#3064 Add indicator objectContains filtering capability + align contains filtering

#3012 Modularization of relation refs

#2994 Report -> Observables page mislabels Author/Creator

#2990 Improve Synchronizer client to try reconnect if started but connection is closed (404, ..)

#2977 Separate Case and Feedback, and implement Request for Information

#2872 Disable list export when more than X elements are targeted (static parameter with default value 50,000)

#2849 User overview modification

#2847 On horizontal bars chart representing an entity, be able to click on the bar to go on the entity

#2555 Customizable confidence scale

#2516 Align opinions behaviour on notes

#2512 Refactor RBAC / seggregation to put everything under the "group"

#2419 Automatically create groups on SSO

Bug Fixes:

#3148 Modifying Valid Until Date

#3147 Pie chart displaying IDs instead of names for attribute created-by.internal_id

#3143 Rules are not displayed anymore in rule engine settings (Demo)

#3138 Confidence scale setting input not behaves correctly

#3135 Don't show sub-narratives twice in Techniques->Narratives view

#3125 Modify the mechanism on created nested relationship in Graph

#3110 Unknown ObservedData in several display contexts

#3106 Creation of entities sometimes doesnt close the panel due to localstorage "types" element

#3103 Live stream / taxii collection query indices resolve too much information

#3102 contain_refs not authorized between files and other observable

#3101 Unable to create dashboard using Revoke filter

#3091 Channel creation with channel type is broken

#3090 Observable type User Agent cannot be sent through data sharing stream

#3084 Unknown channel value in Knowledge>Details

#3079 Unknown names in Overview>Latest relationships

#3077 Link entity from a located-at relationship creation form

#3070 Create entity from a located-at relationship creation form

#3069 Observables upserts don't appear in streams with label filters

#3067 Ref creation on observable can fail because of representative extraction

#3066 Extract referer can fail if malformed + user token must not be logged

#3060 'No label' filtering combination

#3059 Author negative filtering not working on streams

#3047 Report name is Unknown when creating a relationship between an object and a report

#3044 Entities distribution graph display in Groupings

#3033 Can't update end date of an event

#3031 Cannot share observables/artifacts/indicators with Organizations

#3029 You shouldn't be able to merge vocab when builtin

#3011 Multiple errors in logs: This attribute key first_seen is not allowed on the type targets

#3037 [MITRE] Mitre connector fails to create "The MITRE Corporation" entity with default connector permissions

#2985 Settings routes are not protected consistently with APIs

#2623 Synchronizer Stream Restarting on Error

Pull Requests:

[back] Improve Synchronizer client (#2990) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3009

[Front] Report -> Observables page mislabels Author/Creator (#2994) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3008

[tests] Introduce editor and participate users and a way to use the underlying platform by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3013

[back/front] Add Confidence Scale Configuration (#2555) by @SarahBocognano in https://github.com/OpenCTI-Platform/opencti/pull/3006

[back/front] Settings routes protection (#issue/2985) by @SarahBocognano in https://github.com/OpenCTI-Platform/opencti/pull/3032

[front] Fix on access menu and redirections by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3042

[front] Fix entities distribution in Grouping > entity details by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/3048

[Front] event end_date edition bug fix (#3033) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3043

[Front] relationship creation between an object and an entity from analysis: name display (#3047) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3053

[backend] Bump esbuild to 0.17.X (#2971) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3073

[back] Adapt refresh behaviors to handle session refresh for workers that impersonate the connectors (#3037) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3038

[back] Add missing refs organization declaration (#3031) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3056

[Back] 'No label' filtering combination (#3060) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3062

[backend/frontend] Add indicator objectContains filtering capability + align contains filtering (#3064) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3065

[Front] Bug fix: Create entity from a located-at relationship creation form (#3070) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3071

[backend] Improve dynamic resolution for negative filtering in streams (#3059) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3061

[back] Vitest update by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3078

[back] Patch Weakness CWE-843 by @mc256 in https://github.com/OpenCTI-Platform/opencti/pull/3051

[Front] Unknown names in Overview>Latest relationships (#3079) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3080

[Back/Front] Align opinions behaviour on notes by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/2988

Unknown channel value in Knowledge>Details (#3084) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3085

[Front] Fix link entity from a located-at relationship creation form by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/3083

[Front] Prevent update on builtIn Vocabularies by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3086

[Front] Fix on channel creation (#3091) by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3092

[frontend] Add case container management in Workbench (#3088) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3089

[backend] Enforce merging to update elements base on their current index (#3095) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3096

[backend] Add converter for User Agent observable (#3090) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3097

[backend/frontend] Dependabots fix and user edit api protection (#3081) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3082

[backend] Live stream / taxii collection query indices resolve too much information (#3103) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3104

(frontend) Unknown ObservedData in several display contexts (#3110) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3118

[frontend/backend] In malware, make 2 fields "upsertable" (#3117) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3119

[frontend] Disable list export when more than X elements are targeted (#2872) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3108

[backend/frontend] User overview modification (#2849) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3105

[backend/frontend] Refactor RBAC / seggregation to put everything under the "group" (#2512) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2903

[frontend] On horizontal bars chart representing an entity, be able to click on the bar to go to the entity (#2847) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2993

[frontend] Fix on localStorage, not reproducing bug (#3106) by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3124

[backend/frontend] Separate Incident and Feedback from Case (#2977) by @SarahBocognano in https://github.com/OpenCTI-Platform/opencti/pull/3093

[backend] - Fix on subnarrative by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3139

[backend] Improve engine to handle large amount of text to search (#3098) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3099

[backend/frontend] Modularization of relation refs (#3012) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/3063

[backend] Improve synchronizer restart management (#2623) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/3100

[backend] Fix rule inferred relations updates to save only supported attributes (#3011) by @SouadHadjiat in https://github.com/OpenCTI-Platform/opencti/pull/3035

[frontend/backend] Fix on settings page (#2512bis) by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3134

[frontend] Fix confidence scale setting input (#3138) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/3140

[front] fix rules list display with undefined searchTerm (#3143) by @SouadHadjiat in https://github.com/OpenCTI-Platform/opencti/pull/3146

[backend] Automatically create groups on SSO (#2419) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3028

Top label update on dashboard by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/3150

[frontend] enable Valid Until date modification (#3148) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/3152

New Contributors:

@mc256 made their first contribution in https://github.com/OpenCTI-Platform/opencti/pull/3051

@SouadHadjiat made their first contribution in https://github.com/OpenCTI-Platform/opencti/pull/3035

Full Changelog: https://github.com/OpenCTI-Platform/opencti/compare/5.6.2...5.7.0

5.6.07 Mar 2023Breaking

⚠️ No breaking changes in this releases but 3 points to check / fix if necessary:

Dear community, we are so happy to announce that OpenCTI 5.6.0 has been released 🎉! First of all, this new version fixes multiple issues in the analyst workbench, the dashboarding engine as well as various knowledge screens 🤯. In terms of features, it brings various major enhancements to our threat intelligence platform 🚀:

Be able to customize mandatory attributes for each type of entity (default values for each of them will come in the next release) 🪄 .
Cumulation of technical creators (connectors / users) to keep all sources of an entity over time 💭.
Be able to turn a "stream" (feed) to be public, and all public streams listed on a public page "/public" 🌍.
In synchronizers, it's now possible to consume public streams, and available streams on a remote platform are listed with their filters 📡.
2 important enhancements of knowledge graphs, including lasso selection of entities and display of basic information for selected objects in a right panel 🎠.
All STIX indicators patterns are now canonicalized to avoid potential duplicated using STIX pattern grammar (ANTLR) 🧽.

⚠️ No breaking changes in this releases but 3 points to check / fix if necessary:

If you are using streams, they can now be turned off so check in the Data / Streams list that they are all turned on 🚦.

Old custom dashboard widgets have been deprecated, they will not be displayed anymore 🆕.

In custom dashboards, a huge refactor / improvement have fixed several bugs, and some widgets may have been impacted / reversed (check the "Display source" toggle if you find the displayed data to be inaccurate) 💡.

Enhancements:

#2984 Custom Dashboard - Add workflow status filter
#2952 In "indicators" list, add a filter for "indicator_types"
#2951 Rename right column filters in indicators and request pattern type OV
#2927 Add suport for consists-of between infrastructure and infrastructure, observed-data, + sco
#2923 The relationship type targets is not allowed between Attack-Pattern and System
#2921 [back/front] Improve relations based dashboard widgets
#2886 Cumulate creator_id when upserting an entity
#2877 Change Redis trimming default settings to 2 millions (8G average)
#2875 Improve Redis cluster configuration + platform stops when redis is not available
#2869 Marking definition information leak in entity history
#2860 Improve live stream to continue to send Heartbeat during long resolutions
#2843 Address/Postal Code support on Position GUI
#2817 Some entity fields are not aligned in creation and update
#2867 Unable to remove first_seen and last_seen atrributes from Indicator objects in UI
#2735 Checkboxes / selection in all "Event" categories (incidents / sightings / observed data)
#2606 Be able to make a stream "public" and create a public page
#2562 From the "mass operations" toolbar, be able to create a report and add the selected entities
#2447 Expand Pattern Types to include Major AV Vendors
#2239 Be able to hide any menu and sub menu
#2159 View entity details on graph panel
#1941 [FR] Request for the knowledge graph for reports to have the ability to be multiselected (via drag box/ window)
#1850 Allow to make some entity/fields mandatory
#1809 Unable to modify a observable in a report knowledge space
#1683 Improve "location" and the location form
#1667 When hovering over observable in Report, show related objects
#1551 STIX patterns that are equivalent are not canonicalised which creates duplicate objects

Bug Fixes:

#2980 Exit 1 / platform shutdown when Redis becomes unavailable
#2979 In demo, on indicators when filtering with email address, IPs are displayed
#2976 In Observations => Observables, filters do not impact the URL
#2970 Usage count of open vocab is broken
#2963 Specific dashboard filters cause crash of the dashboard
#2960 Deleted trigger still processed by the notification engine
#2959 Filtering of live streams with Detection:Yes
#2945 No submit button to modify a note
#2942 [Platform] SCO's disappear from the analyst workbench
#2941 [Platform] Once a note is created the body can not be edited
#2936 Observations/Indicators filtering by Creator
#2930 When more than 200 markings exists in the system, user build is failing
#2928 [backend] X-TAXII-Date-Added-First/Last response headers are broken
#2915 "is_family" is "null" in STIX because of "Is family" is "NOT APPLICABLE" in portal. stxi2-validator will fail if is_family is null
#2909 Workbench won't display when this PDF is imported
#2908 Workbench File hash indicators disappearing when changing any entity's type
#2906 File observables search broken in bulk search
#2902 Report/Entities inside creation is not consistent and can lead to several problems
#2900 Dashboard number widget must take care of the global filtering dates
#2896 The relationship type "contains" is not allowed between StixFile and Url
#2894 Details panel not updatable with enforce reference enable on Malware entity
#2885 Error when trying to update a Note
#2881 [Front] Incorrect Events filters
#2878 Memory leak issue due to misuse of the dataloader
#2873 [back] Automatic session refresh is broken after redis cluster support
#2870 When entering an open vocab, right menu is not highlighted
#2856 Delete a vocabulary let the dialog opened (and redirect instead of removing the node from the store)
#2845 Organization segregation breaks access to TAXII collections
#2844 Entity types settings page broken
#2842 FIlter "relatedTo" not take into account the entity types palette
#2840 Unknown entities when adding an observed data
#2837 link to Location/Sightings
#2835 Graph names display after update of some elements
#2485 Optimize the query on the screen "Intrusion Set X => Analysis => Graph view"

Pull Requests:

[Front] Graph names display after update of some elements (#2835) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2836
[Front] Refacto Incident component into .tsx pure function by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/2805
[Front] Enable to modify an observable in a report knowledge space (#1809) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2834
[Front] Highlighted right menu in deep route for Access and Labels/Attributes(#2870) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2879
[back] Automatic session refresh is broken after redis cluster support by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2874
[Front] Vocabulary deletion bug fix (#2856) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2880
[Front] Checkboxes / selection in all "Event" categories (incidents / sightings / observed data) #2735 by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2819
[back] Adapt dates attributes in stix converter (#2867) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2868
[back] STIX standardized patterns to avoid duplicate objects by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2865
[backend/frontend] Alignment of entity fields in creation and update (#2817) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2818
[back] Marking definition completion in entity history by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2871
Migrate creation and edition component to function component by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2858
[Front/Back] Events filters + date filters initial values update (#2881) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2883
[FRONT] Fix update note on data/history menu (#2885) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2890
[front] Dashboard number widget must take care of the global filtering by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2901
[Front] FIlter "relatedTo" not take into account the entity types palette (#2842) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2882
[Front] Address/Postal Code/City support on Position GUI (#2843) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2855
[front/api] - Stream collection update for public streams by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/2766
[Front] Fix enforce reference on malware details panel (#2894) by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2912
[back] Disable cache for dataloader (#2878) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2887
[front] - Refactor of EntitySettings by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/2918
[Front] Fix not update input values in some filters by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2913
[back] Improve cluster configuration + platform stops when redis is not available (#2875) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2899
[back] Improve live stream to continue to send Heartbeat during long resolutions by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2861
[back/front] Allow to make some entity/fields mandatory by @RomuDeuxfois in https://github.com/OpenCTI-Platform/opencti/pull/2839
[front] View entity details on graph panel by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/2898
[back/frong] Improve mandatory and enforce reference management (#1850) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2946
Improve performance of validators + add more telemetry by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2968
[back/front] Upgrade dependencies by @SamuelHassine in https://github.com/OpenCTI-Platform/opencti/pull/2974
[back/front] Improve relations based dashboard widgets (#2921) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2922
[front] Report/Entities inside creation is not consistent and can lead to several problems by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2907
[back/front] Cumulate creator_id when upserting an entity by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2888
[front] Align ui filters on runtime mapping capability (#2936) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2956
[Front] Request pattern type OV in Indicators Right Bar (#2951) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2962
[back/front] Fix count of open vocab (#2970) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2978
[back] Adapt filtering for detection attribute (#2959) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2965
[back] Deleted trigger still processed by the notification engine (#2960) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2961
[Front] add indicator_types filter + Indicator migration to tsx (#2952) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2958
Add a "drag to select" feature to Knowledge Graphs by @ckane in https://github.com/OpenCTI-Platform/opencti/pull/2905
[front] - Fix on Observable types filtering by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/2981
[Front] indicators filtering by adress bug fix + add indicator_types filter (#2979) by @Archidoit in https://github.com/OpenCTI-Platform/opencti/pull/2983
[back] Fix X-TAXII-Date-Added-First/Last headers by @rlynch-ironnet in https://github.com/OpenCTI-Platform/opencti/pull/2929
[back] - Improve of the query for huge graphs by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/2933
[back/front] - Fix sur marking searching on the platform by @Kedae in https://github.com/OpenCTI-Platform/opencti/pull/2982
[back] Protect GraphQL Introspection and add playground options (#2932) by @richard-julien in https://github.com/OpenCTI-Platform/opencti/pull/2957
[front] View entity details on graph panel (#2159) by @marieflorescontact in https://github.com/OpenCTI-Platform/opencti/pull/2964

Full Changelog: https://github.com/OpenCTI-Platform/opencti/compare/5.5.4...5.6.0

Open source →

pycti

Release timeline

Releases

Enhancements:

Bug Fixes:

Pull Requests:

New Contributors:

Enhancements:

Bug Fixes:

Pull Requests:

Bug Fixes:

Enhancements:

Bug Fixes:

Pull Requests:

Enhancements:

Bug Fixes:

Pull Requests: