Across the modules listed from our application, we made the following updates in Release 4.7:
Feed Scanner
We introduced a new Feed Scanner feature, replacing the existing Threat Ranking page, which will provide a scanner like UI that users can use to search through our feed data
Simple Search: Select inputs from dropdowns to create a query.
Advanced Search: Directly input SPQL to create a complex query.
We improved the usability; customers can easily search and filter our feed data, and then save the query, along with its column configuration, for easy retrieval in future. Users can additionally export the results of the query both via a one-time download or by automating the export. Customers can also access examples, recent queries, and saved queries in the modal on the right side of the screen.
We are now exposing the full set of enriched fields from our feed data and users can customize the view to select their preferred default columns. Users can view all fields in an expanded view.
Threat Intelligence Management
Note: Available for Enterprise customers only.
We updated our Threat Intelligence Management module and renamed the following features to better reflect their functionality:
Threat Ranking to Feed Scanner
Collections to Draft Feeds
Feeds to All Feeds
Feeds Report to Feeds Comparisons
We moved the IOFA Feeds analytic feature from the Data Export module to the Threat Intelligence Management module.
We implemented a card UI in the All Feeds feature, which will include Draft Feeds, IOFA Feeds and Open-Source Feeds, to standardize the view of information.
For more information on our Threat Intelligence Management module view our documentation.
Data Exports
We renamed our Data Marketplace module to Data Exports, and updated the names of the following features:
Bulk Data Feeds to Bulk Data Exports
IOFA Feeds to IOFA Export.
Organization Feeds to Organization Exports
We implemented a card UI in all three of the features in Data Exports to standardize the view of the information for users.
Customers can manually perform a one-time download of the export file or use the provided API endpoint to automate the export of the file. Code examples are provided to assist with setting up the automation. For more information about our Data Exports module, and its features, view our Data Exports documentation.
Subscription
Note: Available for Enterprise customers only.
We introduced a Threat Check https based API and a DNS based RBL solution; Enterprise customers can now leverage our Threat Check https API endpoint and/or DNS based real-time blocklist solution to perform unlimited lookups against our IOFA feeds by passing in an indicator and receiving a boolean response indicating whether the indicator is listed on any of our IOFA feeds. For more information about our Threat Check API, check out this article.
We introduced the Customer Feed API. Customers can now automate the creation and management of their feeds via this API. For more information about our Customer Feed API, go to our Customer Feed API documentation site.
Organization Settings
Note: Available for Enterprise customers only.
We introduced SCIM support to complement our SSO offering. Enterprise customers can now automate the on-boarding and off-boarding of users to our application. For information, refer to our Manage your SSO Users article.
Total View
We improved how we display our IOFA indicators in Total View by adding the following to the application:
Part of Threat Feed flag: we now display a visual flag to highlight if an indicator is on any feed (previously only shown if indicator was on a Silent Push created feed)
Part of IOFA Feed flag: we now highlight if an indicator is on an IOFA feed with a dedicated flag
Feed Trend: We’ve extended this feature to now show the trend of any feeds including customer created feeds.
For more information, go to our Total View article.