CAL 3.11 Release Notes

New Features

CAL ATL Sources

ThreatConnect®’s CAL™ Automated Threat Library (ATL) is a powerful artificial intelligence (AI)–, machine learning (ML)–driven source that significantly enhances threat intelligence operations. It efficiently distills 74 trusted open-source intelligence (OSINT) sources into structured, ready-to-use threat intel mapped to the ThreatConnect data model and the MITRE ATT&CK® framework. It extracts Indicators of Compromise (IOCs), provides summaries, and identifies related industries via AI. This automation saves analysts hours of manual effort daily by aggregating and analyzing data using AI/ML and natural language processing (NLP).

A complete list of CAL Automated Threat Library Source blogs can be found in the ThreatConnect Knowledge Base. Newly added sources include the following:

• Tenable
• GreyNoise
• Red Canary
• Have I Been Pwned

Updated Features

CAL Document Analysis Improvements

The CAL Document Analysis service is leveraged throughout the ThreatConnect platform via the CAL Automated Threat Library Source, the ThreatConnect Doc Analysis import feature, the ThreatConnect Intelligence Anywhere browser extension, and within Playbooks via the ThreatConnect Doc Analysis App. The following updates were made to the CAL Document Analysis service in CAL 3.11:

• Substantial improvements were made in identification of MITRE ATT&CK techniques, sub-techniques, courses of action, tactics, and campaigns in submitted documents to account for some formatting issues. 
• Improvements were made in identification of embedded links in submitted documents that, in turn, identify additional Indicators in other documents.

CAL Safelist Updates

In this release, we have expanded the CAL Safelist to include more trusted domains, based on customer requests and internal review. Over 250 updates have been made, resulting in over 11,200,000 items being marked as safe in CAL. These Safelist updates are also included in the data available from the ThreatConnect CAL Integration with Polarity. CAL is working to constantly improve the accuracy of your threat intelligence, allowing you to focus on real threats by providing contextual insights and minimizing unnecessary noise in analyst research, document analysis, Indicator queries, and automated workflows across both ThreatConnect and Polarity.

Retired OSINT Sources in TC Exchange

As part of an ongoing effort to improve collection accuracy and relevance, retired OSINT feeds in TC Exchange™ will no longer be downloadable as Sources in ThreatConnect. Most of the retired feeds have not produced data in several years and contain mainly outdated information that can cause confusion and congestion in ThreatConnect.

Are the data from the retired feeds still available?

Yes, the data from retired OSINT feeds are still accessible, just not via a direct feed. To see if an Indicator has ever been seen by these feeds, refer to the CAL Feeds section of the Owners & Feeds card on the Indicator’s Details screen. Information from retired feeds is also available via automation with the Get CAL Enrichment Playbook App, and in the ThreatConnect CAL Integration with Polarity.

Data from retired OSINT feeds are available on Indicator Details screens and via the ThreatConnect CAL Integration with Polarity

How can I tell if a feed is retired?

On the TC Exchange Settings screen, when viewing the report card for a retired feed, you will see an Inactiveicon to the left of the feed’s name, and its report card will be blank.

Inactive feeds have an Inactive icon next to their name and a blank report card

In a future version of ThreatConnect, retired feeds will be removed from the TC Exchange Settings screen.

Which feeds have been retired?

Other Updates

• The temporary gap in coverage for Bleeping Computer in the CAL Automated Threat Library Source was resolved.
• The CAL COVID-19–themed newly registered domains (NRDs) were retired due to lack of new data.
• The Haley SSH Bruteforce IPs were deprecated due to owner retirement.

ThreatConnect® is a registered trademark, and CAL™ and TC Exchange™ are trademarks, of ThreatConnect, Inc.  
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.