CAL 3.16 Release Notes

New Features

Real-Time Dataminr Intelligence in the CAL Automated Threat Library

In CAL™ 3.16, Dataminr Cyber Intel Briefs are now ingested directly into the CAL Automated Threat Library (ATL), bringing one of the most timely and distinctive threat intelligence signals in the industry into the enrichment pipeline that ThreatConnect analysts rely on for aggregation, automation, and analysis of open-source intelligence.

Dataminr’s platform monitors the open web, social media, and thousands of other public signals in real time, surfacing emerging threats as they develop—often before traditional threat intelligence feeds have processed them. Cyber Intel Briefs are Dataminr’s curated, analyst-ready summaries of those signals: structured threat reporting generated directly from live-event detection. IOCs and threat actor activity referenced in each brief are automatically extracted, enriched, and made available in ThreatConnect through the same ATL-powered workflows analysts already use—no separate feed to configure, no new interface to learn. This means threats surfaced by Dataminr’s real-time detection are reflected in CAL enrichment data shortly after a brief is published, complementing the depth of the ATL’s 125-source coverage with the speed of Dataminr’s live-signal processing.
Figure 1_CAL 3.16 Release Notes

Dataminr Cyber Intel Briefs are now available in the CAL Automated Threat Library Source

Note

Dataminr Cyber Intel Briefs are available in the CAL Automated Threat Library Source and the CAL integration with Dataminr Investigative Insights.

New CAL Classifier: Host.FileExtensionTLD

CAL 3.16 introduces a new classifier: Host.FileExtensionTLD. This classifier identifies Host Indicators in ThreatConnect and in Dataminr Investigative Insights (when using the integration with CAL) whose top-level domain (TLD) is also one of 28 common file extensions, including .exe, .zip, .py, .js, and .pdf.

Hosts matching this pattern fall into two main categories: filenames that were mistakenly extracted as Indicators from structured documents such as PDFs or spreadsheets, and attacker-registered domains deliberately designed to mimic file paths and evade detection. The Host.FileExtensionTLD classifier helps analysts quickly identify and triage these potentially mislabeled Host Indicators, reducing noise and improving the accuracy of Indicator review workflows.

Host.FileExtensionTLD replaces the LikelyPythonScript classifier, which has been deprecated in CAL 3.16. Indicators previously classified by LikelyPythonScript are now covered under the broader Host.FileExtensionTLD classifier.

Updated Features

Dataminr Cyber Pulse Limited: CAL Enrichment and Source Attribution

Analysts triaging Dataminr Pulse alerts in CAL 3.16 now have richer context available directly within alert data. When a Dataminr Pulse alert is ingested by the Dataminr Cyber Pulse Limited feed, CAL enrichment data for Discovered Entity Indicators—the IP addresses, hostnames, and URLs that appear in the alert—are captured as a point-in-time snapshot and stored in the following attributes for these Indicators:

CAL Classifier
CAL Impact Factor
CAL Score
CAL Status

Important

The values in these attributes represent a snapshot captured at alert ingestion time and may differ from an Indicator’s current CAL enrichment state if conditions have changed since the alert was created. Analysts who need the latest enrichment data for an Indicator can view the current CAL Global Threat Score and all current CAL Classifiers and CAL impact factors on the Indicator’s Details screen in ThreatConnect and in Dataminr Investigative Insights when using its integration with CAL . CAL status is not directly available in ThreatConnect, but may be viewed to the right of the CAL Global Threat Score when viewing an Indicator in Dataminr Investigative Insights.

Two additional data points are now available in the Description attribute for Event Groups ingested by the Dataminr Cyber Pulse Limited feed:

Data Source Name: Identifies the originating source (the blog or feed) that triggered the alert.
Data Source URL: Provides a direct link to the source content, allowing analysts to quickly access the original intelligence report behind a Dataminr alert.

Finally, CVE identifiers extracted from alerts from the Dataminr Vulnerability Alerts List are now created as Vulnerability Groups and associated to the Event Group for the alert, enabling analysts to pivot directly from a Dataminr alert to the corresponding Vulnerability Group in ThreatConnect.

CAL Automated Threat Library: New Sources

CAL ATL has expanded to 125 blog and report sources in CAL 3.16. In addition to Dataminr Cyber Intel Briefs, the following sources were added in this release:

Security.com: Broadcom/Symantec’s threat intelligence feed, publishing timely write-ups on newly discovered malware, backdoors, and threat actor campaigns alongside broader analysis and expert commentary on the security landscape
Elastic Security Labs: Elastic’s threat research team publishing novel security intelligence and free tools, covering deep-dive malware/intrusion-set analysis, vulnerability research, and detection engineering write-ups (often with accompanying detection rules)

Document Analysis: Indicator Extraction Improvements

CAL 3.16 delivers improvements to Indicator extraction in both the CAL Doc Analysis Service and the CAL ATL source processing pipeline.

Expanded Indicator and CVE Extraction

Indicator extraction patterns have been updated to recognize additional obfuscation and formatting variations commonly found in threat intelligence reporting. Updates include case-insensitive matching for CVE identifiers (e.g., recognizing cve-2024-1234 in addition to CVE-2024-1234) and recognition of defanged network indicators, including hostnames using [.] and [dot] notation and email addresses using [at] substitution.

Improved Indicator Signal Quality

CAL ATL now filters self-referential links and references within source blog posts, preventing source infrastructure such as navigation elements and internal cross-links from being extracted as threat indicators. This update improves the quality of indicator signals across all ATL-sourced content.

Bug Fixes and Other Updates

The CAL safelist that powers features in ThreatConnect, Dataminr Investigative Insights, and Dataminr Pulse has been expanded to include additional trusted infrastructure. The safelist and “known good” label for Indicators improves response times and minimizes alert fatigue in automated workflows and analyst queries by marking 6.3+ million non-IOCs as inactive, further reducing false positives and suppressing benign indicators in analyst workflows.
A regression introduced in CAL 3.15 caused MITRE ATT&CK Enterprise technique associations to be stored with extended name text appended to the technique ID rather than the canonical ID format. For example, T1203 - EXPLOITATION FOR CLIENT EXECUTION was stored in place of the correct T1203. Affected records have been retroactively corrected to the canonical technique ID format.

ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.