---
title: "CAL 3.17 Release Notes"
slug: "cal-3-17-release-notes"
status: "new"
updated: 2026-10-26T14:38:11Z
published: 2026-10-26T14:38:11Z
canonical: "knowledge.threatconnect.com/cal-3-17-release-notes"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CAL 3.17 Release Notes

CAL™ 3.17 focuses on improvements to the CAL Automated Threat Library (ATL). It adds the latest MITRE ATLAS™ update, extracts more vulnerabilities from reports, and reduces noisy Indicator and Group entity extraction.

## CAL Automated Threat Library (ATL) Updates

The CAL Automated Threat Library (ATL) is ThreatConnect®’s automated threat intelligence source. It continuously ingests and structures content from hundreds of authoritative open-source intelligence (OSINT) publishers (CERTs, government agencies, security vendors, and research organizations) and enriches it with related vulnerability data from MITRE ATT&CK® Enterprise and ATLAS, the Known Exploited Vulnerabilities (KEV) catalog, and the National Vulnerability Database (NVD), as well as with AI-generated summaries and extracted IOCs. The result is curated, connected threat knowledge that analysts don't have to assemble by hand.

CAL 3.17 brings the following improvements to the CAL ATL:

- **Reduced noise in indicator and alias extraction:** CAL now applies additional AI processing to judge the context of each entity extraction, reducing false positives in indicators and aliases identified in ATL reports. Common false positives include the following:
  - Author email addresses
  - Top-level domains (TLDs) that are mistaken for file extensions
  - Minified JavaScript® or code parsed as hosts
  - Webpage scripts parsed as hosts
  - References or examples parsed as real indicators
  - Common vendor or government agency hosts and URLs parsed as malicious
  - Phone number notation extracted as an IP address
  - Ads or calls to action that include the names of malware or threat actors
  - Application version numbers extracted as IP addresses
- **MITRE ATLAS v2026.07:** CAL ATL now extracts and tags from MITRE ATLAS v2026.07, which contains 173 techniques and 35 mitigations. This update moves CAL forward from v5.5.0, adding new techniques and updated mitigations.
- **CVEs found in report titles:** CAL now checks ATL report titles for Common Vulnerabilities and Exposures (CVE®) identifiers in addition to checking the report body. Reports whose titles are the only place a CVE appears are now associated and tagged with that Vulnerability, improving associations, Tags, and Threat Graph pivoting in ThreatConnect. The change applies to newly ingested reports starting with this release.

## Other Updates

- Maltrail feeds now read from the updated upstream repository location.
- An issue causing global results in Intelligence Requirements to be empty when multiple **Include** sections were applied was fixed.

---

*ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc. CVE®, MITRE ATT&CK®, and ATT&CK® are registered trademarks, and MITRE ATLAS™ is a trademark, of The MITRE Corporation. JavaScript® is a registered trademark of Oracle Corporation.*