Prepare for CAL ATL Changes in CAL 3.15 Release

Overview

The CAL™ 3.15 release, scheduled for late March 2026, will deliver a major upgrade for ThreatConnect® and Polarity customers leveraging CAL Automated Threat Library (ATL). In addition to bringing in data from new blogs and report sources and improving the frequency and reliability of data retrieval, this release includes changes that streamline and update blog metadata and remove blogs that no longer exist or provide relevant data:

• Tag names for some CAL ATL blogs were changed to ensure consistency and correctness.
• Some CAL ATL blogs were consolidated under a single Tag.
• Retired blogs that were re-activated were added back to CAL ATL.
• Blogs that stopped publishing relevant data were retired.
• URLs for CAL ATL blogs were updated as needed.

CAL ATL Updates for CAL 3.15

The CAL Automated Threat Library Source includes the following features under the CAL 3.15 release:

• 125 of the best blog and report sources—including CERTs, government agencies, security research organizations, industry vendors, and security news—to help power CTI workflows, orchestration, and decision making. These sources include the following:
  • 46 new blog and report sources
  • Reactivated blog and report sources:
    • 360 Netlab Blog
    • Check Point Research
    • CrowdStrike (formerly CrowdStrike Blog)
    • Dark Reading
    • Flashpoint
    • Internet Crime Complaint Center (IC3)
    • RedPacket Security (formerly Red Packet Security Pikabot C2, Red Packet Security Ransomware Feed, and Red Packet Security Posh C2)
    • Security Week
    • Splunk (formerly Splunk Threat Research Team)
    • The DFIR Report
    • The Digest (Crypto-Ransomware) (formerly ID Ransomware)
    • VIPRE Labs (formerly VIPRE Labs Blog)
• Hourly updates for all blog and report sources
• Improved reliability of retrieved information
• Reduced false positives from links identified as indicators of compromise (IoCs) in blogs and reports

What Do I Need to Do?

The CAL 3.15 release is scheduled for late March 2026. You do not need to make any changes, as automatic Tag normalization rules will make all necessary adjustments to account for changed Tags. If you think you may not want automated Tag normalization to occur on your ThreatConnect instance, please reach out to your Customer Support Manager to be excluded.

Table 1 lists the updated blogs, including changes to their corresponding Tag and a description of the change.

ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.

20183-01 v.03.A