8.1 Release Notes

New Features and Functionality

ThreatConnect 8.1 builds upon the Agentic Threat Intelligence Platform (ATIP) foundation introduced as an early-beta feature in version 8.0. This release extends the agentic capabilities in the TIP from a curated set of pre-built agents to a platform you can actively build on and tailor to how your team already works.

Version 8.1 lets you create your own AI agents inside the Playbooks canvas, adding AI to the already highly customizable automation and orchestration functionality available in the platform. In addition, you can now configure the agentic capabilities to use your own LLM provider instead of relying solely on ThreatConnect’s managed model layer, and you can interact with data and automations available in the platform via external AI clients using a new TIP Model Context Protocol (MCP) server. Alongside these agentic offerings, 8.1 includes native, branded, generative AI reporting that lets your organization’s look and feel carry through to finished intelligence products, as well as another phase of improvements to the Case Details screen.

Build Agentic Playbooks

In version 8.1, you can extend Playbooks by adding Agent triggers and Agent nodes (base agents). This functionality lets you customize the out-of-the-box agents introduced in version 8.0 to your own use cases, incorporate AI into existing workflows, and build new AI-powered playbooks.

Once agent building is enabled on your instance, you will gain access to the Agent trigger type and Agent node type in the Playbooks canvas. You can add these elements to a playbook the same way you'd add any other trigger or app—via a new Add Node dropdown that groups the options for adding agents, apps, operators, and triggers in a single, convenient location.

Add an Agent trigger to a playbook

Add an Agent node to a playbook via the new Add Node dropdown

Agent Trigger

When you add an Agent trigger to a playbook, the trigger is automatically assigned a unique name that you can customize to your liking, along with details such as platform areas and objects from which the agent can be called, conversation hints that the Ask AI drawer can display to help users call the agent from there, and suggestions the agent can make at the end of a chat in the Ask AI drawer for further action.

Customize an Agent trigger

Agent Node

When building an agentic playbook, you can add one or more Agent nodes to process and act on information from upstream nodes. From there, you can configure each agent further—for example, connect it to remote MCP servers so it can call external tools, or set up a Knowledge Store for it to reference when reasoning about a request.

Customize an Agent node

Agent Evaluations

Evaluating output and user feedback is an essential part of maintaining and improving agentic systems. When you have agent building enabled on your instance and are viewing a playbook with at least one Agent node, you will be able to access a new Agent Evaluations selection in the redesigned menu for playbook configuration options.

Open the Agent Evaluations tab in agentic playbooks

This option opens the Agent Evaluations tab, where you can create and configure evaluation schemas for the agent using sample inputs and outputs and apply those schemas to the results of agent executions. In addition, you can view user feedback collected by the agent.

Evaluate an agent’s executions against preconfigured schemas and view user feedback

Bring Your Own Model (BYOM)

Many organizations have policies in place requiring AI features to go through a rigorous compliance review before they can be used on production systems. Some of these teams are already using LLMs that have been through this process. Version 8.1 lets you bring already approved or otherwise preferred models into ThreatConnect’s agentic AI features instead of relying solely on the platform-provided LLMs, allowing you to put agentic AI to work without needing to navigate through another compliance review.

In this version of the platform, BYOM supports the following providers:

• OpenAI
• Anthropic®
• (Microsoft) Azure® OpenAI
• Amazon Bedrock®
• OpenAI-Compatible

System Administrators can enable and configure the BYOM feature from the new AI Providers tab of the System Settings screen. First, turn on the Enable Custom AI Provider (BYOM) toggle. Then select an AI provider, provide and verify an API key for that provider, map each performance tier to a model ID for the provider, and save the configuration. You can also add custom models for the provider.

Enable a custom AI provider (BYOM) in System Settings

TIP MCP Server

Version 8.1 exposes threat intelligence, Workflow, notifications, playbooks, and other data available in the TIP through an MCP server, so you can connect the AI client of your choice and work with your TIP data and automations directly from that client rather than being limited to the platform’s built-in Ask AI chat interface and out-of-the-box and custom agents.

Once it is connected to the TIP MCP server, your AI client has access to your Indicators, Groups, Intelligence Requirements, Tags, Victims, Victim Assets, Cases (including Artifacts, tasks, Case notes, timeline events, and Workflows), attributes, attribute types, security labels, notes, notifications, and batch and DataStore operations, along with read access to owners, users, user groups, roles, system settings, Indicator exclusion lists, playbooks, and jobs. Your active playbooks are exposed as callable tools as well, so your client can invoke a playbook directly or trigger one indirectly simply by creating or updating a resource the playbook is watching.

In addition, version 8.1 adds a new trigger type in playbooks: MCP. After you configure your AI client, playbooks with this trigger type will be available as MCP tools in the AI client.

Configure TIP MCP Server in Claude Desktop

Follow these steps to configure the TIP MCP server in Claude Desktop:

1. Get a TIP API token.
2. Confirm that Node.js is installed.
3. Update the Claude Desktop configuration JavaScript® Object Notation (JSON) file with the TIP MCP server configuration.
4. Restart Claude Desktop.

Get TIP API Token

A TIP API token is required for configuring the TIP MCP server. Users with an Organization role of Organization Administrator can retrieve API tokens. All other users must request an API token from their Organization Administrator.

Follow these steps to retrieve a TIP API token:

1. On the Membership tab of the Organization Settings screen, create a new API user or edit an existing API user.
   Important

   If your user account allows you to select Organizations on the Organization Settings screen, make sure to select the Organization whose data you want to work with in the AI client. API tokens are assigned to API user accounts and allow access only to data in the API user’s Organization and the Communities and Sources in which that Organization has membership.
2. If creating a new API user, fill out the fields on the API User Administration window, and then click SAVE USER AND GENERATE TOKEN. If editing an existing API user, click GENERATE TOKEN if the API Token field is empty or the current API token is expired.
   Important

   The AI client’s data access is determined by the Organization role of the API user assigned to the token. When retrieving a token for another user, Organization Administrators should pull it from an API user account with the least-privileged Organization role needed to accomplish tasks in the AI client. Don’t give a user a token from an account whose Organization role is higher than their own.
3. Copy the token in the API Token field. The first five characters of the token are always APIV2.

Confirm Node.js Is Installed

Claude Desktop launches the TIP MCP server using npx, which is installed as part of Node.js®. Follow these steps for your local environment to confirm that Node.js is available on your machine.

macOS

Follow these steps to confirm that Node.js is available on your macOS® machine:

1. Open the Terminal and run the following commands:

   which npx
   npx --version

2. If both commands return a result (a file path and a version number, respectively), Node.js is already installed; skip to the “Update Claude Desktop Configuration File” section. Otherwise, follow the rest of the steps in this section.
3. Run the following command to install Node.js via Homebrew:

   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

4. Enter your Mac login password when prompted and press Enter. Note that the Terminal does not display characters as you type in the password.
5. When the Homebrew install finishes, it outputs a “Next steps” section with commands to add Homebrew to your PATH—something like the code that follows. Copy and run the exact commands shown in your own Terminal’s output.
   Important

   • Do not skip this step, or else brew—and later, npx—won’t be found.
   • The commands in this step will not produce any output. This is normal.

   echo >> /Users//.zprofile
   echo 'eval "$(/opt/homebrew/bin/brew shellenv zsh)"' >> /Users//.zprofile
   eval "$(/opt/homebrew/bin/brew shellenv zsh)"
   

6. Enter the following command:

   brew install node

7. Homebrew will list the formula and dependencies it’s about to install and ask the following question:

   ==> Do you want to proceed with the installation? [y/n]

8. Type y and press Enter to proceed.
9. Once the install finishes, re-run the check in Step 1. You should now get a real path (e.g. /opt/homebrew/bin/npx) and a version number, confirming Node.js is installed correctly.

Windows

Follow these steps to confirm that Node.js is available on your Windows® machine:

1. Open Command Prompt (search cmd in the Start menu) and run the following commands:

   where npx
   npx --version
   

2. If both commands return a result (a file path and a version number, respectively), Node.js is already installed; skip to the “Update Claude Desktop Configuration File” section. Otherwise, install Node.js using one of the following methods:
   • Option A: Install from the Node.js website
     1. Go to https://nodejs.org/en/download/ and follow the instructions to download the Long-Term Support (LTS) installer for Windows with npm®. The installer should download as an .msi file.
     2. Run the downloaded installer. Windows may show a User Account Control prompt asking to allow the app to make changes; if so, click Yes.
     3. Step through the installer wizard (accept the license, keep the default install location, keep default options selected) and click Install and then Finish.
   • Option B: Install via WinGet from Command Prompt
     1. Run the following command:

        winget install OpenJS.NodeJS.LTS
        

     2. If this is your first time using winget, you may be prompted to accept the Microsoft® Store source agreements before continuing. Accept the agreements to proceed.
3. Close and reopen Command Prompt and then re-run the check in Step 1. You should now get a real path and a version number, confirming Node.js is installed correctly.

Update Claude Desktop Configuration JSON File

Follow these steps to update the Claude Desktop configuration JSON file with the TIP MCP server configuration:

1. Navigate to the location of your Claude Desktop configuration file:
   • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
     Hint

     The ~/Library path is hidden by default in the Finder®. To navigate there, open Finder, press Command-Shift-G (Go To Folder), paste ~/Library/Application Support/Claude/, and press Enter.
   • Windows: %APPDATA%\Claude\claude_desktop_config.json
     Hint

     Press WIN+R and enter %APPDATA%\Claude\ to navigate to that folder. Alternatively, depending on your local setup, the folder containing the configuration file may be located in C:\Users\\AppData\Local\Packages\Claude or C:\Users\\AppData\Roaming\Claude.
2. Open the claude_desktop_config.json file in a text or code editor.
3. If the file doesn’t already have an mcpServers key, add the following code as a new top-level key (i.e., on the same level of existing keys such as coworkUserFilesPath and preferences—not nested inside them), replacing <TC_HOST> with your instance host (e.g., acme.threatconnect.com) and <YOUR_TOKEN>with your TIP API token:
   Important

   • The server key (threatconnect) is just a label. When connecting to multiple TIP instances, add a separate mcpServers key block for each instance, using the name of the instance (e.g., tc-dev, tc-prod) as the label. It is critical to use a unique mcpServers key for each instance; reusing a label across different servers can trigger Claude Desktop’s stale-tool caching.
   • The part after <TC_HOST> is always /api/v3/mcp. Confirm the port for your host. :443 is the default, but some deployments use :8443; if the latter is the case, include it in the <TC_HOST>.
   • macOS:

     "mcpServers": {
         "threatconnect": {
           "command": "npx",
           "args": [
             "-y", "mcp-remote@latest",
             "https://<TC_HOST>/api/v3/mcp",
             "--header", "Authorization: Bearer <YOUR_TOKEN>"
           ]
         }
       }

   • Windows:

     "mcpServers": {
         "threatconnect": {
           "command": "mcp-remote",
           "args": [
             "https://<TC_HOST>/api/v3/mcp",
             "--header", "Authorization: Bearer <YOUR_TOKEN>"
           ]
         }
       }

4. Make sure to add a comma after the closing } of the key immediately before mcpServers, and then confirm that your final file is valid JSON (matching braces and brackets).
5. Save the configuration file.
   Warning

   The TIP API token is cleartext data that exists in the claude_desktop_config.json file on a user’s local machine. If this token is leaked, edit the API user on the Membership tab of the Organization Settings screen and generate a new token, which fully and immediately revokes the old token.
6. (Windows only) Run the following additional command:

   npm install -g mcp-remote@latest

Restart Claude Desktop

Fully quit Claude Desktop (not just close the window) and reopen it. The threatconnect (or whatever label you have given it) MCP server should be listed in the Connectors section. If you click on it, you should see the following tools:

• Tc resources: List all available resource types.
• Tc describe: Get field names, ThreatConnect Query Language (TQL) syntax, and enumerable values for a resource type.
• Tc list: List resources with TQL filtering, field selection, sorting, and pagination.
• Tc get: Retrieve a single resource by ID.
• Tc create: Create a new resource.
• Tc update: Replace an existing resource (PUT).
• Tc delete: Delete a resource by ID.

If you have active playbooks with an MCP trigger in your Organization, they will also be listed as tools.

Branded Generative AI Reporting

The new branded generative AI reporting feature lets you produce brand-compliant intelligence report drafts directly from Group data already in the platform. Once generated, a report can be refined in the new HTML report editor and then saved as a Report Group object, exported as a PDF or HTML file, or sent as an email.

An Organization Administrator sets up your brand customization once, through a new configuration drawer (clickat the upper right of the Reporting screen) in which they provide a logo, custom font, and custom colors. After that, every report generated for your Organization can have that same look and feel, no matter who generates it. If you’d rather not build a fully custom palette, three built-in style presets are available out of the box: Blueprint (steel-blue tones), Ember (warm amber tones), and Dataminr (reflecting the TIP’s new post-acquisition branding).

Configure your Organization’s logo, font, and colors for generative AI reports

Generate a report directly from a Group’s Details drawer or screen by clicking the Generative Report Agent button or selecting Generative Report Agent from the Create AI Report dropdown. Then configure the report as follows:

• Choose a report format: Executive Brief, Technical Analysis, or Deep Dive Intelligence Analysis. As in the Intelligence Report Generator Agent released in version 8.0, each format is tuned for a different audience and level of detail.
• Select a style from the presets or the brand configuration set by your Organization Administrator.
• (Optional) Use the Describe with AI text block to further steer the output—for example, by describing the depth and voice the output should use. The tool is designed to prioritize and summarize the data already present in the TIP rather than generate new information, which keeps reports grounded in your actual intelligence rather than introducing hallucinated content.

Once generated, the report opens directly in the HTML report editor, where you can adjust fonts, colors, and text. From there, you can save the finished report as a Report Group object, export it, or email it.

Case Details Screen UI Revamp

Version 8.0 introduced improvements to the Case Details screen that brought it into closer alignment with the Details screen for threat intelligence objects. Version 8.1 iterates on this enhancement with a fully rebuilt Case Details screen. This update is a UI rewrite, not a redesign of the case management feature set: The existing tabbed layout and the task management, Artifacts, associations, timeline, and other features are carried forward from previous versions, refined for consistency and performance. Alongside the rewrite, a handful of new capabilities have been added directly to the page.

The rebuilt Case Details screen

Miscellaneous Case Enhancements

There are a few enhancements available as part of this UI uplift. You can now pin key attributes to the top of the Attributes card, so that you don’t have to dig for the data points that matter to your investigation. This feature is useful for surfacing the details your team references most—status indicators, classification, or any attribute critical to triage.

Pin an attribute in a Case

In addition, Case Artifacts now have a Details drawer that makes it easy to view all available information about the Artifact in a streamlined, familiar interface.

The new Artifact Details drawer provides an organized view of an Artifact’s details

Improvements

Coming soon!

Bug Fixes

Coming soon!

Dependencies & Library Changes

• ThreatConnect is now running the following versions:
  • Java® 21
  • Redis® 8.2.8
  • Postgres® 17
  • Wildfly® 39

Maintenance Releases Changelog

There are no patch releases at this time. 8.1.0 is the latest version.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.
Amazon Bedrock® is a registered trademark of Amazon Web Services, Inc.
Anthropic® and Claude® are registered trademarks of Anthropic, PBC.
Finder® and macOS® are registered trademarks of Apple, Inc.
Wildfly® is a registered trademark of The Commonhaus Foundation.
Microsoft®, Azure®, and Windows® are registered trademarks of Microsoft Corporation.
npm® is a registered trademark of npm, Inc.
Node.js® is a registered trademark of the OpenJS Foundation.
Java® and JavaScript® are registered trademarks of Oracle Corporation.
Postgres® is a registered trademark of PostgreSQL Community Association of Canada.
Redis® is a registered trademark of Redis Ltd.