https://knowledge.threatconnect.com/docs V5.1.6Page actionsAbout Latest VersionVersion 5.1.6 introduces SAML authentication through the browser, updates Polarity sign in page designs and address some issues. New Features and Functionality Sign In Page UI redesign We have updated the UI of the sign in pages to match that of our web design: SAML Authentication through browser In order to enable Polarity users to authenticate through SAML with multiple different SAML setups, we have enabled the Polarity client to authenticate through the ... Wed, 16 Sep 2026 01:02:21 GMT Polarity > Polarity Release Notes https://knowledge.threatconnect.com/docs/polarity-desktop-client https://knowledge.threatconnect.com/docs/polarity-desktop-client Overview This article is a user guide for the Dataminr CTTI Intelligence Engine integration with Dataminr Agentic Threat Intelligence Platform (ATIP). The Dataminr CTTI Intelligence Engine feed API service app ingests cyber threat intelligence alerts, and the cyber entities those alerts reference, from Dataminr Cyber Threat Intelligence (CTTI) and creates corresponding objects in Agentic TIP with select Dataminr metadata: Alerts are created as Event Groups in Agentic TIP. Malware entities are c ... Tue, 15 Sep 2026 13:51:09 GMT ThreatConnect Platform > Apps and Integrations > Premium Threat Intelligence Feed Integrations https://knowledge.threatconnect.com/docs/dataminr-ctti-intelligence-engine-user-guide https://knowledge.threatconnect.com/docs/dataminr-ctti-intelligence-engine-user-guide Software VersionThis guide applies to the Feedly Intelligence Engine App version 1.0.5.What's new in v1.0.5Article stream ingestion as Reports. The App now has a second ingestion path, alongside the existing STIX ingestion, that pulls raw articles from any Feedly stream and writes them into ThreatConnect as Report groups, whether or not Feedly enriched the article into STIX. Configured with the new Article Stream ID(s) field. See Application Setup and Configuration and Article Field Mapping.Arti ... Tue, 15 Sep 2026 11:06:46 GMT ThreatConnect Platform > Apps and Integrations > Premium Threat Intelligence Feed Integrations https://knowledge.threatconnect.com/docs/feedly-intelligence-engine-integration-user-guide https://knowledge.threatconnect.com/docs/feedly-intelligence-engine-integration-user-guide OverviewA ThreatConnect® Query Language (TQL) query expression includes a parameter name, an operator, and a value or list of values, and you can combine multiple query expressions using parentheses and AND/OR logic. This article provides a list of all TQL operators and parameters available in ThreatConnect.NoteA value’s case sensitivity may depend on database deployment type, the operator being applied to it, or other factors.OperatorsTable 1 describes the ThreatConnect Query Language (TQL) ope ... Mon, 14 Sep 2026 20:54:58 GMT ThreatConnect Platform > Threat Intelligence > ThreatConnect Query Language (TQL) https://knowledge.threatconnect.com/docs/tql-operators-and-parameters https://knowledge.threatconnect.com/docs/tql-operators-and-parameters ImportantThis article contains the current version of the ThreatConnect® release notes for version 8.1, including all currently available patches. The most recent version is 8.1.1-M0902R. See the Maintenance Releases Changelog section for a list of updates made for patch versions after the 8.1 release.New Features and FunctionalityThreatConnect 8.1 builds upon the Agentic Threat Intelligence Platform (ATIP) foundation introduced as an early-beta feature in version 8.0. This release extends the a ... Fri, 11 Sep 2026 20:40:59 GMT Release Notes > ThreatConnect Platform Release Notes https://knowledge.threatconnect.com/docs/8-1-release-notes https://knowledge.threatconnect.com/docs/8-1-release-notes Software VersionThis guide applies to software version 2.2.10 of the ThreatConnect® Environment Server.OverviewMulti-environment orchestration (MEO) allows ThreatConnect® users that have an Environment Server behind a firewall to use their instance to communicate with that server and run applications inside their firewall. This article provides the system requirements and instructions for installing an instance of the ThreatConnect Environment Server. See Playbook Environments for information ab ... Thu, 10 Sep 2026 20:53:00 GMT ThreatConnect Platform > Settings and Administration https://knowledge.threatconnect.com/docs/threatconnect-environment-server-installation-guide https://knowledge.threatconnect.com/docs/threatconnect-environment-server-installation-guide Polarity Server V5.3.4 (Latest)The latest 5.3.3 release of the Polarity Server is a server side patch that addresses some identified vulnerabilities, adds in support for TLS connections to Redis and PostgreSQL, fixed an issue with integration functions being called out of order, added the ability to configure SMTP without having setting a username. Issues AddressedAddressed issue with integration functions sometimes being called before the startup function causing integrations to stop. Addressed ... Wed, 09 Sep 2026 19:21:03 GMT Polarity > Polarity Release Notes https://knowledge.threatconnect.com/docs/polarity-platform-v5 https://knowledge.threatconnect.com/docs/polarity-platform-v5 Polarity Web (UI) Wed, 09 Sep 2026 19:20:25 GMT Polarity > Polarity Release Notes https://knowledge.threatconnect.com/docs/polarity-web-v5 https://knowledge.threatconnect.com/docs/polarity-web-v5 # Dataminr - Agentic TIP MCP Server Access Agentic TIP threat intelligence and case management data directly from Claude (or any MCP-compatible client) via the Agentic TIP v3 REST API. Overview The Agentic TIP MCP Server exposes your Agentic TIP instance's v3 API as a set of MCP tools over a hosted endpoint. Every Agentic TIP instance exposes POST /api/v3/mcp directly, and any MCP client that supports remote HTTP servers can connect to it. Note See the "TIP MCP Server" section of the 8.1 releas ... Mon, 31 Aug 2026 19:49:41 GMT ThreatConnect Platform > TIP MCP Server https://knowledge.threatconnect.com/docs/agentic-tip-mcp-server-readme https://knowledge.threatconnect.com/docs/agentic-tip-mcp-server-readme Configure proxy support either server wide or per integrationProxy configuration is required if your Polarity server needs proxy access to reach the Internet and you are running integrations that rely on Internet based services or resources. Proxy support can be enabled for integrations either on a server-wide basis or a per-integration basis. In general, integrations that will be connecting to internal resources do not need to have a proxy configured. Integrations that will be accessing Interne ... Sat, 15 Aug 2026 00:06:59 GMT Polarity > Polarity Administrators Guide > Polarity Server v5 https://knowledge.threatconnect.com/docs/polarity-configuring-proxies https://knowledge.threatconnect.com/docs/polarity-configuring-proxies Server environment variables can be configured by modifying the `.env` file located at /app/.env.  Modifications to the .env file will require a restart of the Polarity Server's Docker containers:cd /app && ./down.sh && ./up.shVariablesMIX_ENV=prod POLARITY_HOSTNAME={{hostname of Polarity server}} POLARITY_HTTPS_PORT=4001 POLARITY_HTTP_PORT=4000 POLARITY_TLS_KEY_PATH=/app/certs/polarity_key.pem POLARITY_TLS_CERT_PATH=/app/certs/polarity.pem POLARITY_LICENSE=/app/license/polarity.lic POLARITY_PUB ... Tue, 11 Aug 2026 15:19:52 GMT Polarity > Polarity Administrators Guide > Polarity Server v5 https://knowledge.threatconnect.com/docs/polarity-server-environment-variables https://knowledge.threatconnect.com/docs/polarity-server-environment-variables Coming soon! For now, see this section of the ThreatConnect 8.0 release notes. Tue, 04 Aug 2026 18:18:43 GMT ThreatConnect Platform > Threat Intelligence > CAL https://knowledge.threatconnect.com/docs/cal-system-settings https://knowledge.threatconnect.com/docs/cal-system-settings Choose Your ModeThere are four ways to harness the power of Polarity. Choose the mode that’s right for you either from within the main window, the Polarity Overlay or via the Polarity icon in the system tray.On-Demand Only -- Real-time recognition is off but you can still execute a search in Polarity.Stream -- Polarity will automatically stream information in real-time to the overlay when more context is available.Highlight -- Information is highlighted in real-time. Hover on highlights to get m ... Tue, 04 Aug 2026 17:29:14 GMT Polarity > Polarity Enterprise Users Guide https://knowledge.threatconnect.com/docs/recognition-modes https://knowledge.threatconnect.com/docs/recognition-modes Polarity Use Case TrainingStep 1Place your overlay window over the recommended area of this page.Step 2:Scroll down to where you see the SIEM example.Place your overlay window over this block.Grab the corners of thee window and adjust the size if neededSIEMPolarity is meant to help augment your workflow, no matter what application you are looking at. This example is meant to showcase how Polarity can help to augment your workflow when looking at information in a SIEM product.Step 1Place your ove ... Tue, 04 Aug 2026 17:20:37 GMT Polarity > Polarity Learning Center https://knowledge.threatconnect.com/docs/practical-polarity-use-cases https://knowledge.threatconnect.com/docs/practical-polarity-use-cases The Polarity AI feature, which powers both the built-in chat and LLM-optimized reducers for the MCP, is configured in the Admin panel under Server Configuration. You must be a Polarity administrator to access these settings.Step 1: Navigate to Model SettingsLog in to the Polarity web interface.Click Admin in the top navigation.Select Server Configuration.Click the Model Settings tab.Step 2: Enable AIToggle the AI-enabled switch to the on position. This activates the AI backend. Without this togg ... Tue, 04 Aug 2026 16:58:08 GMT Polarity > Polarity MCP Server Guide https://knowledge.threatconnect.com/docs/polarity-mcp-enabling-the-ai-feature https://knowledge.threatconnect.com/docs/polarity-mcp-enabling-the-ai-feature This document covers the Polarity Model Context Protocol (MCP) server: what it is, how to enable and authenticate against it, the tools it exposes, how data is optimized for LLM consumption, and how to use the MCP as a foundation for building AI-powered security applications. Audience: Polarity administrators configuring the AI feature, developers integrating external AI agents or tools with Polarity, and security engineers building agentic workflows on top of Polarity's integration data. What I ... Tue, 04 Aug 2026 16:57:17 GMT Polarity > Polarity MCP Server Guide https://knowledge.threatconnect.com/docs/polarity-mcp-server https://knowledge.threatconnect.com/docs/polarity-mcp-server Ten Skills for PolarityAnalyst workflows for Claude, built on the Polarity integrations you already run. Your analysts already have the intel — it's just spread across 90+ integrations, checked one at a time. These ten skills turn that sprawl into a single conversation: point Claude at a suspicious email, a CVE list, or an account, and it enriches, correlates, and hands back a scored verdict. No new infrastructure — every skill runs on Polarity integrations already deployed.Each skill: parse the ... Tue, 04 Aug 2026 16:54:48 GMT Polarity > Polarity MCP Server Guide https://knowledge.threatconnect.com/docs/polarity-mcp-skills https://knowledge.threatconnect.com/docs/polarity-mcp-skills The Polarity AI Features that power the built-in chat and LLM-optimized reducers for the MCP are configured in the Admin panel under Server Configuration. You must be a Polarity administrator to access these settings.Client PrerequisitesNode.js 18 or later and npx must be available. On macOS: brew install npmThe connector package @polarityio/mcp-connector) is fetched and run automatically via npx on each connection — no manual install requiredNetwork access to the Polarity server URL from this ... Tue, 04 Aug 2026 16:46:25 GMT Polarity > Polarity MCP Server Guide https://knowledge.threatconnect.com/docs/polarity-mcp-claude-quickstart https://knowledge.threatconnect.com/docs/polarity-mcp-claude-quickstart Installing integrations on Polarity v5 has become much easier and more streamlined, as installation can be done though the UI.Install Integration through Store Polarity users and admins can now see all of our officially supported integrations right from the store as well as install update or view more information about those integrations on what they do! Admins can just navigate to the integration you want to install and hit the Install Button! Upload Integration through UI If there is a custom ... Tue, 04 Aug 2026 16:41:22 GMT Polarity > Polarity Administrators Guide > Polarity Server v5 https://knowledge.threatconnect.com/docs/polarity-installing-integrations https://knowledge.threatconnect.com/docs/polarity-installing-integrations OverviewWhen editing an agent node in an agentic playbook, the settings on the Model tab allow you to configure how an agent takes in and processes information from upstream in the playbook. In particular, in the Agent Instructions field, you provide the agent with directions about how to behave and respond to the information it receives. This article provides three examples sets of Markdown-formatted agent instructions for your reference.Before You StartUser RolesTo create and edit agent nodes ... Mon, 03 Aug 2026 19:23:30 GMT ThreatConnect Platform > Playbooks > Agentic Playbooks https://knowledge.threatconnect.com/docs/example-agent-instructions https://knowledge.threatconnect.com/docs/example-agent-instructions