Changelog

Synapse-Intel471 Changelog

v3.1.0 - 2026-10-13

Features and Enhancements

  • Added the intel471.verity.inforeport.search command, adding report search on the Intel471 Verity API. Information and fintel reports are searched by default, matching the coverage of the Titan intel471.inforeport.search command; --type extends the search to spot and malware reports. Report attachments are downloaded by default and --skip-attachments opts out. Reports the Verity streams return truncated are retrieved in full so their report text is ingested rather than lost, with --skip-detail to opt out; reports the streams return in full are not refetched. This matches the behavior of the Titan command it replaces.

  • Updated Intel471 Verity information, fintel, spot, and malware reports to populate media:news:updated from the report’s last-updated timestamp, media:news:type with the report type as an intel471.verity taxonomy (with the fintel sub_type as a taxonomy leaf), and media:news:body with the report text, so reports can be filtered on any of these in Storm after ingest. This applies to intel471.verity.inforeport.get as well as the new search command.

Bugfixes

  • Fixed the Intel471 Verity search commands paging indefinitely once a result set was exhausted. Paging now stops when the cursor stops advancing. This affected every intel471.verity.* search command.

  • Fixed intel471.verity.forum.search not yielding forum posts from the private message endpoint when searching both content types (the default). Posts were ingested but never yielded in the output.

  • Fixed intel471.verity.dataleak.search ingesting no data-leak post data and returning a single media:news node regardless of how many posts matched.

  • Fixed intel471.verity.dataleak.search file listing downloads failing with 406 Not Acceptable, and limited downloads to the posts kept by --size.

  • Fixed intel471.verity.girs.sync setting an empty :desc on meta:rule nodes for GIRs with no description.

  • Fixed Intel471 Verity vulnerability reports setting risk:vuln:mitigated to true when the report did not state a patch status at all.

  • Fixed intel471.verity.vulns.search and intel471.verity.vulns.get failing with a StormRuntimeError on a vulnerability report that did not state an exploit status.

v3.0.0 - 2026-08-03

Automatic Migrations

  • Migrated the (refs) light edge between risk:leak nodes and their leaked inet:email nodes to (leaked), so credentials ingested from the Titan API match those ingested from the Verity API.

Features and Enhancements

  • Added intel471.verity.config.add, .del, .list, .show, and .update commands to manage Verity API Client ID/Secret credentials via vault-based configuration, alongside the existing Titan email/API key configuration.

  • Added intel471.verity.girs.sync, intel471.verity.indicators.search, intel471.verity.inforeport.get, intel471.verity.vulns.search, intel471.verity.vulns.get, intel471.verity.breach.search, intel471.verity.credentials.search, intel471.verity.forum.search, intel471.verity.message.search, and intel471.verity.dataleak.search commands, targeting the same Synapse forms as their Titan counterparts where the underlying real-world entity is unchanged, so data ingested from either API is additive rather than duplicated.

Deprecations

  • Added intel471.verity.* commands backed by the new Intel471 Verity API, running alongside the existing Intel471 Titan API commands. The Titan API is being retired by Intel471 on 2026-12-31; existing commands (intel471.girs.sync, intel471.iocs.search, intel471.indicators.search, intel471.vulns.search, intel471.vulns.get, intel471.global.search, intel471.breach.search, intel471.forum.post.search, intel471.forum.message.search, intel471.dataleak.post.search, intel471.inforeport.search, intel471.inforeport.get, intel471.message.search, intel471.credential.search, intel471.setup.apikey, and intel471.setup.tagprefix) are now marked deprecated and continue to work against the Titan API until it is retired.

  • intel471.iocs.search and intel471.global.search have no Verity equivalent. Intel471’s Verity API has no unified IOC or global search endpoint; this is a capability removed by Intel471’s own platform redesign, not a gap in this Power-Up. Both commands continue to work against the Titan API until it is retired.

v2.1.1 - 2026-06-23

Bugfixes

  • Fixed intel471.message.search and intel471.credential.search silently truncating results at 100 items regardless of --size.

v2.1.0 - 2026-04-09

Features and Enhancements

  • Added intel471.credential.search command for searching credentials from the Intel471 API.

  • Added intel471.message.search command for searching instant messages from the Intel471 API.

v2.0.0 - 2026-02-27

Automatic Migrations

  • Migrated inet:service:group nodes to inet:service:channel for Facebook and Odnoklassniki groups, along with VK club and public channels.

Features and Enhancements

  • Updated ingest to use inet:service:channel to represent social media groups and channels.

v1.0.0 - 2025-12-10

Automatic Migrations

  • Migrated and deleted inet:web:acct, inet:web:post, inet:web:channel, and inet:web:instance nodes created by Synapse-Intel471.

  • Migrated inet:service:account:id to the correct ID for Facebook accounts.

  • Migrated storage version tracking to use Storm package inits.

Features and Enhancements

  • Updated ingest to use inet:service:account, inet:service:message, inet:service:channel, inet:service:platform instead of inet:web:acct, inet:web:post, inet:web:channel, and inet:web:instance.

Bugfixes

  • Fixed an issue where inet:service:account:id could be incorrectly set to a URL for Facebook accounts.

v0.10.1 - 2025-09-03

Bugfixes

  • Updated the onload handler to migrate risk:vuln:_intel471:risk:level extended properties to risk:vuln:severity for nodes in layers that are not associated with a view.

v0.10.0 - 2025-05-30

Features and Enhancements

  • Updated intel471.breach.search, intel471.dataleak.post.search, intel471.forum.message.search, intel471.forum.post.search, intel471.global.search, intel471.indicators.search, intel471.inforeport.search, intel471.iocs.search, and intel471.vulns.search to populate the it:exec:query:synuser property.

v0.9.0 - 2025-02-04

Features and Enhancements

  • Updated Intel471 API version to 1.20.0.

  • Added intel471.dataleak.post.search command for ingesting data leak blog posts.

  • Added intel471.inforeport.search and intel471.inforeport.get commands for ingesting information and fintel reports.

v0.8.1 - 2025-01-27

Bugfixes

  • Fixed an issue where the --postsbythreaduid argument on the intel471.forum.post.search command was not handled correctly.

v0.8.0 - 2025-01-17

Features and Enhancements

  • Updated deprecated $lib.list() usage to JSON style syntax.

v0.7.0 - 2024-06-28

Features and Enhancements

  • Replace deprecated risk:hasvuln usage with risk:vulnerable.

This release contains an automatic data migration that will run when the package is first upgraded. The migration creates risk:vulnerable nodes from the deprecated risk:hasvuln nodes.

v0.6.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v0.6.0 - 2024-02-06

Features and Enhancements

  • Use the risk level to set risk:vuln:severity and remove the risk:vuln:_intel471:risk:level extended property.

This release contains an automatic data migration that will set risk:vuln:severity to the existing value of risk:vuln:_intel471:risk:level, and then remove the extended property.

v0.5.0 - 2024-01-05

Features and Enhancements

  • Added iocs.search Optic action for the following forms: hash:md5, hash:sha1, hash:sha256, inet:fqdn, inet:url, inet:ipv4, inet:ipv6, inet:asn, file:base.

v0.4.0 - 2023-10-05

Features and Enhancements

  • Update Intel471 API version to 1.19.7.

  • Add intel471.breach.search, intel471.forum.post.search, and intel471.forum.message.search commands for searching additional Intel471 endpoints.

  • Update intel471.global.search ingest to support forum posts, private messages, and breach alerts.

  • uniq results from search queries to handle duplicate results.

v0.3.0 - 2023-07-28

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Update vulnerability ingest to populate the risk:vuln:cvss:v3_0:score and risk:vuln:cvss:v2_0:score properties instead of the deprecated risk:vuln:cvss:score property.

  • Update risk:vuln node generation to deconflict on the :reporter:name property.

v0.2.0 - 2023-06-12

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • The --debug option for commands now prints the raw HTTP response from the Intel471 API.

  • Add support for ingesting SSL certificate serial number IOCs.

  • Update command documentation to note the maximum number of results returned from the API.

Bugfixes

  • Fix an issue where intel471.gir.sync did not update properties on existing meta:rule nodes created for GIRs.

v0.1.0 - 2023-02-13

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Initial beta release of the Synapse-Intel471 Power-Up.