Minor release 3.8.1#
Product |
EclecticIQ Intelligence Center |
|---|---|
Release version |
3.8.1 |
Release date |
August 2026 |
Time to upgrade |
~40 minutes to upgrade an instance with 2.67 million Entities, 1.85 million Observables.
|
Time to migrate |
For an instance with 2.67 million Entities, 1.85 million Observables:
|
Important: Upgrade IC 3.8.0 to 3.8.1
IC 3.8.0 contained an relation de-deduplication regression that could cause poor general backend performance. If you have previously upgraded to IC 3.8.1, you should upgrade to IC 3.8.1 as soon as possible.
Highlights#
This release brings expanded intelligence management, deeper AI integration, and a stronger security foundation. The new MCP Server enables MCP-compatible AI agents and clients to interact with Intelligence Center programmatically — integrating platform capabilities directly into external AI workflows without manual context switching. Keyword Lists enable analysts to define reusable collections of terms referenced across rules, searches, and Intelligence Compass — eliminating repeated manual entry and keeping definitions consistent across the platform. Custom Entities & Attributes now extend into a broader set of platform capabilities, including Retention Policies, giving teams more flexibility with organization-specific data models. Amazon Bedrock joins the platform as a dedicated AI provider, giving organizations greater flexibility in how they deploy and manage AI infrastructure.
Navigation across Platform Settings and Data Configuration has been restructured for improved discoverability, the Email Extension now supports bulk address population via User Groups, and user-provided regular expressions now run on a safe, non-backtracking engine. Read about everything below and plan your update today.
What’s new#
Model Context Protocol (MCP) Server#
The platform now exposes a public MCP server, enabling MCP-compatible AI agents and clients to interact with Intelligence Center programmatically. This allows teams to integrate platform capabilities directly into their AI-powered workflows without manual context switching.
Get started
See our MCP Server documentation to get started.
Keyword Lists#
Analysts can now create and manage reusable keyword lists — named collections of terms representing assets, domains, technologies, threat actors, or other organizational context. Once defined, lists can be referenced in searches, across rules, and in Intelligence Compass using a simple @list-name picker, with updates propagating automatically wherever a list is referenced.
Get started
See our Keyword Lists documentation to get started.
Custom Entities & Attributes#
Custom entity types and their associated custom attributes can now be used in a broader set of platform capabilities, such as Retention Policies and rules. Analysts working with organization-specific entity models will find consistent support across additional workflows previously limited to built-in entity types.
Get started
See our Custom Entities & Attributes documentation to get started.
Amazon Bedrock AI Provider#
Amazon Bedrock is now available as a dedicated AI provider within the platform. Organizations can configure Bedrock as their preferred provider for AI-powered capabilities, giving teams greater flexibility in how they deploy and manage AI infrastructure to meet their security and compliance requirements.
Improvements#
Email Extension — Bulk address population via User Groups#
The Email Extension now supports User Groups as a source for populating the “To” field. Instead of entering individual email addresses one by one, users can select a platform-defined User Group and have all member addresses imported at once — significantly reducing manual effort in notification and distribution workflows.
Safe regex engine for user-provided expressions#
User-provided regular expressions in extract rules are now executed using the google-re2 non-backtracking engine. This eliminates the risk of catastrophic backtracking on complex or adversarially crafted patterns, improving platform stability and security.
Infrastructure & Security#
ELK Stack upgrade to 9.4#
The ELK Stack has been upgraded to version 9.4.5, maintaining compatibility and bringing the latest performance, security, and stability improvements.
PostgreSQL upgrade to version 18#
PostgreSQL has been upgraded to version 18, bringing improved performance, enhanced reliability, and the latest database capabilities to support platform operations.
Migration to RE2 regex engine#
From IC 3.8 onwards, the platform uses the safer google-re2 regular expression engine
by default. This can cause some regular expression patterns in existing rules to fail.
These are examples of possible regex patterns that fail with the new default re2 engine
that are allowed by the older default re engine:
Pattern |
Description |
Issue type |
|---|---|---|
|
Numeric backreference \1 |
Escape sequences |
|
Numeric backreference \2 |
Escape sequences |
|
Named backreference (?P=name) |
Magic |
|
Positive lookahead (?=…) — foo followed by bar |
Empty strings |
|
Negative lookahead (?!..) — foo NOT followed by bar |
Empty strings |
|
Positive lookbehind (?<=…) — bar preceded by foo |
Empty strings |
|
Negative lookbehind (?<!..) — bar NOT preceded by foo |
Empty strings |
|
Conditional (?(id)yes|no) — if group 1 matched, expect b else c |
Magic (conditional patterns) |
|
Conditional (?(id)yes) — without false branch |
Magic (conditional patterns) |
|
Possessive quantifier *+ (unsupported in stdlib re too) |
Repetitions |
|
Possessive quantifier ++ (unsupported in stdlib re too) |
Repetitions |
|
Possessive quantifier ?+ (unsupported in stdlib re too) |
Repetitions |
|
Atomic group (?>…) (unsupported in stdlib re too) |
Grouping |
|
Backspace \b inside character class |
Escape sequences |
|
Inline comment (?#…) |
Grouping |
|
End of string \Z (before optional trailing newline) |
Empty strings |
To check if you have rules containing regular expression patterns that would fail
with the re2 engine, after upgrading to 3.8, as administrator:
Note
The eiq-platform regex-compat-report command is only available on IC 3.8 and newer.
You have to upgrade to IC 3.8 first, before running this command. The rest of the upgrade can proceed as usual.
After the upgrade is complete, run this command to validate your rules.
If you are worried that you have incompatible rules, you can set the
REGEX_ENGINE="re" parameter before you upgrade to IC 3.8.
We recommend setting it back to REGEX_ENGINE="re2" as soon as you can.
See the instructions below.
Log into the terminal on your IC 3.8 platform instance. In a multi-node deployment, log into the application node.
As root, run
/opt/eclecticiq-platform-backend/bin/eiq-platform regex-compat-report
If the command detects any incompatible rules, it prints output like:
Regex Compatibility Report
==========================
These patterns are not compatible with the regular expression...
If your platform has incompatible rules flagged by the report, please update
them and re-run the command to verify that your updated rules are compatible
with re2.
Alternatively, you can configure the platform to use the older default re engine.
To use the older default re engine, as administrator:
Log into the terminal on your platform instance. In a multi-node deployment, you have to perform these steps on the application, ingestion, and celery worker nodes.
As root, edit
/etc/eclecticiq/platform_settings.py. AddREGEX_ENGINE="re", or update the parameter if already set.Restart platform services and workers. Run as root:
systemctl stop eclecticiq-platform-backend-{services,workers,ingestion} systemctl start eclecticiq-platform-backend-{services,workers,ingestion}
We recommend keeping re2 as the configured regular expression engine.
Fixes#
Relationship deduplication
Fixed the relationship deduplication logic, resulting in a cleaner and more consistent graph experience.
Extract reprocessing misses new observables
Fixed an issue where reprocessing a previously ingested blob with an updated extension
version failed to create new observables extracted by the newer transformer.
STIX 2.1 export fails on invalid related entity reference
Fixed an issue where an invalid entity reference in a relationship caused the STIX 2.1 packing pipeline to fail.
Enrichment rule fails to save when source property is omitted
Fixed an error on the enrichment rule endpoint when the source property was not included in the request payload.
Unknown observable type created on re-ingestion
Fixed an issue where re-ingesting an entity with additional observables on a feed
configured without unstructured text extraction resulted in an unknown observable type
being created instead of the expected observable.
Known issues#
Rules that fail to save because of an invalid or incompatible regex pattern do not show a visible reason for the failure. The rule will just appear to not save. To check if this is the case when you cannot save a rule, open the developer console and check for a HTTP 400 error on a
PUT /private/extract-rules/<id>request. You would need to fix the failing regex pattern before you can save the rule. See Migration to RE2 regex engine above.
In Observable scoring, the Number of Sources parameter shows wrong count. The count includes all sources, even though it was intended to exclude Enrichment sources.
If an Observable Risk Score parameter is empty but enabled, it is still included in the parameter count for thresholds.
The Observable Risk Score preview only works if you’ve already saved the policy.
In an Observable risk score policy, no warning is shown when a value in a parameter is assigned multiple Risk scores, even though this is not intended and results in an error.
Assigning a model to NLP to Lucene or AI intelligence requirements matching capability may take a few minutes.
Incoming and Outgoing feeds fail if any Observable value in them includes a string that matches a character forbidden in XML. The forbidden XML characters are
U+FFFE,U+FFFF, and all UCS surrogates.
When External references are hidden, the counts given for filters still include these references.
Tactics currently appear in ascending ID order instead of following the logical attack progression shown in official MITRE documentation
Reports ingested via feed may generate additional untitled or empty attachment files when edited and published
Widgets created on private dashboards are visible in the navigation menu to read-only users.
CSV export using “Current Columns” does not include all visible fields such as Custom Object name or Observable Risk Score
Workaround: Use Export > Custom Columns to include these fields
Entities added to the graph while the timebar is enabled are not visible until published
Public API compatibility#
EclecticIQ Intelligence Center 3.0 and newer uses Public API v2. It follows EclecticIQ Intelligence Center versioning scheme, e.g.,
EclecticIQ Intelligence Center 3.0.2 is compatible with
eclecticiq-extension-api==3.0.*,EclecticIQ Intelligence Center 3.1.0 is compatible with
eclecticiq-extension-api==3.1.*, etc.
Download#
For more information about setting up repositories, refer to the installation documentation for your target operating system.
EclecticIQ Intelligence Center and dependencies for Rocky Linux and RHEL |
|
|---|---|
EclecticIQ Intelligence Center extensions |
|
Upgrade#
See the following for upgrade instructions:
In order to upgrade to EclecticIQ Intelligence Center 3.0 and later, you must, be running one of the supported operating systems See: - Rocky Linux’ documentation: * for migrating to Rocky Linux * for upgrading Rocky Linux - RHEL’s documentation: * for upgrading 7 > 8 * for upgrading 8 > 9