Minor release 3.9.0#
Product |
EclecticIQ Intelligence Center |
|---|---|
Release version |
3.9.0 |
Release date |
September 2026 |
Time to upgrade |
~40 minutes to upgrade an instance with 2.67 million Entities, 1.85 million Observables.
|
Time to migrate |
For an instance with 2.67 million Entities, 1.85 million Observables:
|
Highlights#
This release brings broader AI provider choice, organization-wide date and time defaults, and clearer visibility into which integrations carry a cost. New AI providers let administrators connect Azure OpenAI, Anthropic Claude, and Mistral as first-class providers, beyond the providers already supported, with configuration flexible enough to authenticate through custom request headers for deployments that need it. Our organization-wide date and time defaults deliver dates and times in your standard conventions from a user’s first login, while still letting individuals override either setting. With free and paid labels for feeds and enrichers, admins can see whether an integration is paid or free before configuring it. Intelligence Center now supports MITRE ATT&CK v19.1, which splits the Enterprise Defense Evasion tactic into Stealth and Defense Impairment and brings new sub-techniques to ICS ATT&CK. Analysts also get faster access to attachments when working through long PDF attachments during triage.
What’s new#
New AI providers#
Beyond the providers already supported, Intelligence Center now offers Azure OpenAI, Anthropic Claude, and Mistral as first-class providers. Provider configuration also gains the flexibility to work with deployments that authenticate through custom request headers.
Get started
See our AI providers documentation to get started.
Organization-wide date and time defaults#
Administrators can now set a default date and time format and time zone for their whole organization, so users see dates and times in your standard conventions without configuring anything. New users inherit the defaults automatically, existing users keep their current settings, and any user can override either setting in their own profile.
Get started
See our date and time settings documentation to get started.
Enhancements#
Free and paid labels for feeds and enrichers#
Incoming feeds and enrichers now show whether a vendor is free or requires a paid subscription, and can be filtered by that pricing category. Analysts and administrators can tell which integrations they can actually turn on before investing time in configuring credentials they do not have.
MITRE ATT&CK v19 support#
Intelligence Center now supports MITRE ATT&CK v19.1, so TTP classifications reflect the way the security community currently classifies adversary behavior. The Enterprise Defense Evasion tactic is split into Stealth and Defense Impairment, and ICS ATT&CK gains sub-techniques.
Report attachment access#
Attachment presence is now visible from the Entities table and the Entity overview, so analysts can tell which Entities carry attachments and open them without scrolling through the whole overview. PDF attachments scroll continuously instead of requiring a click per page.
Fixes#
Outgoing feeds could not be opened when a feed used the group or user dropdown
Fixed an issue where opening an outgoing feed that used the group or user dropdown returned an undefined value, leaving the feed inaccessible.
Retention policy page error on empty values
Fixed missing handling for empty values in the retention policy form and details tab, which caused the retention policy page to return an error.
Incoming feed link type requirement ignored for duplicate entities
Fixed an issue where the require link types setting on an incoming feed was ignored when an already ingested entity was ingested again, so observables that should have been filtered out were still extracted.
Outgoing feed failure when packing unsupported related entity references
Fixed an issue where an invalid related entity reference caused STIX 2.1 packaging to fail, which could prevent an outgoing feed from delivering content and lead to entities and relationships missing at the receiving end.
Known issues#
CSV export using “Current Columns” omits some visible fields
When exporting with the Current Columns option, some fields that are visible in the table — such as Custom Object name or Observable Risk Score — are not included in the exported CSV.
Workaround: Use Export > Custom Columns to include these fields.
Tactics do not follow attack-progression order in ATT&CK views
Tactics currently display in ascending ID order across ATT&CK Analysis matrices and the entity classification modal, rather than the logical attack-progression order used in official MITRE documentation.
Entities added to the graph while the timebar is enabled aren’t visible until published
Creating a new entity on the graph while the timebar is enabled doesn’t display the entity, or gives it an autogenerated title, until the graph is published.
Rule “Run Now” only evaluates entities within the selected ingestion window
Running a rule with Run Now applies only to entities ingested within the selected window (7 days, 14 days, or custom), even though the rule configuration screen’s match count reflects the full matching set. Entities outside that window are not processed, though they appear among the matches shown.
Observable scoring can block saving due to duplicate default parameter values
In an Observable risk score policy, the Number of Sources parameter’s default values can be treated as duplicates because both start at zero, which blocks saving the policy even when that parameter is disabled.
Some incoming feeds fail on XML-incompatible characters in observable values
An incoming feed can fail to ingest content when an extracted observable value contains a character that isn’t XML-compatible, causing the feed run to error rather than skip the offending value.
Editing and republishing a feed-ingested report can attach an extra empty file
Editing and publishing a report that was ingested via a feed can add an extra untitled or empty attachment file alongside the report’s existing attachments.
Widgets on private dashboards are visible to read-only users
A widget created on a private dashboard can appear to a user with read-only dashboard access, even when the dashboard itself has not been shared with them.
Filter counts include external references even when hidden
When external references are hidden from a view, the counts shown for filters still include those hidden references.
Public API compatibility#
EclecticIQ Intelligence Center 3.0 and newer uses Public API v2. It follows EclecticIQ Intelligence Center versioning scheme, e.g., EclecticIQ Intelligence Center 3.0.2 is compatible with eclecticiq-extension-api==3.0.*, EclecticIQ Intelligence Center 3.1.0 is compatible with eclecticiq-extension-api==3.1.*, etc.
Installing and upgrading#
You may use playbooks or install offline:
Ansible playbooks — the standard path for both new installs and upgrades on Rocky Linux or RHEL, for deployments with network access.
Offline install — for installing and upgrading from a mirrored location on your local network, when the target system has no internet access.