Threat Intelligence Utilities
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Generally available
Serverless Security
Generally available
Stack
9.0+
Generally available since 9.0
| Version | 1.7.1 (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Elastic |
| Minimum Kibana version(s) | 9.0.0 8.13.0 |
The threat intelligence utilities package contains a dashboard that provides a high-level overview of data from all connected TI feeds.
To add the dashboard, click Settings > Install Threat Intelligence Utilities assets.
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 1.7.1 | Bug fix (View pull request) Remove duplicate security-solution-default tag references |
9.0.0 8.13.0 |
| 1.7.0 | Enhancement (View pull request) Update Kibana constraint to support 9.0.0. |
9.0.0 8.13.0 |
| 1.6.0 | Enhancement (View pull request) Update the kibana constraint to ^8.13.0. |
8.13.0 |
| 1.5.0 | Enhancement (View pull request) Update manifest format version to v3.0.3. |
8.5.0 |
| 1.4.1 | Enhancement (View pull request) Changed owners |
8.5.0 |
| 1.4.0 | Enhancement (View pull request) The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest. |
8.5.0 |
| 1.3.0 | Enhancement (View pull request) Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. |
8.5.0 |
| 1.2.3 | Bug fix (View pull request) Fix the query type for matching 'event.dataset'. |
8.5.0 |
| 1.2.2 | Bug fix (View pull request) Update to use new Threat Indicator Match rule names. |
8.5.0 |
| 1.2.1 | Bug fix (View pull request) Update to use security-solution-default. |
8.4.0 |
| 1.2.0 | Enhancement (View pull request) Update package-spec version to 2.7.0. |
8.4.0 |
| 1.1.0 | Enhancement (View pull request) Include ti_util in threat_intel category. |
8.4.0 |
| 1.0.1 | Bug fix (View pull request) Correcting index-pattern references in dashboard |
8.4.0 |
| 1.0.0 | Enhancement (View pull request) Initial draft of the package |
8.4.0 |