The AIL Project version 5.4, released on March 25, 2024, includes a series of changes, fixes, and other updates.

Changes:

• Language Enhancements:
  • Add thread languages stats.
  • Add nb languages stats by chat/subchannel objects.
  • Improve language detection + UI for manual translation.
• New Features and Improvements:
  • Add lexilang and demoji to requirements.
  • Add default and basic cards for user accounts, chat-subchannels, image objects, etc.
  • Performance improvements in the global module.
  • Reprocessing tools for objects by type and improved error outputs in modules.
  • RetroHunt on messages, Direct Correlations UI changes, and heatmap for messages per hour in chats.
  • API enhancements for message retrieval and object investigations.
  • New crawler stats, pie charts, and stacked bar charts.
  • Basic API tests and updates in gitignore.
  • Refactor API blueprint.
  • Favicon Correlations.
  • Update vanity domains, including a vanity domain explorer.
  • Sort onion vanity names and new APIs for titles.
  • Enhanced tracker listings and retro hunt features.

Fixes:

• Chat and Subchannel Issues:
  • Fix subchannel-message correlation and empty chat card issues.
  • Address language detection in empty messages.
• Dashboard and Tracker Corrections:
  • Fix object links in the dashboard and Yara content errors in the tracker.
  • Correct typos.
• Module and Domain Adjustments:
  • Fix SQL Injection Detection object ID and domain-related issues.
  • Fix favicon crawler and export issues.
• Testing and Documentation:
  • Adjust tests and update documentation for chat JSON fields and chat translation.
  • Various fixes in monthly crawled domain stats, favicon export, vanity titles, and chat image importer.

For detailed overview of the all the changes, the changelog provides an extensive overview of all the changes.

JTAN

Development of the AIL framework is co-funded by the European Union CEF program and CIRCL.

The Action will establish a Joint Threat Analysis Network, an open collaboration group of European computer security incident response teams (CSIRTs) with the focus on collecting, sharing and analysis of technical, operational and strategic threat intelligence. The purpose of this collaboration is to combine unique advantages of different teams to obtain comprehensive situational awareness and actionable information to effectively defend constituencies in each Member State, from critical infrastructure operators targeted by state-sponsored actors to individual citizens affected by cybercrime. The main part of the Action addresses gaps in the Cyber Threat Intelligence (CTI) tooling that is currently used by the national level CSIRTs in Europe. By strengthening individual tools and interconnecting them, the beneficiaries will achieve a new level of common situational awareness and they will benefit from shared knowledge and tooling.