RECENT POSTS

AIL v6.8 - Hunting, Graphs & Analyst Experience

Apr 29, 2026 • AIL Project Team

AIL v6.8 focuses on making hunting workflows smoother and the analyst interface easier to use. This release brings redesigned tracker and retro hunt pages, Markdown exports, a refreshed UI across the platform, Pivotick graph rendering, improved YARA and Rulezet support, BCP 47 language handling, organisation and user management improvements, and important security fixes.

Hunting, trackers, and retro hunts

AIL v6.8 brings major improvements to the Hunting section, formerly known as Leak Hunter. The new name better reflects the role of trackers and retro hunts in analyst workflows.

hunting-dashboard

This release makes hunting easier to create, review, monitor, and export, with:

  • Redesigned tracker and retro hunt dashboards.
  • Improved tracker creation and editing forms.
  • Improved tracker type selector.
  • Clickable tracker heatmap days.
  • Improved retro hunt creation pages.
  • Clearer retro hunt task descriptions and status display.
  • Object status updates for trackers and retro hunts without full-page reloads.
  • Markdown export support for trackers and retro hunts.

Interface refresh across AIL

AIL v6.8 includes a broad UI refresh to improve usability, consistency, and navigation across the platform.

Notable improvements include:

  • Improved main dashboard.
  • New quick search bar.
  • Refreshed settings dashboard.
  • Improved user list, profile, and creation pages.
  • Improved organisation list, detail, create, and edit pages.
  • Cleaner templates for item views, extracted objects, and modals.
  • More consistent navigation and layouts across several sections.

YARA and Rulezet

AIL v6.8 introduces a more accessible YARA rule experience and adds Rulezet support for tracker and retro hunt rule imports.

yara-section-rulezet

yara-builder

New and improved capabilities include:

  • Beginner-friendly YARA rule builder.
  • Improved YARA builder onboarding, examples, helper text, and live preview.
  • CodeMirror YARA editor in retro hunt task creation.
  • Rulezet import as a YARA rule source for trackers and retro hunts.
  • Rulezet connector configuration in user profiles.

Pivotick graph rendering

Correlation graph views have been migrated to Pivotick, with related improvements also applied to relationship graphs.

pivotik-correlation

  • Improved graph rendering and layout.
  • Cleaner and more responsive graph tooltips.
  • Sidebar filtering for graph keys.
  • Better rendering of icons, edges, and graph metadata.

Investigations

Investigations receive several usability and interface refinements in v6.8, including:

  • Improved investigations dashboard layout.
  • Better investigation sidebar organization.
  • Improved add and edit investigation forms.
  • Better investigation selector refresh behavior.
  • Fixed investigation creation and name-field handling.
  • Removed the threat model field.

Organisations

Organisation management has been refreshed with better templates, metadata display, and region handling.

Changes include:

  • Improved organisation list and detail pages.
  • Improved organisation create and edit forms.
  • Added metadata such as sector and organisation type.
  • Renamed “Nationality” to “Region”.
  • Improved country and region formatting using pycountry.
  • Added world map visualization of organisations by country.
  • Improved handling of special regions and countries.

Language handling and chat analytics

BCP 47 language handling is now fully integrated in AIL.

This release includes:

  • Migration to BCP 47 primary language subtags.
  • Removal of the legacy ISO3 language dictionary.
  • Improved language lookup and aliases.
  • Added and fixed language support, including Norwegian Bokmål and Serbian.
  • Added language distribution pie chart in chat instance views.
  • Added multi-language filtering for chat instances.
  • Fixed language labels in charts and filters.

Module extractor and extraction improvements

The module extractor receives performance, safety, and usability improvements, including:

  • Added extraction maximum time and deadline handling.
  • Improved regex safety.
  • Added typosquatting extraction.
  • Improved typosquatting extraction performance.
  • Improved extraction tooltips.
  • Display of retro hunt information and descriptions where relevant.
  • Improved extracted object display in item views.

User settings and integrations

AIL v6.8 adds the first step of FlowIntel integration: users can now configure FlowIntel settings in the UI.

Export to FlowIntel is not part of this release and is planned for a future version.

Other integration-related improvements include:

  • Added FlowIntel configuration section in user settings.
  • Added Rulezet connector configuration in user profiles.
  • Improved MISP integration layout in user profiles.

Security and hardening

AIL v6.8 includes important security fixes and hardening work:

  • Hardened file-serving endpoints.
  • Fixed an XSS issue in modal show_min_item.html when item content exceeds 800 characters, reported by Jeroen Gui.
  • Fixed a path traversal issue allowing authenticated AIL users to read gzip-compressed files accessible to the AIL process, reported by Jeroen Gui.

Search, API, and backend updates

Other technical improvements include:

  • Search now catches unreachable and timeout errors.
  • Increased Meilisearch search timeout.
  • Removed old Whoosh indexer.
  • Removed unmaintained and unused ssdeep library.
  • Replaced lexilang with ail-project/picolang.
  • Added crawler REST API endpoints for scheduler, captures, stats, and blocklist management.

Fixes

AIL v6.8 also includes many fixes across the platform, including:

  • Tracker creators can now edit levels and remove their own global trackers.
  • Fixed object dashboard Font Awesome icon style.
  • Fixed tracker tags disappearing on edit.
  • Fixed retro hunts failing to start when objects have no entries.
  • Fixed tracker and retro hunt object date formatting.
  • Fixed tracker and retro hunt redirects after creation.
  • Fixed domain search by language.
  • Fixed organisation description, last edit, and region field formatting.
  • Added missing countries to world map assets and improved pycountry handling.

Contributors

Thanks to everyone who contributed to AIL v6.8, including:

  • terrtia
  • cln-io
  • Anonymous user for bug reports and fixes
  • Jeroen Gui for responsible security reporting

Funding 🇪🇺

AIL is developed and maintained with the support of the European Union as part of the HOPLITE European Project.
HOPLITE aims to strengthen the capacity of law enforcement authorities to gather, analyse, and share open-source and closed-source intelligence, integrating AI-driven analysis to enhance real-time threat detection and response workflows. The project builds on previous EU-funded initiatives and enhances key components such as AIL and MISP to deliver scalable, responsible, and actionable threat intelligence capabilities for cybersecurity and public safety across EU Member States.

Law enforcement agencies willing to discover and leverage the MISP/AIL-LEA platforms can apply on the misp-lea.org website.

EU logo

Follow us