Version 1.12.0

Hello dear community!

The OpenBAS 1.12.0 is out ! Hope you will enjoy it! 🎉

🐦 OpenCTI x OpenBAS TTP placeholder

Let’s clarify your payload coverage ! When you generate a scenario from OpenCTI , we will now give you visibility on all TTPs that could not be covered by your payload library. This will take the shape of placeholders in your scenario that you can replace with custom payloads to complete it.
Find the related documentation here.

🔗 Assign asset groups on tagged scenario/simulation

Who doesn’t like to automate ? You can now define asset groups to apply by default on scenario and simulation with a defined tag. This allows simple asset group assignment for your OpenBAS scenario and also and foremost automated asset assignment for scenario created from OpenCTI.
Find the related documentation here.

🗒️ Execution payload traces for multi end points & multi agents

Want to review how your payloads are executing ? We’ve organized the payload traces by asset and agent to make it easier! In the "Execution Details" tab of a technical inject, you’ll find traces organized by agent, and agents grouped by endpoint. This allows you to easily track execution progress at both the agent and endpoint levels.
Each agent generates multiple traces corresponding to different execution steps, including:

• Prerequisite checks (validation before execution)
• Prerequisite retrieval (only if the check fails)
• Attack command
• Cleanup commands

We clarified and explained in details the 3 different statuses you can see the in the “Execution Details” tab:

• Traces statuses: each execution step reports a status.
• The agent status computation: when an agent completes execution, the server retrieves all traces and computes an agent status based on some rules.
• The inject status: after all agents have completed their execution, the system calculates the inject status using the same logic applied to compute the agent status.

Find the related documentation here.

🙌 Expectation on manual injects

What if I want to log & evaluate events that can’t be captured in OpenBAS ? Now you can ! We improved our manual injects, you can now assign teams and expectations to them. For example, you can now create an inject for “a crisis cell has been put together” and validate the expectation that “the right protocol has been used”.
Find the related documentation here.

‼️ PostgreSQL

We’re updating the recommended PostgreSQL version to 17. This doesn’t mean it won’t work on PG16, but we will no longer support versions lower than the recommended one.
Find the related documentation here.

📔 Documentation

The development and product teams have dedicated significant effort to creating thorough and comprehensive documentation to ensure clarity, ease of use, and seamless understanding for all you! And it’s still an ongoing process 💪. For now, here are the main topics we tackled:

• How Microsoft sentinel configuration works with Microsoft Defender
• Set up : RabbitMQ , MinIO, Postgres
• Creation of a targeted team
• REST API of OpenBAS and how it works using SwaggerUI

Enhancements:

• #2434 Disable remove from asset group controls for assets included by filter
• #2253 Add links to the doc for CrowdStrike agent and Tanium agent installation
• #2217 Implement expectations results per agent level
• #2168 Clarify crowdstrike collector name
• #2123 Add info about the timeframe for the 4 top widget of the dashboard
• #1998 Define and apply default assets for OCTI generated simulation
• #1982 [implant/agent] Code Quality
• #1981 [implant/agent] Fix warnings during compile
• #1951 Ability to understand my payload traces for multi endpoints & multi agents
• #1908 Ability to run 100 simulations at the same time
• #1824 Align Feature Flag with the changes done on OCTI
• #1774 Move to Postgresql 17
• #1768 Add expectation on manual inject
• #1489 [ Unit testing - simulation scope ] - import/export of a simulation (JSON)

Bug Fixes:

• #2435 Duplicate documents when adding one that already exists
• #2431 Team player count does not update on Teams list page when changing player roster
• #2429 Error in imported scenario
• #2372 Error when I try execute an inject with a executable file and this file is linked to other entities (exercises, injects)
• #2351 Incorrect color in organizations and players selectors
• #2350 Incorrect background colors in tags selector
• #2349 Incorrect behaviour on field with on-the-fly creation (label is not correctly placed)
• #2348 Spacing is not correct between papers on endpoint overview
• #2328 Bottom bar bulk actions in Injects list view do not work reliably with sparse selection
• #2325 Mail Functionality for Teams is not working
• #2324 Error with MailGun
• #2311 When I try to access the Payload info (atomic test) I get an internal error
• #2308 Execution callback route authorize no message
• #2299 Postges docker error
• #2290 I didn't find the docker.compose.yml file when I cloned the repository.
• #2289 Remove grey sections with 'coming soon' to be more align with what's actually available
• #2255 Targets list in atomic testing with asset group is not accurate
• #2250 Inject still in Missing Content after fill Assets or Asset Groups
• #2220 File upload payloads executed by the default OpenBAS agent on Windows do not appear to function correctly
• #2174 Bulk test only test injects on displayed page on the "test" tab of a scenario/simulation
• #2173 In overview of simulation, spaces are not correct
• #1993 Defender not detecting
• #1946 Execution status & traces are not aligned
• #1943 Display Tracking Ack Date in traces of inject execution
• #1855 Sending a media pressure inject should require an article
• #1843 Lessons learned space below header tabs is not correct
• #1821 Tags design is broken
• #1626 When adding a team to the definition page, the page is not automatically updated
• #1609 Missing margin bottom in simulation overview

Pull Requests:

• [frontend] Update Yarn to v4.6.0 (release/current) by @renovate in #2200
• [frontend/backend] retrieve only usefull teams informations by @MarineLeM in #2194
• [tool] update circle for prerelease platform by @guillaumejparis in #2206
• [frontend] Filter out injects that are not enabled or have no exposed by @savacano28 in #2212
• [backend] Update dependency io.opentelemetry:opentelemetry-bom to v1.46.0 (release/current) by @renovate in #2211
• [frontend] Update dependency @stylistic/eslint-plugin to v2.13.0 (release/current) by @renovate in #2241
• [frontend] Update dependency qs to v6.14.0 (release/current) by @renovate in #2246
• [frontend] Update dependency @testing-library/react to v16.2.0 (release/current) by @renovate in #2242
• [frontend] Update dependency fs-extra to v11.3.0 (release/current) by @renovate in #2245
• [frontend] Update dependency @xyflow/react to v12.4.1 (release/current) by @renovate in #2243
• [backend] Update dependency org.bouncycastle:bcpg-jdk18on to v1.80 (release/current) by @renovate in #2239
• [frontend] Update dependency cronstrue to v2.53.0 (release/current) by @renovate in #2244
• [frontend] Fix on bad request message being ignored by @Dimfacion in #2209
• [frontend] Add tests to Environment.exportData (#1489) by @antoinemzs in #2210
• [frontend] Update dependency @xyflow/react to v12.4.2 (release/current) by @renovate in #2280
• [frontend] Update dependency @types/qs to v6.9.18 (release/current) by @renovate in #2279
• [backend] Update logback monorepo to v1.5.16 (release/current) by @renovate in #2278
• [backend] Update dependency org.postgresql:postgresql to v42.7.5 (release/current) by @renovate in #2277
• [backend] Update dependency io.swagger.core.v3:swagger-annotations-jakarta to v2.2.28 (release/current) by @renovate in #2276
• [backend] Update dependency io.minio:minio to v8.5.17 (release/current) by @renovate in #2275
• [backend] Update dependency com.diffplug.spotless:spotless-maven-plugin to v2.44.2 (release/current) by @renovate in #2274
• [tool] Update Node.js to v22.13.0 (release/current) by @renovate in #2273
• [frontend] Update typescript-eslint monorepo to v8.21.0 (release/current) by @renovate in #2272
• [frontend] Update material-ui monorepo (release/current) by @renovate in #2271
• [frontend] Update eslint monorepo to v9.18.0 (release/current) by @renovate in #2270
• [frontend] Update dependency monocart-coverage-reports to v2.12.0 (release/current) by @renovate in #2269
• [frontend] Update dependency @faker-js/faker to v9.4.0 (release/current) by @renovate in #2267
• [frontend] Update dependency eslint-import-resolver-oxc to v0.9.1 (release/current) by @renovate in #2268
• [backend] Add default values to is ready computation by @RomuDeuxfois in #2251
• [backend] adding @transactional to the ExecuteInject method to fix issue/2220 by @heditar in #2236
• [backend/frontend] Set feature flag policy to opt-in (#1824) by @antoinemzs in #2287
• Add links to the doc for CrowdStrike agent and Tanium agent installation by @RomuDeuxfois in #2265
• [backend] Add tests for importing Simulation (JSON) (#1489) by @antoinemzs in #2219
• [tool] Release artifacts to package expanded application.properties (docs#91) by @antoinemzs in #2293
• [frontend/backend] Adding TagRule frontend (#1998) by @heditar in #2213
• Fix the regression on executing external injects Issue/2220 by @heditar in #2305
• [backend] TagRule: Cosmetic changes after demo feedbacks Issue/1998 by @heditar in #2310
• [backend] add needed execution message not blank constraint by @guillaumejparis in #2309
• [backend/frontend] Implement injectExpectations per agent level by @savacano28 in #2228
• [frontend] Remove grey sections with 'coming soon' to be more align with what's actually available by @RomuDeuxfois in #2297
• [frontend] Fix bulk actions on sparse selection (#2328) by @antoinemzs in #2323
• [frontend] Update dependency eslint-import-resolver-oxc to v0.10.1 (release/current) by @renovate in #2336
• [backend] add executionTrace table by @MarineLeM in #2296
• [frontend] Update dependency eslint-plugin-playwright to v2.2.0 (release/current) by @renovate in #2337
• [frontend] Update dependency cronstrue to v2.54.0 (release/current) by @renovate in #2335
• [frontend] Update dependency @playwright/test to v1.50.0 (release/current) by @renovate in #2333
• [tool] fix migration order by @antoinemzs in #2344
• [frontend] Update eslint monorepo to v9.19.0 (release/current) by @renovate in #2341
• [backend] Account for all relevant pauses in inject start date computation (#2282) by @antoinemzs in #2319
• [doc] add comments to critical sections of the application.properties file (docs/#89) by @antoinemzs in #2354
• [frontend] Update dependency dompurify to v3.2.4 (release/current) by @renovate in #2343
• [backend] Refact creation expectation with clean signatures by @savacano28 in #2353
• [backend] Update dependency io.hypersistence:hypersistence-utils-hibernate-63 to v3.9.1 (release/current) by @renovate in #2362
• [frontend] Update dependency esbuild to v0.24.2 (release/current) by @renovate in #2364
• [frontend] Update dependency eslint-plugin-react-refresh to v0.4.18 (release/current) by @renovate in #2366
• [frontend] Update dependency @playwright/test to v1.50.1 (release/current) by @renovate in #2363
• [frontend] Update dependency eslint-plugin-react to v7.37.4 (release/current) by @renovate in #2365
• [backend]Add traces for sending emails(#2324) by @johanah29 in #2373
• [frontend] migrating from jss to emotion with tss-react (#1821) by @guillaumejparis in #2371
• [backend] Build payloadOutput for Caldera injects by @savacano28 in #2360
• [Frontend]Correct the replay all of injects tests(#2174) by @johanah29 in #2374
• [frontend] Remove empty content by @savacano28 in #2379
• [tool] Update postgres Docker tag to v17 - abandoned by @renovate in #1566
• [frontend] Correct spacing between papers in endpoint details page (#2348) by @johanah29 in #2376
• [frontend] Correct color in organizations and players selectors (#2351) by @johanah29 in #2377
• [backend] Expectation on Manual inject Issue/1768 by @heditar in #2340
• [frontend] Update dependency mdi-material-ui to v7.9.3 (release/current) by @renovate in #2384
• [frontend] Update dependency html-react-parser to v5.2.2 (release/current) by @renovate in #2383
• [frontend] Update dependency express to v4.21.2 (release/current) by @renovate in #2382
• [frontend] Update dependency vite to v6.1.0 (release/current) by @renovate in #2381
• [frontend] Correct background color in tags selector (#2350) by @johanah29 in #2385
• Rework executor system by @RomuDeuxfois in #2303
• [frontend] Update dependency apexcharts to v4.4.0 (release/current) by @renovate in #2334
• [backend] Fix status null by @savacano28 in #2391
• [frontend/backend] display traces by agent by @MarineLeM in #2375
• [frontend] Correct in scenario lessons learned tab (#1843) by @johanah29 in #2394
• [frontend] Correct spacing in simulation overview (#2173) by @johanah29 in #2386
• Add trace status test by @MarineLeM in #2395
• [frontend] Update dependency eslint-plugin-react-refresh to v0.4.19 (release/current) by @renovate in #2402
• [frontend] Update dependency @vitest/eslint-plugin to v1.1.27 (release/current) by @renovate in #2401
• [frontend] Update eslint monorepo to v9.20.0 (release/current) by @renovate in #2400
• [backend] Update dependency io.opentelemetry:opentelemetry-bom to v1.47.0 (release/current) by @renovate in #2398
• [backend] Update dependency com.rabbitmq:amqp-client to v5.25.0 (release/current) by @renovate in #2397
• [backend] Add exceptions when articles and challenges are deleted (#1855) by @johanah29 in #2396
• [frontend] Update dependency monocart-reporter to v2.9.13 (release/current) by @renovate in #2406
• [frontend] Update dependency esbuild to v0.25.0 (release/current) by @renovate in #2399
• [frontend] Update dependency react-intl to v7.1.6 (release/current) by @renovate in #2409
• [frontend] Update dependency react-router to v7.1.5 (release/current) by @renovate in #2411
• Adding Swagger doc on users endpoints by @Dimfacion in #2249
• [frontend] Update dependency uuid to v11.0.5 (release/current) by @renovate in #2415
• [frontend] Update dependency usehooks-ts to v3.1.1 (release/current) by @renovate in #2414
• [frontend] Update dependency typescript to v5.7.3 (release/current) by @renovate in #2413
• [frontend] Update dependency swagger-typescript-api to v13.0.23 (release/current) by @renovate in #2412
• [frontend] Update dependency react-hook-form to v7.54.2 (release/current) by @renovate in #2408
• [frontend] Update dependency moment-timezone to v0.5.47 (release/current) by @renovate in #2404
• [frontend/backend] search missing assets for execution details logs by @MarineLeM in #2423
• [frontend] Correctly placing label of fields with on-the-fly creation (#2349) by @johanah29 in #2380
• [frontend] Correct dropdowns background (#2351) by @johanah29 in #2419
• [backend] remove content on manual injects by @heditar in #2426
• [backend] fix openapi annotations to restore compatible api types by @antoinemzs in #2428
• Update OrganizationField.js by @RomuDeuxfois in #2430
• [frontend] adapt injectdefinition with new contract of EndpointsList (#2434) by @antoinemzs in #2440

Full Changelog: 1.11.5...1.12.0