Changelog

New

• Inspect transport and agent attribution. Use GET /v2/attribution/flow to retrieve account-scoped feed contributions grouped by transport, agent identity, and self-reported skill, with window_days and optional feed_id filters. Check complete and the coverage counts when interpreting partial results or missing metadata. See Intelligence flow.
• Inspect the sources behind an answer. Use GET /v2/answers/{answer_id}/attribution to retrieve recorded facts and contributing feeds, together with agent identity, transport, and skill metadata when available. You need read:intel for both attribution endpoints, and results are scoped to your authenticated account. See Answer attribution.
• Declare the executing skill in agent context. Add optional agent_context.skill with an id and optional version to identify the skill making a request. Treat this metadata as self-reported, not as proof of installation or a successful outcome. See Agent context.

New

• Traverse ATT&CK detection knowledge. /v2/relationships now links techniques to tactics, detection strategies, analytics, data components, and data sources. Use relationship_types for the related entity type, predicates for the link meaning, and direction, platform, and include_inactive to narrow results. See Traverse ATT&CK detection knowledge.
• Existing relationship requests are unchanged. General actor, campaign, malware, IOC, sector, and country pivots keep their default behavior; ATT&CK traversal applies only when you request an ATT&CK predicate or target type. ATT&CK cursors follow their own rules. See ATT&CK relationship responses.

New

• IoC feed for enterprise accounts. GET /v2/ioc-feed keeps a local indicator dataset in sync: retrieve a paginated snapshot, then poll daily for additions, updates, and removals with the saved next_cursor. Kyberis must enable feed access for your account. See IoC feed.
• Confidence intervals. Set min_confidence and max_confidence on the first request to limit the feed to an interval of source confidence. See Select a confidence interval.
• Upsert-based credits. Each page costs 10 credits per 1,000 upserts, rounded up; removals and empty responses are free. Cursors expire with retained feed history after seven days, so poll regularly. See Access and credits.

New

• Structured inventory for environment assessments. Send environment_context.products to /v2/environment-assessments, and set inventory_complete: true only when the list covers the entire environment. Read metadata.applicability for product-level affected, unaffected, or unknown status. See CVE environment applicability.
• Product applicability on prioritized CVEs. CVE items from /v2/prioritize include product_match and applicability without debug mode. See CVE inventory applicability.

Improved

• Consistent product matching. Equivalent inventory and source product names now produce the same product applicability on /v2/prioritize and /v2/environment-assessments. Free-text environment is retained but not interpreted; the response reports metadata.environment_text_evaluated: false. See CVE environment applicability.

Improved

• IoC scores reflect enrichment context. When Kyberis has indicator intelligence for an IOC, /v2/ioc-assessments adds a bounded enrichment boost, capped at 8 confidence points, for MITRE breadth, malware context, attribution, targeting, and source diversity. IOCs with richer context can now rank above sparser IOCs with similar base confidence. See Enrichment-aware scoring.
• Inspect the enrichment contribution. Read the total in metadata.ioc_enrichment_boost. With options.include_debug: true and the debug:assessments scope, debug.signal_data.enrichment_boost_breakdown returns the five component values. See Enrichment scoring.

New

• Direct API-key authentication for MCP. One-command MCP setup now installs Authorization: ApiKey <key_id>:<secret> in your MCP client, so tool calls use your API key directly. To switch a client you set up earlier, reconnect it from API keys. See How MCP access works.

Improved

• Stable, larger relationship pages. Paged traversal returns the same ordered results regardless of page size within a snapshot of up to 500 ranked results. max_results accepts 1–100. See General relationship pagination.