Article
by M&NTIS team

M&NTIS Platform v26.8: What’s New

We’re pleased to announce M&NTIS Platform v26.8, a release built around two axes: seeing what the attack actually did, with the raw output of every red team command now shown in the console; and a substantially faster interface.

The scenario and account pages have also been redesigned, and the platform’s REST APIs now express every date in ISO 8601 format.

⭐ Key Highlights

See What the Attack Actually Did

Until now, M&NTIS told you which commands a red team attack step had run, and what it had extracted from them — hosts, credentials, payloads. What it never told you was what the target actually answered.

  • The console tab now shows the raw output of each executed command, on an output> line directly under the command itself.
  • This applies to scenario attack steps and to manually issued redteam commands alike, such as Atomic tests.
  • The output is part of the attack report served by the Redteam API, on a new result field per command — so it is available to your own tooling, not only in the interface.
Raw command output shown on an output> line beneath the command in the attack console

For a trainee reading an attack after the fact, this is the difference between a list of commands and an account of what happened. For a detection engineer, it is the evidence that the technique behaved as expected on that particular host.

A Faster Platform

This release includes a measured performance campaign on the scenario API and the lab runner. The most visible result: lab listing is roughly three times faster, with its response time cut by about 70%.

Redesigned Pages

  • Scenario page redesigned.
  • Account page redesigned.
  • The attack details overview follows the new design.

📋 Other Release Changes

Reliability

  • A lab stopped while it was still queued is now released properly, instead of remaining indefinitely in teardown and continuing to count against the active-lab limit.
  • Catalog archive extraction is now bounded, and API tokens that are malformed or signed by an unknown key are rejected cleanly instead of producing a server error.
  • Copy all in the lab attack console now copies every command rather than part of them.

Scenarios and Content

  • Vesperlyn now runs over HTTPS by default. The attacker’s control channel is deployed over TLS regardless of the scenario profile, and the certificate is installed by a dedicated attack step instead of manual commands — a closer match to how an operator actually sets this up.
  • Suricata basebox updated, with its hostname fixed.

For API Consumers: Dates Move to ISO 8601

Every date and timestamp served by the platform’s REST APIs is now an ISO 8601 UTC string (2026-09-03T14:20:00Z). Lab timestamps were previously Unix epoch seconds as numbers; attack report dates, security alert times, notification dates and assessment submission dates were previously free-form strings. A date with no value is now null rather than an empty string.

Existing lab data is migrated automatically. If you drive M&NTIS from your own tooling — which became a great deal more common since we opened the public REST APIs in v26.7 — adapt your date parsing before upgrading.

M&NTIS v26.8 is a release about visibility. The console now shows what the attack did rather than only what it attempted, that output reaches your own tooling through the Redteam API, and the platform gets noticeably quicker to use along the way.