# January

This summary covers all product updates released in January 2026, including the releases from:

* January 8 – 14
* January 15 – 21
* January 22 – 28
* January 29 – February 4

Across these releases, we focused on improving investigation quality, reducing false positives, expanding integration coverage, enhancing APIs, and strengthening reliability and performance.

***

## Investigation Quality & Signal Clarity

January releases significantly improved investigation decisiveness and noise reduction:

* Expanded “normal activity” baselines for users, devices, IPs, and cloud environments.
* Introduced multi-signal alert investigations that break large SIEM cases into focused sub-investigations with a single consolidated conclusion.
* Added new insight tags such as **Invalid Credentials** and **Research Scanner**.
* Improved classification for:
  * Research scanners and internet-wide scanning activity
  * OAST testing
  * Pretexting lure phishing
  * Pirated software alerts
  * Reconnaissance and enumeration activity
* Enhanced Microsoft Defender malware investigations with richer file origin, reputation, and prevalence context.
* Reduced false positives by better recognizing expected activity (authorized security tools, MSP admin behavior, service accounts, test environments).

***

## Integration Expansion & Enhancements

January introduced new integrations and major improvements across existing ones:

### New & Expanded Integrations

* Azure Monitor / Log Analytics
* Vectra AI
* Exabeam (Beta)
* Expanded support across Microsoft 365, Defender, Sentinel, CrowdStrike, Sumo Logic, Datadog, Cato Networks, GreyNoise, ReversingLabs, and Custom Threat Intelligence.

### Integration Improvements

* Parallelized and optimized SIEM queries (Microsoft Sentinel, Panther, Sumo Logic).
* Improved large query summarization across Microsoft, Google SecOps, and Sumo Logic.
* Enhanced enrichment handling when queries return partial or empty results.
* Added severity-based filtering and exclusion controls for SentinelOne.
* Expanded Advanced Hunting and table mappings in Microsoft Defender.
* Improved retry logic, error handling, and performance for long-running or complex queries.

***

## APIs & Automation

January included major API enhancements:

* Added Customer APIs to:
  * Manage response actions (create, update, delete)
  * Configure investigation thresholds
  * Manage global company settings
* Introduced Integration Management APIs to:
  * List, create, update, test, enable/disable, and delete integrations
  * Retrieve available integration types and schemas
* Improved context and knowledge APIs with sorting capabilities.
* Increased reliability of asynchronous indicator lookups and investigation workflows.

***

## User Experience & Workflow Improvements

Several updates focused on usability and triage efficiency:

* Launched a new investigation list view with swimlanes for faster prioritization.
* Added an upgrade status page for visibility during maintenance windows.
* Improved alert readability with automatic title shortening.
* Shortened and refined investigation conclusion summaries.
* Added copy-to-clipboard support for summaries and tag explanations.
* Surfaced alert reinvestigation chains directly in the UI.
* Enhanced the context library with improved filtering and investigation linking.

***

## Phishing, Identity & Email Enhancements

* Improved phishing email parsing, including uncommon encodings.
* Enhanced handling of legitimate SaaS platforms used in phishing campaigns.
* Improved identity threat detection for suspicious logins from uncommon hosting providers.
* Refined handling of invalid credential scenarios.
* Improved email header parsing and URL extraction reliability.

***

## Security, Performance & Reliability

January releases also strengthened core platform stability:

* Improved performance for large, multi-table SIEM queries.
* Enhanced error handling for long-running queries.
* Hardened backend dependencies and container configurations.
* Improved structured JSON parsing and metadata extraction robustness.
* Enhanced UI and API behavior during upgrades and client-side errors.

***

## Overall Impact

The January 2026 releases focused on:

* Delivering more decisive, lower-noise investigations
* Expanding integration depth and reliability
* Increasing automation and API control
* Improving analyst workflow efficiency
* Strengthening platform performance and resilience

Together, these updates continue to advance investigation quality at scale while reducing operational friction for security teams.