# January 29, 2026

## Highlights

* Added new classification and prioritization for research scanners, OAST testing, pretexting lures, and pirated software to better distinguish testing, noise, and real risk.
* Improved investigation outcomes for internet research scanning, reconnaissance activity, and Microsoft Defender malware detections to reduce noise and increase decisiveness.
* Expanded integration capabilities for Microsoft 365 / Defender, Sumo Logic, Panther, and CrowdStrike ThreatGraph.
* Shortened investigation conclusion summaries and made tag explanations easier to copy and share in tickets and reports.

***

## New Features

### Research Scanner Classification

* Improved handling of well-known internet research scanners, reducing noise from expected scanning activity.

### OAST Testing Handling

* Improved handling of OAST (Out-of-Band Application Security Testing).

### Pretexting Lure Phishing Handling

* Improved handling of pretext lure phishing attacks.

### Pirated Software Handling

* Improved handling of pirated software alerts.

### Research Scanner Benign Conclusion Strategy

* Added a new system strategy to improve handling of research scanners found in alerts.

***

## Improvements

### Outcome Summaries

* Added length controls to investigation conclusion summaries so they remain concise and easier to scan while preserving key findings and recommendations.

### Reconnaissance & Enumeration Alerts

* Refined outcome logic so reconnaissance and enumeration against sensitive infrastructure are more decisively classified when clearly malicious, reducing ambiguous results.

### Microsoft Defender Malware Investigations

* Expanded investigation steps for Microsoft Defender malware detections to capture file origin, reputation, and prevalence more consistently, improving decision quality.

### Related Alert Analysis

* Enriched related-alert hypotheses with additional conclusion and tagging context so related alerts are grouped and explained more clearly.

### Alert Classification

* Improved classification of certain infrastructure alerts (including Fortinet administrator logins) so they are mapped more accurately to identity-focused attack surfaces.

### Investigation Reinvestigation Chains

* Optimized how reinvestigation chains are calculated and stored, reducing query overhead today and enabling future filtering and reporting enhancements.

### Tag Explanations in the UI

* Updated tag hover behavior so explanations now use a popover that supports text selection and copying, making it easier to include rationale in tickets and runbooks.

### Analysis Robustness

* Improved robustness of structured JSON handling and time/metadata extraction used by the analysis engine, reducing rare parsing and extraction failures in investigations.

***

## Security & Reliability

* Updated backend dependencies and container images to incorporate recent security patches and library fixes, improving overall platform security posture.
* Adjusted internal health checks and container configuration to avoid false-positive health alerts and improve resilience during deployments.

***

## Bug Fixes

### CrowdStrike ThreatGraph

* Fixed token refresh handling so missing permissions and configuration issues now surface as clear authorization errors instead of generic unauthorized responses.

### URL Sandbox

* Resolved a browser navigation issue that could prevent analysis of some URLs behind proxies, improving analysis success rates for content hosted on major cloud providers.

***

## Integration Improvements

### Microsoft 365 & Defender

* Added support for querying specific named and shared calendars when assessing user availability or travel status.
* Improved endpoint enrichment so device investigations more reliably surface hostname and related context when pivoting from IP-only data.
* Enhanced investigation flows for Microsoft Defender malware alerts to automatically gather richer file context (origin, reputation, and prevalence).

### Sumo Logic

* Improved automatic query correction and retry behavior when Sumo Logic rejects generated searches, increasing reliability of log retrieval during investigations.

### Panther

* Modernized the Panther query workflow by running table queries in parallel, adding per-table retries, and capturing empty and error responses as evidence for better transparency.
* Refined Panther query generation logic to better handle complex questions and avoid generation issues seen in some environments.