February

This summary covers all product updates released in February 2026, including the releases from:

• February 5 – 11

• February 12 – 18

• February 19 – 25

• February 26 – March 4

Across these releases, we focused on improving investigation accuracy and context, expanding threat intelligence capabilities, enhancing integrations at scale, and introducing new analyst-facing workflows and intelligence surfaces.

---

Investigation Quality & Signal Clarity

February releases continued to drive more decisive investigations with reduced noise:

• Expanded classification logic across:

  • Identity, VPN, and authentication activity

  • Endpoint tooling and management agents

  • Firewall admin changes and SSH activity

  • Cloud analytics, BI usage, and SaaS access

  • Email threats including phishing, HTML smuggling, and double-extension attachments

• Improved differentiation between:

  • Legitimate cloud and infrastructure activity vs suspicious behavior

  • Research scanners vs real external reconnaissance

  • Command-and-control traffic vs benign outbound connections

• Enhanced Microsoft Defender investigations with:

  • File origin, reputation, and prevalence context

  • Registry-aware malware analysis

  • Improved reinvestigation workflows for updated alerts

• Introduced blast radius analysis (Beta) to identify impacted users, hosts, and assets for email incidents.

• Improved investigation summaries:

  • Shorter, clearer, and more actionable

  • Better grounded in verifiable evidence (e.g., email address vs display name)

---

Threat Intelligence & Enrichment

February introduced major advancements in threat intelligence capabilities:

• Launched a new Threat Intel workspace:

  • Browse and manage intelligence collections

  • Support for Dropzone-provided and customer-provided indicators

• Added Dropzone-native threat intelligence:

  • File hash reputation

  • Common file behaviors

  • Parent/child process relationships

  • Frequency insights

• Added ANY.RUN integration for sandbox-based enrichment (file, URL, domain, IP).

• Improved enrichment reliability and depth:

  • Combined multiple sources (e.g., AbuseIPDB + hosting provider context)

  • Better handling of malformed or partial responses

  • More consistent IP, file, and domain reputation analysis

---

Integration Expansion & Scalability

February significantly expanded integration coverage and performance:

New & Expanded Integrations

• ANY.RUN

• Wiz Threat (webhook ingestion)

• Continued expansion of:

  • Microsoft 365 / Defender / Sentinel

  • Splunk and Splunk ES

  • Palo Alto Cortex XDR / XSIAM

  • Exabeam (Beta)

  • QRadar

  • Okta

  • Google Workspace

  • Panther

  • Elasticsearch

  • CrowdStrike

---

Integration Improvements

• Improved query generation, validation, and execution across SIEMs:

  • Parallel queries and better dataset selection

  • Reduced timeouts and retries

  • More resilient handling of partial or empty results

• Enhanced enrichment coverage:

  • Device, user, and identity context

  • File, registry, and process relationships

  • Cloud and SaaS activity

• Added new filtering and ingestion controls:

  • Detection-source filters (Microsoft)

  • Severity and tag-based filtering (SentinelOne, Cortex, Splunk ES)

• Improved performance and scalability:

  • Reduced query volume (e.g., Splunk wildcard grouping)

  • Better handling of large datasets and long-running queries

  • Graceful handling of API limits and quota exhaustion

---

User Experience & Investigation Workflows

February introduced several new analyst-facing capabilities:

• Added detection objective summaries to explain alert intent in plain language.

• Introduced blast radius summaries (Beta) for quick impact assessment.

• Added outcome comparison dashboards (Beta) to track investigation accuracy vs analyst feedback.

• Released early Threat Hunter catalog and reporting (Beta).

• Improved investigation workflows:

  • Enhanced investigation list with better defaults and navigation

  • Deep linking and improved triage experience

  • Clearer evidence presentation (timestamps, time ranges, empty results)

• Improved context memory:

  • Redesigned UI with Active/Inactive views

  • Added expiration dates and usage tracking

  • Reduced duplication and improved filtering

• Enhanced system observability:

  • Expanded system events for API calls and enrichment activity

  • Improved auditability and troubleshooting visibility

---

Email, Identity & Endpoint Enhancements

• Improved phishing detection:

  • Better parsing of complex headers

  • Stronger detection of credential-harvesting campaigns

  • Reduced false positives from legitimate SaaS usage

• Enhanced identity and authentication analysis:

  • Improved Entra ID and hybrid identity enrichment

  • Better distinction between successful and failed logins

  • Improved VPN and device posture handling

• Strengthened endpoint and process analysis:

  • Improved process tree reconstruction (especially for Cortex data)

  • Better file-origin tracking across multiple sources

  • Reduced false positives for legitimate system processes and updates

---

Security, Performance & Reliability

February releases continued to harden the platform:

• Improved API security:

  • Enforced API key permissions aligned with UI roles

• Enhanced system resilience:

  • Better retry logic and error handling across integrations

  • Improved handling of timeouts and upstream failures

• Optimized performance:

  • Reduced database and API overhead (e.g., context memory optimizations)

  • Improved responsiveness under load

  • Reduced unnecessary prefetching and query overhead

• Continued platform hardening:

  • Dependency updates

  • Container and infrastructure improvements

  • More consistent handling of malformed or incomplete data

---

Overall Impact

The February 2026 releases focused on:

• Delivering higher-confidence investigations with less noise

• Expanding threat intelligence depth and visibility

• Improving integration scalability and reliability across large environments

• Introducing new analyst workflows and intelligence surfaces

• Strengthening platform performance, resilience, and observability

Together, these updates significantly improve Dropzone’s ability to provide rich, contextual, and actionable investigations at scale while supporting increasingly complex security environments.