For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

January

This summary covers all product updates released in January 2026, including the releases from:

• January 8 – 14
• January 15 – 21
• January 22 – 28
• January 29 – February 4

Across these releases, we focused on improving investigation quality, reducing false positives, expanding integration coverage, enhancing APIs, and strengthening reliability and performance.

Investigation Quality & Signal Clarity

January releases significantly improved investigation decisiveness and noise reduction:

• Expanded “normal activity” baselines for users, devices, IPs, and cloud environments.
• Introduced multi-signal alert investigations that break large SIEM cases into focused sub-investigations with a single consolidated conclusion.
• Added new insight tags such as Invalid Credentials and Research Scanner.
• Improved classification for:
  • Research scanners and internet-wide scanning activity
  • OAST testing
  • Pretexting lure phishing
  • Pirated software alerts
  • Reconnaissance and enumeration activity
• Enhanced Microsoft Defender malware investigations with richer file origin, reputation, and prevalence context.
• Reduced false positives by better recognizing expected activity (authorized security tools, MSP admin behavior, service accounts, test environments).

Integration Expansion & Enhancements

January introduced new integrations and major improvements across existing ones:

New & Expanded Integrations

• Azure Monitor / Log Analytics
• Vectra AI
• Exabeam (Beta)
• Expanded support across Microsoft 365, Defender, Sentinel, CrowdStrike, Sumo Logic, Datadog, Cato Networks, GreyNoise, ReversingLabs, and Custom Threat Intelligence.

Integration Improvements

• Parallelized and optimized SIEM queries (Microsoft Sentinel, Panther, Sumo Logic).
• Improved large query summarization across Microsoft, Google SecOps, and Sumo Logic.
• Enhanced enrichment handling when queries return partial or empty results.
• Added severity-based filtering and exclusion controls for SentinelOne.
• Expanded Advanced Hunting and table mappings in Microsoft Defender.
• Improved retry logic, error handling, and performance for long-running or complex queries.

APIs & Automation

January included major API enhancements:

• Added Customer APIs to:
  • Manage response actions (create, update, delete)
  • Configure investigation thresholds
  • Manage global company settings
• Introduced Integration Management APIs to:
  • List, create, update, test, enable/disable, and delete integrations
  • Retrieve available integration types and schemas
• Improved context and knowledge APIs with sorting capabilities.
• Increased reliability of asynchronous indicator lookups and investigation workflows.

User Experience & Workflow Improvements

Several updates focused on usability and triage efficiency:

• Launched a new investigation list view with swimlanes for faster prioritization.
• Added an upgrade status page for visibility during maintenance windows.
• Improved alert readability with automatic title shortening.
• Shortened and refined investigation conclusion summaries.
• Added copy-to-clipboard support for summaries and tag explanations.
• Surfaced alert reinvestigation chains directly in the UI.
• Enhanced the context library with improved filtering and investigation linking.

Phishing, Identity & Email Enhancements

• Improved phishing email parsing, including uncommon encodings.
• Enhanced handling of legitimate SaaS platforms used in phishing campaigns.
• Improved identity threat detection for suspicious logins from uncommon hosting providers.
• Refined handling of invalid credential scenarios.
• Improved email header parsing and URL extraction reliability.

Security, Performance & Reliability

January releases also strengthened core platform stability:

• Improved performance for large, multi-table SIEM queries.
• Enhanced error handling for long-running queries.
• Hardened backend dependencies and container configurations.
• Improved structured JSON parsing and metadata extraction robustness.
• Enhanced UI and API behavior during upgrades and client-side errors.

Overall Impact

The January 2026 releases focused on:

• Delivering more decisive, lower-noise investigations
• Expanding integration depth and reliability
• Increasing automation and API control
• Improving analyst workflow efficiency
• Strengthening platform performance and resilience

Together, these updates continue to advance investigation quality at scale while reducing operational friction for security teams.