For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

February

This summary covers all product updates released in February 2026, including the releases from:

• February 5 – 11
• February 12 – 18
• February 19 – 25
• February 26 – March 4

Across these releases, we focused on improving investigation accuracy and context, expanding threat intelligence capabilities, enhancing integrations at scale, and introducing new analyst-facing workflows and intelligence surfaces.

Investigation Quality & Signal Clarity

February releases continued to drive more decisive investigations with reduced noise:

• Expanded classification logic across:
  • Identity, VPN, and authentication activity
  • Endpoint tooling and management agents
  • Firewall admin changes and SSH activity
  • Cloud analytics, BI usage, and SaaS access
  • Email threats including phishing, HTML smuggling, and double-extension attachments
• Improved differentiation between:
  • Legitimate cloud and infrastructure activity vs suspicious behavior
  • Research scanners vs real external reconnaissance
  • Command-and-control traffic vs benign outbound connections
• Enhanced Microsoft Defender investigations with:
  • File origin, reputation, and prevalence context
  • Registry-aware malware analysis
  • Improved reinvestigation workflows for updated alerts
• Introduced blast radius analysis (Beta) to identify impacted users, hosts, and assets for email incidents.
• Improved investigation summaries:
  • Shorter, clearer, and more actionable
  • Better grounded in verifiable evidence (e.g., email address vs display name)

Threat Intelligence & Enrichment

February introduced major advancements in threat intelligence capabilities:

• Launched a new Threat Intel workspace:
  • Browse and manage intelligence collections
  • Support for Dropzone-provided and customer-provided indicators
• Added Dropzone-native threat intelligence:
  • File hash reputation
  • Common file behaviors
  • Parent/child process relationships
  • Frequency insights
• Added ANY.RUN integration for sandbox-based enrichment (file, URL, domain, IP).
• Improved enrichment reliability and depth:
  • Combined multiple sources (e.g., AbuseIPDB + hosting provider context)
  • Better handling of malformed or partial responses
  • More consistent IP, file, and domain reputation analysis

Integration Expansion & Scalability

February significantly expanded integration coverage and performance:

New & Expanded Integrations

• ANY.RUN
• Wiz Threat (webhook ingestion)
• Continued expansion of:
  • Microsoft 365 / Defender / Sentinel
  • Splunk and Splunk ES
  • Palo Alto Cortex XDR / XSIAM
  • Exabeam (Beta)
  • QRadar
  • Okta
  • Google Workspace
  • Panther
  • Elasticsearch
  • CrowdStrike

Integration Improvements

• Improved query generation, validation, and execution across SIEMs:
  • Parallel queries and better dataset selection
  • Reduced timeouts and retries
  • More resilient handling of partial or empty results
• Enhanced enrichment coverage:
  • Device, user, and identity context
  • File, registry, and process relationships
  • Cloud and SaaS activity
• Added new filtering and ingestion controls:
  • Detection-source filters (Microsoft)
  • Severity and tag-based filtering (SentinelOne, Cortex, Splunk ES)
• Improved performance and scalability:
  • Reduced query volume (e.g., Splunk wildcard grouping)
  • Better handling of large datasets and long-running queries
  • Graceful handling of API limits and quota exhaustion

User Experience & Investigation Workflows

February introduced several new analyst-facing capabilities:

• Added detection objective summaries to explain alert intent in plain language.
• Introduced blast radius summaries (Beta) for quick impact assessment.
• Added outcome comparison dashboards (Beta) to track investigation accuracy vs analyst feedback.
• Released early Threat Hunter catalog and reporting (Beta).
• Improved investigation workflows:
  • Enhanced investigation list with better defaults and navigation
  • Deep linking and improved triage experience
  • Clearer evidence presentation (timestamps, time ranges, empty results)
• Improved context memory:
  • Redesigned UI with Active/Inactive views
  • Added expiration dates and usage tracking
  • Reduced duplication and improved filtering
• Enhanced system observability:
  • Expanded system events for API calls and enrichment activity
  • Improved auditability and troubleshooting visibility

Email, Identity & Endpoint Enhancements

• Improved phishing detection:
  • Better parsing of complex headers
  • Stronger detection of credential-harvesting campaigns
  • Reduced false positives from legitimate SaaS usage
• Enhanced identity and authentication analysis:
  • Improved Entra ID and hybrid identity enrichment
  • Better distinction between successful and failed logins
  • Improved VPN and device posture handling
• Strengthened endpoint and process analysis:
  • Improved process tree reconstruction (especially for Cortex data)
  • Better file-origin tracking across multiple sources
  • Reduced false positives for legitimate system processes and updates

Security, Performance & Reliability

February releases continued to harden the platform:

• Improved API security:
  • Enforced API key permissions aligned with UI roles
• Enhanced system resilience:
  • Better retry logic and error handling across integrations
  • Improved handling of timeouts and upstream failures
• Optimized performance:
  • Reduced database and API overhead (e.g., context memory optimizations)
  • Improved responsiveness under load
  • Reduced unnecessary prefetching and query overhead
• Continued platform hardening:
  • Dependency updates
  • Container and infrastructure improvements
  • More consistent handling of malformed or incomplete data

Overall Impact

The February 2026 releases focused on:

• Delivering higher-confidence investigations with less noise
• Expanding threat intelligence depth and visibility
• Improving integration scalability and reliability across large environments
• Introducing new analyst workflows and intelligence surfaces
• Strengthening platform performance, resilience, and observability

Together, these updates significantly improve Dropzone’s ability to provide rich, contextual, and actionable investigations at scale while supporting increasingly complex security environments.