March | Dropzone AI Documentation

Investigation Quality & Signal Clarity

March releases significantly improved investigation precision and reduced noise across common enterprise scenarios:

• Introduced detection objective summaries:

  • Plain-language descriptions of alert intent
  • Faster understanding for both junior and senior analysts

• Improved alert conclusions across:

  • VPN and cloud-aligned activity
  • Print server and Kerberos scenarios
  • Browser updaters and scheduled tasks
  • Vendor background processes and IIS workers
  • Downloads from newly registered domains

• Enhanced phishing detection:

  • Better parsing of complex email headers
  • Correct sender attribution in Microsoft alerts
  • Stronger identification of credential-harvesting campaigns
  • Improved handling of newly registered domains returning HTTP 404

• Expanded investigation context:

  • Microsoft 365 / Defender / Sentinel
  • Splunk
  • GCP
  • Palo Alto Cortex

• Improved classification accuracy:

  • Better distinction between benign infrastructure activity and malicious behavior
  • Improved handling of Linux SSH brute-force alerts as endpoint activity

Threat Intelligence & Enrichment

March continued expanding enrichment depth and intelligence coverage:

• Added Swimlane Threat Intelligence integration:

  • Enrichment for IPs, domains, URLs, hashes, and email indicators
  • Supports customer-owned intelligence sources

• Improved domain and file reputation analysis:

  • More consistent handling of suspicious domains
  • Human-readable filenames alongside hashes

• Expanded enrichment coverage across:

  • Identity (Entra ID, Okta)
  • Devices (multi-platform enrichment improvements)
  • Endpoint and process activity

• Improved file-origin analysis:

  • Parallel queries across EDR and SIEM sources
  • Clearer provenance summaries

• Added CrowdStrike Falcon Sandbox support:

  • Query existing reports
  • Detonate files and retrieve behavioral summaries

Integration Expansion & Scalability

March introduced major new integrations and expanded existing ones:

New Integrations

• ServiceNow

  • Query incidents, request items, and alerts during investigations
  • Supports investigation-time context retrieval (not just periodic ingestion)

• Rapid7 InsightIDR (Beta)

  • Alert ingestion
  • User/device enrichment
  • Process-tree analysis
  • LEQL query support

• Swimlane Threat Intelligence

  • Native enrichment integration using Swimlane apps

Integration Improvements

• Splunk

  • Major performance improvements:
    • Reduced scanner runtimes
    • Deduplicated ingest batches
    • Optimized tstats queries
    • Parallelized processing
  • Improved reliability:
    • Concurrency-aware retries with backoff
    • Better schema detection and sourcetype selection
    • Reduced scan failures in large environments

• Microsoft Defender / Sentinel / KQL

  • Improved ingestion filtering and KQL generation
  • Better handling of dynamic fields and large datasets

• Microsoft 365 / Graph

  • Improved phishing and sign-in timeline accuracy
  • Pagination support for large tenants
  • Better timeout handling and retry behavior

• ServiceNow

  • OAuth improvements (client credentials flow)
  • Configurable table selection for investigations

• Elasticsearch

  • Added time-range visibility in evidence
  • Introduced controls for large-cluster query scope

• Okta & Splunk

  • Added multi-slot support for multi-tenant environments

• Wiz

  • Added enrichment for issue and threat alerts
  • Improved webhook ingestion and context structuring

• Datadog, Panther, GCP, Slack

  • Improved query reliability, enrichment accuracy, and error handling
  • Better diagnostics and handling of expected API responses

User Experience & Investigation Workflows

March introduced several improvements to analyst workflows and usability:

• Enhanced AI-driven investigation flows:

  • Better interviewer behavior
  • Correct timeframe alignment
  • Proper completion handling

• Improved investigation summaries:

  • Clearer conclusions grounded in evidence
  • Reduced speculation

• Expanded context memory capabilities:

  • Introduced Context Memory API:
    • Filtering, search, sorting, pagination
    • Enables external automation and integrations
  • Improved context usage in investigations:
    • Focused on stored organizational knowledge

• Introduced Threat Hunter catalog and reporting (Beta):

  • Browse hunt definitions
  • Review hunt results with timelines and findings

• Improved dashboards:

  • Released Impact dashboard to all customers
  • Enhanced Sankey visualizations and navigation
  • Added deep linking from visualizations to investigations
  • Improved KPI accuracy (date-based calculations)

• Improved system observability:

  • Added system events for API calls and evidence lookups
  • Improved auditability and debugging

Email, Identity & Endpoint Enhancements

• Strengthened phishing investigation workflows:

  • Improved header parsing and sender attribution
  • Better impersonation detection

• Enhanced identity analysis:

  • Expanded Entra ID and hybrid identity enrichment
  • Improved login success/failure differentiation

• Improved endpoint and process analysis:

  • Better process-tree reconstruction (especially Cortex)
  • Enhanced handling of missing process IDs
  • Improved classification of endpoint-origin alerts

• Expanded device enrichment:

  • Improved cross-platform lookup reliability
  • Better handling of incomplete identifiers

• Improved script and automation analysis:

  • Detection of repeated PowerShell usage across hosts

Security, Performance & Reliability

March releases focused heavily on scalability and robustness:

• Significant performance improvements:

  • Reduced Splunk scan times in large environments
  • Optimized query generation and dataset selection
  • Reduced database and API load (context memory optimizations)

• Improved reliability:

  • Better handling of partial results and timeouts
  • More resilient enrichment pipelines
  • Reduced failures from malformed or missing data

• Enhanced API and integration stability:

  • Improved error handling and retry strategies
  • Better handling of authentication and permissions

• Platform hardening:

  • Dependency upgrades to secure versions
  • Improved HTTP client performance and diagnostics
  • Shared concurrency controls across integrations

Overall Impact

The March 2026 releases focused on:

• Delivering clearer, more explainable investigations with less noise
• Expanding enterprise integration coverage, including ServiceNow and Rapid7
• Improving performance and scalability for large environments (especially Splunk)
• Enhancing analyst workflows with better context, APIs, and dashboards
• Strengthening platform reliability, observability, and resilience

Together, these updates significantly improve Dropzone’s ability to operate at scale in complex environments while providing faster, more accurate, and more actionable security investigations.