All release notes
Platform
Investigations, and detection that reads behaviour
Introduces Investigations as a first-class product area for triaging suspicious activity, and reworks endpoint detection toward behavioural threat detection: process anomaly classification, security event-log monitoring and multi-step attack-chain correlation, plus a set of risk-scoring accuracy fixes.
New
- Investigations (new): a dedicated triage area, separate from Risks. Where a risk is a verifiable, remediable problem, an investigation is suspicious activity that must be triaged first. Investigations have their own lifecycle, confidence levels and signal-type taxonomy, SLA tiers, evidence views and an activity timeline, with numbered, shareable references. Security event-log signals and correlated attack chains open investigations automatically, and an investigation can also be created manually. A list view with stat cards and filters and a detailed evidence and activity view are added under Security.
- Behavioural attack-chain detection: high-signal endpoint changes are clustered over a rolling time window and evaluated against a set of attack-chain definitions (for example antivirus disable followed by persistence, or a new admin account alongside antivirus disable). A matched chain raises a compound critical or high risk and opens a linked investigation. Each definition is tuned to keep innocent-explanation rates low.
Improved
- Risk-scoring accuracy: the internet-exposure check now recognises remote-access and database services (RDP, VNC, SMB, WinRM, Telnet and common database ports) in addition to web and SSH, so a device exposing remote desktop is no longer treated as not exposed. The firewall compensating-control reduction now distinguishes all profiles being on from only one, so a device unprotected on public or private networks no longer earns the full reduction. The AI assessment of exploit realism and remediation priority now adjusts the risk score rather than being stored only for display.
- Endpoints now collect process image paths and command lines with on-device anomaly classification, and sample key Windows security events, so detection is driven by structured facts rather than text pattern matching. See the agent release notes for detail.