All release notes
Platform
Integrations, agent-driven patching, and investigation depth
Feature and fix release completing several areas opened in earlier releases. Integrations now deliver events with per-connector filtering and a delivery log, Patch Management gains agent-driven update detection and installation, the Investigations product area is completed with a full incident-response lifecycle, and a batch of operator-experience features gains per-client configuration.
New
- Integrations now deliver events live to configured connectors, including risk creation, severity thresholds, confirmed and escalated investigations and overdue patches. Per-connector trigger conditions (minimum severity and event-type selection) prevent low-value noise reaching ticketing or chat systems, and a per-integration delivery log records each attempt with timestamp, event, status and any error.
- The generic webhook connector is fully configurable: custom headers, authentication type (including HMAC-SHA256 payload signing, Bearer and Basic), HTTP method and a documented payload shape. Ticketing connectors gain severity-to-priority mapping and issue-type selection.
- Patch Management is now agent-driven: endpoints report missing and installed Windows updates so the catalogue fills itself, and approved patches can be installed by the agent with real per-device deployment state.
- Investigations completed: a full incident-response lifecycle (Contained, Eradicated, Recovered) with responder team and post-incident report, a left-hand attack-type filter rail, assignment scoping that limits who can be assigned, and in-app modals replacing browser dialogs for dismiss and delete.
Improved
- Integration secrets are now encrypted at rest and continue to never be returned to the browser. Connectivity tests are provider-aware rather than a simple field-presence check, and connectors can be enabled or disabled in bulk.
- Data-retention policies can now be configured per client in addition to a platform default.
- Usage metrics now support a per-client view in addition to the platform-wide view.
- Real-time notifications: the header bell now subscribes to the live notification stream on login and updates the unread badge without a page reload.
- Investigations are now powered by richer endpoint signals including lateral movement, persistence and fleet-baseline anomalies. See the agent release notes for detail.
- Internal logging now emits structured JSON with a request identifier propagated through the request, improving traceability.
Fixed
- The What's New changelog is now seeded so the in-app release-notes modal and page have content.
- Report period comparisons showed the wrong sign: an increase now displays as a positive value rather than a negative one.
- Remaining dark-mode visual defects fixed across the dashboard, risk detail and other pages (white cards, hidden text and low-contrast borders).