Changelog

What changed for customers over the last three months, newest first.

September 2026

12 updates
Reports arrive as PDFs

Emailed reports now carry the PDF as an attachment, and you can email a stored report again from the reports list.

Reports
Reports build in the background

Large reports no longer hold up the screen. The list refreshes on its own when a report is ready.

Reports
Times show Malaysian time, with the zone named

Every time printed in a report now says which time zone it is in.

Reports
A section that fails says so

If one part of a report cannot be built, that section is marked instead of left blank.

Reports
Four new report types

Compliance overview, single-framework compliance, the monthly intelligence digest and network monitoring.

Reports
Search older logs and export the results

Search beyond the live window and download what you find.

Investigation
Feed exports match the screen

Filtering now happens on the server, so the export contains exactly the rows you see.

Investigation
See which firewall will carry a block

Before you approve a block, the console names the firewall that will apply it.

Response
Approve a block from the reasoning

You can approve a proposed firewall block straight from the reasoning behind a verdict.

Response
Explain on the network view, and every address is clickable

Ask for an explanation from the network view and open any address shown on it.

Investigation
MITRE ATT&CK rows explain themselves

Each technique row says in plain words what it means for you.

Investigation
Status says "not measured" instead of guessing

When a service has not been checked, the status page says so rather than showing it as healthy.

Platform

August 2026

10 updates
Microsoft Defender XDR

Defender detections, vulnerability exposure and hunting queries now flow into your cases.

Integrations
Rename and retire your own sites

Customers can now manage their own site list without raising a request.

Platform
Retention follows your terms

The retention set in your subscription is now enforced for your data automatically.

Data
A record when personal data is removed

Download a record showing what personal data was removed and when.

Data
Vulnerability assessment report

Includes credentialed scans, web application assessment and your OWASP Top 10 posture.

Reports
Structured filters and exact time ranges

Filter the feed by field and pick an exact start and end time.

Investigation
CSV and JSON exports match the PDF

Every export format now carries the same numbers.

Reports
The collector keeps telemetry through an outage

If the link drops, the on-site collector stores telemetry on disk and forwards it when the link returns.

Collector
A signed daily advisory feed

The daily advisories are signed so you can check they came from us.

iNTelligence
Stronger checks on collector connections

Collectors must now present a valid certificate before they can connect.

Collector

July 2026

6 updates
Guides and support in the console

Find how-to guides and reach support without leaving the console.

Platform
Contain an indicator from a case

Act on a bad address or file straight from the case it appears in.

Response
New log formats get picked up

Log samples the platform does not recognise yet are routed to us for mapping.

Integrations
Faster answers to console questions

Questions you ask in the console no longer wait behind background work.

Investigation
Device names on the network view

The network view shows device names, not only addresses.

Investigation
Web application firewall shows real numbers

WAF reporting now reflects what was actually enforced.

Integrations

Want to see it on your own logs?

Start a 60-day trial, or check how the platform is running right now.