The Cyber Toolchain — issue 050, August 19, 2026

Platform admins can define, publish, and manage structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. contracts (findings, assets, and custom types) via Operations → Objects, with capabilities binding to approved registry versions and all item writes validated against the canonical schema.

Adds the full Caido MCP server (66 tools, 6 resources) as a second MCP server in the web-security capability, alongside the existing Python wrapper, both targeting the same Caido instance.

Adds a --include-public flag documentation clarification for Hub browse pages (Datasets, Models, Capabilities, Environments), distinguishing CLI --include-public behavior from the Public scope tab.

Adds a download client artifact endpoint (BED-8091) and a delete client artifact endpoint (BED-8129) for retrieving and removing collector client artifacts via the API. Adds part_number support to the artifact upload API for multipart upload handling, S3 configuration support (BED-9174) to enable object-storage-backed artifact handling, and exposes artifact metadata on management operation responses.

Adds Kind Metadata APIs to retrieve node and relationship kind details by graph-assigned kind ID, enabling OpenGraph automation and integrations. Specifically adds the api/v2/relationship-kinds/{relationship_kind_id} endpoint to retrieve a specific relationship kind by ID, and a new GET node kind endpoint (BED-8756) for querying individual node kinds via the API.

PostgreSQL Graph Storage Optimization runs after ingest and analysis to improve reliability and performance of PostgreSQL-backed graph databases, including faster graph data deletion. This includes optimized full graph database wipes for faster data-clearing operations in DB Management, and optimized source_kind and relation deletion using database indices for improved performance.

Extension Management is now enabled by default — OpenGraph extensions can be managed without manually enabling the feature first, via the opengraph_extension_management feature flag being turned on for all users.

Adds a confirmation dialog when deleting a rule in Semgrep Editor that shows which policies use the rule, automatically removes the rule from those policies, and deletes any policy left with no remaining conditions.

Adds enabledPlugins to require Copilot plugins be enabled or disabled across JetBrains IDEs, extraKnownMarketplaces to make approved plugin sources available, and strictKnownMarketplaces to restrict plugin installation to approved sources only. Adds allowedMcpServers and deniedMcpServers to centrally control which MCP servers developers can connect to, and permissions.disableBypassPermissionsMode to prevent the Copilot agent from using Bypass Approvals or Autopilot. Also enables centrally managed OpenTelemetry configuration (collector endpoint, protocol, service name, resource attributes, content-capture policy) that takes precedence over developer settings, with the applied configuration exposed to developers under Settings > Tools > GitHub Copilot > Chat > OpenTelemetry.

allowedMcpServers:
  - https://mcp.example.com/approved
deniedMcpServers:
  - https://mcp.untrusted.io

permissions:
  disableBypassPermissionsMode: disable

Adds a Trends tab to the organization-level Code Quality dashboard, plotting open findings over 7, 14, or 30-day windows grouped by health score or severity. Includes most improved and needs support repository ranking tables showing net change in open findings since the start of the selected period, and both the graph and tables respect repository filters applied at the top of the dashboard. Available on GitHub Enterprise Cloud, GitHub Team plans with GitHub Code Quality enabled, and GitHub Enterprise Cloud with data residency; not available on GitHub Enterprise Server.

Adds token-type-specific bulk deauthorization via enterprise REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and UI, letting enterprise owners revoke all SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authorizations for a specific credential type (Personal access tokensPersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., SSH keys, OAuth app tokens, or GitHub App user access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.) across the enterprise or for a single user without touching other credential types. Adds matching bulk revocation to delete or revoke all user-level credentials of a specific type for an individual EMU user while leaving other types intact, and extends both actions from enterprise-only to the organization level via organization REST APIs and web UI for incident-response parity. All actions are captured in the audit log and trigger email notifications to affected users.

Noir adds an errors key to JSON output that records per-tech analyzer failures and skipped files, distinguishing an empty result from an analyzer that never ran; skipped files are tallied per tech with up to five example paths instead of one entry each. The errors key propagates to -f yaml output and is mapped to runs[0].invocations[0].executionSuccessful in -f sarif output. A new --strict flag exits with code 2 after a degraded scan (analyzer failure or skipped files), writing the report before exiting, so failures and skipped files that were previously silently dropped now surface in CI.

$ noir scan . -f json --no-log --strict > endpoints.json

$ noir -b <source_dir> --strict

Noir adds end-to-end support for the HTTP QUERY method across roughly 24 frameworks including Express, Fastify, Hono, NestJS, Flask, aiohttp, Rails, Laravel, Phoenix/Plug, Echo, Fiber, Go net/http, axum, Ktor, http4k, Micronaut, Vert.x, JAX-RS/Quarkus/Dropwizard, ASP.NET Core, and Kemal, including OAS3 serialization and HTML report rendering.

Endor Labs open-sourced two complete Endor Patch examples in the endor-patches repository, including reproducible builds, attestations, and auditable diffs. Patched JARs in patches/<library>/artifacts/ can be installed to a local Maven repository via mvn install:install-file and declared using the -endor-YYYY-MM-DD version string, with transitive override support via <dependencyManagement> in Maven or resolutionStrategy in Gradle so nothing else in the build needs to change.

$ cat patches/com.fasterxml.woodstox/woodstox-core/security_attestation.json | jq '.[] | select(.fix_type == "FIX_TYPE_VULN")'

$ # Extract the source tarball, then build with Docker and Bazel per the included README.md
tar -xf patches/com.fasterxml.woodstox/woodstox-core/source.tar.gz
cd woodstox-core-patched && docker run --rm -v "$PWD":/build <hermetic-image> bazel build //...
sha256sum output/woodstox-core-6.3.1-endor-2024-09-03.jar
diff <(sha256sum output/woodstox-core-6.3.1-endor-2024-09-03.jar | awk '{print $1}') SHA256SUM.txt

$ mvn install:install-file \
  -Dfile=patches/com.fasterxml.woodstox/woodstox-core/artifacts/woodstox-core-6.3.1-endor-2024-09-03.jar \
  -DgroupId=com.fasterxml.woodstox \
  -DartifactId=woodstox-core \
  -Dversion=6.3.1-endor-2024-09-03 \
  -Dpackaging=jar

Endor Labs AI SAST now supports C with buildless scans that run in the IDE and on pull requests, requiring no compiler hook or reproducible build. It pairs a deterministic call-graph and reachability engine with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. reasoning to trace data flow across functions and files, catching buffer overflows, use-after-free, integer overflows, and other cross-function memory-safety flaws that pattern-based rules miss. C SAST runs alongside existing C SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. in the same platform, covering first-party C code and its open-source dependencies together, and is surfaced through AURI by Endor Labs as an independent security harness with policy enforced across any agent, model, or CI stage.

Agent Governance is a new inventory and control plane for AI coding agents, models, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and skills running across developer workstations and cloud environments, with real-time monitoring of agent actions such as commands, file access, and tool calls. It adds policy enforcement that can block, alert on, or require approval for risky agent behavior before execution, backed by a built-in policy catalog extensible with custom rules, plus reusable, saveable filters for findings and projects under Coding Agent Governance.

A new self-contained Go binary git-clone-override-policy intercepts bare git clone <URL> calls and runs a fixed 13-step shallow-and-partial-clone sequence based on a .afullhistorycloneoverridepolicy.toml (schema_version = 2) file stored in the repo root, before enforcing any policy on disk. The policy file supports [git_config] (scoping core.compression, http.postBuffer, http.lowSpeedLimit, http.lowSpeedTime, pack.windowMemory, pack.packSizeLimit, pack.threads to the cloned repo only), [fetch] flags such as --depth=1 and --filter=blob:none, [sparse_checkout] with conemode = 'auto' (resolved to cone/no-cone), includes, excludes, and exclude_extensions covering 30+ binary file types, plus a [policyinfo] section with description and OptimalForAIAgents metadata. The binary runs on Linux, macOS and Windows (amd64/arm64, including CMD, PowerShell, Git Bash, WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host.) with no dependency beyond git on PATH, and is bypass-safe: clones that already pass a flag like --depth or --filter, or repos without a policy file, pass through unchanged.

⤢

▶ ⤢

▶ ⤢

# .afullhistorycloneoverridepolicy.toml at repo root
schema_version = 2

[policyinfo]
description = "Optimized clone for CI and AI agents"
OptimalForAIAgents = true

[git_config]
"core.compression" = 0
"http.postBuffer" = "1024M"
"pack.threads" = 4

[fetch]
flags = ["--depth=1", "--filter=blob:none"]

[sparse_checkout]
enabled = true
conemode = "auto"
includes = ["/*"]
exclude_extensions = [
  "png", "jpg", "gif", "svg", "pdf",
  "zip", "tar", "gz", "mp4", "exe",
  "dll", "woff", "woff2", "ttf", "psd"
]
case_variants = "both"

$ ./git-clone-override-policy https://example.com/group/my-repo.git

Polaris can now generate AI-assisted fix pull requests for SAST findings both CI-natively via the Bridge CLI — triggerable from GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration with no server-side scheduling — and on-demand or policy-driven from the UI, individually or in bulk, or via issue policy actions. Admins can cap open PRs per branch or per run and filter by CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., issue type, language, and file pattern; a new View issue policies action shows which policies, compliance requirements, and governance rules are attached to a given SAST finding.

Security teams can define rule profiles at organization, application, project, or branch level with hierarchical inheritance, enforced automatically across CI pipelines, CLI scans, and integrations — for example, setting a mandatory organization-level profile via Settings > Rule Profiles so every scan picks it up without per-pipeline changes. The feature adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., audit trails, and version awareness, with visibility into which profile was used for each scan.

Polaris now syncs triage states, ticket statuses, and fix-by dates bidirectionally with GitLab Issues, GitHub Issues, Jira, ServiceNow, and Azure Boards — changes in either system propagate automatically, including fix-by date updates flowing to Jira/ServiceNow/Azure Boards due dates and back. GitLab Issues, GitHub Issues, and ServiceNow are new native bug-tracking targets supporting individual and bulk export, single-ticket bundling for ServiceNow, and policy-driven issue creation; Jira gains configurable field mapping to standard or custom fields and customizable ticket descriptions. Per-project bug-tracker integration mappings can be saved as reusable templates across projects and workflows, scoped to all branches or the default branch only, and linked tickets now auto-close when findings are dismissed or absent in a later scan, with a reappearing issue creating a new ticket to preserve the audit trail.

The Rapid Scan Static engine extends its seven existing Java JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. checks (algorithm confusion, nonexpiring tokens, ignored expiration/start times, missing claims validation, untrusted decoding) to Scala, and adds six new Scala web security checks covering permissive and credentialed CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. origins, excessive preflight age, missing TLS, and disabled security headers across the http4s and Play frameworks. It also adds a crypto bits private key pattern to detect embedded cryptographic private keys in source and config files, and adds support for Go 1.26 and Dart 3.11.

The fAST SCA engine adds new detectors for UV (Python), Rush monorepo tooling, a tree-based Conda detector, and Ant/Ivy dependency extraction. Ecosystem coverage is extended to Poetry, pnpm, SBTSBTA build tool for Scala and Java projects, maintained by the open-source community, that handles compilation, dependency resolution, and packaging using an incremental build model to speed up iterative development., SetupTools, Bazel 9, .slnx solution files for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., buildless go.mod analysis for Go, and Cargo workspace support with include and exclude controls.

Polaris adds outbound-only secure tunnel connectivity — requiring no inbound firewall changes — to self-hosted Azure DevOps Server, GitLab Self-Managed, Bitbucket Server and Data Center, and on-premises Jira, built on the Bridge CLI and Teleport infrastructure. Multitunnel support for on-prem Jira connectivity is restricted to org admins via RBAC, with full audit logging.

Evo by Snyk replaces the previous Risk Index with a new model risk score ranging 0–1,000 that combines attack success rate with impact weighting, tested across prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., and insecure code generation attack categories. The score is split into four severity bands for at-a-glance triage: low (0–249), medium (250–499), high (500–749), and critical (750–1,000). Policies built on the old Risk Index remain visible but no longer evaluate under the new model risk score — existing Risk Index-based policies must be reviewed and recreated against it to keep enforcement active.

Introduces Continuous Offensive Security (COS), a new offensive scanning capability covering Targets, Scans, and Findings and Reports, with dedicated documentation for defining target scope, configuring authentication, managing targets, monitoring scans, and interpreting results.

Adds a snyk fix CLI command, documented at commands/fix.md.

DOMPurify's built-in SVG allow-list now includes the pointer-events and vector-effect presentation attributes, letting sanitized SVG content use them without custom configuration.

New protonmailDbMail.py parser surfaces four artifacts from Proton Mail's db-mail (MailX) Room store: MailX Messages (time, subject, sender/recipient addresses decoded from JSON, read/replied/forwarded flags, attachment count, size, conversation ID, message ID), MailX Attachments (name, size, MIME type, disposition, saved content URI from MessageAttachmentMetadataEntity), MailX Contacts (ContactEmailEntity rows), and MailX Account (UserEntity + AccountEntity including createdAtUtc in Unix millis).

Adds a TikTok Account artifact and TikTok activity artifacts, with multi-account database handling for IM data and deduplication of duplicate extraction paths.

Upgrades Proton Mail Inbox Messages parsing to a conversation view with inline media, adding remote_conversation_id, Conversation Subject, From Me direction, and first cached Attachment columns via a new data_views.conversation block.

Adds a new logarchive dialed numbers artifact that extracts CommCenter call.provider setup/teardown blocks, Call(StatusUpdate) state chains, and ContactSearchManager digit-sequence entries from unified log archives.

Adds parsers for new apps and data types: Snapchat (including a Memories Search Index), Tinder, four TikTok artifacts (Watch History, Account, Published Videos, App Sessions), Reddit (user and subscription data), OneDrive, Google Drive DriveKit artifacts, four WhatsApp add-on artifacts (reactions, channel tallies, group events, membership changes), Chrome saved credit cards and Chrome payments customer data artifacts, and GroupMe message deletion state reporting.

Wiz integrates Google Threat Intelligence, enriching risk and threat findings with Mandiant frontline intelligence, VirusTotal crowdsourced intelligence, and Google threat insights, available out of the box to all Wiz customers. The enrichment extends to malware findings for deeper investigation context beyond a simple verdict, and to malicious AI Skill intelligence that identifies potentially risky open-source skills AI agents can import, addressing agentic AI attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..

Pen Test Findings reaches general availability with new Graph Controls that surface attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. tied to pen-test findings, enabling blast-radius visualization correlated against external network exposure, identity privileges, secrets, data, and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. paths within the Wiz Security Graph.

Introduces .sbxenv.yaml (fallback .sbxenv.yml) files declaring a reproducible sandbox with schemaVersion, name, agent, kits, workspace, additionalWorkspaces, env, sandboxOptions, secrets, bindings, registries, mcp, and ports fields, managed via sbx env run [PATH...], sbx env create [PATH...], sbx env exec [PATH...] -- COMMAND [ARG...], and sbx env rm [PATH...] (requires sbx 0.39.0+). Multiple files can be layered — sbx env run base.sbxenv.yaml local.sbxenv.yaml — merging nested mappings by key, concatenating lists, and letting later scalars override earlier ones for team-base-plus-local-override setups. additionalWorkspaces entries take path and readOnly to mount extra repositories; sandboxOptions supports template, memory (e.g. 8g), cpus, pullPolicy (always/missing/never), and profile; secrets maps service names to value, ref (e.g. op://Vault/Item/field), or command sources with optional refresh, backend (sdk/cli), and noVerify; bindings approves credential-injection domains into the host-global credentials.yaml (removable with sbx env rm --prune-bindings); registries maps hostnames like ghcr.io to pull credentials; mcp.servers registers remote (url) or local stdio (command/args) MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers with the built-in gateway, persisting across sbx env rm; ports declares sandbox-to-host mappings with sandbox, host, protocol, and hostIP; and workspace takes an object form with path and clone (default false), overridable per-invocation with --clone/--clone=false.

# web-app-env/.sbxenv.yaml
schemaVersion: "1"
name: web-app
agent: claude
workspace: ./web-app
kits:
  - docker.io/sbx/playwright-kit:latest
env:
  NODE_ENV: test
ports:
  - sandbox: 3000
    host: 3000

# Then, from web-app-env/:
sbx env run

$ sbx env run base.sbxenv.yaml local.sbxenv.yaml

$ sbx env create
sbx env exec -- npm test
sbx env rm --force

$ sbx env run

Adds --ref to register a dynamic secret source using a 1Password reference (op://...) or AWS Secrets Manager ARN (arn:aws:secretsmanager:...), resolved at runtime by the host CLI rather than stored as plaintext, and --command to register any host tool that prints a secret to stdout (e.g. gh auth token) as a dynamic source. --refresh <duration> controls caching (default 55 minutes), with --refresh on-demand resolving on every use. --no-verify stores a source that can't be resolved at registration time, and --show-error surfaces provider errors when verification fails (the two cannot be combined); --ref and --command are mutually exclusive and cannot combine with --token, --oauth, or --registry. OP_ACCOUNT and AWS_PROFILE environment variables select a specific 1Password account or AWS profile. On Linux hosts without a running Secret Service, credentials fall back to a file under the user config directory with restricted permissions and a warning that the secret is protected only by file permissions. sbx secret set and the experimental sbx secret set-custom gained the same dynamic-source, refresh, verification and error-output options for injecting credentials for known hosts via the host-side proxy without exposing values to the agent; third-party kits extending a built-in agent inherit credentials but not built-in provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. and require explicit approval.

$ docker sandbox credentials set anthropic --ref 'op://Work/Anthropic/credential' --refresh 30m

$ docker sandbox credentials set github --command 'gh auth token' --refresh on-demand

$ AWS_PROFILE=prod docker sandbox credentials set openai --ref 'arn:aws:secretsmanager:us-west-2:123456789012:secret:openai-api-key'

$ github --command 'gh auth token' --refresh on-demand

$ github --ref 'op://Work/GitHub/token' anthropic --ref 'op://Work/Anthropic/credential'

$ anthropic --ref 'arn:aws:secretsmanager:us-west-2:123456789012:secret:anthropic-api-key'

Adds --gpu to sbx create and sbx run for NVIDIA GPU passthrough into sandboxes on x86_64 Linux hosts using VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space., gated behind sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.sandbox-gpu true. A prepare-nvidia-bundle.sh script assembles the required EROFS driver bundle (distributed as nerdbox-nvidia-modules-x86_64.zip) and installs it at /usr/libexec/nerdbox-nvidia-bundle.erofs, with OUTPUT overriding the install path and ACCEPT_NVIDIA_LICENSE=1 for non-interactive builds; hosts need IOMMU enabled in BIOS and iommufd/vfio_pci kernel modules loaded via sudo modprobe -a iommufd vfio_pci. After upgrading, the kernel modules must be rebuilt to match the new guest kernel by re-running prepare-nvidia-bundle.sh with the new release's module zip.

$ sbx settings set platform.allowExperimentalFeatures true
sbx settings set feature.sandbox-gpu true
sbx create --gpu claude .

Introduces the sbx CLI for running AI coding agents in isolated microVMs without requiring Docker Desktop or Docker Engine. Installs on macOS via brew trust docker/tap then brew install docker/tap/sbx; on Windows via winget install -h Docker.sbx; on Linux alongside Docker Engine via curl -fsSL https://get.docker.com | sudo SBX=1 sh; on Linux without Docker Engine via Docker's apt repository and sudo apt-get install docker-sbx (using REPO_ONLY=1 with the convenience script); or manually from the sbx-releases repository binaries. Authentication is via sbx login, which opens a browser for Docker OAuth.

$ curl -fsSL https://get.docker.com | sudo SBX=1 sh

$ curl -fsSL https://get.docker.com | sudo REPO_ONLY=1 sh
sudo apt-get install docker-sbx
sbx login

$ brew trust docker/tap && brew install docker/tap/sbx && sbx login

Adds -e/--env and --env-file flags to sbx run and sbx create to set individual environment variables or load them from files (following docker run precedence rules), including copying a value from the host by naming a variable without a value (requires v0.39.0+); sbx exec -e and sbx exec --env-file set variables for a single exec session without altering the sandbox's stored environment. Variables can be persisted across future sessions by appending exports to /etc/sandbox-persistent.sh, which is sourced when Bash starts inside the sandbox.

$ export API_URL=https://api.example.com
sbx run -e LOG_LEVEL=debug -e API_URL --env-file .env.sandbox claude

$ sbx exec -d my-project bash -c "echo 'export INTERNAL_API_URL=https://api.example.com' >> /etc/sandbox-persistent.sh"

$ sbx run --env-file .env -e MY_TOKEN=abc123 my-image

Adds an experimental --usb flag to sbx create (enabled via the DOCKER_SANDBOXES_FEATURE_SANDBOX_USB environment variable) to re-attach specified USB devices inside a sandbox via usbfs; supported on Linux x86_64/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. only.

$ DOCKER_SANDBOXES_FEATURE_SANDBOX_USB=1 sbx create --usb /dev/bus/usb/001/003 my-sandbox

Adds sbx prune to remove all stopped local sandboxes, with --dry-run to preview removals and --filter since=<duration> (e.g. since=168h) to exclude recently stopped sandboxes; a running sandbox is never removed.

$ sbx prune --dry-run --filter since=168h

Adds --provider ollama flag to sbx run (e.g. sbx run --model gemma4 --provider ollama claude) to use an existing Ollama installation instead of the default provider. This flag replaces the former ollama/ model-name prefix, which sbx run --model no longer accepts.

$ sbx run --model gemma4 --provider ollama claude

Adds sbx kit sign and sbx kit verify to sign and verify kits with cosign-compatible Sigstore signatures, with optional policy enforcement applied at load time.

Tines Stories now ships a first-party MCP server endpoint built into every tenant, letting AI clients such as ChatGPT, Codex, Cursor, Claude Code and Claude Desktop create and modify stories through natural-language instructions against the same story-authoring capabilities as the storyboard UI. This built-in server is distinct from custom MCP servers built inside Tines Stories for running production integrations, and both can be used simultaneously.

Workbench is a new AI chat interface that lets practitioners ask questions and take action in real time using Tines Stories-powered tools, keeping data private within the tenant. Tool configurations, chats, and custom instructions are scoped per user, who can enable credentials or stories they have access to, and individual template actions can be turned on for use inside Workbench; a built-in formula documentation tool answers questions about Tines Stories formula usage and construction. Workbench has also been extended into Workbench for Cases, integrating Cases with AI.

⤢ ⤢ ⤢

⤢

Tines Stories adds sample dashboard templates so practitioners can create a pre-built dashboard ready to rename or edit immediately, and adds dashboard Snapshots to email a copy of a dashboard on a configurable schedule, with control over recipients, frequency, and which charts to include — enabling recurring reports for stakeholders without Tines Stories access.

⤢ ⤢ ⤢

⤢

Tines Apps can now call built-in functions to read cases, records, and resources directly from your tenant, eliminating the need to create or call an endpoint — adding native support for Tines primitives inside Apps.

Adds Google Cloud Platform to the Iru Compliance connector catalog, enabling configuration and inventory evidence collection across Google Cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., Cloud Storage, Cloud KMS, and Cloud Logging. Connects to a Google Cloud project via a read-only service account and JSON key for scoped, least-privilege access.

Adds 209 pre-configuration templates for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. across commonly used web applications, including Slack, Zoom, and Google Workspace. Templates also cover SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user provisioning configuration, guiding identity administrators through the full setup process.

⤢

Trend Vision One now supports Application Control for macOS agents in Endpoint Security Policies, enabling the same allow/block application rules previously available for Windows and Linux agents, including Lockdown mode. It is configurable under Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies in the Vision One console.

A new Investigations dashboard, accessed via Investigations in the top navigation, shows a chronological timeline of SOC signals reviewed, actions taken, remediations applied, and final outcomes for both closed-benign and reported investigations. Investigations can be exported as CSV or Excel for compliance reporting or post-incident records via Investigations > locate the investigation > Export.

A new System Tools option under the Remote Tools button on Device Details opens Task Manager, Registry Editor, Device Manager, and Service Manager on managed Windows devices in a background session with no desktop takeover required. On macOS, System Tools surfaces Activity Monitor as the native equivalent of Task Manager for background process triage.

A new Auto-record all sessions setting on the Remote Tools Settings tab automatically begins recording every Remote Control session at the organization level, and a new Lock Recording setting prevents technicians from stopping a recording mid-session to support audit and compliance requirements.

Cribl Stream can now automatically enumerate log destinations (S3, CloudWatch, Firehose, and Firehose destinations) across multiple AWS accounts and regions without manual hunting or custom scripts. It generates CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates to provision a read-only AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets. role for discovery via AWS APIs, and produces CloudFormation configuration files deployable as a stack to onboard discovered sources into Cribl Stream; results indicate whether a source is already onboarded, and the feature supports both existing Cribl organizations and brand-new AWS environments or accounts.

Cribl Marketplace is a new central in-product hub within Cribl.Cloud (for cloud and hybrid leaders) for browsing, discovering, and one-click installing prebuilt apps from Cribl, partners, and community developers, replacing manual GitHub URL imports and endpoint configuration. The catalog can be filtered by solution type, publisher, product, tags, support model, certification status, and recency, and per-app detail pages show overview, permissions, external API access, files, support information, and version history before install. Cribl plans a standardized publisher process, automated readiness checks, security scanning, review workflows, publisher verification, and a dedicated public Marketplace URL for non-customers.

⤢

A new Suricata Rules AI Model can be paired with an AI Feed to continuously collect articles containing Suricata rules from 5,000 vetted CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. sources and repositories as new reporting is published, extract the rules, and make them exportable or pullable via API directly into detection pipelines, IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity., or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. tooling. Feedly Threat Intelligence now recognizes six detection rule formats across open-source reporting: Suricata, Snort, Sigma, YARA, Splunk, and KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly.-based Hunting Queries for Microsoft Defender and Sentinel, spanning network traffic inspection, file/malware matching, and log-based detection.

⤢ ⤢ ⤢ ⤢

Test runs now capture tenzir-node output from startup through teardown into node-stdout.log and node-stderr.log, exposed to tests via the TENZIR_NODE_STDOUT_LOG and TENZIR_NODE_STDERR_LOG environment variables. A new --keep flag retains these per-test log files in the scratch directory after a test run instead of deleting them.

$ tail "$TENZIR_NODE_STDERR_LOG"

Self-hosted runZero instances can force-disable any license entitlement instance-wide via RUNZERO_DISABLE_<ENTITLEMENT> environment variables, overriding the license for every account and organization. Supported variables include RUNZERO_DISABLE_AUTOSCAN, RUNZERO_DISABLE_AI, RUNZERO_DISABLE_PASSIVE_MONITORING, RUNZERO_DISABLE_API_ORG, RUNZERO_DISABLE_API_ACCOUNT, RUNZERO_DISABLE_DATA_RETENTION, RUNZERO_DISABLE_OFFLINE, RUNZERO_DISABLE_METAMIN, RUNZERO_DISABLE_FINDINGS, RUNZERO_DISABLE_ISSUES, RUNZERO_DISABLE_SUPPRESSION, RUNZERO_DISABLE_RISK_EVENTS, RUNZERO_DISABLE_RULES_BASIC, RUNZERO_DISABLE_REPORTS_BASIC, RUNZERO_DISABLE_REPORTS_ADVANCED, RUNZERO_DISABLE_CERTIFICATE_INVENTORY, and integration-specific variables such as RUNZERO_DISABLE_INT_CROWDSTRIKE, RUNZERO_DISABLE_INT_SENTINELONE, RUNZERO_DISABLE_INT_TENABLE, RUNZERO_DISABLE_INT_SPLUNK, RUNZERO_DISABLE_INT_SERVICENOW, RUNZERO_DISABLE_INT_QUALYS, RUNZERO_DISABLE_INT_INSIGHTVM, RUNZERO_DISABLE_INT_CLOUD, RUNZERO_DISABLE_INT_LDAP, RUNZERO_DISABLE_INT_AZURE_AD, RUNZERO_DISABLE_INT_INTUNE, RUNZERO_DISABLE_INT_WIZ, RUNZERO_DISABLE_INT_JIRA, RUNZERO_DISABLE_INT_PAN, and more.

$ RUNZERO_DISABLE_AUTOSCAN=true
RUNZERO_DISABLE_AI=true

$ RUNZERO_DISABLE_INT_CROWDSTRIKE=true
RUNZERO_DISABLE_INT_SENTINELONE=true
RUNZERO_DISABLE_INT_TENABLE=true
RUNZERO_DISABLE_INT_QUALYS=true
RUNZERO_DISABLE_INT_INSIGHTVM=true

Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files. Assets export as Device Inventory Info events and their observed services as Live Evidence Info events; fields without an OCSF equivalent are preserved under the event's unmapped object so no asset data is silently dropped. The export is accessible via the inventory export menu and the Export API, supporting both .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. and .json formats.

A new Qualys AI-Powered Patch Reliability Scoring feature predicts patch deployment success before rollout by combining LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-analyzed global public sentiment (technical discussions, release feedback) with Qualys telemetry on patch rollback rates and vulnerability reopen rates into a single reliability score.

⤢ ⤢ ⤢