The Cyber Toolchain — issue 071, September 11, 2026

Bastille now identifies the unique wireless signatures of smart glasses within seconds of their entry into a monitored facility, and locates them to within one to three meters in real time across Wi-Fi, Bluetooth, and cellular frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Detections automatically alert security teams and feed into existing security systems with no new infrastructure required, delivered to existing customers via a subscription software update requiring no hardware changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The Captive Portal attack's DHCP backend is replaced, moving from isc-dhcp-server (dhcpd) to kea-dhcp4, with JSON-based config generation and AppArmor local override handling for the kea-dhcp4 profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Systems relying on isc-dhcp-server will need kea-dhcp4 installed and its AppArmor profile configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The DHCP lease file has moved to /var/lib/kea/kea-leases4.csv, and client IP/MAC/hostname lookup has been reworked against kea's CSV lease format. Tooling or scripts reading the old dhcpd lease file path will no longer find client lease data there.

Adds DREADNODE_TUI_THEME=light to switch the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. from its default dark palette to a light theme; /reload to reload the current agent without leaving a chat session; /transcript to toggle between compact and full agent transcript views; and /status to show the current session, model, user, org, workspace, and project at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The CLI adds a --mine flag to dn runtime ls to filter to runtimes you own (and marks non-owned runtimes in the default listing) and a provision alias for create in dreadnode env.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ /status

$ dn runtime ls --mine

Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.

$ curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/api/v1/tools | jq '.[].id'

Serves the SDK and CLI as self-contained offline bundles from self-hosted deployments (no PyPI or external host required) and serves documentation at /docs inside every deployment. Adds an air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access, plus a replicated.isAirgap=true Helm setting to stop the Replicated SDK pod reaching replicated.app.

$ helm upgrade --install dreadnode ./dreadnode-chart --set replicated.isAirgap=true

Runtime cold start was reduced by more than 60%, dropping time-to-ready from 18.8 s to 6.6 s, and dn runtime start and GET /runtimes/{id} now surface a full timing breakdown (total, platform overhead, provider provisioning, boot, installs, slowest step).

$ dn runtime start && curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/runtimes/<id> | jq '.timing'

Three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — are now available to all organizations, covering extraction, membership inference, evasion, and inversion attack types, and are provisionable by name via the SDK or TUI, including bare public task name resolution without an org prefix.

$ dreadnode env provision ml-extraction-fraud-tabular

Adds a caBundle config key for self-hosted deployments to inject a custom CA bundle into the Node frontend, completing CA trust support across all workloads (API, LiteLLM, and frontend); Helm charts also gain support for non-root container execution and custom CA bundle mounts for outbound TLS trust in private-CA environments.

caBundle: |
  -----BEGIN CERTIFICATE-----
  <your-internal-CA-cert>
  -----END CERTIFICATE-----

Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.

Adds environment-agnostic attack-success detection to the airt SDK, using canary exfiltration, OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.

Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OAST endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.

Expands postMessage handler detection in the web-security capability's DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. analysis to cover window.onmessage, MessagePort/MessageChannel, and monitoring-shim wrappers, plus additional origin-validation bypass patterns including unescaped-dot and missing-anchor regex bugs.

Adds bulk workspace member addition to select and add multiple members to a workspace at once from the workspace settings page; a bulk share-with-workspace action for multiple agent sessions via the floating action bar; and bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.

The workspace_mount runtime option is now a no-op; /home/user/workspace is ordinary sandbox-local storage, and object-storage access must go through the SDK instead.

Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., and sector-specific meshes to the task catalog under the airt-generative-ai set.

Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.

Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.

Adds signup IP allow-list mode letting admins restrict new account creation to explicitly approved IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges, with deny rules taking precedence over allow rules.

Adds two honeytoken tools to the ai-red-teaming capability: one to mint canary tokens (exfil or RCE variants) and one to check whether a target agent leaked them across an output boundary.

Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels, plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

Surfaces failed capability preflight checks (e.g. missing dnsx, katana) as explicit warnings in the agent system prompt and operator logs instead of silently proceeding.

Adds access sync for GitHub and Bitbucket teams, including Bitbucket Cloud workspace groups and Bitbucket Server project groups, mapping provider roles to 39 ZeroPath permissions across 10 groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Assistant Skills: reusable, administrator-authored methodology files covering triage, dependency reachability, report writing, and patch review that guide the Assistant's behavior. Four built-in skills ship forkable, and edits apply starting on the next run.

Adds Gerrit project scanning with both full scans and per-patch-set scanning of open changes; findings are posted as review messages directly on the patch set.

GitHub Actions adds cache-mode to control least-privilege access to the Actions cache at workflow and job level: job-level settings override workflow-level ones, and a called reusable workflow cannot receive more cache access than its caller granted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Setting cache-mode explicitly to write or write-only on low-trust events such as pull_request_target (where the default is read) now triggers a warning annotation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

on:
  pull_request:

permissions:
  contents: read

cache-mode: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
      - run: npm ci

on:
  push:
    branches: [main]

jobs:
  seed-cache:
    runs-on: ubuntu-latest
    cache-mode: write-only
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: dist/
          key: ${{ runner.os }}-dist-${{ github.sha }}
      - run: npm run build

New GET/PATCH endpoints on /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan let you read and update AI Scan for pull requests enablement at the organization or repository level, enabling programmatic at-scale rollout of AI-powered security detections without configuring each repo in the UI. In public preview.

$ curl -X PATCH \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  -d '{"enabled": true}' \
  https://api.github.com/repos/{owner}/{repo}/code-scanning/ai-scan

$ curl -X GET \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/orgs/{org}/code-scanning/ai-scan

A public-preview redesign of the repository PR listing page adds content assist to help find and apply filters, advanced search supporting AND/OR keywords and nested searches, a collapsible sidebar with quick-access filters like Authored by me and Involves me, a compact presentation mode to fit more PRs on screen, and richer per-PR context including status check counts, stack indicator, and unread-update indicators. Opt in via the Preview badge at the top of the pull requests tab, and switch back to the classic view the same way.

encryptedData keys can now be omitted from the unsealed Secret by setting the corresponding key to null in the SealedSecret template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds zap_list_resources, zap_read_resource, and zap_get_history tools to the MCP Integration add-on; zap_get_history supports body paging via body_offset and max_body_chars fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ zap_get_history body_offset=0 max_body_chars=2000

Adds a maxMessages option to the GraphQL Support, Import/Export (HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session.), OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. Support, Postman Support, and SOAP Support add-ons to cap the number of messages imported during testing, settable via the UI, the Automation Framework, or the API.

The AJAX Spider and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Active Scan Rule add-ons are removed from nightly and weekly Docker releases starting the week of 14 September 2026; existing Automation Framework and API jobs continue working, now backed by the Client Spider, while teams must install the add-ons manually from the Marketplace or switch to the Client Spider and OWASP PTK respectively.

New LLM Support add-on (v0.0.1) connects ZAP to Claude (Anthropic), Google Gemini, Azure OpenAI, Ollama, and OpenAI Compatible endpoints, adding a tabbed LLM Chat panel and integrating with the MCP Integration add-on.

⤢ ⤢

OAST Support no longer supports Interactsh servers older than v1.3.0 — interactions are now decrypted using AES-CTR (matching Interactsh server 1.3.0+), and AES-CFB used by older servers is no longer supported.

Adds Traffic Visibility Drop Alerting, now fully available to all customers, delivering health notifications via email, webhook integrations, API, or Syslog when significant drops in observed IPs, traffic bandwidth, or packet volume are detected, using ML-adapted thresholds per customer network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Automatically surfaces the probable process behind an NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. detection alongside the detection in the platform and via API, eliminating the need for custom SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. correlation logic.

A single Go 1.27 FIPS artifact built from cgr.dev/chainguard/go-openssl-fips:1.27 can be deployed to environments requiring different validated crypto modules without recompilation at deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ FROM cgr.dev/chainguard/go-openssl-fips:1.27

Adds --aws-connect-timeout and --aws-read-timeout CLI flags plus PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables to control per-call AWS API wait times for restricted-egress networks (VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoints, GovCloud, private deployments).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Lowers the default connect timeout from 60s to 10s while keeping the read timeout at 60s, and changes --aws-retries-max-attempts 0 to disable Boto3 retries entirely (a single attempt) instead of silently falling back to three attempts — automation relying on the old fallback will now only get one attempt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ prowler aws --region us-gov-west-1 --aws-connect-timeout 10 --aws-read-timeout 60 --aws-retries-max-attempts 0

$ prowler aws --region us-gov-west-1 --aws-connect-timeout 5 --aws-read-timeout 60 --aws-retries-max-attempts 0

Adds support for AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e, aws-iso-f), resolving regions and services from botocore endpoint metadata with no credentials or network access, so ISO regions such as us-isob-east-1 are accepted by --region and --excluded-region without a hand-edited aws_regions_by_service.json. Adds PROWLER_AWS_PARTITION to bootstrap STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. calls inside the configured partition's region, preventing routing failures and timeouts in air-gapped deployments such as GovCloud VPC-endpoint-only installs.

$ prowler aws --region us-isob-east-1

$ prowler aws --region us-isob-east-1

Honors TRIVY_CACHE_DIR in the Image provider so Trivy's vulnerability database is downloaded once and reused across scans; pairing it with TRIVY_SKIP_DB_UPDATE=true enables scanning images on hosts without internet access.

$ export TRIVY_CACHE_DIR=/mnt/trivy-db
export TRIVY_SKIP_DB_UPDATE=true
prowler image myregistry.internal/myapp:latest

Adds a compliance catalog integrity test that enforces unique requirement IDs, no duplicate check references within a requirement, and that every referenced check exists for its provider, spanning 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes, and Microsoft 365.

The CubeS3lvol S3 backend for cross-node pause/resume and snapshots, including on Kubernetes, must now be explicitly enabled via [cow.s3] enable = true or the ONE_CLICK_ENABLE_S3LVOL=1 environment variable; it is disabled by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Nodes that were relying on it without an explicit setting must add this config after upgrading, or the S3 volume will be disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

[cow.s3]
enable = true

A new top-level redis.db Helm config key applies to CubeMaster, CubeProxy, and CLM, letting multiple CubeSandbox clusters that share one Redis instance isolate logical databases per cluster.

redis:
  db: 2

The tpl delete subcommand in cubemastercli accepts multiple template IDs in a single batch deletion call.

CubeTemplateCenter splits template build, delete, and reclaim operations out of CubeMaster into an independently scalable, multi-replica service, persisting build artifacts to S3/MinIO (AWS S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. storage).

The CUBE_DATABASE_DRIVER variable selects MySQL or PostgreSQL, letting one-click deployments connect to a self-managed external database instance instead of the bundled default.

Same-bucket cross-node snapshot restore now uses object-storage server-side copy, with added snapshot cancellation and improved delayed-delete reclamation. A still-referenced snapshot can now be deleted immediately, with its underlying storage reclaimed once the last reference is released.

virtiofsd now rejects root-directory mutation operations and forged readdirplus requests once a directory whitelist is configured.

A free browser-based calculator at https://devicie.com/intune-roi-calculator lets IT teams compare their organization's Intune application estate against Devicie's managed catalog coverage, with no account or upload required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Users export their application list from the Microsoft Intune admin center, load it into the calculator, and review per-app coverage and estimated annual hours consumed by manual management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exclusion Windows can now independently suppress Policy Execution, Device Scans, or both, via a new Blocked Activities section on the Exclusion Window configuration page and matching API support for blocked activities / scope configuration payload parameters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ When a scan is suppressed, the Scan Result Tile shows a Scan Blocked status with a yellow warning shield and tooltip naming the active window, Device Activity Logs record a timestamped entry ('Scan was blocked due to exclusion window: [Window Name]'), the Connection Tile displays a yellow warning icon with Last scan was blocked text, and a warning confirmation modal appears if a manual scan is triggered via Device Details > Scan or the bulk Devices Table > Scan action while the window is active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢ ⤢

Adds the detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with the NIST AI Risk Management Framework, and adds an alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds from_microsoft_365_activity operator to collect unified audit records from Microsoft 365, handling Activity API subscriptions, backfills, continuous polling, pagination, retries, and snapshot-backed blob checkpoints; emits original audit fields alongside microsoft_365_activity source metadata including tenant_id, content_type, content_id, and content_created.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ from_microsoft_365_activity
  auth = {
    tenant_id: secret("m365-tenant-id")
    client_id: secret("m365-client-id")
    client_secret: secret("m365-client-secret")
  }
  content_types = ["Audit.General"]

The sigma operator now performs automatic OCSF matching: it recognizes OCSF-shaped schemas (a string metadata.version and an int64/uint64 class_uid), covering major SigmaHQSigmaHQAn open community repository on GitHub that maintains the Sigma generic signature format and its growing library of detection rules, giving cyber tools a vendor-neutral rule set they can convert to any SIEM query language. logsources including all Sysmon-backed Windows categories, Linux/macOS process creation, Windows Security/System/PowerShell/Defender channels, Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Azure activity logs, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GCP Cloud Audit Logs, and Zeek DNS/HTTP/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.; use mapping="direct" to opt out and match every rule field literally.

$ subscribe "ocsf"
| sigma path="sigma/rules" mapping="direct"

The from_clickhouse operator pushes where predicates, select field selections, and head limits down into the SQL SELECT sent to ClickHouse, supporting comparisons, null checks, in with literal lists, and and/or/not, falling back to local evaluation for unsupported types (function calls, time/ip comparisons, Enum/Decimal columns). It was then extended to push time values against Date, Date32, DateTime, and DateTime64 columns (including non-UTC time zones), ip values and subnet in against IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. columns, equality on enum names, UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and FixedString, ordering on strings, column-to-column comparisons, starts_with, ends_with, length_bytes, substring search, safe arithmetic, and literal expressions, plus field projections of nested fields (e.g. meta.level) so only the requested tuple element is fetched, and matching of ip literals against String-typed IP columns in table mode. Field projections and row limits are also pushed through branching operators and nested pipelines (if, match, fork, fork_merge, merge, parallel, group, window, every, load_balance, strict) and through field removal, batching, replacement, history, time shifting, enrichment, and OCSF processing transforms.

Adds a parallel option to to_splunk, to_opensearch, to_elasticsearch, and to_azure_log_analytics to send multiple HTTP requests in flight simultaneously, defaulting to the same value now adopted by to_google_secops; these four sinks are also made parallelizable so pipelines running with parallelism enabled replicate sink instances across workers.

$ to_splunk "https://splunk.example.org:8088"
  hec_token = secret("hec")
  parallel  = 8

Adds from_microsoft_defender operator to run arbitrary KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. queries against Microsoft Defender advanced hunting via Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs., with app-only Entra authentication and optional start/end timestamps.

$ from_microsoft_defender "DeviceEvents | take 10"
  azure_auth = {
    tenant_id: secret("AZURE_TENANT_ID")
    client_id: secret("AZURE_CLIENT_ID")
    client_secret: secret("AZURE_CLIENT_SECRET")
  }

Adds from_azure_log_analytics operator (experimental) to run KQL queries against Azure Log Analytics workspaces, supporting Entra app-only auth, optional time bounds, configurable query timeouts, and access to Microsoft Sentinel tables.

$ from_azure_log_analytics "SecurityEvent | project TimeGenerated, Computer, EventID"
  workspace_id = secret("azure-workspace-id")
  azure_auth = {
    tenant_id: secret("azure-tenant-id")
    client_id: secret("azure-client-id")
    client_secret: secret("azure-client-secret")
  }
  start = 2026-01-01
  end   = 2026-01-02

Parallelizes from_kafka and to_kafka when the pipeline is parallelized, while keeping sequential behavior for from_kafka with count, non-stored offset, or group.instance.id set, and for to_kafka with key.

Continuous Lakeflow pipelines now support maintenance window scheduling: you specify a day of the week, start hour, and time zone, and Databricks confines runtime upgrades and serverless infrastructure restarts to that one-hour window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Configurable via the Jobs UI, the Pipelines UI, or the Jobs REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Databricks-managed MCP connectors for Genie One are now GA for Google Drive, Gmail, Microsoft 365, Atlassian, and Slack. All connector tool calls are governed through Unity Catalog and Unity Gateway, enforcing built-in policies, approval requirements, and usage/audit logging, and require per-user individual authentication with OAuth tokens that are never shared across users.

Dashboard visuals and theming gain several additions: Include-style level of detail (LOD) expressions in YAML in the metric view editor; a Line shape control on line/area charts connecting points with linear, smooth, or stepped lines; an Apply to setting on the pivot table color scale to paint cell text as well as background; path map support for connecting ordered point sequences from separate longitude/latitude columns or a single point geometry column into GPS-track-style trajectories; and the ability to export a dashboard theme to a JSON file and import a theme JSON file into another dashboard for reuse.

Ask Genie on dashboards gains several context and insight features: suggested starter questions are now scoped to the current dashboard page and widget on published dashboards; Key Insights are generated per dashboard page with a New insights badge and a live-generating indicator; the Ask Genie input bar shows the selected chart as context so you can ask about a specific chart; Genie Code now prefers governed metric views over ad-hoc SQL datasets and reuses an existing metric view when building a dashboard; and the /importBI Genie Code command supports more parameterized calculations when importing Tableau reports.

⤢

Lakeflow Connect adds three new Beta connectors: Anaplan, which ingests audit trail events and user account records and can be enabled/disabled from the Previews page; Anysphere (Cursor) Organization, which ingests members and groups as daily snapshots and is toggled via Settings > Previews; and Celigo, which ingests integrator.io audit log events.

Genie One supports backend steering: you can send a steering message while a response is still generating (e.g. Focus only on Q3 data) to guide the output without waiting for it to finish or restarting the conversation.

Genie One adds memory confirmation prompts (Beta): the assistant detects facts worth remembering, surfaces a suggestion (e.g. 'Remember: your fiscal year starts in February — save this?'), and requires explicit approval, modification, or rejection before saving.

The Databricks Excel Add-in is now GA, connecting Microsoft Excel to a Databricks workspace to browse and import Unity Catalog tables and views, run SQL queries, build pivot tables, use custom functions, and write data back to Unity Catalog. Pivot tables also gain a Live query mode that refreshes results in real time as fields are updated.

External Secrets in Unity Catalog (Beta) links a Unity Catalog schema to AWS Secrets Manager so its secrets appear as read-only securable objects governed by Unity Catalog privileges, with values read from AWS Secrets Manager on demand.

Genie Agents now support up to 50 data sources (tables, views, or metric views) per agent, up from 30, and up to 200,000 stored conversations per agent, up from 10,000.