Exaforce

No entries match these filters. Clear filters

1. announced Oct 1, 2026 · issue 092

   Exaforce launches an agentic managed SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. service in Japan with autonomous Exabot AI agents for triage, investigation, automated response, and natural-language data querying.

   • New supported platformLaunches CTC-MSS AI SOC Service powered by Exaforce, a managed security service built on the Exaforce Agentic SOC platform and delivered by ITOCHU Techno-Solutions for enterprise customers in Japan.
   • Introduces Exabots — task-specific AI agents that autonomously handle detection, triage, investigation, and response, closing false positives with supporting evidence so only fully investigated, verified threats escalate to customer teams.
   • Enables automated response actions (such as resetting a password or revoking a session) configurable by ITOCHU Techno-Solutions per customer, rather than only sending notifications.
   • Provides natural-language investigation, allowing customer teams to query their own security data without learning complex query languages.
   • Operates the Exaforce real-time Data Platform as a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., correlating identity, device/asset, log, configuration, and metadata sources into a real-time context graph for AI agent use.

   +1 more show less

   • Delivers 24/7 autonomous investigation and containment, including overnight and weekend alert handling without queuing until the next business day.

   6 details in Everything

   • New integration SaaS platform detection coverage
2. From Raw Logs to Semantic Intelligence Sep 17, 2026 · release notes

   Exaforce introduces semantic data models for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., HTTP, EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., proxy, and firewall logs to enable context-rich detection.

   • Adds purpose-built semantic models for SaaS audit logs, normalizing events into a Principal-Action-Resource-Location-Result structure with curated sensitivity ratings.
   • Introduces automatic API endpoint discovery from HTTP access logs, normalizing unique URLs into canonical paths without manual configuration.
   • Adds automatic API contract learning for discovered endpoints to baseline request parameters, headers, and body types for deviation detection.
   • Adds a process-centric semantic model for EDR telemetry that captures parent process chains and typed resources (files, registry, scripts, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers).
   • Enables sub-principal labeling in SaaS models to distinguish human-driven actions from those executed by OAuth apps, API tokens, or service accounts.

   +3 more show less

   • Supports geo-IP enrichment on every event across all supported data models to resolve source and destination locations.
   • Adds specific semantic modeling for forward proxy logs (Zscaler, Cato, Netskope) capturing user-device-URL-proxy policy context.
   • Adds specific semantic modeling for network firewall/IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. logs correlating L4 flows with identity and threat categorization.

   8 details in Everything

3. announced Sep 15, 2026 · issue 079

   Exaforce AI Security adds agentless visibility, risk scoring, governance, threat detection, and an agent kill switch for AI agents and agentic apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds support for OpenAI, Gemini, and Microsoft Copilot model providers to the existing Claude Compliance API integration, giving teams cross-provider AI activity coverage on one platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a continuous, agentless inventory of AI apps connected to company accounts, coding agents (Claude Code, Cursor), hosted agents (custom GPTs), MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills, and IDE plugins, tied to the people and permissions behind them — with no new endpoint agent, browser extension, or gateway to deploy.
   • Adds visibility into chats and prompts classified as personal or business use to support adherence to usage policies.
   • Adds per-agent and per-skill risk scoring for every agent, skill, MCP server, and plugin, paired with a recommended fix, covering exposures such as excessive permissions and unvetted MCP servers.
   • Adds governance controls to define which AI apps, agents, and models are sanctioned and for whom, enforced through existing identity, endpoint, and model-provider controls.

   +4 more show less

   • Adds threat detection that correlates agent actions, agentic-app activity, and prompts with human identities, endpoint data, file access, and code context to detect misuse, sensitive-data exposure, and active threats — including chains of individually legitimate-looking actions.
   • Adds threat containment actions — session revocation, model-provider API key deactivation, device isolation, and an agent kill switch (ending an agent's process) — executed through existing EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., identity, and model-provider controls, with autonomy tunable per action from analyst-approved to fully autonomous.
   • Adds token-usage monitoring with anomaly detection to identify runaway AI token use, exploitation, or misuse across the organization.
   • Ingests EDR endpoint data, model-provider audit and usage logs, and productivity-suite activity into the Exaforce knowledge graphknowledge graphA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources. alongside existing identity, cloud, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and code data.
   • Adds support for OpenAI, Gemini, and Microsoft Copilot model providers to the existing Claude Compliance API integration, giving teams cross-provider AI activity coverage on one platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a continuous, agentless inventory of AI apps connected to company accounts, coding agents (Claude Code, Cursor), hosted agents (custom GPTs), MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, skills, and IDE plugins, tied to the people and permissions behind them — with no new endpoint agent, browser extension, or gateway to deploy.
   • Adds visibility into chats and prompts classified as personal or business use to support adherence to usage policies.
   • Adds per-agent and per-skill risk scoring for every agent, skill, MCP server, and plugin, paired with a recommended fix, covering exposures such as excessive permissions and unvetted MCP servers.
   • Adds governance controls to define which AI apps, agents, and models are sanctioned and for whom, enforced through existing identity, endpoint, and model-provider controls.

   +3 more show less

   • Adds threat detection that correlates agent actions, agentic-app activity, and prompts with human identities, endpoint data, file access, and code context to detect misuse, sensitive-data exposure, and active threats — including chains of individually legitimate-looking actions.
   • Adds threat containment actions — session revocation, model-provider API key deactivation, device isolation, and an agent kill switch (ending an agent's process) — executed through existing EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., identity, and model-provider controls, with autonomy tunable per action from analyst-approved to fully autonomous.
   • Adds token-usage monitoring with anomaly detection to identify runaway AI token use, exploitation, or misuse across the organization.

   1 more in Everything

4. Expanding beyond the SOC: Introducing Exaforce Agentless AI Security Sep 15, 2026 · release notes

   Exaforce introduces agentless AI Security with visibility into agentic apps, skills, and real-time threat detection.

   • Exabot Detect capabilities now include hooks for Cursor telemetry (pre-execution events) and exposed secrets in AI chats.
   • Continuous visibility and risk identification for endpoint agentic apps, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and IDE plugins via existing EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. data ingestion.
   • Detection of Shadow-AI OAuth apps with excessive scopes (e.g., write access to Google Workspace) and risky configuration changes to agent allow/deny lists.
   • AI & Agentic Insights dashboard providing aggregated findings on flagged skills, MCPs, chats with secrets, AI footprint, and anomalous token spend spikes.

   4 details in Everything

5. The Agentic SOC, Grounded in the Network Jul 22, 2026 · release notes

   Exaforce integrates ExtraHop RevealX 360 as a first-class source with automatic triage and Exabot Search for natural-language network queries

   • Adds integration between ExtraHop and Exaforce's Exabot Search, allowing network data queries in plain language without complex syntax.

   1 detail in Everything

6. Claude meets the SOC: Removing the AI blind spot Jun 12, 2026 · release notes

   Exaforce integrates with Claude Compliance API for AI identity, content sensitivity, and threat detection

   • Adds Claude Enterprise as a data source via the Claude Compliance API for inventory and identity context
   • Enables sensitive chat labeling for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., secrets, and regulated data to feed detections and access graphs
   • Expands the identity access graph traversal to include Claude organizations, projects, and resources

   3 details in Everything