Lacework FortiCNAPP

No entries match these filters. Clear filters

1. updated seen Nov 4, 2026 · issue 130

   Lacework FortiCNAPP adds Azure identity risk coverage for resource exposure, privilege passing, and credential exposure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2. updated seen Nov 3, 2026 · issue 129

   Lacework FortiCNAPP adds composite alert severity customization and Risk Insights in Public Preview⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Customize composite alerts by setting the severity level of each composite alert type individually, or turn off specific types entirely.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Risk Insights is now available in Public Preview.

   2 details in Everything

3. changelog Nov 1, 2026 · issue 127

   Lacework FortiCNAPP's intrusion graph now shows why entities in a composite alert are connected; Linux Agent 8.5.0 released October 22, 2026.

   • Lacework FortiCNAPP's intrusion graph now shows why entities in a composite alert are connected.
   • Linux Agent 8.5.0 is now available (released October 22, 2026).

   2 details in Everything

   • New supported platform Vulnerability assessment for Microsoft Azure Linux (CBL-Mariner)
4. updated seen Oct 31, 2026 · issue 126

   Lacework FortiCNAPP adds connection-reason visibility in intrusion graphs and an improved compliance evaluation engine⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Lacework FortiCNAPP's intrusion graph now shows why entities in a composite alert are connected, giving analysts direct context for relationships between flagged resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. updated seen Sep 30, 2026 · issue 090

   FortiCNAPP September 2026 snapshot adds graph-based anomaly alerts, click-to-filter alerts, and cloud account rollback history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Polygraph v2 graph-based anomaly alerts for visualizing and detecting anomalous behavior patterns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables click-to-filter alerts by category and sub-category for faster alert triage.
   • Adds cloud account rollback and deployment history tracking.

   3 details in Everything

6. updated seen Sep 26, 2026 · issue 086

   FortiCNAPP adds risk score adjustment for inline firewall protection, vulnerability assessment for COS and Ubuntu, and Polygraph v2 graph-based anomaly alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds risk score adjustment for inline FortiGate or other next-generation firewallnext-generation firewallA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. protection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds vulnerability assessment for Google Container-Optimized OS.
   • Adds vulnerability assessment for Ubuntu 25.04 through 26.10.
   • Adds click-to-filter alerts by category and sub-category.
   • Adds cloud account rollback and deployment history.

   +3 more show less

   • Adds resource group support for alerts.
   • Adds new AWS service coverage.
   • Adds on-demand container image scanning.
   • Adds risk score adjustment for inline FortiGate or other next-generation firewallnext-generation firewallA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. protection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds vulnerability assessment for Google Container-Optimized OS.
   • Adds click-to-filter alerts by category and sub-category.
   • Adds cloud account rollback and deployment history.
   • Adds on-demand container image scanning.

   3 more in Everything

7. Latest Platform Release Notes Sep 1, 2026 · release notes

   New Polygraph v2 alerts, Bedrock LQL policies for AI Security, and Windows SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. support in Lacework FortiCNAPP.

   └──▷ HOW TO FIND IT
   Filter alerts quickly by clicking category and sub-category links in the dashboard.
   📍Go to Alerts › Dashboard, then click the Category or Sub-category filter chips on any alert card.
   • Polygraph v2 graph-based anomaly alerts are now generally available.
   • Click-to-filter alerts by category and sub-category in the alert dashboard.
   • New detection: Anomalous cloud API discovery spikes for compromised AWS Keys.
   • Explorer gains natural language search capability alongside a redesigned Saved Queries panel.

   4 details in Everything

8. FortiCNAPP Release Updates seen Jul 13, 2026 · issue 014

   FortiCNAPP adds AI-generated incident reports, FortiGuard IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feeds, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. skills scanning, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves./GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. low-latency audit log alerts, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for Windows across recent releases.

   └──▷ TRY IT
   Use the AiAssistants API with alert context support to programmatically pull AI-generated triage context for a specific alert.
   copy

   $ curl -X POST 'https://<your-instance>.lacework.net/api/v2/AiAssistants' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"context": {"alertId": "<alert-id>"}}'

   Navigate to the Alert Dashboard to triage active threats filtered by severity or sub-category using the new interactive time chart.
   📍In the FortiCNAPP console, go to Alerts › Alert Dashboard, then use the severity, category, or sub-category filters and click a time-chart segment to drill into alerts for that period.
   Enable FortiGuard IoC feed integration to enrich detections with Fortinet threat intelligence.
   📍In the FortiCNAPP console, go to Settings › Integrations › Threat Intelligence and enable the FortiGuard IoC Feed integration.
   • New Alert Dashboard: View and filter alerts by severity, category, or sub-category with an interactive time chart.
   • Integrates FortiGuard IoC feed as a threat intelligence source for detections.
   • New Vulnerability Scanner 0.29.0 released with updated scanning capabilities.
   • Explorer adds natural language search and a redesigned Saved Queries panel.
   • Cloud activity log pages unified into a single view; AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and GCP/Azure cloud log pages redesigned.

   +28 more show less

   • AI-generated Incident Report and Remediation tabs added to alert details for composite alerts.
   • Low-latency EKS and GKE audit log violation policy evaluation and alerting now available.
   • Code Security gains advanced configuration settings, lock file generation, and LLM Skills Scanner (Public Preview).
   • SAST scanning support extended to Windows environments, including VS Code extension updates.
   • AiAssistants API adds alert context support for programmatic AI-assisted triage.
   • Vulnerability management now supports AlmaLinux and ChainGuard Wolfi images.
   • New detection: Anomalous cloud API discovery spikes for compromised AWS Keys.
   • CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. integrations now available directly in the FortiCNAPP console.
   • New Azure service coverage added across multiple releases.
   • New AWS service coverage added, including AWS Terraform, CloudFormation, and Control Tower configuration module upgrades.
   • Threat Observations Policies page introduced for managing observation-based policies.
   • Observation process attribution added to link runtime observations to specific processes.
   • AI Security: Bedrock LQL policies added for detecting risks in AWS Bedrock environments.
   • Agent support expanded for Kubernetes on cloud platforms.
   • Policy exceptions can now be configured for all codespaces.
   • Code Security Claude Code Plugin added (Public Preview) for IDE-native security feedback.
   • Unified CI/CD integration for GitHub covering both IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning.
   • Enhanced scanning configuration for PR and Git Status behaviors in Code Security.
   • AI-vendor secret detection added (Public Preview) to identify exposed AI provider credentials.
   • RiskWatch adds Runtime Vulnerability Detection and Prioritization.
   • Cursor IDE extension introduced for in-editor code security scanning.
   • Improved FortiGate integration surfaced in Explorer and Attack Path views.
   • Consolidated Subscription page simplifies entitlement management.
   • Alerts page gains inline details panel for faster triage without leaving the list view.
   • Detection intelligence enriched with Observation details on alert pages.
   • Policy aggregate status update provides rolled-up compliance posture at the policy level.
   • Enhanced timestamp precision added for CloudTrail logs.
   • Lacework ServiceNow integrations updated in the ServiceNow Store.

   33 details in Everything

9. FortiCNAPPRelease Updates seen Jul 13, 2026 · issue 014

   FortiCNAPP adds AI-generated incident reports, FortiGuard IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feeds, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Skills Scanner, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves./GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. low-latency audit alerting, and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. for Windows across recent releases.

   └──▷ HOW TO FIND IT
   Investigate a composite alert's AI-generated incident summary and recommended remediation steps without manual triage.
   📍In the FortiCNAPP console, navigate to Alerts › select a composite alert › open the Incident Report or Remediation tab to view AI-generated analysis.
   Query alert data using plain English instead of LQL to accelerate threat hunting in Explorer.
   📍In the FortiCNAPP console, go to Explorer › use the natural language search bar to enter a query such as 'show me all failed SSH logins in the last 24 hours', then save results via the redesigned Saved Queries panel.
   Retrieve AI-assisted alert context programmatically to enrich SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks or ticketing workflows.
   copy

   $ curl -X POST 'https://<instance>.lacework.net/api/v2/AiAssistants' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"type": "AlertContext", "alertId": "<alert_id>"}'

   • New Alert Dashboard lets practitioners view and filter alerts by severity, category, or sub-category.
   • Integrates FortiGuard IoC feed to enrich threat detection with Fortinet threat intelligence.
   • New Vulnerability Scanner 0.29.0 released with updated scanning capabilities.
   • Explorer adds natural language search and a redesigned Saved Queries panel for faster investigation.
   • Unified view for cloud activity log pages consolidates CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and other cloud log data.

   +38 more show less

   • AI-generated Incident Report and Remediation tabs added to composite alert details.
   • Low-latency EKS audit log violation policy evaluation and alerting now available.
   • Low-latency GKE audit log violation policy evaluation and alerting now available.
   • New Code Security LLM Skills Scanner (Public Preview) detects risks in AI/LLM skill definitions.
   • Code Security Claude Code Plugin (Public Preview) brings FortiCNAPP scanning into Claude Code workflows.
   • Vulnerability management now supports AlmaLinux and ChainGuard Wolfi images.
   • AI Security: Bedrock LQL policies enable detection of anomalous AWS Bedrock activity.
   • Threat Observations Policies page provides centralized management of observation-based policies.
   • Agent support extended to Kubernetes on cloud platforms.
   • SAST scanning support added for Windows environments.
   • Alerts page gains inline details panel for faster triage without leaving the list view.
   • AiAssistants API now supports alert context, enabling AI-assisted alert analysis via API.
   • Policy exceptions can now be configured for all codespaces.
   • VS Code extension updated with Windows SAST support and UI improvements.
   • Supports viewing non-default branch assessments in Code Security.
   • New detection: Anomalous cloud API discovery spikes for compromised AWS Keys.
   • CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. integrations now available directly in the FortiCNAPP console.
   • New Azure service coverage added across multiple releases.
   • New AWS service coverage added.
   • Interactive time chart added to the alert dashboard for timeline-based alert analysis.
   • Enhanced timestamp precision for CloudTrail logs improves forensic accuracy.
   • Detection intelligence expanded with Observation Details in alert context.
   • AI-vendor secret detection (Public Preview) identifies exposed API keys for AI services.
   • RiskWatch adds Runtime Vulnerability Detection and Prioritization.
   • Improved FortiGate integration in Explorer and Attack Path analysis.
   • Alerts dashboard updates with new visualization and filtering capabilities.
   • Consolidated Subscription page simplifies license and subscription management.
   • Advanced configuration settings for Code Security and CI/CD integrations.
   • Code security lock file generation added to secure dependency resolution.
   • Unified CI/CD integration documentation for GitHub IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself..
   • Observation process attribution links observed activity to specific processes.
   • Enhanced scanning configuration for PR and Git Status behaviors in Code Security.
   • Advanced configuration management for Code Security available in UI.
   • Redesigned GCP and Azure cloud log pages improve navigation and readability.
   • Redesigned AWS CloudTrail log page with improved layout.
   • Policy aggregate status update provides roll-up compliance visibility.
   • Lacework ServiceNow integrations updated in the ServiceNow Store.
   • Cursor IDE extension added for in-editor code security scanning.

   43 details in Everything