https://cybertoolchain.io/tools/runreveal New releases and features in RunReveal, tracked by The Cyber Toolchain. en Sun, 31 May 2026 00:00:00 GMT https://runreveal.com/changelog#Product%20Newsletter%20-%20May%202026 https://runreveal.com/changelog#Product%20Newsletter%20-%20May%202026 Sun, 31 May 2026 00:00:00 GMT RunReveal adds federated S3 search, managed detections, agent metrics, and new data sources. • Adds `Federated object storage search` to query external S3 buckets alongside RunReveal data directly from the UI • Introduces Tier 1 managed detections with auto-triage enabled by default for high-signal findings • Makes agent metrics available including queue depth, usage, and error rate monitoring • Adds ability to disable or enable sources without deleting configuration • Enables configurable outbound webhook allowlist to restrict permitted destinations • Adds support for Anthropic compliance activity logs as a new source • Adds Keycloak support via webhook and object storage ingestion paths • Adds Datadog Audit Trail polling source for audit activity • Ingests CrowdStrike EDR alerts as event logs • Supports Zoom audit logs via webhook Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20April%202026 https://runreveal.com/changelog#Product%20Newsletter%20-%20April%202026 Tue, 28 Apr 2026 00:00:00 GMT RunReveal adds Kubernetes Helm deployment, auto-triage investigations, 8 new data sources, and per-source TTLs • Adds `Kubernetes single-tenant deployments` via Helm for EKS and GovCloud in self-hosted environments • Introduces `IOC lookup tool` to allow the investigation agent to pull external context during triage • Supports new data sources including Kandji, Wiz Sensor Detections, Google Workspace Alerts, Netskope, Airlock, Tenable, Prisma Access, and Salesforce EventLogFile • Adds `per-source TTLs` to set custom retention periods on a per-source basis for storage management • Enables auto-open investigations from detections to automatically create and open an investigation without manual triage • Incorporates detection notes into agent context so analyst-written notes inform automated analysis • Adds `Investigation classification` to mark investigations as true positive, false positive, or inconclusive • Tracks MTTD / MTTR metrics on the investigations overview page • Allows exporting investigation chat history as markdown for evidence and documentation • Provides a SQL query toggle in chat to view and audit agent queries with syntax highlighting • Introduces an `Agent task killswitch` for admins to clear agent task queues during noisy detections • Adds configurable key prefixes for S3, R2, and GCS destinations, including per-pipeline-step overrides • Adds GeoIP enrichment on audit events automatically • Adds Bootstrap API key for pre-login provisioning of on-prem deployments via API key • Makes Email and object storage optional dependencies for self-hosted deployment • Allows Microsoft OAuth URL override for configurable login URLs in sovereign cloud deployments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20February%202026 https://runreveal.com/changelog#Product%20Newsletter%20-%20February%202026 Sat, 28 Feb 2026 00:00:00 GMT RunReveal vFeb2026 adds agentic triage, async queries, SCIM via WorkOS, BYOS preview, and new data sources. • Adds agent templates including Alert Tuning and Data Volume Anomaly Detection for automated security operations. • Enables streaming AI chat responses in real-time for Anthropic, AWS Bedrock, and OpenAI backends. • Allows creating agents directly from detection rules or existing chat conversations. • Adds an Agent Widget on the homepage to display active agents, recent runs, and errors. • Enables AI Triage for Managed Detections with automatic Investigation creation. • Supports background execution of long-running queries via a dedicated work queue. • Adds the ability to cancel running queries from the query history page. • Displays all past queries, status, and execution times in the new Query History view. • Introduces SCIM Directory Sync via WorkOS for automatic user provisioning and group-based role mapping. • Logs all SCIM sync actions for compliance and troubleshooting. • Provides a Source Creation Wizard for Bring Your Own Source (BYOS) in preview. • Offers data preview with sample extraction to validate log parsing before schema commitment in BYOS. • Adds inline field mapping with AI-powered auto-suggestions for custom sources in BYOS. • Allows cloning managed detections into standalone, editable detections. • Adds PlanetScale as a supported data source for audit logs. • Adds ConductorOne as a supported data source for identity governance audit logs. • Adds Microsoft 365 as a supported data source for unified audit log polling. • Adds Cursor as a supported data source for AI coding environment audit logs. • Updates Salesforce Audit Trail integration with improved event monitoring. • Renders Mermaid diagrams inline within AI chat and investigations. • Buffers high-volume webhook dispatch through S3 for reliable delivery. • Exposes health check results as a system table for direct querying. • Displays pipeline step types inline in the configuration UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20Jan%202026 https://runreveal.com/changelog#Product%20Newsletter%20-%20Jan%202026 Tue, 27 Jan 2026 00:00:00 GMT RunReveal RBAC, Custom Views, JIT provisioning, health check thresholds, and new data sources • Adds Role-Based Access Control (RBAC) with separate management and data plane permissions assignable to users and API tokens. • Adds `Custom Views` allowing JSON log fields to be mapped to structured, queryable columns via dot notation paths. • Adds Just-In-Time (JIT) provisioning for SSO user accounts to eliminate manual invitations. • Adds multiple health checks per source with custom volume thresholds and notification frequency limits. • Adds keyboard shortcuts `Command + k` (Mac) and `Ctrl + k` (Windows) for rapid navigation. • Adds support for Duo Security, Fireblocks, GitHub Rulesets, and n8n as new data sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20Nov%20%2B%20Dec%202025%20-%20Slab https://runreveal.com/changelog#Product%20Newsletter%20-%20Nov%20%2B%20Dec%202025%20-%20Slab Wed, 10 Dec 2025 00:00:00 GMT RunReveal beta adds Investigations management, saved queries with AI, new Explorer UI controls, custom workspace logos, and 7 data sources. • Adds the `Investigations` feature in beta for full investigation management including status tracking (open, investigating, closed), severity levels, artifacts, and tagging • Adds a `Queries` section where users can save queries, share unique URLs, and use AI assistance for query writing or fixing • Adds column selector with decomposed results components to the Explorer UI • Adds a GroupBy dropdown for stacked histograms in the Explorer UI • Adds filter functionality to limit tables to enabled sources only • Adds column reset functionality in the Explorer UI • Adds support for sharable filter settings via URL parameters • Allows uploading a custom logo, accessible at `Settings > Workspace Settings > Workspace Logo` • Adds Workday as a new polling data source for activity logs • Adds HashiCorp Vault as a new source with audit log ingestion via object storage • Adds AWS Network Firewall as a new source with firewall logs via S3 • Adds Formal Security as a new source for data access logs • Adds Linear Webhook as a new source for audit log events • Adds Abnormal Security (polling) as a new alternative polling-based ingestion source • Adds SentinelOne Endpoint Logs as a new source with EDR logs via blob storage and GCS support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20October%202025%20-%20Slab https://runreveal.com/changelog#Product%20Newsletter%20-%20October%202025%20-%20Slab Sat, 25 Oct 2025 00:00:00 GMT RunReveal adds custom ClickHouse views, detection testing with 30-day log validation, and new data source integrations. • Adds support for creating reusable SQL views in the workspace to define complex data transformations once. • Enables testing and validating detections before saving them by scanning the last 30 days of logs for matches. • Adds FireHydrant as a supported data source connector. • Adds AWS WAF as a supported data source connector. • Adds Linear Audit Logs as a supported data source connector. • Adds SentinelOne Endpoint Logs (blob storage version) as a supported data source connector. • Enforces fine-grained role-based access controls across the UI for dashboards, notifications, destinations, enrichments, topics, and pipelines. • Adds AI chat cancellation to stop queries mid-execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20September%202025%20-%20Slab https://runreveal.com/changelog#Product%20Newsletter%20-%20September%202025%20-%20Slab Thu, 25 Sep 2025 00:00:00 GMT RunReveal introduces Dashboards, Scheduled Prompts, pipeline metrics, MITRE mapping, detection silencing, and BYO LLM support. • Adds `Dashboarding` feature to create visual security graphs integrated with the AI chat agent • Adds `AI Settings` on the `Settings` page and brain emoticon in RunReveal AI Chat to specify specific large language model versions via 'Bring your own LLM' • Adds `Scheduled prompts` to automate AI-powered reports delivered as markdown on custom intervals • Adds `pipeline metrics` tracking event throughput and drop rates for data processing visibility • Adds `MITRE techniques` mapping on detections to tag coverage with tactics and techniques • Adds 'Silence Detection' button to mute noisy detections for a specific time period Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#August%202025%20Changelog https://runreveal.com/changelog#August%202025%20Changelog Wed, 27 Aug 2025 00:00:00 GMT RunReveal adds custom AI prompts, bulk detection subscriptions, a redesigned alerts view with search, and PagerDuty audit log source support. • Adds `Custom Prompts` feature in the native AI chat to standardize security analysis workflows with reusable templates and dynamic arguments • Enables bulk subscription to detections by selecting multiple entries from the Detections UI table and clicking `+ Subscribe` • Adds PagerDuty audit log as a new data source under `Source → Add a New Connection` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#Product%20Newsletter%20-%20July%202025 https://runreveal.com/changelog#Product%20Newsletter%20-%20July%202025 Mon, 28 Jul 2025 00:00:00 GMT RunReveal adds Google Gemini and AWS Bedrock AI providers, chat sharing, and Slack, Opal, Wiz, S3 sources • Adds `Gemini API Key` configuration in workspace Settings under 'AI Model Providers' to enable Google Gemini support (uses Gemini 2.5 Pro). • Adds AWS Bedrock integration using IAM Role Authentication with external ID for enhanced security, defaulting to Claude 3.5 Sonnet. • Enables switching between configured LLM providers directly in the native AI chat interface. • Adds `Share Chat` > `Share to Workspace` action to share AI conversation links with other RunReveal users. • Adds Slack source integration for ingesting audit logs (requires Pro plan and Enterprise Grid subscription). • Adds Opal source integration for log ingestion and analysis. • Adds Wiz Threats source via webhook, writing alerts to the `wiz_threat_webhook_logs` table(s). • Adds S3 Access Logs source for monitoring bucket activity, writing data to the `s3_access_logs` table(s). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal https://runreveal.com/changelog#june%202025%20changelog https://runreveal.com/changelog#june%202025%20changelog Thu, 26 Jun 2025 00:00:00 GMT RunReveal adds native AI Chat (early access), Remote MCP Server, and four new log sources. • Adds the RunReveal Native Agent AI Chat feature to all customers in early access • Makes the RunReveal Remote MCP Server easier to configure by adding OAuth authentication • Adds support for Cloudflare Gateway Network Logs • Adds support for Cloudflare Gateway Access Logs • Adds support for BitWarden Logs • Adds support for Sophos Logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/runreveal