Sekoia.io

No entries match these filters. Clear filters

1. docs update Oct 4, 2026 · issue 094

   Sekoia.io launches Roy, a built-in AI assistant for writing SigmaSigmaAn open, vendor-neutral rule format for describing patterns in log data, maintained by the Sigma project community, giving cyber tools a shared detection language that converts into platform-specific queries. rules, building queries, and answering threat-intel questions in natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Ask Roy to draft a Sigma rule from plain language so you can iterate on detection logic without hand-writing YAML from scratch.
   📍1. Click the Roy button in the left-hand navigation menu to open the chat panel. 2. Type a prompt such as: 'Write a Sigma rule to detect PowerShell downloading a file from an external IP.' 3. Review the generated rule, then use the thumbs up/down icons to rate the response before copying it into your detection workflow.
   Translate a plain-English search into a Query Builder query on the Events page without leaving context.
   📍1. Click the Roy button in the left-hand navigation menu. 2. Type: 'Show me all failed authentication events for privileged accounts in the last 24 hours.' 3. Roy returns a Query Builder query you can copy directly into the Events page Query Builder.
   • Adds Roy, a built-in AI assistant accessible from the left-hand navigation menu, supporting natural-language queries across the platform without switching context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Roy can write and refine Sigma detection rules from a plain-language description.
   • Roy can build Query Builder queries from natural language.
   • Roy can explain complex event attribute fields directly in the Events page.
   • Roy can answer questions about platform features using the live documentation.

   +2 more show less

   • Roy can provide context on current threats using the Intelligence database.
   • Roy responds in English, French, and Polish.

   7 details in Everything

2. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds Elevate, an autonomous AI investigation agent (Roy) that verdicts every alert as TP/FP with a confidence score and audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable the Elevate autonomous triage agent for your workspace so every new alert is automatically investigated and verdicted without analyst intervention.
   📍In the Sekoia console, go to Settings › Subscriptions, verify the Elevate module is included, then follow Activate Elevate on a workspace to enable auto-analyze.
   • Introduces the Elevate AI investigation agent (Roy), which autonomously triages every incoming alert — assessing true positive vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ false positive, collecting and correlating evidence, enriching with threat intelligence, and producing a verdict with a confidence score and plain-language explanation.
   • Extends autonomous investigation to cases: assign a case to Roy and it produces a verdict, findings, and reasoning questions at the case level.
   • Generates one runbook per detection rule automatically, defining what the detection catches, likely false-positive scenarios, and the reasoning questions the agent works through.
   • Keeps all AI computation on Sekoia infrastructure with no data sent to external LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers, making Elevate suitable for regulated environments.

   4 details in Everything

3. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds guided intake health verification with event counters, delivery lag metrics, and intake monitoring notifications⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Set up an alert so you are notified immediately when a critical intake goes silent for more than 15 minutes.
   📍In Collect › Intakes, locate the intake card, click the notification menu and select the monitoring option. Set the inactivity threshold to 15 minutes, choose Slack as the delivery channel, and save the notification rule.
   Diagnose why a pull connector is receiving zero events by inspecting connector-side errors without leaving the platform.
   📍In Collect › Intakes, click the intake name to open its detail page, then select the Connector log tab and review error messages for authentication failures or source API connectivity issues.
   • Adds intake monitoring notifications configurable from the intake card, with selectable inactivity thresholds (15 minutes to 24 hours) and delivery channels (in-app, email, Slack, or Teams).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes an event delivery metric on the intake detail page showing average lag between source creation time and Sekoia receipt, to surface timezone misconfigurations, network latency, and ingestion bursts.
   • Adds a Connector log tab on the intake detail page for pull connectors, surfacing authentication failures and source API connectivity errors.
   • Intake cards now display three event counters — valid events, events in warning, and invalid events — filterable by 24-hour, 7-day, or 30-day time ranges.
   • Documents acceptable thresholds: warning events below 3% and invalid events below 1% of total events per intake.
   • Adds intake monitoring notifications configurable from the intake card, with selectable inactivity thresholds (15 minutes to 24 hours) and delivery channels (in-app, email, Slack, or Teams).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Exposes an event delivery metric on the intake detail page showing average lag between source creation time and Sekoia receipt, to surface timezone misconfigurations, network latency, and ingestion bursts.
   • Adds a Connector log tab on the intake detail page for pull connectors, surfacing authentication failures and source API connectivity errors.
   • Documents acceptable thresholds: warning events below 3% and invalid events below 1% of total events per intake.

   1 more in Everything

4. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds notification rules to push alerts via email, Slack, Teams, Mattermost, or webhook when workspace events fire.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Set up an intake-silence alert so your team is notified the moment a data source stops sending events.
   📍In Sekoia, go to Settings › Notifications tab › + New notification rule. Set Trigger to No events are received, select the specific community and intake to monitor, choose a delivery method (e.g. Slack webhook URL), then click Save.
   Route high-urgency production asset alerts to both email and Slack, with full event context in the email body.
   📍In Sekoia, go to Settings › Notifications tab › + New notification rule. Set Trigger to A new alert is raised. Under Conditions, add Urgency is greater than 80 and Asset name contains Production. Under Action to perform, add Email (enable Enrich email with contextual info) and Slack (paste incoming webhook URL). Click Save.
   Forward workspace events as JSON to an internal SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or automation platform using a generic HTTP endpoint.
   📍In Sekoia, go to Settings › Notifications tab › + New notification rule. Select the desired Trigger and optional Conditions. Under Action to perform, select Webhook and enter your HTTP endpoint URL. Click Save — Sekoia will POST a JSON payload to that URL on each matching event.
   • Adds notification rules with a Webhook delivery action that POSTs a JSON payload to any HTTP endpoint when a trigger fires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Enrich email with contextual info toggle on Email delivery actions to include event details in the message body.
   • Adds notification rules supporting Slack, Teams, and Mattermost delivery via incoming webhook URL.
   • Adds No events are received trigger for intake-silence monitoring, activating once a first event is received on the selected intake.
   • Adds in-app notification delivery channel that surfaces alerts in the Sekoia notification panel.

   +2 more show less

   • Adds a Conditions filter section on notification rules to narrow qualifying events and reduce noise.
   • Adds notification rules that monitor specific communities or all communities via the it concerns field.

   7 details in Everything

5. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds a personal notification system with per-event triggers, optional filters, and multi-channel delivery including Slack, Teams, and custom webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Set up a notification that posts to a Slack channel whenever a detection rule enters a rate-limited state, so your SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. team is immediately aware of throttled rules.
   📍In Sekoia.io, go to Notifications › Create a notification. Set Trigger to A detection rule entered rate-limited state, leave Conditions empty, set Action to Slack, and enter your incoming webhook URL. Set it concerns to the target community.
   Alert on silent intakes — send an email when an intake stops delivering events — useful for catching collector outages before they create coverage gaps.
   📍In Sekoia.io, go to Notifications › Create a notification. Set Trigger to No events are received, select the specific community and intake to monitor, and set Action to Email with the enriched option enabled.
   Forward all new alert notifications to an internal ticketing system by posting a JSON payload to a custom HTTP endpoint.
   📍In Sekoia.io, go to Notifications › Create a notification. Set Trigger to A new alert is raised, set Action to Custom webhook, and enter your ticketing system's HTTP endpoint URL to receive the JSON payload.
   • Adds a personal notification rule system where each user defines triggers, optional conditions, and delivery actions scoped to their own workspace view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports delivery via in-app notification panel, email (with an enriched contextual variant), Slack, Microsoft Teams, Mattermost, and a custom webhook JSON payload to any HTTP endpoint.
   • Provides alert-category triggers: new alert raised, alert updated, automated case created, automated case edited, and detection rule entering rate-limited (throttled) state.
   • Provides intelligence-category triggers: new rule added to the Rules Catalog, rule scheduled for deprecation, rule deprecated, and CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. report available.
   • Provides operations-category triggers: no events received from an intake for a defined period, playbook run error, and pull intake connector error.

   +1 more show less

   • Enforces a per-recipient email rate limit of 10 emails per hour for a single notification rule.

   6 details in Everything

6. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds Custom and Restricted role types with intake-scoped access control, configurable at Settings > Workspace > Roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Create a restricted role so an external SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analyst can only see alerts and events from a single endpoint intake, preventing access to other data streams.
   📍In Sekoia.io, go to Settings › Workspace › Roles, click + Role, select the Restricted option, choose the specific intake(s) to scope, and save. Then assign the role to the user at Settings › Workspace › Users.
   Create a custom role for an analyst who needs read/write access to alerts and cases but must not be able to modify detection rules or playbooks.
   📍In Sekoia.io, go to Settings › Workspace › Roles, click + Role, select only the Alerts and Cases permission groups (leaving Rules and Playbooks write permissions unselected), and save.
   • Adds Custom roles, created at Settings > Workspace > Roles via the + Role button, enabling fine-grained permission sets (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ analyst-level access without rule modification, or narrowly scoped API integration roles).
   • Adds Restricted roles, created at Settings > Workspace > Roles with the Restricted option, limiting a user's event and alert visibility to specific intakes.
   • Adds Intake-restricted roles, a read-only variant of Restricted roles scoped to one or more specific data sources for users or external systems.
   • Supports assigning multiple simultaneous roles to a single user, with effective permissions computed as the union of all assigned roles, managed at Settings > Workspace > Users.
   • Documents three built-in roles — Guest (read-only), Analyst (read/write SOC operations), and Admin (full community management including SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., 2FA reset, API key management, and subscription settings).

   5 details in Everything

7. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds documented user management flows including role editing, deactivation, reactivation, and automatic 90-day inactive-account enforcement for PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly./DSS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable automatic 90-day inactive account deactivation to meet PCI/DSS requirements without manual auditing.
   📍In the Sekoia.io console, go to Settings › Workspace › Workspace Security, find the Deactivate inactive accounts section, enable the toggle, and confirm.
   Quickly audit all suspended accounts after an offboarding wave by filtering the user list to show only inactive users.
   📍In the Sekoia.io console, go to Settings › Workspace › Users, open the Filter by Status dropdown, and select Deactivated to list only inactive accounts.
   Grant a user a second role to expand their permissions without removing their existing role.
   📍In the Sekoia.io console, go to Settings › Workspace › Users, click the user's name, then in the Roles section click Add role, select the additional role, and save your changes.
   • Enables automatic deactivation of accounts inactive for 90 days (PCI/DSS compliance) via the Deactivate inactive accounts toggle at Settings > Workspace > Workspace Security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports filtering the user list by active or deactivated status using the Filter by Status dropdown at Settings > Workspace > Users.
   • Allows assigning or removing multiple roles per user simultaneously from the Roles section of a user's detail page, with effective permissions being the union of all assigned roles.
   • Adds a time-gated reactivation flow: reactivated users must log in at least once before midnight on the same day or their account is automatically deactivated again.
   • Supports deactivating a user account (suspending access without deleting data) from either the user list or the user detail page via Deactivate / Deactivate account.

   +1 more show less

   • Supports permanent user deletion via Delete user on the user detail page, removing all community memberships and assigned roles.

   6 details in Everything

8. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds automatic user creation on first SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login and a Re-send invitation control for pending users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Automatically provision accounts for Okta SSO users on first login, eliminating manual invite overhead for large teams.
   📍In the Sekoia console, go to Settings › Workspace › Security › SSO and enable Automatic user creation, then set the default role to assign to new accounts.
   • Enables Automatic user creation under Settings > Workspace > Security > SSO to provision accounts on first Okta SSO login, with a configurable default role — no manual invitation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Re-send invitation button to re-trigger the password setup email for users who did not click the original 24-hour link.
   • Scopes invited users in multi-tenant workspaces to only the specific communities selected at invitation time, with no access to other communities or the workspace as a whole.
   • Enables Automatic user creation under Settings > Workspace > Security > SSO to provision accounts on first Okta SSO login, with a configurable default role — no manual invitation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Re-send invitation button to re-trigger the password setup email for users who did not click the original 24-hour link.

   1 more in Everything

9. docs update Oct 4, 2026 · issue 094

   Sekoia.io adds persistent UI customization: pin favorite pages, reorder menu sections, and configure per-page table columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Surface triage-relevant columns (urgency, entity, rule name, asset) on the Alerts page so analysts see what matters without scrolling.
   📍1. Navigate to the Alerts page. 2. Click the columns icon at the top of the table. 3. Select columns such as urgency, entity, rule name, and asset; deselect any you don't need. 4. Drag columns into your preferred order. 5. Configuration is saved automatically per page.
   Set a preferred MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. method so the correct authenticator is presented first at every login, reducing friction for accounts with both an authenticator app and backup codes configured.
   📍1. Click your name at the bottom of the navigation menu. 2. Select Profile and security. 3. In the authentication section, select your preferred authentication method (authenticator app or backup codes).
   • Adds per-page table column customization on Alerts, Rules Catalog, and Intakes pages — choose which columns are visible, hide others, and drag to reorder; configuration is saved per page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ability to pin pages to favorites via a star icon in the navigation menu, persisting the pinned order across sessions.
   • Adds drag-and-drop reordering of navigation menu sections to match individual workflow order.
   • Adds preferred authentication method selection under Profile and security, letting users with multiple methods (authenticator app and backup codes) choose which Sekoia presents first at login.

   4 details in Everything

10. docs update Oct 4, 2026 · issue 094

    Introductory documentation page describing the Sekoia platform, its Defend (XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss.) and Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) products, Reveal and Elevate add-on modules, and the Roy AI assistant.

    • New detectionSekoia Defend is an XDR product covering log collection, real-time detection, alert triage, playbook automation, and dashboards.
    • Sekoia Intelligence is a CTI product providing access to a threat database of actors, malware families, campaigns, indicators, and analytical reports, with direct integration into Defend alerts and detection rules.
    • The Reveal add-on module adds a unified asset inventory enriched with vulnerability data, endpoint hygiene signals, behavioral anomalies, and attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visualization inside alert and case investigation workflows.
    • The Elevate add-on module adds AI-powered autonomous alert triage, verdict generation, and runbook step execution to reduce repetitive analyst work.
    • Roy, the built-in AI assistant, can explain event fields in natural language, generate Sigma detection rules from a description, build search queries using plain language, and surface platform documentation in-context.

    5 details in Everything

11. 📡 New SOL functions - CIDR, Split, Base64 Sep 10, 2026 · release notes

    Sekoia Defend introduces new SOL functions (cidr_match, split, base64_encode/decode) and a flexible lookup operator

    • cidr_match() function added to check if an IPv4 address belongs to a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range
    • split() function added to split strings on a delimiter with optional index selection
    • base64_encode() function added to encode strings as Base64
    • base64_decode() function added to decode Base64 strings with optional character encoding
    • lookup operator now accepts any condition, not just column equality

    5 details in Everything

12. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a native playbook integration to push CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. into Palo Alto XSIAM Collections via the indicators/insert_jsons API

    └──▷ USE IT
    Configure the XSIAM push playbook to pull the last week of IOCs from a specific Sekoia feed and send them to your XSIAM tenant — paste this into Node 2's request body after setting your region, API key, and API ID.
    json copy

    {
      "Method": "POST",
      "URL": "https://<your-region>.xdr.fa.paloaltonetworks.com/public_api/v1/indicators/insert_jsons",
      "Headers": {
        "Accept": "application/json",
        "Content-Type": "application/json",
        "Authorization": "<REPLACE_WITH_API_KEY>",
        "x-xdr-auth-id": "<REPLACE_WITH_API_ID>"
      },
      "JSON payload": {
        "request_data": "{{ node.1.data }}",
        "validate": true
      },
      "fail_on_http_error": true,
      "verify_ssl": true
    }

    Override severity and reliability mappings in Node 1 to force all indicators to LOW severity and a custom 3-band reliability scale, without modifying the built-in STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-to-XSIAM transform logic.
    yaml copy

    severity_mapping: LOW
    reliability_mapping: |
      75-100: A
      50-74: B
      0-49: C
    stix_objects_path: "{{ node.0.stix_objects_path }}"
    class_override: "{id}"
    comment: "Valid from {valid_from} AND STIX Pattern: {pattern}"

    Set up the CTI Feed Consumption trigger (Node 0) to bootstrap with one week of history and resolve source references, scoped to a specific feed ID.
    yaml copy

    Batch Size Limit: 200
    Feed ID: <your-sekoia-feed-id>
    Modified After: 2025-06-05T00:00:00.00Z
    Resolve Sources: true

    • New Push Sekoia.io IOCs to Palo Alto XSIAM Collection playbook template automates ingestion of STIX IOCs from a Sekoia CTI feed into a Palo Alto XSIAM Collection via POST /public_api/v1/indicators/insert_jsons.
    • New CTI Feed Consumption module (Node 0) pulls STIX objects from a custom feed with configurable Batch Size Limit, Feed ID, Modified After (RFC-3339 timestamp), and Resolve Sources parameters, outputting results at {{ node.0.stix_objects_path }}.
    • New Transform Sekoia STIX to XSIAM module (Node 1) converts STIX patterns into XSIAM-ready JSON with overridable class_override, comment, severity_mapping, reliability_mapping, and stix_objects_path parameters, mapping observable types (file → HASH, filename → FILENAME, directory → PATH, domain-name → DOMAIN_NAME, ipv4-addr → IP) and confidence scores to XSIAM severity (LOW/MEDIUM/HIGH/INFO) and reliability (A–E) bands.
    • New Send batch to XSIAM module (Node 2) POSTs transformed IOCs to XSIAM using x-xdr-auth-id and Authorization headers, with fail_on_http_error and verify_ssl options.
    • Supports Directory, Domain name, File, Filename, and IPv4 address observable types in the custom feed; URL observables are explicitly unsupported by XSIAM DOMAIN_NAME type and are omitted.

    5 details in Everything

13. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a Palo Alto Cortex XSOAR integration via the SEKOIAIntelligenceCenter marketplace pack

    └──▷ TRY IT
    Look up a suspicious email address against Sekoia.io InThreat directly from a Cortex XSOAR War Room or playbook task.
    copy

    $ !GetObservable value="eicar@sekoia.io" type="email-addr"

    Install and authenticate the SEKOIAIntelligenceCenter pack in Cortex XSOAR so analysts can query Sekoia.io threat intel without leaving the XSOAR console.
    📍In Cortex XSOAR, go to Marketplace and search for sekoia. Select the SEKOIAIntelligenceCenter pack and click Install. Then navigate to Settings › Integrations › SEKOIAIntelligenceCenter, click Add instance, paste your Sekoia.io XDR API key (scoped to INTHREAT_READ_OBJECTS), save, and click Test to confirm a green result.
    • Exposes the !GetObservable XSOAR command to query Sekoia.io InThreat objects by value and type (e.g. value="eicar@sekoia.io" type="email-addr") from within Cortex XSOAR.
    • Requires a Sekoia.io XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. API key scoped to the INTHREAT_READ_OBJECTS permission (8d9901dc-0508-4472-b3c1-5ad5efc96032) to authenticate the integration.

    2 details in Everything

14. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. app with three CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. API actions: Get Indicator, Get Indicator Context, and Get Observable.

    └──▷ HOW TO FIND IT
    Install the Sekoia.io app in Splunk SOAR when it is not visible in the unconfigured apps list.
    📍1. Search for sekoia in the Splunk Marketplace and download the app as a tar file. 2. In your Splunk SOAR instance, go to Apps › Install App. 3. Upload the downloaded tar file. 4. Configure the app with an API key that has the INTHREAT_READ_OBJECTS permission.
15. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a native Splunk app that syncs CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. feed IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. nightly and enables lookup-table threat matching in Splunk searches.

    └──▷ HOW TO FIND IT
    Install the Sekoia.io app from Splunk and wire it to your CTI feed using a scoped API key and an optional custom feed ID.
    📍Apps › Find more Apps › search Sekoia.io › Install Configure fields: SEKOIA.IO API Key: <your_api_key> Sekoia API url: https://api.sekoia.io Feed ID: <your_custom_feed_id> # optional; omit to use default feed Proxy URL: http://username:password@host:port # optional
    • Adds | inputlookup sekoia_iocs_url | rename _key as indicator | convert ctime(valid_until) SPL query to search existing Sekoia IOCs with expiry dates inside Splunk.
    • Supports HTTP_PROXY and HTTPS_PROXY environment variables so the Sekoia Splunk app inherits the global Splunk proxy configuration without a separate proxy entry.
    • Adds a native Sekoia.io app for Splunk (Enterprise on-prem and Splunk Cloud) that pulls IOCs from the Sekoia CTI feed and populates a Splunk lookup table, updated on a nightly schedule.
    • Supports six IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. types in Splunk — domain, url, ipv4, md5, sha1, and sha256 — downloaded from the Sekoia CTI feed.
    • Accepts an optional Feed ID configuration field to pull from a custom Sekoia feed instead of the default feed.

    +2 more show less

    • Accepts an optional Proxy URL field on the installation page to route Sekoia app traffic through a dedicated proxy (format: http://[username:password@]host:port).
    • Requires an API key scoped to CTI > View feeds, CTI > View intelligence, CTI > View labels, CTI > View observables, and CTI > View graph explorations permissions (replacing the deprecated Intelligence Center - Read Only role).

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Intelligence Center - Read Only role is deprecated and renamed to Analyst Role; API keys previously documented as requiring that role must now be configured with the individual CTI > View feeds, CTI > View intelligence, CTI > View labels, CTI > View observables, and CTI > View graph explorations permissions.
16. docs update Sep 9, 2026 · issue 069

    New OpenCTI Sekoia.io Intel Stream Connector syncs OpenCTI indicators to Sekoia.io IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. collections in real time

    • Supports bidirectional operations: indicator creation and revocation in Sekoia.io IOC collections triggered by deletion events in OpenCTI.
    • Supports multiple connector instances, allowing one stream-to-collection pair per instance with OpenCTI stream filters controlling which indicators reach each collection.
    • Requires Python 3.11.x (not compatible with 3.12+), OpenCTI Platform 6.8.x or higher, pycti 6.8.x or higher, and a Sekoia.io API key with IoC Collections permissions.

    3 details in Everything

17. docs update Sep 9, 2026 · issue 069

    Sekoia.io threat intelligence can now be pushed to Microsoft Sentinel via a TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. feed connector.

    └──▷ HOW TO FIND IT
    Configure the Microsoft Sentinel TAXII data connector to pull Sekoia.io threat intelligence hourly into Sentinel's Threat Intelligence section.
    📍In the Microsoft Sentinel interface in Microsoft Azure: 1. Go to Configuration › Data connectors. 2. Search for TAXII and select Threat intelligence - TAXII. 3. Click Open connector page and fill in the form: - Friendly name: Sekoia.io - API Root URL: https://app.sekoia.io/api/v2/inthreat/taxii-server - Collection ID: <your Sekoia.io feed identifier> - Username: username - Password: <your Sekoia.io API key> - Import indicators: All available - Polling Frequency: Once an hour 4. Click Add.
    • Adds a Microsoft Sentinel integration that connects Sekoia.io CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. to Sentinel using the Threat intelligence - TAXII connector at API root https://app.sekoia.io/api/v2/inthreat/taxii-server.
    • Supports configuring the TAXII feed to export only CTI indicators in JSON format for ingestion into Sentinel's Threat Intelligence section.
    • Enables authentication to the TAXII server using a Sekoia.io API key (with the Intelligence Center Read-Only role) as the password field in the Sentinel connector form.

    3 details in Everything

18. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a MISP IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. Attributes to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Collection trigger that auto-imports MISP to_ids-flagged indicators into Sekoia IOC Collections for detection.

    • Adds the MISP IDS Attributes to IOC Collection playbook trigger that periodically polls a MISP instance for attributes with the to_ids flag enabled and pushes them to a Sekoia.io IOC Collection.
    • Supports MISP attribute types ip-dst, domain, url, sha256, md5, and sha1, mapping each to the corresponding Sekoia IOC field (ipv4-addr.value, domain-name.value, url.value, file.hashes.SHA-256, file.hashes.MD5, file.hashes.SHA-1).
    • Trigger configuration accepts IOC Collection UUID, IOC Collection Server, Published Timestamp (look-back window in days), and Sleep Time (polling interval, default 5 minutes) to control import behaviour.
    • Supports Http Proxy and Https Proxy account parameters to route MISP API calls through a proxy in private-region deployments.
    • Batches outbound IOC writes to Sekoia in groups of up to 1,000 per request and deduplicates previously processed attributes via an internal cache.

    5 details in Everything

19. docs update Sep 9, 2026 · issue 069

    Sekoia.io exposes its default intelligence feed as a MISPMISPAn open-source threat intelligence platform maintained by CIRCL and the MISP Project for sharing, storing, and correlating indicators of compromise across organizations and cyber tools. feed via a new API endpoint, consumable by any MISP instance.

    └──▷ TRY IT
    Verify connectivity to the Sekoia.io MISP feed manifest before wiring it into a MISP instance.
    copy

    $ curl -s -H 'Authorization: Bearer <APIKEY>' https://api.sekoia.io/v1/misp-gateway/misp/manifest.json

    Add the Sekoia.io MISP feed to an existing MISP instance with the correct field values.
    📍Input Source: Network URL: https://api.sekoia.io/v1/misp-gateway/misp Source Format: MISP Feed Headers: Authorization: Bearer <APIKEY> Enabled: True
    • Adds a MISP feed endpoint at https://api.sekoia.io/v1/misp-gateway/misp (manifest at /manifest.json) serving all non-expired Sekoia.io intelligence, kept in sync so indicators are updated rather than duplicated.
    • Requires an API key with the INTHREAT_READ_OBJECTS permission, passed as an Authorization: Bearer <APIKEY> header, with MISP input source set to Network and source format MISP Feed.

    2 details in Everything

20. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a Cortex analyzer integration to enrich TheHive with CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. indicators, context, and observables.

    └──▷ HOW TO FIND IT
    Enable all three Sekoia.io Cortex analyzers so TheHive analysts can enrich observables with Sekoia CTI without leaving the platform.
    📍1. In Cortex, select your Organization (top-right corner). 2. Go to Analyzers Config tab and search for SekoiaIntelligenceCenter. 3. Edit the entry: set your Sekoia API key and Base URL (leave Base URL empty if hosted on FRA1 region). 4. Go to the Analyzers tab, search SekoiaIntelligenceCenter, and enable all three: SEKOIAIntelligenceCenter_Indicators_1_0, SEKOIAIntelligenceCenter_Context_1_0, SEKOIAIntelligenceCenter_Observables_1_0.
    • Enables Sekoia.io CTI data (indicators, context, observables) to be searched and retrieved directly from a self-managed Cortex instance by configuring a Sekoia API key with the View intelligence permission under the SekoiaIntelligenceCenter Analyzers Config entry.

    1 detail in Everything

21. docs update Sep 9, 2026 · issue 069

    Sekoia.io Intelligence Center now exposes a TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. server with HTTP Basic Authentication and cursor-based pagination.

    └──▷ TRY IT
    Pull the first page of STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. objects from a specific Intelligence Center feed collection using curl.
    copy

    $ curl -u api:<YOUR_APIKEY> \
      -H 'Accept: application/taxii+json' \
      'https://app.sekoia.io/api/v2/inthreat/taxii-server/collections/d6092c37-d8d7-45c3-8aff-c4dc26030608/objects?match[spec_version]=2.1&limit=100'

    Discover available API roots and collections on the TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. server before configuring a downstream threat-intel platform.
    copy

    $ curl -u api:<YOUR_APIKEY> \
      -H 'Accept: application/taxii+json' \
      'https://app.sekoia.io/api/v2/inthreat/taxii-server/taxii2'

    • Exposes a TAXII 2.1 server with discovery endpoint at https://app.sekoia.io/api/v2/inthreat/taxii-server/taxii2 and API root at https://app.sekoia.io/api/v2/inthreat/taxii-server, enabling any TAXII-compatible platform to consume Intelligence Center feeds.
    • Authenticates to the TAXII server via HTTP Basic Authentication using the Intelligence Center API key as the password, with any string accepted as the username.
    • Supports cursor-based pagination via the next parameter and match[spec_version] filter on collection object endpoints (e.g. /collections/<id>/objects) to iterate incrementally over STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 objects.

    3 details in Everything

22. docs update Sep 9, 2026 · issue 069

    Sekoia.io Intelligence Center API docs surface feed consumption, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lookup, and object context endpoints at https://api.sekoia.io/v2/inthreat/

    └──▷ TRY IT
    Pull only indicators added or updated in the last 30 days from the default feed, skipping years of historical data.
    copy

    $ curl -H 'Authorization: Bearer <APIKEY>' 'https://api.sekoia.io/v2/inthreat/collections/d6092c37-d8d7-45c3-8aff-c4dc26030608/objects?limit=2000&match[type]=indicator&modified_after=2024-01-01T00:00:00.000Z'

    Enrich a matched IP IOC at detection time by fetching its full context bundle, including relationships and mitigations.
    copy

    $ curl -H 'Authorization: Bearer <APIKEY>' 'https://api.sekoia.io/v2/inthreat/indicators/context?type=ipv4-addr&value=198.51.100.42'

    Page through an entire feed incrementally, persisting the cursor so only new or changed objects are fetched on each run.
    copy

    $ curl -H 'Authorization: Bearer <APIKEY>' 'https://api.sekoia.io/v2/inthreat/collections/d6092c37-d8d7-45c3-8aff-c4dc26030608/objects?limit=2000&cursor=<next_cursor>'

    • Adds GET v2/inthreat/collections/{feed_id}/objects endpoint to consume CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. feed objects, returning up to 2000 STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. objects per request via the limit parameter and paginating with the cursor parameter.
    • Adds modified_after parameter to GET v2/inthreat/collections/{feed_id}/objects to filter intelligence entries created or modified after a specified ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 timestamp, avoiding full-feed re-download.
    • Adds match[type] parameter to GET v2/inthreat/collections/{feed_id}/objects for filtering returned objects by a comma-separated list of STIX types (e.g. indicator).
    • Adds GET v2/inthreat/objects/{object_id} endpoint to fetch a specific STIX object by ID, and GET v2/inthreat/relationships/{relationship_id} for relationship objects.
    • Adds GET v2/inthreat/objects/{indicator_id}/context endpoint returning a STIX bundle with the indicator, first-level relationships, related objects, Course-Of-Action objects, and referenced sources.

    +5 more show less

    • Adds GET v2/inthreat/indicators/context endpoint to look up a specific IOC by type and value parameters and retrieve its full context bundle.
    • Adds POST v2/inthreat/feeds endpoint to create feed configurations programmatically, returning a feed id for subsequent consumption.
    • Supports four feed output formats: JSON (default), CSV (configurable attributes), Text (one observable per line), and Custom (template strings using $name-style variables).
    • Provides a default feed with ID d6092c37-d8d7-45c3-8aff-c4dc26030608 available to all communities with no filter configuration required.
    • Supports incremental feed updates by reusing the last next_cursor value returned by the objects endpoint, with the cursor located in the Cursor HTTP header for non-JSON feed formats.

    10 details in Everything

23. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds Threat Landscape hub with real-time malware, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. technique, and adversary trend dashboards

    └──▷ HOW TO FIND IT
    Quickly identify threat actors that spiked in activity in the last week and pivot to related alerts observed in your own network.
    📍In Sekoia.io, navigate to CTI › Threat Landscape. Set the global time filter to 7 days. In the Adversary Activity Trend widget, look for actors highlighted in green (rising activity). Then open Prevalence trends: Top 5 MITRE techniques and click the warning icon next to any technique to pivot into the alert details for your network.
    Review the latest finished intelligence reports and jump directly to their associated indicators when triaging a new campaign.
    📍In Sekoia.io, navigate to CTI › Threat Landscape. In the Latest FLINT reports section, click the relevant report, then select Associated IoCs to open the filtered indicator list (Intelligence subscription required).
    • Adds the Threat Landscape dashboard — a centralised hub showing real-time trends on cyber threats and adversary activities, driven by global XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. telemetry and the TDR team's analysis.
    • Includes a global time filter (default: last 30 days) at the top of the Threat Landscape page, letting users narrow all trend-type widgets to a custom time frame.
    • Adds a Latest FLINT reports section giving quick access to finished intelligence reports published by the TDR team, with direct pivot to associated IoCs (requires Intelligence subscription).
    • Adds Trending threat entities widgets — manually curated by the TDR team — covering Trending Malware, Trending Campaign, Trending Adversary, and Trending Vulnerability.
    • Adds a Prevalence trends: Top 5 malware families widget showing the most prevalent malware families from global telemetry, with in-network occurrence indicators (warning icon, pivot to alert details) for XDR/Defend subscribers.

    +5 more show less

    • Adds a Prevalence trends: Top 5 MITRE techniques widget showing the most prevalent MITRE techniques from global telemetry, with in-network occurrence indicators (warning icon, pivot to alert details) for XDR/Defend subscribers.
    • Adds an Adversary Activity Trend widget highlighting rising threat actors (green) and declining ones (red) based on spikes in threat activity, infrastructure, and attack volume over the prior quarter.
    • Adds Rank-type Top Threat Entities widgets ranking Top Adversaries, Top Malware families, Top Tools, and Top latest exploited vulnerabilities by current indicator volume within the selected time filter.
    • Adds an Adversaries reports table widget showing the most recent TDR reports on specific threat actors, updated in real-time (full details require Intelligence subscription).
    • Adds a Top Threats table providing a global overview of the most prevalent threat objects — Malware families, MITRE techniques, Adversaries, and Tools — with columns for total historic threat volume, past week activity, network impact (XDR customers), and linked reports (Intelligence subscription).

    10 details in Everything

24. docs update Sep 9, 2026 · issue 069

    Sekoia.io Intelligence Center gains fully configurable dashboards with modular widgets, custom filters, and date range controls.

    └──▷ HOW TO FIND IT
    Create a threat-team-specific dashboard surfacing only the widgets and filters relevant to your community's focus area.
    📍1. Click Settings (upper right) › Create a new dashboard 2. Enter a name and description, then click Save 3. Click Add widget, select widgets from the right panel, and drag them into the workspace 4. Configure each widget's date range and filters as needed 5. Click Save — the dashboard is immediately available to all community members
    Spin up a variant of an existing dashboard without rebuilding from scratch, then customise only the widgets that differ.
    📍1. Select the dashboard to copy from the dashboard name list (upper left) 2. Click Settings (upper right) › Duplicate this dashboard 3. Rename the dashboard and update its description 4. Edit or reposition widgets as needed, then click Save
    • Adds a configurable dashboard system to the Intelligence Center homepage, composed of modular widgets that can be repositioned, filtered by date range, and set to auto-refresh.
    • Adds a preconfigured default dashboard showing community activity including risk level, alert counts, last posted comments, and last created alerts.
    • Supports creating new dashboards from scratch via Settings > Create a new dashboard, with named widgets dragged into a workspace and shared across all community members.
    • Supports duplicating an existing dashboard via Settings > Duplicate this dashboard to bootstrap a new layout from an existing one.
    • Supports editing dashboards and adding widgets via Settings > Edit this dashboard > Add widget.

    +1 more show less

    • Supports deleting custom dashboards via Settings > Delete this dashboard (the default dashboard cannot be deleted).

    6 details in Everything

25. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Collections: import, manage, and detect on external indicators from CSV, XLS, XLSX, or plain text

    └──▷ HOW TO FIND IT
    Import a CSV threat-intel feed into a new IOC Collection and automatically activate detection — useful when onboarding a new external IOC provider into your SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflow.
    📍1. In Sekoia.io, go to the IOC Collections page and click + Collection. 2. Name the collection (e.g. External Feed - CERT-XYZ), add an optional description, and enable 'automatically add IOCs into detection'. 3. Click Import, choose File Import, and upload your CSV/XLS/XLSX file. 4. Review the first 10 lines; map columns to Observable, Valid From, Valid Until, Kill Chain Phases, Related Threats, or set Ignore for irrelevant columns. 5. Click Next, set any community-wide defaults for unmapped fields, then click Import.
    Quickly add a short list of IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (e.g. fresh C2 IPs from a threat report) that all share the same threat context, without preparing a file.
    📍1. Open the target IOC Collection and click Import, then choose Text Import. 2. Paste one IOC per line (e.g. IPv4 addresses) into the text field and click Next. 3. Set Kill Chain Phase to Command and Control — detection will automatically scope to destination.ip to limit false positives. 4. Optionally link Related Threats and set Valid From / Valid Until dates, then click Import.
    Revoke a specific indicator that is generating false positive alerts, removing it from active detection immediately.
    📍1. Go to the IOC Collection containing the indicator and locate it using the search bar. 2. Click the Revoke button at the end of the indicator's row. — OR — Go to the Intelligence section in the left menu, search for the object, review its pattern, source, threat context, and linked observables, then click Request revocation at the top right.
    • Adds IOC Collections, a new feature to import external indicators (IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet., domain, URL, MD5/SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications./SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data./SHA-512 hash, email) from sources outside Sekoia's own Threat & Detection Research team and use them in detection rules.
    • Supports File Import using CSV, XLS, and XLSX files with column-mapping UI (including an Ignore option to discard columns) to import tabular IOC feeds.
    • Supports Text Import for pasting a plain list of IOCs (one per line) sharing common properties such as Related Threats, Valid From, Valid Until, Kill Chain Phases, and Description (capped at 500 characters).
    • Enforces a community-wide limit of 500,000 IOC entries across all collections.
    • Enables optional auto-creation of a dedicated detection rule when creating a new IOC Collection.

    +3 more show less

    • Supports per-indicator actions: edit indicator properties (excluding the observable value) or revoke an indicator to immediately remove it from detection.
    • Adds IOC revocation request workflow: navigate to Intelligence, find the object, and click Request revocation to flag a false-positive indicator.
    • In MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. communities, allows scoping an IOC Collection to a specific subcommunity or to All communities for shared visibility across subcommunities.

    8 details in Everything

26. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds data export from Object and Report pages in CSV, TXT, JSON, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. formats.

    └──▷ HOW TO FIND IT
    Export an ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. coverage map from a Sekoia.io Report to visualize technique coverage in the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CK Navigator.
    📍In a Report page, click Export, open the export modal, select the relationship type (or all relationships), choose the MITRE ATT&CK format, then download and upload the file at https://mitre-attack.github.io/attack-navigator/.
    • Adds an export modal on Object and Report pages to download related items in CSV, TXT, JSON, or MITRE ATT&CK format, with the option to export all relationships or filter by a specific relationship type.
    • CSV export converts TLP, sources, and kill chain phase values to human-readable text instead of IDs.
    • MITRE ATT&CK format export produces output compatible with the MITRE ATT&CK Navigator for visual matrix generation.

    3 details in Everything

27. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds External Reports: curated third-party threat intelligence publications browsable, filterable, and linked to STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. objects in-platform.

    └──▷ HOW TO FIND IT
    Pivot from an external threat report into your investigation by exploring its linked STIX objects and relationships.
    📍1. Navigate to Reports in the left-hand menu. 2. Select a report from the External Reports list. 3. Click any object or observable in the report body to open its detail page, or click the report title to see all associated STIX objects. 4. Open the graph exploration view to visualize relationships between the report's objects.
    Scope the External Reports list to intelligence relevant to a specific sector or geography by applying a feed filter.
    📍1. Navigate to Reports in the left-hand menu. 2. In the filter bar at the top of the reports list, select the desired feed (configured by source, sector, geography, or other criteria). 3. Browse the filtered External Reports alongside FLINTs for your scoped threat intelligence view.
    • Adds an External Reports section under Reports in the left-hand menu, surfacing curated publications from government CERTs, national cybersecurity agencies, security vendors, and independent research organizations alongside existing FLINT reports.
    • Reports open in PDF view by default with a toggle to switch to text view for a summarized version of the publication.
    • Enables filtering the reports list by feed — scoped by source, sector, or geography — using the filter bar at the top of the reports list.
    • Links reports to STIX objects and observables in the platform, allowing pivot from a report into investigation workflows via object detail pages or graph exploration view.

    4 details in Everything

28. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds a dedicated FLINT Reports page for browsing, reading, and pivoting from flash intelligence publications into investigation workflows.

    └──▷ HOW TO FIND IT
    Pivot from a FLINT report into an active investigation by navigating to the report and opening the graph exploration view.
    📍1. In the left-hand menu, go to Reports and select FLINTs in the filter bar. 2. Open a FLINT report of interest. 3. Click the report title to view all associated STIX objects and observables. 4. Open the graph exploration view to visualize relationships between those objects.
    • Adds a FLINT Reports page reachable via Reports > FLINTs in the left-hand menu, or from the Threat Landscape page's FLINT Reports widget, to browse and read flash intelligence publications.
    • Supports PDF view and text view for each FLINT report, with zoom, a PDF download option, and a resizable report list panel.
    • Enables direct pivot from a FLINT report into the platform by clicking any object or observable to open its detail page, or the report title to see all associated STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. objects and observables.
    • Provides graph exploration view from within a FLINT report to visualize relationships between the report's STIX objects.

    4 details in Everything

29. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds Graph Explorations: interactive, shareable CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. visualizations with layer management and team collaboration.

    └──▷ HOW TO FIND IT
    Start a focused exploration on a specific threat actor to map its infrastructure, techniques, and malware from within the object page.
    📍In Sekoia.io, open any intelligence object (e.g. a threat actor or malware family), then click the New Graph Exploration tab to launch an interactive graph seeded with that object.
    Organise a complex APT campaign analysis by separating threat actors, malware families, and C2 infrastructure into distinct layers within a single exploration.
    📍In a Graph Exploration, open the layer management panel in the top-left corner adjacent to the main analysis panel. Create separate layers — e.g. Threat Actors, Malware Families, Infrastructure — then switch the active layer before adding objects so each category is independently toggleable.
    Access the team's shared library of saved explorations to resume or build on prior threat research without starting from scratch.
    📍In the Sekoia.io sidebar, navigate to Graph Explorations to browse, open, and collaborate on all saved threat intelligence graph explorations shared across your community.
    • Adds a New Graph Exploration tab on any intelligence object page to launch focused graph explorations from a specific threat actor, malware family, attack technique, or other CTI entity.
    • Adds a Graph Explorations menu item providing a team-shared library of saved threat intelligence explorations for collaborative research, analytical continuity, and intelligence production.
    • Introduces graph layer management — accessible from the top-left corner of the analysis panel — allowing analysts to create independent layers per threat actor, malware family, ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. technique, or infrastructure category within a single exploration.
    • Introduces two distinct investigation types: Explore for free-form, saveable CTI mapping sessions and Investigate for event-driven graph construction that auto-updates as new events are added to alerts or cases.
    • Supports launching graph explorations directly from existing threat report graphs, using pre-established threat relationships as starting points for deeper analysis.

    +1 more show less

    • Enables adding and removing individual objects and relationships interactively via the side panel Relationships tab and Add relationship to graph button, with automatic cleanup of orphaned relationships when objects are deleted.

    6 details in Everything

30. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. feed-linked detection rules that check both live telemetry and historical events for feed indicator matches.

    └──▷ HOW TO FIND IT
    When you want a detection rule to fire whenever your environment sees indicators from a specific threat-intelligence feed — including against historical events.
    📍1. Navigate to Rules catalog 2. Click to create a new rule 3. In the detection pattern, select CTI 4. Select your custom feed from the list 5. Configure the rule logic and status 6. Click Save
    • Adds ability to create a detection rule directly from a CTI feed by selecting CTI as the detection pattern type and choosing a custom feed, enabling automatic monitoring of both incoming telemetry and historical events against feed indicators (requires Defend subscription).

    1 detail in Everything

31. docs update Sep 9, 2026 · issue 069

    Sekoia.io Feeds deliver filtered CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. views via JSON/STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form., CSV, Text, or Custom formats over API and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. endpoints

    • Exposes a Public API URL (https://app.sekoia.io/api/v2/inthreat/collections/...) and a Public TAXII URL (https://app.sekoia.io/api/v2/inthreat/taxii-server/...) per feed for direct integration with SIEMsSIEMsSecurity Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point., firewalls, and TIPs
    • Introduces Feeds — filtered, scoped views of CTI objects — supporting output formats JSON/STIX, Text (firewall EDLs), CSV, and Custom (user-defined templates with variables $tlp, $id, $name, $observables)
    • Provides a Default Feed covering the entire Sekoia CTI database with no filters, accessible out of the box via Feed ID d6092c37-d8d7-45c3-8aff-c4dc26030608
    • Enables linking a feed to a CTI detection rule to automatically match IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. against telemetry (requires a Defend subscription)

    4 details in Everything

32. docs update Sep 9, 2026 · issue 069

    Sekoia.io adds Observable and Threat Telemetry — heatmap-based sighting history for IPs, domains, hashes, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. threat objects across communities.

    └──▷ HOW TO FIND IT
    Check whether a suspicious domain has been consistently seen across all Sekoia.io communities before deciding to use it as an IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    📍1. Open the Intelligence database page. 2. Search for the domain name and open the Observables tab. 3. Click the observable to open its Observable details page. 4. Set the scope filter to In all Sekoia.io and review the daily sighting heatmap for the past year.
    During alert triage, determine whether an observable involved in a detection is part of a broader attack pattern or an isolated hit.
    📍1. Open the Alert details page. 2. Navigate to the Graph Investigation tab. 3. Click a public IPv4, IPv6, domain name, or file hash node in the graph. 4. In the left panel, click the sightings button to open the full telemetry heatmap.
    After importing external IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. via the IOC collections feature, generate a telemetry report to validate that each observable is a reliable indicator rather than routine background noise.
    📍1. Open the IOC collections feature and select your imported collection. 2. Generate a telemetry report for the collection. 3. Review the observable sighting history to identify IOCs that appear continuously without deviation (less reliable) versus those with discrete spikes (more reliable).
    • Adds Observable Telemetry for public IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses, domain names linked to public TLDs, and file hashes — showing a daily sighting heatmap over the past year drawn from parsed events.
    • Adds Threat Telemetry for all 8 STIX threat object types (attack patterns, campaigns, infrastructures, intrusion sets, malware, threat actors, tools, vulnerabilities) — recording an occurrence each time an alert fires from associated IOCs, correlation rules, or AI models.
    • Adds a telemetry report for IOC collections, allowing analysts to verify the viability of imported IOCs by reviewing historical observable sightings before use.
    • Adds scope filters — In all Sekoia.io, In my managed communities, and single-selected community — so MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. and multi-tenant users can slice telemetry by community hierarchy.
    • Surfaces observable telemetry inside the Graph Investigation tab of Alert detail pages — click a public IPv4, IPv6, domain, or file hash node to see its sighting count and full heatmap.

    5 details in Everything

33. 🚀 New Custom Fields and Custom Date Format features Aug 25, 2026 · release notes

    Adds Custom Fields and Custom Date Format to Sekoia.io

    • Adds text, integer, boolean, single select, and multi select field types under *Settings > Custom Fields* to attach structured metadata to cases and alerts.
    • Enables filtering, aggregation, and dashboard building on custom fields using SOL query syntax.
    • Adds date format selection (Day/Month/Year or Month/Day/Year) under *Settings > Profile* to control UI date display.

    3 details in Everything

34. 🛡️Sekoia Endpoint Agent 1.11.0 Aug 6, 2026 · release notes

    Sekoia Endpoint Agent 1.11.0 adds macOS user context enrichment and legacy Windows routing

    • macOS EPS events now include uid and username fields for account attribution

    1 detail in Everything

35. ▶️ Run Playbook from Case Aug 4, 2026 · release notes

    New Available playbooks for this case panel and Manual Trigger for Case allows triggering SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks directly from a case.

    • Available playbooks for this case panel added to the case header to trigger SOAR playbooks without leaving the investigation
    • New Manual Trigger for Case trigger type available for playbook authors to make playbooks case-aware
    • New View last runs performed feature on cases showing status badge, run timestamp, and duration

    3 details in Everything

36. Integration catalog updates 🎉 Jul 15, 2026 · release notes

    Sekoia.io adds new integrations, automations, and asset connectors in Q1-Q2 2026 update

    • Adds Akamai Guardicore - OnPrem version integration for network security intake
    • Adds Akamai Guardicore - SaaS version integration for network security intake
    • Adds BeyondTrust PRA - Syslog source integration for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. intake
    • Adds BeyondTrust PRA - Team integration for IAM activity tracking
    • Adds BeyondTrust PRA - VaultAccountActivity integration for vault account monitoring

    +30 more show less

    • Adds Check Point Harmony Email & Collaboration Suite Security integration for email security
    • Adds Cisco Catalyst SD-WAN integration for network monitoring
    • Adds Cisco Secure Access - Cloud Firewall integration for firewall events
    • Adds Cisco Secure Access - DNS integration for DNS security logs
    • Adds Cisco Secure Access - File Events integration for file access monitoring
    • Adds Cisco Secure Access - IPS integration for intrusion prevention events
    • Adds Cisco Secure Access - Web integration for web traffic monitoring
    • Adds Delinea Platform Audit Logs integration for privileged access auditing
    • Adds Microsoft 365 Message Trace - GraphAPI integration for email trace data
    • Adds Microsoft Defender XDR - GraphAPI integration for endpoint detection data
    • Adds Mokn Baits integration for threat intelligence baiting
    • Adds Nanocorp integration for network security monitoring
    • Adds One Identity Safeguard for Privileged Sessions integration for session auditing
    • Adds Ping Identy - PingFederate integration for identity federation logs
    • Adds Prodaft USTA integration for threat intelligence sharing
    • Adds Radware DefensePro integration for web application firewall events
    • Adds Silverfort Universal MFA integration for multi-factor authenticationmulti-factor authenticationMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. logs
    • Adds Trapster by Ballpoint integration for honeypot/trap data
    • Adds Ubika Cloud Protector Next Generation - Traffic logs integration for cloud traffic
    • Adds WIZ - Threat detections integration for cloud security posture threats
    • Adds Zscaler Private Access integration for zero trust network access logs
    • Adds ilert - Playbook actions automation for incident response orchestration
    • Adds ReverseDNS - Playbook action automation for DNS lookup capabilities
    • Adds SOL - Playbook actions automation for query execution within playbooks
    • Adds Stormshield SNS - Playbook actions automation for network security alerts
    • Adds ESET Protect - Devices collection asset connector for endpoint inventory
    • Adds Microsoft Defender - Devices collection asset connector for Microsoft endpoints
    • Adds SentinelOne EDR - Devices collection asset connector for SentinelOne endpoints
    • Adds Sophos EDR - Devices collection asset connector for Sophos devices
    • Adds Sophos EDR - Users collection asset connector for Sophos user data

    35 details in Everything

37. ✨ New Runbooks feature and platform updates Jul 6, 2026 · release notes

    Sekoia.io Defend adds AI-generated Runbooks per detection rule and revamps alert/case layouts with new SOL query column controls.

    • Introduces Runbooks, an AI-generated investigation guide attached to every detection rule in Sekoia Defend
    • Enables editing of runbooks for customers on the Prime plan
    • Adds column controls (display, sort, top values, toggle) to SOL query table mode
    • Makes dialect and smart description columns available on event results in SOL queries
    • Reprioritizes information layout on the alert details page for faster context understanding

    +1 more show less

    • Aligns case details layout with the new alert details page for consistent investigation experience

    6 details in Everything

38. 🎛️ New feature: Alert Custom Statuses Jun 29, 2026 · release notes

    Sekoia Defend introduces custom alert statuses and verdicts for workflow management

    • Adds ability to create and edit custom status labels for alerts in Sekoia Defend
    • Adds support for defining custom verdict categories shared across alerts and cases

    2 details in Everything

39. ✨ Intelligence Upgraded: Deeper Threat Context, Easier Access to FLINTs Jun 17, 2026 · release notes

    Sekoia.io Intelligence module gets new IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. type filters, column management, and FLINT report access enhancements.

    • IOC type filter added to the Threat Context panel to scope views to specific indicators like IPs or domains.
    • Support for First Seen and Last Seen columns in the Threat Context table alongside existing date fields.
    • Last updated filter available in Threat Context to scope results to relationships modified within the last 30 days.
    • New Access all FLINTs button on the Threat Landscape page for direct navigation to threat intelligence reports.

    4 details in Everything

40. 📡 New SOL operators and new chart type Jun 11, 2026 · release notes

    Sekoia adds leftanti/rightanti SOL operators and a Sankey chart rendering mode to Query Builder

    └──▷ TRY IT
    Render network traffic flows between source and destination IPs as a Sankey chart directly within a SOL query result.
    copy

    $ events | where timestamp > ago(1h) and source.ip != null and destination.ip != null | aggregate count() by source.ip, destination.ip | limit 50 | render sankey with (source=source.ip, target=destination.ip, value=count)

    • Adds leftanti and rightanti join operators in SOL for detecting missing or new data patterns.
    • Adds a new Sankey chart visualization type accessible via the Query Builder UI.
    • Adds render sankey with (source=..., target=..., value=...) syntax in SOL to render flow mappings programmatically.

    3 details in Everything

41. 🛡️Sekoia Endpoint Agent 1.10.0 Jun 10, 2026 · release notes

    Sekoia Endpoint Agent 1.10.0 adds ProcessHashEnabled config and --remote-optimization-rules install flag

    • Adds ProcessHashEnabled config setting to disable process hash computation at the agent level for resource-constrained environments.
    • Adds --remote-optimization-rules install argument to enable remote optimization rules during installation.

    2 details in Everything

42. ✨ New features: Bulk add events to case & SOL Dataset Jun 4, 2026 · release notes

    Sekoia Defend adds bulk event-to-case ingestion and SOL Dataset support for CSV lookups.

    • Adds multi-select on the event search page to add up to 1000 events to a case in one action
    • Adds SOL Dataset import for CSV files as named lookup tables queryable in SOL
    • Adds ability to join datasets against events, alerts and cases within SOL queries
    • Adds dataset update functionality via re-uploading a CSV file

    4 details in Everything

43. 📡 New SOL features and rules search improvement Apr 27, 2026 · release notes

    SOL gains parse_json/tostring functions and alerts-assets join; rules search covers descriptions.

    • Adds parse_json() function to SOL queries for parsing JSON strings into structured objects
    • Adds tostring() function to SOL queries for value conversion and text operations
    • Enables joining the alerts and assets datasources in SOL for correlation
    • Expands Rules Catalog search to match against rule descriptions

    4 details in Everything

44. 🛡️Sekoia Endpoint Agent 1.9.1 Apr 23, 2026 · release notes

    Sekoia Endpoint Agent 1.9.1 adds native ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support and process hash computation for richer telemetry.

    • Linux ARM64 Support runs the agent natively on ARM64 architectures, expanding deployment coverage to ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based servers and cloud instances.
    • Process Hash Computation computes hashes for running processes, enriching endpoint telemetry for detection and investigation workflows.

    2 details in Everything

45. 🔁 Feeds Redesigned: More Control Over Scoping, Formatting and Dissemination Apr 14, 2026 · release notes

    Sekoia.io Feeds Redesigned: New scoping, formatting, and dissemination controls for threat intelligence

    • Adds guided, step-by-step feed creation flow with inline explanations at every stage
    • Adds source-level filtering to scope feeds to Sekoia sources, external sources, or any combination
    • Adds ability to exclude expired and revoked IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. from feeds
    • Adds configurable sorting (newest-to-oldest or oldest-to-newest) across all formats
    • Adds in-product documentation embedded in the Disseminate modal explaining Feed ID, API URL, and TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. URL

    +1 more show less

    • Adds one-click feed duplication with independent dissemination links per copy

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Sector and geography filters have been removed from feed creation
46. ✨ Introducing Reveal: Unified Asset Intelligence Mar 31, 2026 · release notes

    Sekoia.io introduces Reveal add-on providing unified asset intelligence with new connectors and context panels.

    • Adds Asset Connectors to collect, unify, and enrich assets from connected systems for the Reveal add-on module
    • Adds Vulnerability Enrichment capability to add vulnerability context directly to assets in the Asset Context Panel
    • Adds Points of Interest feature to surface notable behavioral and risk signals, including early UEBA-driven insights, on assets
    • Adds Endpoint Hygiene identification for hygiene issues impacting asset health within Reveal
    • Adds Attack Path Visualization to explore observed relationships between assets and identities for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. analysis

    5 details in Everything

47. New features: New SOL datasource intake_formats, Asset tags (SOL), Asset filter in Cases and new SOL documentation Mar 25, 2026 · release notes

    Adds intake_formats datasource and tags column to SOL, plus asset filtering in Cases

    • Adds intake_formats new datasource that maps dialect and format UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to human-readable names for cleaner ingestion pipeline analytics
    • Adds tags column to the assets table in SOL to list all tags associated with each asset for tag-based filtering and enrichment
    • Adds ability to filter alerts by specific assets within a Case's Alerts tab

    3 details in Everything

48. 📦 Massive Event Export Mar 20, 2026 · release notes

    Sekoia.io adds asynchronous Massive Event Export via sekoia-event-exporter CLI and API, supporting up to 100M events.

    • Adds support for exporting up to 100 million security events in a single job via the async export workflow
    • Adds S3 bucket export destination option for data lake and long-term retention workflows
    • Adds gzip-compressed file output format for exported results

    3 details in Everything

49. 🎯 Alert Storm Control Mar 12, 2026 · release notes

    Sekoia introduces Alert Storm Control to cap runaway rule alert volumes via rule-level cooldown.

    • Adds automatic cooldown mechanism for detection rules generating more than 30 distinct alerts in 30 seconds, entering a 30-minute rate-limited state.
    • Adds per-IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. cooldown logic for CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. rules where individual IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. reaching 30 matches trigger a rule-level cooldown while other IOCs continue normally.
    • Adds configurable notification A detection rule entered rate-limited state to alert on when a rule enters cooldown.

    3 details in Everything

50. 📡 New SOL functions: toint(), extract(), replace_regex() and countif() Feb 27, 2026 · release notes

    SOL adds toint(), extract(), replace_regex() and count_if() functions for enhanced data transformation and analytical capabilities.

    • toint() converts text-based fields to integers for numeric filtering, comparisons and arithmetic operations
    • extract() extracts specific patterns from strings using regular expressions for precise log parsing and field enrichment
    • replace_regex() transforms and sanitizes text data by replacing regex-matched patterns with custom values
    • count_if() performs conditional counting within aggregate queries for targeted statistical breakdowns

    4 details in Everything

51. 📊 Stop Rebuilding Dashboards: Share + Filter Are Here Feb 17, 2026 · release notes

    Sekoia.io adds dashboard sharing between MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. workspaces and communities, dynamic SOL query filters (?variable_name), and a new Queries page with search and filter capabiliti

    • Adds ?filter_name syntax to SOL queries to create dynamic input fields (Text, Boolean, Single/Multi selection, Time) for interactive dashboards
    • Adds ability to share MSSP workspace dashboards to end-user communities via Manage access with auto read-only sync
    • Introduces a new Queries page with search bar and filters by type, author, and access scope to locate SOL queries

    3 details in Everything

52. 🎯 New feature: Sigma Pattern Validation Dec 18, 2025 · release notes

    Sekoia.io adds Sigma Pattern Testing in GA for validating detection rules against historical data

    • Test Pattern button enables validation of new or existing Sigma rules against 7, 30, or 60 days of historical event data to reduce alert noise.
    • Alert Filter Testing mode allows optimization of exclusion patterns to minimize false positives using correlation tables.
    • Dual visualization provides chronological bar graphs and detailed event analysis with top 10 value distributions for pattern testing.

    3 details in Everything

53. Integration catalog updates 🎉 Dec 18, 2025 · release notes

    Adds Azure Activity Logs, Keycloak, OpenCTI Stream import and New Relic Playbook actions to Sekoia.io Integrations catalog.

    • Adds Azure Activity Logs integration for ingesting logs from Microsoft Azure environments
    • Adds Broadcom Siteminder integration for mainframe authentication events
    • Adds CyberArk Digital Vault integration for privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. monitoring
    • Adds Forcepoint Manager Server and Forcepoint Next-Generation Firewall integrations
    • Adds Juniper Networks NGFW integration for firewall log ingestion

    +8 more show less

    • Adds Keycloak integration for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. event correlation
    • Adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. (via Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint.) integration using the Graph API endpoint
    • Adds Netskope Log Streaming (Transaction Events) integration for cloud security posture data
    • Adds New Relic - Alerts integration for application performance monitoring alerts
    • Adds Nucleon Security Nucleon EDR integration for endpoint detection and responseendpoint detection and responseEndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. telemetry
    • Adds Trellix Advanced Threat Defense integration for advanced threat detection logs
    • Adds OpenCTI Stream import external integration for Cyber Threat Intelligence feeds
    • Adds New Relic - Playbook actions enabling Make NRQL query automation tasks

    13 details in Everything

54. 🛡️Sekoia Endpoint Agent 1.9.0 Dec 8, 2025 · release notes

    Sekoia Endpoint Agent 1.9.0 adds optimization rules (beta), embedded root CAs, configurable log rotation, configurable event buffer cache, and glob patterns for HashesExclude

    • HashesExcludedPaths now supports glob patterns (e.g., C:\temp\*) for flexible path matching
    • Fully configurable log file rotation via LogMaxSize, LogMaxBackups, and LogCompress in config.yaml
    • Optimization rules (beta) allow fine-tuned control over event collection and processing

    3 details in Everything

55. 🛡️ Rules Catalog Enhancements: New Features and Detection Updates Dec 1, 2025 · release notes

    Sekoia.io adds Integration Rules filtering and Rule Lifecycle management to the Rules Catalog

    • Adds Integration Rules feature to identify and filter rules sourced from third-party integrations.
    • Adds Rule Lifecycle feature to offer TDR and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams new maintenance capabilities for detection strategy.

    2 details in Everything

56. 🧩 Integrations Rules + 📆 Validity Dates on Rules Nov 13, 2025 · release notes

    Sekoia.io Rules Catalog gains third-party integration filtering and rule validity dates with auto-disable.

    • Adds Rule type > Integration rule filter in the Rules Catalog to identify detection rules tied to third-party integrations
    • Adds Valid until date field when creating or editing a rule to signal maintenance end date
    • Adds automatic disabling of deprecated rules via Automatically disable deprecated rules option in Rules Catalog settings
    • Adds notification opt-in for rule deprecation at Get Notified > Notify me when a rule from the catalog is deprecated/scheduled for deprecation

    4 details in Everything

57. Sekoia.io Forwarder 2.7.3 🔎 Oct 22, 2025 · release notes

    Sekoia.io Forwarder 2.7.3 adds support for custom log destinations via an environment variable

58. Defend updates 🎉 - Oct'25 Oct 15, 2025 · release notes

    Sekoia Defend Oct'25 adds manual AI Case priority, in-UI alert title editing, and alert timeline observables

    • Manually set the priority level for AI Cases to disable automatic updates

    1 detail in Everything

59. Integration catalog updates 🎉 Sep 18, 2025 · release notes

    New intake connectors for Kubernetes, Vectra, Nozomi, Barracuda, and NeroSwarm; new playbook actions for TrendMicro and Bitdefender.

    • Adds Kubernetes Audit Logs integration for endpoint telemetry ingestion
    • Adds Vectra Respond UX Entities scoring integration for network security data
    • Adds Nozomi Vantage integration for OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. visibility
    • Adds Nozomi Central Management Console (CMC) integration for device management
    • Adds Barracuda CloudGen Firewall integration for firewall logs

    +3 more show less

    • Adds NeroSwarm Honeypot integration for threat intelligence
    • Adds TrendMicro VisionOne playbook actions: Add alert note, Collect a file, Deisolate endpoints, Isolate endpoints, Init a scan, Terminate a process, Update alert status
    • Adds Bitdefender GravityZone playbook actions: Create a new custom task scan, Deisolate an endpoint, Get blocked items, Isolate an endpoint, Kill a process, Block connections, Block hashes, Block Paths, Remove blocks, Create a new task scan, Update an incident comment, Update the status of an incident

    8 details in Everything

60. 📈 Multi-Layer Graphs for Smarter Investigations Sep 11, 2025 · release notes

    Adds Multi-Layer Graphs for investigations with drag-and-drop visibility controls.

    • Adds support for organizing investigation graphs into customizable layers to separate IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. or ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques.
    • Enables auto-collection of new data into default and active layers within graphs.
    • Adds visibility controls to hide or show individual layers instantly to reduce visual noise.
    • Supports drag-and-drop movement of observables and objects between graph layers.
    • Provides real-time collaboration where layer changes are saved instantly and visible to the team.

    5 details in Everything

61. 📡 New SOL functions Sep 2, 2025 · release notes

    Sekoia Defend adds five new SOL functions for string math, conditionals, data quality, and datetime formatting.

    • tolower() and toupper() normalize text case for consistent analysis across mixed-case datasets
    • round() formats numerical results with specified decimal precision for professional reporting
    • iff() implements inline conditional logic for dynamic data categorization within queries
    • coalesce() handles missing data by returning the first non-null value from a list of expressions
    • format_datetime() applies Python strftime specifiers to timestamp values for tailored report formats

    5 details in Everything

62. 🛡️ Rules Catalog updates! (CrowdStrike, Microsoft, WIZ) Sep 1, 2025 · release notes

    Sekoia.io adds detection rules for WIZ Critical Alerts, CrowdStrike Falcon EppDetections, and new MacOS/Windows threat patterns.

    • Adds a new rule to detect WIZ Issues Critical Alert from the WIZ integration
    • Adds support for detecting Informational Severity EppDetection from CrowdStrike Falcon
    • Adds support for detecting Intrusion Detection severity events from CrowdStrike Falcon
    • Adds support for detecting Low Severity EppDetection from CrowdStrike Falcon
    • Adds support for detecting Medium Severity EppDetection from CrowdStrike Falcon

    +5 more show less

    • Adds support for detecting High Severity EppDetection from CrowdStrike Falcon
    • Adds support for detecting Critical Severity EppDetection from CrowdStrike Falcon
    • Adds a new rule to detect Entra ID Sign-In Via Known AiTM Phishing Kit (Rockstar 2FA) from Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
    • Adds 8 new detection rules for MacOS threats including Chflags Hidden and Tmutil operations
    • Adds 5 new correlation detection rules for Windows threats including PowerShell infection chains

    10 details in Everything

63. 🔔 Teams and Slack Notifications Aug 28, 2025 · release notes

    Adds Teams and Slack webhook notifications via Settings > Notifications for new alerts and cases.

    • Enables sending alert and case notifications to Microsoft Teams and Slack via webhook URLs in the Notifications settings
    • Makes the feature available to FRA 1 region users with a broader rollout scheduled for subsequent regions

    2 details in Everything

64. 🚀 Improvement of Intake Restricted Roles Jul 30, 2025 · release notes

    Intake Restricted Roles gain full dashboard access and intake management visibility.

    • Grants Intake Restricted Roles full access to dashboards for perimeter monitoring and key metrics tracking
    • Grants Intake Restricted Roles complete visibility over datasource monitoring and debugging via Intakes Management

    2 details in Everything

65. New Feature: Event Telemetry Datasource 📊 Jul 18, 2025 · release notes

    Adds Event Telemetry datasource to SOL query builder for tracking intake data volume and lag.

    • Introduces Event Telemetry as a new data source in the SOL query builder to track intake-level data usage.
    • Enables visualization of telemetry metrics including event counts, message sizes, and lag per intake.

    2 details in Everything

66. Integration catalog updates 🎉 Jul 9, 2025 · release notes

    New WatchGuard, Hornetsecurity, Olfeo integrations and Palo Alto XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. playbook actions for Sekoia.io

    • Adds WatchGuard Endpoint Protection Detection and Response integration to the catalog
    • Adds Hornetsecurity 365 Total Protection integration to the catalog
    • Adds Olfeo SAAS integration to the network security category
    • Adds Palo Alto XDR (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) playbook actions: Block malicious files, Comment alerts, Isolate endpoint, Quarantine the file, Unisolate endpoint, Update alert status and severity, XQL query

    4 details in Everything

67. 🛡️Sekoia Endpoint Agent 1.8.0 Jun 30, 2025 · release notes

    Sekoia Endpoint Agent 1.8.0 adds Host Hygiene Compliance collectors and Hyper-V sandbox event telemetry.

    • Host Hygiene Compliance collectors for Windows, Linux, and macOS (disabled by default)
    • Collection of specific Hyper-V sandbox events (Windows)

    2 details in Everything

68. 🧩 Build Your Private Integration Autonomously with the New Integrations page! Jun 16, 2025 · release notes

    New Integrations Catalog and Custom Apps feature for building private integrations via Automation SDK and GitHub/GitLab sync

    • Adds the Integrations Catalog as a centralized hub to discover, filter, and manage all Sekoia.io integrations with sorting by Recent/Popular/All and filters by Features, Categories, and Content Types.
    • Enables creation of private custom integrations using the Sekoia.io Automation SDK, allowing users to define custom playbook actions, triggers, connectors, and intake formats.

    2 details in Everything

69. Integration catalog updates 🎉 Jun 13, 2025 · release notes

    New intake connectors for CyberArk Identity Audit Logs, Trellix ePO, Azure Network Watcher, Ubika Cloud Protector, and Lookout Mobile Endpoint Security; new Palo Alto Cortex

    • Adds CyberArk Identity Audit Logs integration to ingest IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. audit events
    • Adds Trellix ePO - On Prem integration for on-premise endpoint security telemetry
    • Adds Azure Network Watcher (Virtual Network flow logs) integration for network traffic analysis
    • Adds Ubika Cloud Protector Next Generation integration for cloud security posture data
    • Adds Lookout Mobile Endpoint Security integration for mobile device monitoring

    +1 more show less

    • Adds Convert STIX to XSIAM action to Palo Alto Cortex XSIAM integration

    6 details in Everything

70. 📈 Assets Page Upgrade: Bulk Actions & Tags May 27, 2025 · release notes

    Assets page gains bulk actions (tags, revocation, criticality), visible tags column, advanced filtering, and recently used tag suggestions.

    • Adds bulk actions on the Assets page: adding tags, revoking multiple assets, changing criticality levels, and updating review statuses simultaneously
    • Adds a Visible Tags Column to the asset table that displays all associated tags for each asset and allows instant filtering by clicking a tag
    • Adds Advanced Filtering on the Assets page to pinpoint specific assets based on Criticality, Tags, Types, Source, and Status
    • Adds Recently Used Tags in the tagging interface to provide a convenient list of already used tags for quick selection

    4 details in Everything

71. 🏘️ Set your favorite dashboard as your default Sekoia homepage! (and more) May 21, 2025 · release notes

    Sekoia introduces a central Dashboards page for management and transparency.

72. 🔴 Important: 2FA Resets Now in Admin Hands May 15, 2025 · release notes

    Admins gain UI capability to reset user 2FA tokens; enhanced 2FA setup flow with immediate backup code generation.

    • Adds Reset User 2FA action to the Admin UI Settings > Users interface for resetting a specific user's two-factor authentication
    • Enhances the Profile → Security page to allow users to choose between TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. apps and security devices during setup
    • Generates backup codes immediately during the new enhanced 2FA setup process

    3 details in Everything

73. Sekoia.io Forwarder 2.7.2 🔎 May 14, 2025 · release notes

    Sekoia.io Forwarder 2.7.2 adds RELPRELPReliable Event Logging Protocol, an open protocol for transporting syslog messages over a persistent TCP connection with application-layer acknowledgements, so a cyber tool built on it can guarantee log delivery without silent message loss. protocol support and configurable intake queue_size.

    • queue_size config key added to an intake definition to set a specific retention size in memory
    • protocol: relp value added to allow sending events via the RELP protocol instead of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.

    2 details in Everything

74. Integration catalog updates 🎉 May 6, 2025 · release notes

    Adds Akamai WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and F5 Distributed Cloud intakes plus new Incident automations and ElasticSearch actions

    • Adds Akamai WAF integration to the integration catalog for network security monitoring
    • Adds F5 Distributed Cloud intake to capture logs from F5's distributed cloud platform
    • Adds new incident automation triggers: Case Created, Case Updated, Case Alerts Updated
    • Adds new incident automation actions: Delete Case, Remove event from case, Get custom status, Get custom priority, Get custom verdict
    • Adds ElasticSearch query actions with the new action Execute ES|QL query

    5 details in Everything

75. New feature: Time-based detection 🕑 Apr 29, 2025 · release notes

    Sekoia Defend adds Time-based Sigma detection for filtering alerts by business hours and holidays

    • Time-based Sigma enables detection of suspicious activities outside normal working hours, weekends, public holidays, or custom dates.
    • Time-based Sigma reduces alert fatigue via time-window alert filters.

    2 details in Everything

76. 🌟 AI Cases now available in GA Apr 9, 2025 · release notes

    Sekoia Defend adds GA AI Cases for automated incident correlation and summarization.

    • Adds AI Cases feature in Defend Prime and Legacy XDR plans that automatically creates security incidents by correlating related alerts over a 7-day period with AI summarization and dynamic priority rating.

    1 detail in Everything

77. 📖 New Sekoia.io API Documentation Apr 9, 2025 · release notes

    Sekoia.io API docs unified to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.1 with global search and inline testing

    • Adds a global search feature in the API documentation to quickly locate specific endpoints.
    • Reorganizes all API endpoints into logical categories based on product functionality for easier navigation.
    • Includes region availability information for each API endpoint in the documentation.
    • Provides a unified, fully OpenAPI 3.1-compliant manifest available as a downloadable JSON schema.
    • Enables testing of endpoints directly from the documentation page using an API key.

    5 details in Everything

78. Integration catalog updates 🎉 Apr 7, 2025 · release notes

    Sekoia.io adds Wiz Audit Logs, Wiz Vulnerability Findings, BeyondTrust PRA, Seckiot Citadelle integrations and Azure Monitor action

    • Adds Wiz Audit Logs intake to the integration catalog
    • Adds Wiz Vulnerability Findings intake to the integration catalog
    • Adds BeyondTrust Privileged Remote Access intake to the integration catalog
    • Adds Seckiot Citadelle intake to the integration catalog
    • Adds Azure Monitor actions automation (supports Query Azure Monitor Logs) to the action library

    5 details in Everything

79. 🎉 CSV export in Queries Mar 26, 2025 · release notes

    Sekoia.io Queries adds CSV export to download results as spreadsheets.

80. Sekoia.io Forwarder 2.7.1 🔎 Mar 14, 2025 · release notes

    Sekoia.io Forwarder 2.7.1 adds support for the USA region.

    • Adds support for the USA region.

    1 detail in Everything

81. Integration catalog updates 🎉 Mar 7, 2025 · release notes

    New intake connectors for Microsoft Sentinel, Wiz, and Outlook/Stormshield automation actions

    • Adds Microsoft Sentinel alerts as a new ingestion integration to the catalog
    • Adds Wiz Issues as a new ingestion integration to the catalog
    • Adds Wiz Cloud Configuration Findings as a new ingestion integration to the catalog
    • Adds Get a message, Delete a message, Forward a message, and Update a message actions for Microsoft Outlook automations
    • Adds Isolate agent, Deisolate agent, Quarantine file, Restore quarantine file, Terminate process, and Wait for a Stormshield task to complete actions for Stormshield SES automations

    5 details in Everything

82. 🛡️ Sekoia Endpoint Agent 1.7.0 Feb 19, 2025 · release notes

    Sekoia Endpoint Agent 1.7.0 adds watchdog service and Linux audit optimizations

    • Adds a new watchdog service to ensure the agent stays running, restarting it after updates or if it stops/crashes
    • On Linux, introduces volume and cost optimization by discarding exit_group syscall events from audit rules
    • On Linux, improves collection reliability for the parent.process field which was previously missing in some events

    3 details in Everything

83. 🔓 Playbooks on-prem are OUT of beta! Feb 12, 2025 · release notes

    Sekoia.io adds out-of-beta on-prem Playbooks for local environment execution.

    • Enables running automation playbooks directly within a local on-premises environment via the playbook runner component.
    • Allows admins to orchestrate Docker-based actions (e.g., disabling Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. users) from the Sekoia platform.

    2 details in Everything

84. Integration catalog updates 🎉 Feb 7, 2025 · release notes

    Sekoia adds LockSelf intake and ESET Protect/Inspect isolation and scan automations

    • Adds LockSelf LockPass/LockTransfer/LockFiles as a new intake integration
    • Adds isolate endpoint, deisolate endpoint, and scan endpoint actions for ESET Protect/Inspect

    2 details in Everything

85. 🍏 Sekoia Mac Agent is Now Available for Everyone! Feb 6, 2025 · release notes

    Sekoia releases version 1.6.2 of the Mac Agent, enabling automatic event collection from macOS endpoints with no performance impact.

86. Roy Assistant and Notebooks available in Public Beta 🎉 Jan 22, 2025 · release notes

    Public Beta release adds the Roy Assistant AI interface and Notebooks for incident response documentation to Sekoia.io.

    • Adds Roy Assistant as an interactive UI element accessible via the Ask Roy button for AI-driven support.
    • Adds Notebooks feature for centralizing investigation queries, automation actions, and reporting in a single markdown document.

    2 details in Everything

87. New feature: Subscriptions page (Beta)! 📑 Jan 9, 2025 · release notes

    Adds Beta Subscriptions page for unified subscription management and MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. community allocation

    • Adds Settings > Subscriptions page to view and manage all subscriptions
    • Enables MSSPs to allocate purchased subscriptions directly from the product interface

    2 details in Everything

88. New integrations in GA 🎉 Jan 6, 2025 · release notes

    Sekoia.io adds six new integrations (Olfeo, Ubika, ESET, Bitsight, EfficientIP, 1Password) and changes Mimecast auth error handling.

    • Adds olfeo intake for network security monitoring in GA
    • Adds ubika_cloud_protector_traffic intake for traffic analysis in GA
    • Adds eset_protect intake for endpoint protection monitoring in GA
    • Adds bitsight_spm intake for supply chain risk monitoring in GA
    • Adds efficientip_solidserver_ddi intake for DDI monitoring in GA

    +1 more show less

    • Adds 1password_epm intake for enterprise password manager data in GA

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Mimecast Email Security intakes now treat authentication errors as CRITICAL level (previously ERROR) and automatically stop the intake after 5 failed attempts, with a 30-minute grace period for counter reset.
    • !Fortinet Fortigate events using the timestamp field now use native timezone for calculations; the eventtime field is prioritized as the primary timestamp source if available.
89. New Feature: View MITRE details 🔍 Dec 4, 2024 · release notes

    Sekoia Defend adds fullscreen MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Matrix visualization to detection rules page

90. Integration catalog updates 🎉 Dec 3, 2024 · release notes

    Sekoia.io adds Bitdefender, Prisma Access and Trend Micro intake integrations plus EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. automation actions.

    • Adds Bitdefender GravityZone integration for endpoint event ingestion
    • Adds Palo Alto Prisma Access integration for network security telemetry
    • Adds Trend Vision One Workbench Alerts integration for endpoint alerts
    • Expands Google Workspace intake to support ChromeOS events
    • Adds Microsoft Defender EDR automation actions (create iocs, isolate machine, deisolate machine, scan a machine, stop and quarantine a file, update an alert, comment an alert, get machine action, restrict code execution, unrestrict code execution)

    +2 more show less

    • Adds Crowdstrike EDR automation actions (update alert status, comment alert)
    • Adds HarfangLab EDR automation actions (create iocs, comment threat, update threat status, download file from endpoint)

    7 details in Everything

91. Sekoia.io Forwarder 2.7.0 🔎 Nov 28, 2024 · release notes

    Sekoia Forwarder 2.7.0 adds monitoring capabilities for integrations, including health status and event forwarding metrics.

    • Adds enhanced monitoring capabilities for the concentrator to monitor performance and status of integrations
    • Enables monitoring of the Sekoia forwarder to access health status information and advanced metrics of event forwarding

    2 details in Everything

92. New Feature: Usage page (Beta)! 📈 Nov 27, 2024 · release notes

    New Usage page (Beta) at Settings > Usage for tracking consumption, forecasting, and quota management.

    • Adds the Settings > Usage page to track platform usage across all communities
    • Adds predictive consumption forecasting based on historical data trends
    • Adds a history view to analyze data consumption trends over the past months
    • Adds multi-tenancy compatibility to view each community's consumption status
    • Adds a gauge to visualize progress towards fair use quotas

    +1 more show less

    • Adds monitoring for currently running playbook actions

    6 details in Everything

93. New feature: Rules and intakes ☂️ Nov 14, 2024 · release notes

    Sekoia Defend adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. visualization with filters for configured intakes and detection gap identification.

94. New improved MISP feed Oct 29, 2024 · release notes

    Sekoia.io introduces a new API version for its MISP feed to update and remove indicators instead of pushing duplicates.

    • Adds a brand new API to consume Sekoia Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) into MISP
    • Enables updating existing objects and their properties in the MISP feed
    • Enables removing expired indicators from the MISP feed
    • Organizes MISP events by source in the new feed integration

    4 details in Everything

95. New field "EDR agent ID" in Assets Oct 28, 2024 · release notes

    New EDR agent ID field on Host assets to enable EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-targeted playbook actions

    • Adds EDR agent ID field to Host assets, populated from ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. agent.id and agent.type fields

    1 detail in Everything

96. 🌟 Exciting Q3 Updates from Sekoia.io! 🌟 Oct 23, 2024 · release notes

    Sekoia.io adds Intake v2 for data source management, Meta-Playbooks for multi-community automation, and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Agent ID support.

    • Adds Intake v2 to the UI for enhanced data source management and easier integration setup
    • Adds Meta-Playbooks capability to manage automation across multiple communities simultaneously
    • Adds EDR Agent ID field access to enable quicker incident response workflows
    • Improves visualization of event, alert, and case queries in Enhanced Dashboards

    4 details in Everything

97. 📊 Line charts, bar charts, numbers... New visualizations in the Query Builder Oct 17, 2024 · release notes

    Sekoia.io adds Number, Column, Line, and Bar chart visualizations to the Query Builder for custom dashboards.

    • Adds Number visualization to display a single numeric value prominently in dashboards
    • Adds Column chart with stacked or grouped modes to compare values across categories
    • Adds Line chart support for visualizing trends over time with up to 200 data points
    • Adds Bar chart with stacked or grouped modes to compare values between different groups

    4 details in Everything

98. Review Alert Filters 🔇 Oct 14, 2024 · release notes

    Adds search, expiration dates, and mute counts to active alert filters in Sekoia.io Rules catalog

    • Adds search filter to the Rules catalog to find rules with active alert filters for periodic reviews
    • Adds expiration date support to alert filters for temporary muting (e.g., 24h, 7 days)
    • Displays the number of alerts muted by an alert filter in the last 30 days within the review view

    3 details in Everything

99. Integrations updates 🗞️ Oct 11, 2024 · release notes

    Sekoia.io adds six new data integrations and automations for SentinelOne, WithSecure, and Sophos

    • Adds Pradeo MTD integration for endpoint telemetry ingestion
    • Adds Google Cloud Load Balancing integration for network security logs
    • Adds 1Password EPM integration for applicative event collection
    • Adds Clavister NGFW integration for firewall log ingestion
    • Adds OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. generic integration for standardized log parsing

    +6 more show less

    • Adds Gatewatcher AionIQ V103 integration for network security events
    • Adds SentinelOne EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. automation actions: initiate scan, Update Threat Incident, Create Threat Note, and Create Iocs
    • Adds WithSecure EDR automation actions: kill thread, kill process, and enumerate processes
    • Adds Sophos EDR automation actions: isolate endpoint, deisolate endpoint, and scan
    • Enhances Alert Comment Created trigger to return comment uuid, comment content, comment date, and comment author uuid
    • Adds HarfangLab event fields: action.properties.CertIssuerName, action.properties.CertSerialNumber, action.properties.CertThumbprint, action.properties.PreAuthType, action.properties.ServiceName, action.properties.ServiceSid, action.properties.TicketEncryptionType, and action.properties.TicketOptions

    11 details in Everything

100. Segregated Data Access now available 🛡️ Oct 10, 2024 · release notes

     Sekoia.io now supports Segregated Data Access to compartmentalize data streams based on user permissions.

     • Segregated Data Access enables organizations to control which users can access specific subsets of data.
     • The Intake restricted role feature allows selection of authorized intakes for fine-grained access control.

     2 details in Everything

101. 📢 Introducing changelog directly in Sekoia Oct 2, 2024 · release notes

     Adds an integrated 'What's new?' changelog menu and mail notification settings directly in the Sekoia platform UI

     • What's new? menu adds an in-platform changelog view for feature updates
     • Visual notification and configurable mail alerts for platform changelog updates

     2 details in Everything

102. Sekoia extension for Palo Alto XSOAR is now available Sep 24, 2024 · release notes

     Sekoia extension for Palo Alto XSOAR is now available in the marketplace

     • Adds Sekoia Defend (XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss.) content pack to Palo Alto XSOAR for retrieving assets, collecting alerts, and querying events

     1 detail in Everything

103. Netskope intake improvements Sep 18, 2024 · release notes

     Adds five new netskope.* DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. fields to the Netskope integration intake.

     • Adds netskope.dlp.action field to capture the action taken on a DLP incident
     • Adds netskope.dlp.forensic_id field for forensic identifier mapping
     • Adds netskope.dlp.policy field indicating the policy that triggered the DLP incident
     • Adds netskope.dlp.profile_name field to store the DLP profile name
     • Adds netskope.dlp.rules field to list rules that triggered the DLP incident

     5 details in Everything

104. 🦅 New Crowdstrike actions (isolate, deisolate) added Sep 17, 2024 · release notes

     Adds isolate hosts and deisolate hosts playbook actions for Crowdstrike integration

105. New Intake v2 feature 🚀 Aug 30, 2024 · release notes

     Intake v2 for Sekoia Defend offers redesigned data source creation, health monitoring, enhanced search, and integrated diagnosis.

     • Adds a redesigned creation process in the UI to create data sources with a few clicks without relying on Playbooks
     • Enables monitoring the health state of data ingestion, including logs volume, event delivery performance, and parsing issues
     • Introduces enhanced search capabilities using search filters to retrieve datasources
     • Provides integrated diagnosis to review data collection errors and troubleshoot data pipeline issues

     4 details in Everything

106. 📈 Effortless widget edition Aug 28, 2024 · release notes

     Dashboard widgets can now be edited directly via the widget menu without entering full Edition mode.

     • Adds inline Edit widget option to dashboard widgets, removing the need for global Edition mode
     • Supports direct editing of Preset widget options (time range, visualization type) in an Editing panel
     • Redirects Query visualization edits to the query settings page upon selection

     3 details in Everything

107. Query Builders in Dashboards 🚀 Aug 16, 2024 · release notes

     Adds Query Builders to Sekoia.io Dashboards for dynamic data visualization and automatic synchronization.

     • Allows inserting existing query builders into any dashboard directly from the dashboard or query page
     • Provides automatic synchronization so edits to a query builder on the query page reflect in all dashboards using it
     • Ensures visualization consistency by applying the visualization settings saved with the query builder
     • Enables viewing a list of all dashboards using a query builder from its edit page

     4 details in Everything

108. Integration AWS CloudFront now in GA Aug 14, 2024 · release notes

     AWS CloudFront integration now in General Availability for collecting web logs.

     • Integrates AWS CloudFront to collect Web logs from the CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. for threat detection and hunting.

     1 detail in Everything

109. New integration Thinkst Canary [BETA] Aug 5, 2024 · release notes

     New Thinkst Canary [BETA] integration brings deception alerts into Sekoia.

     • Adds Thinkst Canary integration in BETA to collect accurate alerts for detecting intruders and blocking cyber-attacks

     1 detail in Everything

110. Integrations Fastly Next-Gen WAF Audit Logs and Veeam Backup & Replication in GA Jul 31, 2024 · release notes

     Sekoia.io adds GA Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and Veeam Backup & Replication integrations with specific log collection.

     • Adds Fastly Next-Gen WAF Audit Logs integration to collect Corp audit logs and Site audit logs for monitoring unusual admin activity in your WAF
     • Adds Veeam Backup & Replication integration to collect Application, File, Network and Service logs to monitor your critical backup and replication systems

     2 details in Everything

111. New integrations available for ESET, Juniper, Azure, EfficientIP and Sesame it 🎉 Jul 26, 2024 · release notes

     Sekoia.io adds BETA integrations for ESET Protect/Inspect, Juniper Switches, Azure App Gateway, EfficientIP and Sesame it Jizô NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems.

     • Adds ESET Protect / Inspect [BETA] integration to collect alerts and telemetry from Cloud and On-prem versions
     • Adds Juniper Switches [BETA] integration to collect firewall logs from Juniper switches
     • Adds Azure Application Gateway [BETA] integration to collect access and firewall logs
     • Adds Efficient IP [BETA] integration to collect DNS logs from EfficientIP SOLIDserver
     • Adds Sesame it Jizô NDR [BETA] integration to collect logs from the Jizô NDR network observability platform

     5 details in Everything

112. API keys have improved! Jul 25, 2024 · release notes

     Sekoia.io now supports expiration dates and granular permissions for API keys

     • API keys are now less than 100 characters long.
     • Users can specify expiration dates for API keys (predefined or custom up to 1 year).
     • Migration from role-based to permission-based API key system allows defining specific permissions per key.

     3 details in Everything

113. New integrations: Bitsight and Mimecast Jul 22, 2024 · release notes

     Sekoia.io adds BETA integrations for Bitsight SPM and Mimecast Email Security to collect findings and logs.

     • Adds Bitsight SPM integration in BETA to collect findings with vulnerability and asset details into Sekoia
     • Adds Mimecast Email Security integration in BETA to collect email gateway logs into Sekoia

     2 details in Everything

114. New integrations: Daspren Parad 🇫🇷 and Nybble Security 🇫🇷 Jul 11, 2024 · release notes

     Sekoia.io adds inbounds for Daspren Parad and outbounds for Nybble Security

     • Adds Daspren Parad integration to collect logs from this Data Detection and Response tool.
     • Adds Nybble Security integration to automatically create an alert in Nybble Hub when a new alert is raised in SEKOIA.IO.

     2 details in Everything

115. Query builder API documentation is available Jul 9, 2024 · release notes

     Sekoia Defend exposes Query Builder API documentation for direct interaction.

     • Query Builder API documentation is now available at https://docs.sekoia.io/xdr/develop/rest_api/query_builder/.

     1 detail in Everything

116. [Office 365 intake] Improvements Jul 2, 2024 · release notes

     Adds ParticipantInfo.HasForeignTenantUsers field to Office 365 intake for external chat detection

117. [Windows intake] Improvements Jul 1, 2024 · release notes

     [Windows intake] Adds process.parent.pid, TargetLogonId, MessageNumber/MessageTotal fields to Windows logs; fixes registry.key parsing

     • process.parent.pid field added for Event code 4688 (Process created) to allow analysts to read the whole process tree.
     • TargetLogonId field added for Event code 4624 (Account logged on) to allow analysts to get the user session ID and search attacker actions.
     • MessageNumber and MessageTotal fields added for Event code 4104 (Powershell Script Block Logging) to allow analysts to reconstitute split scripts.

     3 details in Everything

118. ⭐ Sekoia agent v.1.6.0 Jun 18, 2024 · release notes

     Sekoia Endpoint Agent v1.6.0 enhances functionality, security, and reliability for Linux and Windows.

119. Integration catalog updates 🎉 Jun 13, 2024 · release notes

     Sekoia.io adds Azure Key Vault and Ubika Cloud Protector Traffic integrations in Beta, plus five Endpoint tools reaching GA

     • Adds Azure Key Vault integration (Beta) to collect audit logs for monitoring cryptographic keys and secrets
     • Adds Ubika Cloud Protector Traffic integration (Beta) to collect web logs for CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. and built-in detection rules
     • Promotes Checkpoint Harmony Mobile integration to General Availability to collect alerts for mobile device visibility
     • Promotes Crowdstrike Falcon Telemetry integration to General Availability to collect endpoint telemetry
     • Promotes Palo Alto Cortex EDR integration to General Availability to collect alerts and telemetry

     +2 more show less

     • Promotes SentinelOne Cloud Funnel 2.0 integration to General Availability to collect endpoint telemetry
     • Promotes Stormshield SES integration to General Availability to collect endpoint telemetry

     7 details in Everything

120. Support of TheHive v5 🐝 Jun 10, 2024 · release notes

     Adds a dedicated playbook action for TheHive v5 integration

121. Duplicate rules, queries and playbooks ➿ Jun 4, 2024 · release notes

     Adds one-click duplication for rules, playbooks, and queries in Sekoia Defend

     • Adds a Duplicate button to the rule details panel to clone detection rules.
     • Adds a Duplicate button to the playbook panel to clone entire playbooks.

     2 details in Everything

122. Intelligence database: UX improvements and new telemetry columns 📺 Jun 4, 2024 · release notes

     Intelligence database adds unified filter menu (press F), column show/hide with drag-and-drop reordering, and Global/Workspace Telemetry columns.

     • Adds a centralized filter menu for Objects and Observables accessible via the F key shortcut

     1 detail in Everything

123. New Feature: Report Potential False Positives 🎈 May 31, 2024 · release notes

     Adds ability to report false positives directly from Alerts or Intelligence Database object details via UI.

     • Adds Report as False Positive option in Alert details for indicators
     • Adds Flag as potential false positive option in Intelligence Database Object Details

     2 details in Everything

124. Exciting new release: Threat Landscape 🎉 May 15, 2024 · release notes

     Sekoia.io launches the Threat Landscape feature for real-time adversary trend visibility and intrusion monitoring.

     • Provides real-time threat statistics and rankings within the new interface

     1 detail in Everything

125. New Integrations of April 🎉 Apr 26, 2024 · release notes

     Sekoia.io adds Fastly WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., Olfeo SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions., Ubika Cloud Protector, and Systancia Cleanroom integrations in April.

     • Adds Fastly WAF integration (BETA) to collect WAF alerts
     • Adds Fastly WAF integration (BETA) to collect Corp audit logs and Site audit logs
     • Adds Olfeo Secure Web Gateway integration (BETA) to collect network logs
     • Adds Ubika Cloud Protector integration (BETA) to collect WAF alerts
     • Adds Systancia Cleanroom integration (BETA) to collect authentication logs

     5 details in Everything

126. Sekoia.io Agent for MacOS is released in Beta 🍎 Apr 15, 2024 · release notes

     Sekoia.io Agent for MacOS beta releases with optimized resource utilization and minimal configuration overhead.

     • Adds the Sekoia.io Agent for MacOS to enable security event collection on macOS endpoints
     • Introduces optimized compression and aggregation algorithms to minimize CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., and bandwidth usage for the new Mac agent

     2 details in Everything

127. 🎉 Exciting new release: Unified Sekoia SOC Platform interface Apr 11, 2024 · release notes

     Unified Sekoia SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Platform interface merges Intelligence, Operation, and User Centers into a single workspace with customizable menus, dark mode, and workspace switching.

     • Adds a unified interface merging the Intelligence Center (IC), Operation Center (OC), and User Center (UC) into one workspace
     • Enables menu customization via a new favorite system for marking important items

     2 details in Everything

128. 🎉 News integrations available! 🎉 Mar 19, 2024 · release notes

     Adds AWS CloudFront, Palo Alto Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss., Broadcom SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions., and CrowdStrike Falcon for Mobile integrations

     • Adds AWS CloudFront integration (BETA) to collect CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. telemetry events
     • Adds Palo Alto Cortex XDR (EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.) integration (BETA) to collect alerts and telemetry in real time
     • Adds Broadcom Cloud Secure Web Gateway integration (BETA) for cloud-native content filtering
     • Adds Broadcom Edge Secure Web Gateway integration (BETA) for on-prem threat protection
     • Adds Crowdstrike Falcon For Mobile integration (GA) for iOS and Android device alerts

     5 details in Everything

129. Update of intake F5 BIG-IP Mar 18, 2024 · release notes

     Adds F5 BIG-IP APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause., LTM, AFM and PSM intake with extracted rule names and timestamps

     • Adds support for F5 Big-IP APM, LTM, AFM and PSM integration to the Sekoia.io intake.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The previous value of event.category is now mapped to event.action
     • !The previous value of observer.type is now mapped to observer.product
130. Improve your IOC detection capabilities with retrohunting! Mar 14, 2024 · release notes

     Adds Retrohunt alerts to Sekoia SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. for real-time and retrospective IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. detection.

     • Adds Retrohunt alerts to uncover potential threats in real-time and retrospectively with insights into alerts triggered by Retrohunt
     • Provides deeper understanding of the platform's Indicators of Compromise (IoC) identification mechanism to support decision-making
     • Integrates IOC collection to enhance the existing IoC detection process

     3 details in Everything

131. ⭐ Sekoia agent v.1.5.0 Feb 16, 2024 · release notes

     Sekoia agent v1.5.0 adds path exclusion, advanced file monitoring patterns, and optional DNS capture on Linux

     • Adds the ability to exclude specific paths from monitoring across all operating systems.
     • Adds support for path pattern configuration in advanced file monitoring.
     • Enables optional DNS resolution capture on Linux agents.

     3 details in Everything

132. 🚀 Playbooks enhanced with 3 new features Jan 31, 2024 · release notes

     Sekoia.io playbooks gain a variable selector in node configs, click-to-add node chaining, and enhanced Run view with per-run condition context.

     • Run view now displays the exact playbook state and individual run logs for each execution history item
     • Input fields in node configuration now include a variable selector allowing direct insertion of variables from any node in 2 clicks
     • Playbook editor gains a click to add interaction that inserts a new node at the clicked location

     3 details in Everything

133. New feature: Built-in roles Jan 29, 2024 · release notes

     Platform update enhancing user management with new pre-configured access levels.

134. Integrations News & Updates 🎉 Dec 21, 2023 · release notes

     New Sekoia.io integrations for OpenVPN, Checkpoint Harmony Mobile, Azure Files, IIS, Darktrace, and Cato.

     • Adds OpenVPN integration to ingest access logs and connection events detected by CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. rules
     • Adds Checkpoint Harmony Mobile integration for mobile device alerts collection
     • Adds Azure Monitor for Azure Files integration to collect events and monitor access to sensitive files
     • Adds Microsoft IIS integration for access logs ingestion
     • Enhances Darktrace connector to support IA analyst events

     +1 more show less

     • Adds Cato SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. connector for comprehensive event collection (Firewall, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection., Malware detection, Network connection and more)

     6 details in Everything

135. New version: Sekoia agent 1.4 Dec 8, 2023 · release notes

     Sekoia Endpoint Agent 1.4 adds multi-region support via config parameter and custom CA for proxies

     • multi_region config parameter allows agents to interact with the tenant's specific region
     • Support for custom CA certificates when using a proxy
     • Improved logs aggregation isolates signal from noise, reducing network and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. footprint

     3 details in Everything

136. Enhanced integration: Active Directory upgrade 🚀 Nov 29, 2023 · release notes

     Sekoia.io Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integration now supports enabling/disabling users and resetting passwords via playbooks for both Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and on-premises AD.

     • Extends Active Directory playbook actions to cover Microsoft Entra ID in the cloud alongside on-premises Active Directory.

     1 detail in Everything

137. Revamped Asset Management: Beauty Meets Functionality 🌟 Nov 20, 2023 · release notes

     Sekoia Defend unveils revamped Asset Management feature with enhanced UI.

138. New Jira integration for efficient incident management 🚀 Nov 15, 2023 · release notes

     Adds Sekoia.io Jira integration for automated incident management via playbooks

     • Adds Jira integration to automate issue creation and streamline security incident workflows

     1 detail in Everything

139. Add multiple alerts to a case Nov 14, 2023 · release notes

     Adds bulk alert-to-case ingestion from the alerts page in Sekoia Defend

     • Adds the ability to select multiple alerts and add them in bulk to a case from the alerts page

     1 detail in Everything

140. 4 new integrations available in public beta! 🚀 Nov 9, 2023 · release notes

     Adds public beta support for AD Audit Plus, Sonicwall Secure Mobile Access, Trellix Network Security, and Trend Micro Email Security integrations.

     • Adds AD Audit Plus integration in public beta for connecting to the Sekoia SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Platform
     • Adds Sonicwall Secure Mobile Access integration in public beta for connecting to the Sekoia SOC Platform
     • Adds Trellix Network Security integration in public beta for connecting to the Sekoia SOC Platform
     • Adds Trend Micro Email Security integration in public beta for connecting to the Sekoia SOC Platform

     4 details in Everything

141. Playbooks On-Premises (Public beta) is here! 🔥 Oct 30, 2023 · release notes

     Playbooks On-Premises public beta allows executing Playbook actions on local networks.

     • Enables execution of Playbook actions (e.g., Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. management, firewall rule modification) on local networks inaccessible via the internet.
     • Provides a unified interface to select and execute local network actions within the existing Playbook workflow.

     2 details in Everything

142. 🌟 6 new network integrations now live in Sekoia SOC Platform! 🚀 Oct 25, 2023 · release notes

     Adds six new network integrations to Sekoia SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Platform for enhanced threat detection.

     • Adds support for Cato Networks SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. integration.
     • Adds support for Cisco NX-OS integration.
     • Adds support for OGO WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. integration.
     • Adds support for OPNSense integration.
     • Adds support for Skyhigh Secure Web Gateway integration.

     +1 more show less

     • Adds support for SonicWall Firewall integration.

     6 details in Everything

143. 🚀 Notification Settings are now available in a multi-tenant context ! Oct 18, 2023 · release notes

     Notification settings now support filtering by sub-community in Sekoia Defend.

     • Adds the ability to select specific sub-communities for notification delivery in Sekoia Defend.

     1 detail in Everything

144. 🌟 4 new Cloud & SaaS integrations out of beta! 🌟 Oct 18, 2023 · release notes

     Sekoia.io adds AWS GuardDuty, Cortex Data Lake, Salesforce, and Varonis integrations out of beta.

     • Adds AWS GuardDuty integration
     • Adds Palo Alto Cortex Data Lake integration
     • Adds Salesforce integration
     • Adds Varonis integration

     4 details in Everything

145. Announcing SEKOIA.IO for AWS Network Firewall! 🎉 Oct 12, 2023 · release notes

     Sekoia.IO introduces an open-source CDK integration for AWS Network Firewall to ingest its CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feed via Lambda.

     • Adds sekoiaio-cti-aws-integration GitHub repository containing a CDK script to deploy an AWS architecture that syncs Sekoia threat intelligence to Network Firewall rule groups
     • Enables automatic population of AWS Network Firewall rule groups with Sekoia IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. via a deployed Lambda function

     2 details in Everything

146. Agent 1.2.1 release : Watch applications logs (Beta) ! 🔥 Oct 12, 2023 · release notes

     Agent 1.2.1 adds beta application log watching capability with simplified configuration.

     • Enables beta support for watching and sending application logs from files to Sekoia.io
     • Simplifies log collection setup requiring only two lines in the Agent configuration file

     2 details in Everything

147. 7 new and improved integrations supercharge Sekoia.io XDR's endpoint capabilities! 🚀 Oct 4, 2023 · release notes

     Sekoia.io XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adds seven new endpoint integrations for enhanced threat detection and response

     • Adds Crowdstrike Falcon Telemetry integration to the endpoint category of Sekoia XDR platform
     • Adds Microsoft 365 Defender integration to the endpoint category of Sekoia XDR platform
     • Adds Sophos EDR integration to the endpoint category of Sekoia XDR platform
     • Adds Trend Micro Apex One integration to the endpoint category of Sekoia XDR platform
     • Adds WithSecure Elements integration to the endpoint category of Sekoia XDR platform

     +2 more show less

     • Adds VMWare ESXi integration to the endpoint category of Sekoia XDR platform
     • Adds VMware vCenter integration to the endpoint category of Sekoia XDR platform

     7 details in Everything

148. 🚀 6 new Identity & Access Management integrations now out of beta! Sep 26, 2023 · release notes

     Sekoia.io brings six Identity & Access Management integrations out of beta

     • Adds Cisco Duo Security as an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. integration
     • Adds Cisco ISE as an IAM integration
     • Adds Cloudflare Access Requests as an IAM integration
     • Adds Crowdstrike Falcon (Identity Protection) as an IAM integration
     • Adds Jumpcloud Directory Insights as an IAM integration

     +1 more show less

     • Adds RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. SecurID as an IAM integration

     6 details in Everything

149. Rules Catalog updates! (Cisco, Darktrace, GitHub, Microsoft, Sekoia.io, SentinelOne, RSA) Sep 1, 2023 · release notes

     Sekoia.io adds detection rules for Cisco ESA, Darktrace, GitHub, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Office365, SentinelOne, and RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., plus OS-specific threats.

     • Adds support for Cisco ESA integration with 1 rule to detect suspicious email attachments
     • Adds support for Darktrace Threat Visualizer integration with 2 rules to alert on Critical or Suspicious behavior
     • Adds support for GitHub Audit Logs integration with 5 rules related to compliance or suspicious actions
     • Adds support for Microsoft Entra ID (Azure AD) integration with 3 rules detecting configuration changes and phishing pages
     • Adds support for Office365 integration with 4 rules for email forwarding and Business Email Compromise detection

     +7 more show less

     • Adds support for Sekoia.io activity logs integration with 1 rule to detect Login Brute-Force
     • Adds support for SentinelOne integration with 1 rule to detect login brute force on Management Console
     • Adds support for RSA SecurID integration with 1 rule to detect failed authentication
     • Adds Linux-specific detections for Fail2ban and Shell PID Injection (2 rules)
     • Adds Windows-specific detections including Suspicious TGS requests, Reconnaissance Commands, and Powershell AMSI Bypass (11 rules)
     • Adds Cloud-specific WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. Correlation Block action detections (2 rules)
     • Enables filtering on editor/product names in the Rules Catalog tags

     12 details in Everything

150. ✅ New feature: Add users in bulk Jul 25, 2023 · release notes

     Sekoia Defend introduces bulk user addition for streamlined team onboarding via the workspace UI.

     • Enables adding multiple users to a workspace by pasting comma-separated email lists or manually entering several emails in the onboarding flow.

     1 detail in Everything

151. New feature : make Two-Factor Authentication (2FA) mandatory on your community Jul 11, 2023 · release notes

     Sekonia.io adds mandatory Two-Factor Authentication (2FA) enforcement for community workspaces.

152. New release : Playbooks notifications (Single-tenant only) Jun 27, 2023 · release notes

     Adds playbook error and crash notifications to track operations.

     • Enables configuration of alerts for playbook execution errors and crashes.
     • Notifications are available exclusively for single-tenant workspaces.

     2 details in Everything

153. Integration: winlogbeat and Cisco Meraki MX now available May 31, 2023 · release notes

     SEKOIA.IO adds winlogbeat and Cisco Meraki MX data intake formats for general availability

     └──▷ HOW TO FIND IT
     Ingest Windows security events into SEKOIA.IO XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. using the new Winlogbeat integration
     📍https://docs.sekoia.io/xdr/features/collect/integrations/endpoint/winlogbeat/
     Configure the Meraki MX network integration to monitor device activity in SEKOIA.IO
     📍https://docs.sekoia.io/xdr/features/collect/integrations/network/cisco/cisco_meraki_mx/
     • Adds winlogbeat format to ingest Windows log events from the open-source agent
     • Adds cisco_meraki_mx format to supervise network activities from Meraki MX devices

     2 details in Everything

154. 🎉 New release : A (lot) better filtering tool for Alerts May 5, 2023 · release notes

     Sekoia Alerts UI gains exclusion filters, multi-value handling, keyboard nav, and pre-made filter presets

     • Adds exclusion filter support in the Alerts list to skip matching events
     • Enables managing multiple values per filter criterion in the Alerts filter component
     • Adds seamless update of the current filter state without full page reloads
     • Adds keyboard navigation for the Alerts filter interface
     • Introduces pre-made filters selectable directly in the Alerts filter panel

     5 details in Everything

155. New features : More security to protect your account May 3, 2023 · release notes

     Sekoia.io adds automatic logout (configurable timeout) and auto-deactivation of inactive accounts for PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly./DSS compliance.

     • Managed Communities > Security settings now include Automatic logout to close sessions after inactivity (default 24h, configurable to 15mn)
     • Managed Communities > Security settings now include Account deactivation to auto-disable users inactive for 90 days

     2 details in Everything

156. Intelligence page : Multilines search for objects and observables ! Apr 5, 2023 · release notes

     Adds multilines search for objects and observables on the Intelligence page; removes redundant Observables menu.

157. Modify Alert Status with No Restrictions 🎉 Mar 27, 2023 · release notes

     Sekoia Defend now allows modifying alert status without any restrictions

158. The SEKOIA.IO Endpoint Agent V1 is out of Beta! Mar 10, 2023 · release notes

     Sekoia.io Endpoint Agent V1 exits beta with stable binaries for Windows and Linux

159. FreeRADIUS format available 👻 Feb 27, 2023 · release notes

     Sekoia.io adds FreeRADIUS log ingestion and viewing in the events page

     • Adds FreeRADIUS format integration for supervising authentication and accounting logs.
     • Enables viewing FreeRADIUS events through the platform's events page.

     2 details in Everything

160. Import your IoC’s in SEKOIA.IO (and other updates) Feb 14, 2023 · release notes

     Sekoia.io adds IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. import via file/API, stable Anomaly Detection rules, and new UI pivots.

     • Adds the ability to import IoCs in SEKOIA.IO from CSV or XLSX files and through a TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. URL integration
     • Makes anomaly detection rules generally available (GA), moving them out of beta
     • Introduces new UI pivots for navigating between rules, alerts, and intakes

     3 details in Everything

161. Tracking new threats with SEKOIA C2 Tracker: HookBot & new SEO poisoning infrastructures typosquatting notorious software 🌐 Feb 7, 2023 · release notes

     New SEKOIA C2 Tracker capabilities added for HookBot and SEO poisoning infrastructures

     • Adds SEKOIA C2 Tracker source filter to Intelligence Center IoCs for tracking new Command & Control infrastructure.
     • Enables detection tracking for newly supervised threats HookBot and typosquattingtyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike.-based SEO poisoning sites.

     2 details in Everything

162. Netskope integration out of beta Feb 2, 2023 · release notes

     Netskope integration leaves beta

     • Adds the SEKOIA.IO x Netskope integration connector to monitor authentications and activities in Cloud applications.
     • Removes beta status from the Netskope integration, making it generally available for forward events.

     2 details in Everything

163. Define your own custom similarity strategy Jan 30, 2023 · release notes

     Allows users to define custom similarity strategies for alert grouping at the rule level in Sekoia Defend.

     • Adds the ability to see, create, or update similarity strategies at the rule level instead of using only default identical-field grouping.
     • Enables custom configuration of alert similarity logic per detection rule.

     2 details in Everything

164. Tracking new threats with SEKOIA C2 Tracker: RedWarden, TrueBot, Aurora, Cova, Nosu, Squarephish, ChaosRAT 🕵️ Jan 10, 2023 · release notes

     Sekoia adds SEKOIA C2 Tracker source for new IoCs covering RedWarden, TrueBot and more.

     • Adds the SEKOIA C2 Tracker as a filterable source in the Intelligence Center
     • New C2 trackers operational for RedWarden, TrueBot, Aurora, Cova, Nosu, Squarephish, ChaosRAT, and DuckLogs

     2 details in Everything

165. In the content proposal, bulk change the attributes of the IOCs. Jan 9, 2023 · release notes

     Adds bulk attribute editing for IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. in the Content Proposal

     • Enables mass changing TLP, Source, Kill chain, and date validity attributes for multiple IOCs simultaneously in the Content Proposal

     1 detail in Everything

166. Christmas integrations🎄 Dec 23, 2022 · release notes

     Sekoia.io adds new log collection integrations for Microsoft Intune, AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., Okta and IBM AIX.

     └──▷ HOW TO FIND IT
     Monitor mobile device compliance by collecting Intune logs.
     📍https://docs.sekoia.io/xdr/features/collect/integrations/endpoint/microsoft_intune/
     Alert on malicious web traffic by connecting AWS WAF logs.
     📍https://docs.sekoia.io/xdr/features/collect/integrations/cloud_and_saas/aws/aws_waf/
     Supervise cloud app authentication via Okta system logs.
     📍https://docs.sekoia.io/xdr/features/collect/integrations/cloud_and_saas/okta_system_log/
     Collect audit logs from IBM AIX endpoints.
     📍https://docs.sekoia.io/xdr/features/collect/integrations/endpoint/ibm_aix/
     • Adds Microsoft Intune integration to monitor mobile devices and applications
     • Adds AWS WAF integration to alert on malicious HTTP(S) requests
     • Adds OKTA integration to supervise authentication to cloud apps
     • Adds IBM AIX integration to collect audit and activities logs

     4 details in Everything

167. Rules Catalog updates! (OKTA, AWS, Cybereason, WAF, ISO-LNK) Dec 20, 2022 · release notes

     New detection rules for Okta, AWS, Cybereason, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. block detections, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-LNK correlation added to Sekoia.io.

     • Adds 13 new detection rules on OKTA to detect abnormal user activities
     • Adds 23 new detection rules on AWS to detect abnormal user activities
     • Adds 2 new detection rules for Cybereason, covering MalOp alerts and malware detection
     • Adds a generic WAF Block Rule to detect external attacks, supporting AWS and Cloudflare WAF sources
     • Adds a correlation rule detecting infection chains using archive formats (ISO, VHD, IMG) to hide LNK files

     5 details in Everything

168. SEKOIA.IO Agent - Public beta 2 Dec 6, 2022 · release notes

     Sekoia.io Agent beta 2 adds auto-update mechanism, broader event collection (DNS, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS.), and Windows binary signing.

     • Adds an auto-update configuration option to the Sekoia.io Agent so that new agent versions are automatically downloaded and installed on endpoint hosts
     • Extends the Sekoia.io Agent's event collection surface to include DNS server requests, RDP connections, and WinRM information
     • Introduces Microsoft-recognized code signing for the Windows binary of the Sekoia.io Agent

     3 details in Everything

169. Add events to cases Nov 28, 2022 · release notes

     Sekoia Defend allows adding events to cases directly from the event list or creating cases on the spot.

     • Adds the ability to add any event to existing cases from the event list
     • Enables creating a new case on the spot directly from an event in the list

     2 details in Everything

170. Events Search History Improvements Nov 28, 2022 · release notes

     Sekoia Events Search History now supports search differentiation, result sharing via link, and extended instant result availability.

     • Differentiates event searches performed by individual users from those of colleagues in the Search History view
     • Allows sharing search results by copying a shareable link directly from the Search History
     • Indicates when instant results are available and extends their availability period

     3 details in Everything

171. Built-in detection rules, EventIDs and EventProviders relations Nov 15, 2022 · release notes

     Sekoia Defend adds a new documentation page linking built-in detection rules to their required EventIDs and Event Providers.

172. Collect TEHTRIS EDR events in SEKOIA.IO 🏯 Nov 7, 2022 · release notes

     New SEKOIA.IO integration for TEHTRIS EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. alerts

     • Adds support for collecting and normalizing TEHTRIS EDR alerts via a dedicated connector

     1 detail in Everything

173. WatchGuard Firebox integration released 🔥 Oct 25, 2022 · release notes

     Newsekoia.io WatchGuard Firebox integration for network traffic supervision

     • Adds WatchGuard Firebox as a supported integration format in Sekoia.io to supervise network traffic.
     • Enables visualization of WatchGuard Firebox events on the Sekoia.io events page.

     2 details in Everything

174. Drill down into your events with the new filters 🕵️ Oct 7, 2022 · release notes

     Adds UI Event Filters with edit, remove, invert, and disable badges to restrict search scope in Sekoia Defend

     • Introduces Events Filters as individual badges below the search bar to restrict the scope of event searches.
     • Enables actions on individual filter badges: edit, remove, invert, or temporarily disable them.

     2 details in Everything

175. Tracking new threats with SEKOIA C2 Tracker: JSSLoader, Xsploit, EvilProxy, and more! 🕵️ Oct 6, 2022 · release notes

     SEKOIA C2 Tracker adds IoCs for JSSLoader, Xsploit, EvilProxy, and others

     • Adds SEKOIA C2 Tracker as a filterable source in the Intelligence Center for tracking Command & Control infrastructure.
     • Updates threat coverage to include newly supervised threats (EvilProxy, Manjusaka, Xsploit, JSSLoader, Erbium, Lumma, GinzoStealer) and already tracked threats (BruteRatel, Sliver, Amadey, Revsocks).
     • Provides analyst-created cards and models for the above threats in the Intelligence Center.

     3 details in Everything

176. OSINT collection playbooks updated with new threats: Brute Ratel C4, Lumma Stealer, TinyNuke, Erbium, etc. 🦠 Oct 3, 2022 · release notes

     Sekoia.IO updates OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. collection playbooks to ingest IoCs for new malware families including Brute Ratel C4 and Lumma Stealer

     • OSINT collection playbooks now automatically gather and contextualize Indicators of Compromise (IoCs) for new or recent information stealers (Erbium, Lumma, LOLI Stealer, YTStealer, Zingo), widespread loaders (PrivateLoader, PureCrypter, NullMixer, Colibri, IceXLoader), and C2 frameworks (Sorillus RAT, TinyNuke, Empire, Brute Ratel C4) from community threat intelligence feeds and Hatching Triage sandbox analysis.

     1 detail in Everything

177. Proofpoint email integrations available Sep 30, 2022 · release notes

     Sekoia.io adds Proofpoint TAP and On Demand integrations for real-time threat monitoring

     • Adds Proofpoint Targeted Attack Protection (TAP) integration to collect detected threats and monitor malicious link clicks.
     • Adds Proofpoint On Demand integration to observe email exchanges in realtime.

     2 details in Everything

178. Single Sign-On Authentication with OpenID Connect on SEKOIA.IO TIP Sep 15, 2022 · release notes

     SEKOIA.IO TIP adds OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Single Sign-On authentication via Office 365 or Azure AD

179. Entering Microsoft Defender integrations Sep 14, 2022 · release notes

     Adds Microsoft Defender for Endpoints and O365 event collection via Azure EventHub trigger.

     • Adds support for collecting events from Microsoft Defender for Endpoints using the Azure EventHub trigger
     • Extends Office 365 format to support Microsoft Defender for O365 events

     2 details in Everything

180. Block users on Azure AD and control your Sentinel One's endpoints with Symphony Sep 8, 2022 · release notes

     New Azure AD and Sentinel One Symphony modules for Sekoia.io automation

     • Adds Azure AD symphony module to monitor and act on users in Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
     • Adds Sentinel One symphony module to check and control endpoints against malicious activities

     2 details in Everything

181. Collect Azure Front Door logs with our EventHub connector Sep 6, 2022 · release notes

     Adds Azure Front Door log collection via the new Azure EventHub trigger connector

     • Adds Azure Front Door format support in the SEKOIA.IO catalog for monitoring access logs to global CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. content.
     • Adds the Azure EventHub trigger connector to forward messages from any EventHub to any intake.

     2 details in Everything

182. Discovery Correlation Rule 📝 Sep 6, 2022 · release notes

     New Discovery Commands Correlation Sigma rule detects ransomware recon chains (cmd/powershell -> nltest -> net) with low false positives.

     • Adds Discovery Commands Correlation correlation rule to detect command chains (cmd/powershell, nltest, then net) over a one-minute period.

     1 detail in Everything

183. Automatically reject alerts generated by revoked indicators Aug 30, 2022 · release notes

     Adds automatic alert rejection when Intelligence Center indicators are revoked

     • Alerts created by revoked Intel Center indicators are automatically rejected with an explanatory comment

     1 detail in Everything

184. Add a comment when you edit alerts' statuses in bulk. Aug 25, 2022 · release notes

     Adds comment field for bulk status edits in Sekoia.io alerts listing

     • Allows adding a comment when editing alert statuses in bulk on the alerts listing screen

     1 detail in Everything

185. New tab "Similar Alerts" on the alert details page Aug 16, 2022 · release notes

     Sekoia adds Similar Alerts tab to alert details for investigation context

186. SEKOIA Endpoint Agent for Linux 🐧 Aug 11, 2022 · release notes

     Release of the SEKOIA Endpoint Agent for Linux in beta, enabling ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.-formatted telemetry via the Linux Audit Framework.

     • Introduces a new endpoint agent for Linux that collects process, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection, and file creation events using the Linux Audit Framework.
     • Enables data export to SEKOIA.IO in ECS format for use with existing Linux detection rules.

     2 details in Everything

187. Trigger logs in Playbooks 📝 Aug 10, 2022 · release notes

     Sekoya.io adds trigger logs in Playbook triggers to help creators understand execution flow and troubleshoot issues.

188. Tracking new threats with SEKOIA C2 Tracker: PrivateLoader, Sload, NoMercy, and more! 🕵️ Aug 8, 2022 · release notes

     New SEKOIA C2 Tracker sources for PrivateLoader, Sload, NoMercy, ABCSoup, DeimosC2, ExoBot, Sliver, BruteRatel, and Magecart

     • Adds IoCs collected from the new SEKOIA C2 Tracker source to the Intelligence Center for newly supervised threats (PrivateLoader, Sload, NoMercy, ABCSoup, DeimosC2, ExoBot)
     • Adds IoCs collected from the existing SEKOIA C2 Tracker source to the Intelligence Center for already tracked threats (Sliver, BruteRatel, Magecart cluster)

     2 details in Everything

189. Learn what is usual to spot the intruder 🔦 Aug 3, 2022 · release notes

     Sekoia adds statistical anomaly detection engine that learns perimeter seasonality from aggregation queries to reduce false positives.

     • Adds a third detection technology using Statistical Analysis and Machine Learning to spot advanced intruders using valid credentials and legitimate tools.
     • Enables an anomaly detection engine that automatically and continuously learns the seasonality of user-defined aggregation queries, removing the need for static thresholds.

     2 details in Everything

190. Re-run a playbook ♾️ Aug 1, 2022 · release notes

     Playbook orchestrator now supports re-running specific playbook runs or their individual actions.

     • Adds the ability to re-run a previously executed playbook instance to retry execution after errors like remote service unavailability
     • Enables re-running only pending or errored actions within a failed playbook run

     2 details in Everything

191. Aggregation on Events comes to life 📈 Jul 28, 2022 · release notes

     Sekoia adds in-console event aggregation (Count, Cardinality, Sum, etc.) to visualize search results over time.

     • Adds an aggregation view to the event page, allowing users to select a method and visualize computed values over time for any search query
     • Supports six new aggregation methods: Count, Cardinality, Sum, Min, Max, and Average

     2 details in Everything

192. Cloudflare intakes now available Jul 28, 2022 · release notes

     Adds Cloudflare HTTP request, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. event, and DNS log integrations with dedicated CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. rules

     • Adds Cloudflare HTTP requests integration to collect access logs and observe content distribution through the Cloudflare CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server.
     • Adds Cloudflare Firewall events integration to monitor network traffic and detected attacks from the Cloudflare WAF
     • Adds Cloudflare DNS logs integration to follow domain-name resolutions to your servers
     • Adds two dedicated Cyber Threat Intelligence (CTI) rules to raise alerts based on Cloudflare managed rules or Cloudflare customer defined rules

     4 details in Everything

193. First rule for CrowdStrike Falcon EDR agent Jul 27, 2022 · release notes

     Adds first CrowdStrike Falcon EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration to Sekoia.io

     • New CrowdStrike Falcon EDR integration in Rules Catalog raises an alert when the agent detects a threat

     1 detail in Everything

194. 14 new detection rules for SentinelOne agent 🕵 Jul 18, 2022 · release notes

     Adds 14 new detection rules for SentinelOne agent intake on Sekoia.io

     • Adds 14 specific detection rules for the SentinelOne agent integration.
     • Adds SentinelOne Custom Rule Alert rule to raise alerts based on user-defined SentinelOne custom rules.

     2 details in Everything

195. Tracking new threats with SEKOIA C2 Tracker: Raccoon Stealer v2, NetDooka, Matanbuchus, TearDroid and more! 🕵️ Jul 11, 2022 · release notes

     SEKOIA C2 Tracker adds detection for Raccoon Stealer v2, NetDooka, Matanbuchus, TearDroid, Roaming Mantis and Satellite

     • Adds support for the Raccoon Stealer C2 tracker in the SEKOIA C2 Tracker data source to identify associated indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
     • Adds support for the NetDooka, Matanbuchus and TearDroid C2 trackers in the SEKOIA C2 Tracker data source for newly supervised threats.
     • Adds support for the Roaming Mantis and Satellite C2 trackers in the SEKOIA C2 Tracker data source to update existing threat coverage.

     3 details in Everything

196. SEKOIA.IO Agent for Endpoint 🤩 Jun 30, 2022 · release notes

     New SEKOIA.IO Agent for Endpoint enables Windows event collection for XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. detection

     • Adds the SEKOIA.IO Agent for Endpoint, a new agent installed on Windows workstations and servers to collect native logging events for XDR correlation.
     • Introduces secure conveyance of host events to the SEKOIA.IO platform for intrusion detection.

     2 details in Everything

197. Comments in Content Proposal 💬 Jun 21, 2022 · release notes

     Adds Comments button to Content Proposal pages in SEKOIA.IO TIP for reviewer collaboration

     • Comments button added to Content Proposal page to allow reviewers and assignees to add comments during the review process

     1 detail in Everything

198. Request for Intelligence 🛎️ Jun 21, 2022 · release notes

     Adds Request for Intelligence (RFI) feature to SEKOIA.IO TIP Intelligence Center for analyst collaboration

     • Adds Request for Intelligence (RFI) functionality within the Intelligence Center to enable end-users to request intelligence reports or actions from colleagues directly via the platform.

     1 detail in Everything

199. Single Interface for Objects and Observables 💎 Jun 21, 2022 · release notes

     Sekoia Intelligence merges object and observable pages into a single unified interface.

     • Intelligence Center now provides a 'single source of trust' by merging previously separate object and observable pages.

     1 detail in Everything

200. Telemetry on Observables ✨ Jun 21, 2022 · release notes

     Sekoia.io now displays telemetry statistics (sighting counts) on observable pages to help analysts verify IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. anteriority and gain context.

201. OSINT collection playbooks updated with new threats: Follina, Black Basta, FFDroider... 🤖 Jun 10, 2022 · release notes

     OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. collection playbooks now monitor IoCs for Follina, Black Basta, and other emerging malware families

     • Adds monitoring of Indicators of Compromise (IoCs) for the Follina vulnerability (CVE-2022-30190) in OSINT collection playbooks
     • Adds tracking for new or emerging malware families: Black Basta, StormKitty, Eternity Stealer, FFDroider, Jester Stealer, Parasite RAT, and Blister

     2 details in Everything

202. Introduce Google Cloud integrations Jun 8, 2022 · release notes

     Adds three new Google Cloud intakes (Google Cloud Audit, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow logs) and a corresponding playbook template for automated event processing.

     • Adds the Google Cloud Audit intake to collect and monitor activities from Google Workspace services.
     • Adds the Google Kubernetes Engine intake to track and detect unclear behaviours in Kubernetes clusters.
     • Adds the Google VPC Flow logs intake to supervise network flows from and to virtual machines.
     • Adds a new playbook template to pull and forward events from these Google Cloud integrations to SEKOIA.IO.

     4 details in Everything

203. Monitor your traffic from Forcepoint Security Web Gateway in SEKOIA.IO Jun 1, 2022 · release notes

     Adds Forcepoint Security Web Gateway integration to SEKOIA.IO for traffic visualization and detection.

     • Adds support for monitoring traffic traces from Forcepoint Security Web Gateway in SEKOIA.IO
     • Enables visualization of Forcepoint events and raising alerts via SEKOIA.IO detection rules

     2 details in Everything

204. Major review on the Russian threat context and associated threat actors Jun 1, 2022 · release notes

     Sekoia.io updates intelligence objects for Russian state-sponsored threat actors, intrusion sets and associated TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind./IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..

     • Updates strategic intelligence assessment on the Russian Federation cyber organization and associated threats within SEKOIA Intelligence
     • Refreshes descriptions and associated IOCs/YARA rules for state sponsored threat actors including GRU, SVR, and FSB
     • Updates details for Russian intrusion sets Sandworm, APT28, Nobelium, Turla, and DragonFly with related TTPs and indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.

     3 details in Everything

205. New contextualized observables related to Tor guard nodes 🧅 May 31, 2022 · release notes

     New tor:guard observable tag for Tor entry node IPs enables perimeter monitoring of Tor usage.

     • Adds the tor:guard tag to approximately 4,200 daily IP addresses for Tor guard nodes in the Intelligence Center
     • Enables the TOR usage detection rule in the Operation Center (XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss.) catalog to identify perimeter equipment connecting to the Tor network

     2 details in Everything

206. ⚠️ FLINT reports - Create a notification to keep receiving them by email ✉️ May 25, 2022 · release notes

     Sekoia.io FLINT reports now deliver in-app PDF and STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.; email requires new User Center notification

     • FLINT reports are now integrated directly in SEKOIA.IO in PDF format and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 with their respective IOCs, available in real-time.
     • All previous FLINT reports are available for download in PDF format in the Intelligence Center module of SEKOIA.IO.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !FLINT reports are no longer sent by email by default; users must create a notification from their User Center to keep receiving them via email.
207. Collect Cybereason Malop activities with our new intake May 16, 2022 · release notes

     Sekoia Defend adds a new Cybereason MalOp intake for collecting and visualizing Malop activities.

     • Enables visualization of collected events with enrichments and contextualization

     1 detail in Everything

208. New object details page 🎉 May 12, 2022 · release notes

     Sekoia.io adds a new Object details page with tabs including Threat Context and embedded Observables.

     • Adds a new Object details page with tabs moved to the top of the page for faster context access.
     • Adds a Threat Context tab showing statistics and filtering capabilities for object relationships.
     • Adds inline observables view on an indicator's page, allowing users to see linked observables without leaving the page.

     3 details in Everything

209. OSINT collection playbooks updated: Kaiji, StealthWorker, Ave Maria... 🦠 May 3, 2022 · release notes

     Sekoia.io adds OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. collection for Stealthworker, Kaiji, and Ave Maria malware families.

     • Adds automatic collection and context for Stealthworker/GoBrut Linux malware IoCs via updated playbooks
     • Adds automatic collection and context for Kaiji IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. malware IoCs via updated playbooks
     • Adds automatic collection and context for Ave Maria cyber criminal tool IoCs via updated playbooks
     • Adds new Cobalt Strike threat trackers to OSINT collection for more exhaustive detection

     4 details in Everything

210. Analyze malwares with Glimps May 2, 2022 · release notes

     Sekoia Defend adds Glimps integration for malware analysis and classification via playbook actions.

     • Adds Glimps integration to Sekoia Defend for analyzing and classifying malwares.
     • Enables scoring hazardousness of contents through new Glimps actions in playbooks.

     2 details in Everything

211. CrowdSec: New contextualized observables related to scanning activities 💻 Apr 21, 2022 · release notes

     Sekoia.io integrates with CrowdSec to provide contextualized observables for scanning activities, including IP addresses and associated protocol/vulnerability tags.

212. New detection rules for Azure Active Directory 🕵️☁️ Apr 13, 2022 · release notes

     Sekoia adds detection rules for Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. suspicious actions and CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. alerts

     • New detection rules in Sekoia Defend for Azure Active Directory intakes
     • Detection of suspicious user actions such as unusual configuration, connection locations, and brute-force
     • Alerts related to Azure Active Directory CTI including malicious IP addresses and known attack patterns

     3 details in Everything

213. Introduce Panda Security Aether integration Apr 13, 2022 · release notes

     Adds Panda Security Aether integration for Sekoia Defend playbooks and event intake.

     └──▷ HOW TO FIND IT
     Access documentation for new Panda Security playbook actions.
     📍https://docs.sekoia.io/playbooks/library/panda-security/
     • Introduces playbook actions for Panda Security EDRs/EPPs within Sekoia Defend

     1 detail in Everything

214. New detection rules for Office 365 🕵️ 📧 Apr 8, 2022 · release notes

     Sekoia adds new Office 365 detection rules for safety measure deactivation, malicious file uploads, and suspicious user behavior.

     • Adds detection for the deactivation of Office 365 safety measures like anti-phishing rules or email attachment scanning rules
     • Adds detection for malicious file uploads to Office file sharing services such as OneDrive or SharePoint that enable lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.
     • Adds detection for suspicious user behaviors including downloading or deleting large numbers of files

     3 details in Everything

215. New detection rules for Vade for M365 integration 📧 Apr 1, 2022 · release notes

     Adds 9 new M365 threat detection rules for Vade integration

216. Presentation of the Digital Shadows Searchlight integration ✨ Mar 23, 2022 · release notes

     New Digital Shadows Searchlight integration available via playbook templates for log collection.

     • Adds Digital Shadows Searchlight integration to Sekoia.io Defend, enabling automated collection of logs related to unwanted exposures.
     • Provides a ready-to-use playbook template in the playbook interface for configuring the new Digital Shadows Searchlight integration.

     2 details in Everything

217. New catalog integrations: AWS Cloud Trail and VPC Flow Logs Mar 18, 2022 · release notes

     New AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs integrations for log collection in Sekoia.io.

     • Adds AWS CloudTrail integration to collect user activity and API usage logs
     • Adds VPC Flow Logs integration to collect IP traffic logs

     2 details in Everything

218. McAfee Web Gateway integration has been released 🎉 Mar 16, 2022 · release notes

     New McAfee Web Gateway integration allows log ingestion and detection rule correlation in Sekoia.io

     • Adds support for the McAfee Web Gateway integration to visualize events and trigger alerts via detection rules

     1 detail in Everything

219. Vade for M365 integration is now up 📧 Mar 8, 2022 · release notes

     New Vade for M365 integration allows importing AI-based email threat insights into SEKOIA.IO via a new trigger and playbook actions.

     • Adds a Vade for M365 integration to import the service's AI-based protection insights into SEKOIA.IO.
     • Introduces a new trigger specifically for Vade for M365 events, enabling automated playbook execution upon detection.

     2 details in Everything

220. New contextualized observables related to ngrok and opendir 📂 Feb 25, 2022 · release notes

     New contextualized ngrok and opendir observables in the Intelligence Center to aid CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. analysis.

     • Adds new ngrok, opendir, and opendir:exe tags to the Intelligence Center's observable database for automatic context of related IP addresses.
     • Enables SEKOIA.IO XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. alerts containing these IPs to be automatically contextualized with the new ngrok/opendir tags.
     • Provides a shareable playbook template in the Community Github repository for customers to collect and contextualize these observables.

     3 details in Everything

221. New design and features for the playbooks actions library 🧰 Feb 24, 2022 · release notes

     Sekoia.io playbooks actions library gets redesigned UI with icons and refined search

     • Adds visual icons to the playbook actions library modules for easier identification
     • Improves module search in the actions library to provide more context about modules and their entities
     • Introduces filters for the playbook actions library search to refine results

     3 details in Everything

222. Playbooks edition and runs details panel🚦 Feb 23, 2022 · release notes

     New runs details panel with status-based filtering for Sekoia.io playbooks

     • Adds a Runs details panel that classifies playbook executions by status and provides a filter to isolate runs in progress, succeeded, or error.
     • Allows users to (de)activate a playbook directly from the new panel interface.

     2 details in Everything

223. SEKOIA YARA Tracker 🔬 Feb 15, 2022 · release notes

     New SEKOIA YARA Tracker IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. source added to Intelligence Center

     • Automatically ingests YARA match hashes at least twice weekly

     1 detail in Everything

224. New Theme ✨ Purple Rain Feb 3, 2022 · release notes

     Sekoia.io introduces Purple Rain visual theme with WCAG-compliant colors and dynamic logo.

     • Adds Purple Rain visual theme option in profile appearance settings for improved contrast and accessibility
     • Introduces a new main menu with smooth transition animations for opening and closing
     • Updates the application logo to feature a dynamic gradient switching between Intelligence Center and Operation Center

     3 details in Everything

225. New detection rules added to the catalog in January 🕵 Feb 1, 2022 · release notes

     Sekoia.io adds four new detection rules for Windows threats in January.

     • Adds Suspicious Windows DNS Queries rule to detect rare usage of text-based web services from Windows command line tools
     • Adds Dynwrapx Module Loading rule to detect loading of DynamicWrapperX modules in infection chains
     • Adds UAC Bypass Using Fodhelper rule to detect User Access Control bypass via the Fodhelper process
     • Adds Suspicious Windows Installer Execution rule to detect installation of downloaded MSI packages using Microsoft Installer

     4 details in Everything

226. Specify the format of a feed ✨ Jan 28, 2022 · release notes

     New configurable feed export formats (JSON, CSV, Text, Custom template)

     • Adds CSV feed format allowing users to choose specific fields when consuming the feed
     • Adds Text feed format producing raw text with object or observable names on each line
     • Adds Custom feed format allowing specification of a custom output template

     3 details in Everything

227. Playbooks listing gets a makeover 💅 Jan 26, 2022 · release notes

     Sekoia.io Playbooks UI gets card layout with toggle and status counts

     • Displays playbooks in a card shape for improved visibility
     • Adds a toggle to (de)activate a playbook directly from the listing
     • Shows the number of runs per status more clearly on each card

     3 details in Everything

228. Filter your feeds with Observable Types (ipv4, domain, url, mutex…) ✂️ Jan 13, 2022 · release notes

     New configurable observable type filters for Sekoia.io feeds allow restricting indicators to specific types like ipv4 or domain.

     • Adds indicator and ipv4-addr (and other observable) filtering options in the feed definition UI to restrict visible indicators by type
     • Enables selection of observable types (e.g., ipv4, domain, url, mutex) within existing feed configurations to narrow down indicator visibility

     2 details in Everything