https://cybertoolchain.io/tools/sekoia-io New releases and features in Sekoia.io, tracked by The Cyber Toolchain. en Wed, 17 Jun 2026 14:28:55 GMT https://changelog.sekoia.com/changelog/57366 https://changelog.sekoia.com/changelog/57366 Wed, 17 Jun 2026 14:28:55 GMT Sekoia.io Intelligence module gets new IOC type filters, column management, and FLINT report access enhancements. • `IOC type filter` added to the Threat Context panel to scope views to specific indicators like IPs or domains. • Support for `First Seen` and `Last Seen` columns in the Threat Context table alongside existing date fields. • `Last updated filter` available in Threat Context to scope results to relationships modified within the last 30 days. • New `Access all FLINTs` button on the Threat Landscape page for direct navigation to threat intelligence reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/57189 https://changelog.sekoia.com/changelog/57189 Thu, 11 Jun 2026 11:57:48 GMT Sekoia adds leftanti/rightanti SOL operators and a Sankey chart rendering mode to Query Builder • Adds `leftanti` and `rightanti` join operators in SOL for detecting missing or new data patterns. • Adds a new Sankey chart visualization type accessible via the Query Builder UI. • Adds render sankey with (source=..., target=..., value=...) syntax in SOL to render flow mappings programmatically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/57160 https://changelog.sekoia.com/changelog/57160 Wed, 10 Jun 2026 13:44:25 GMT Sekoia Endpoint Agent 1.10.0 adds `ProcessHashEnabled` config and `--remote-optimization-rules` install flag • Adds `ProcessHashEnabled` config setting to disable process hash computation at the agent level for resource-constrained environments. • Adds `--remote-optimization-rules` install argument to enable remote optimization rules during installation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/56592 https://changelog.sekoia.com/changelog/56592 Thu, 04 Jun 2026 15:38:23 GMT Sekoia Defend adds bulk event-to-case ingestion and SOL Dataset support for CSV lookups. • Adds multi-select on the event search page to add up to 1000 events to a case in one action • Adds SOL Dataset import for CSV files as named lookup tables queryable in SOL • Adds ability to join datasets against events, alerts and cases within SOL queries • Adds dataset update functionality via re-uploading a CSV file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/55065 https://changelog.sekoia.com/changelog/55065 Mon, 27 Apr 2026 08:02:50 GMT SOL gains parse_json/tostring functions and alerts-assets join; rules search covers descriptions. • Adds parse_json() function to SOL queries for parsing JSON strings into structured objects • Adds tostring() function to SOL queries for value conversion and text operations • Enables joining the **alerts** and **assets** datasources in SOL for correlation • Expands Rules Catalog search to match against rule descriptions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/55110 https://changelog.sekoia.com/changelog/55110 Thu, 23 Apr 2026 12:00:22 GMT Sekoia Endpoint Agent 1.9.1 adds native ARM64 support and process hash computation for richer telemetry. • `Linux ARM64 Support` runs the agent natively on ARM64 architectures, expanding deployment coverage to ARM-based servers and cloud instances. • `Process Hash Computation` computes hashes for running processes, enriching endpoint telemetry for detection and investigation workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/54881 https://changelog.sekoia.com/changelog/54881 Tue, 14 Apr 2026 12:29:43 GMT Sekoia.io Feeds Redesigned: New scoping, formatting, and dissemination controls for threat intelligence • Adds guided, step-by-step feed creation flow with inline explanations at every stage • Adds source-level filtering to scope feeds to Sekoia sources, external sources, or any combination • Adds ability to exclude expired and revoked IOCs from feeds • Adds configurable sorting (newest-to-oldest or oldest-to-newest) across all formats • Adds in-product documentation embedded in the Disseminate modal explaining Feed ID, API URL, and TAXII URL • Adds one-click feed duplication with independent dissemination links per copy Breaking changes: • Sector and geography filters have been removed from feed creation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/54618 https://changelog.sekoia.com/changelog/54618 Tue, 31 Mar 2026 12:00:34 GMT Sekoia.io introduces Reveal add-on providing unified asset intelligence with new connectors and context panels. • Adds `Asset Connectors` to collect, unify, and enrich assets from connected systems for the Reveal add-on module • Adds `Vulnerability Enrichment` capability to add vulnerability context directly to assets in the Asset Context Panel • Adds `Points of Interest` feature to surface notable behavioral and risk signals, including early UEBA-driven insights, on assets • Adds `Endpoint Hygiene` identification for hygiene issues impacting asset health within Reveal • Adds `Attack Path Visualization` to explore observed relationships between assets and identities for lateral movement analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/54405 https://changelog.sekoia.com/changelog/54405 Wed, 25 Mar 2026 11:23:06 GMT Adds `intake_formats` datasource and `tags` column to SOL, plus asset filtering in Cases • Adds `intake_formats` new datasource that maps dialect and format UUIDs to human-readable names for cleaner ingestion pipeline analytics • Adds `tags` column to the `assets` table in SOL to list all tags associated with each asset for tag-based filtering and enrichment • Adds ability to filter alerts by specific assets within a Case's Alerts tab Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/54354 https://changelog.sekoia.com/changelog/54354 Fri, 20 Mar 2026 07:00:28 GMT Sekoia.io adds asynchronous Massive Event Export via `sekoia-event-exporter` CLI and API, supporting up to 100M events. • Adds support for exporting up to 100 million security events in a single job via the async export workflow • Adds S3 bucket export destination option for data lake and long-term retention workflows • Adds gzip-compressed file output format for exported results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/54075 https://changelog.sekoia.com/changelog/54075 Thu, 12 Mar 2026 14:00:21 GMT Sekoia introduces Alert Storm Control to cap runaway rule alert volumes via rule-level cooldown. • Adds automatic cooldown mechanism for detection rules generating more than 30 distinct alerts in 30 seconds, entering a 30-minute rate-limited state. • Adds per-IoC cooldown logic for CTI rules where individual IOCs reaching 30 matches trigger a rule-level cooldown while other IOCs continue normally. • Adds configurable notification "A detection rule entered rate-limited state" to alert on when a rule enters cooldown. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/53839 https://changelog.sekoia.com/changelog/53839 Fri, 27 Feb 2026 09:01:54 GMT SOL adds toint(), extract(), replace_regex() and count_if() functions for enhanced data transformation and analytical capabilities. • toint() converts text-based fields to integers for numeric filtering, comparisons and arithmetic operations • extract() extracts specific patterns from strings using regular expressions for precise log parsing and field enrichment • replace_regex() transforms and sanitizes text data by replacing regex-matched patterns with custom values • count_if() performs conditional counting within aggregate queries for targeted statistical breakdowns Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/53322 https://changelog.sekoia.com/changelog/53322 Tue, 17 Feb 2026 13:38:57 GMT Sekoia.io adds dashboard sharing between MSSP workspaces and communities, dynamic SOL query filters (?variable_name), and a new Queries page with search and filter capabiliti • Adds `?filter_name` syntax to SOL queries to create dynamic input fields (Text, Boolean, Single/Multi selection, Time) for interactive dashboards • Adds ability to share MSSP workspace dashboards to end-user communities via 'Manage access' with auto read-only sync • Introduces a new Queries page with search bar and filters by type, author, and access scope to locate SOL queries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/51933 https://changelog.sekoia.com/changelog/51933 Thu, 18 Dec 2025 15:51:55 GMT Sekoia.io adds Sigma Pattern Testing in GA for validating detection rules against historical data • `Test Pattern` button enables validation of new or existing Sigma rules against 7, 30, or 60 days of historical event data to reduce alert noise. • Alert Filter Testing mode allows optimization of exclusion patterns to minimize false positives using correlation tables. • Dual visualization provides chronological bar graphs and detailed event analysis with top 10 value distributions for pattern testing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/51601 https://changelog.sekoia.com/changelog/51601 Mon, 08 Dec 2025 13:46:48 GMT Sekoia Endpoint Agent 1.9.0 adds optimization rules (beta), embedded root CAs, configurable log rotation, configurable event buffer cache, and glob patterns for HashesExclude • `HashesExcludedPaths` now supports glob patterns (e.g., `C:\temp\*`) for flexible path matching • Fully configurable log file rotation via `LogMaxSize`, `LogMaxBackups`, and `LogCompress` in `config.yaml` • Optimization rules (beta) allow fine-tuned control over event collection and processing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/51539 https://changelog.sekoia.com/changelog/51539 Mon, 01 Dec 2025 10:15:25 GMT Sekoia.io adds Integration Rules filtering and Rule Lifecycle management to the Rules Catalog • Adds `Integration Rules` feature to identify and filter rules sourced from third-party integrations. • Adds `Rule Lifecycle` feature to offer TDR and SOC teams new maintenance capabilities for detection strategy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/51051 https://changelog.sekoia.com/changelog/51051 Thu, 13 Nov 2025 13:20:00 GMT Sekoia.io Rules Catalog gains third-party integration filtering and rule validity dates with auto-disable. • Adds `Rule type > Integration rule` filter in the Rules Catalog to identify detection rules tied to third-party integrations • Adds `Valid until date` field when creating or editing a rule to signal maintenance end date • Adds automatic disabling of deprecated rules via `Automatically disable deprecated rules` option in Rules Catalog settings • Adds notification opt-in for rule deprecation at `Get Notified > Notify me when a rule from the catalog is deprecated/scheduled for deprecation` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/49556 https://changelog.sekoia.com/changelog/49556 Wed, 22 Oct 2025 07:31:13 GMT Sekoia.io Forwarder 2.7.3 adds support for custom log destinations via an environment variable • Adds custom log destination support via an environment variable Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/49970 https://changelog.sekoia.com/changelog/49970 Wed, 15 Oct 2025 14:55:54 GMT Sekoia Defend Oct'25 adds manual AI Case priority, in-UI alert title editing, and alert timeline observables • Manually set the priority level for AI Cases to disable automatic updates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/48748 https://changelog.sekoia.com/changelog/48748 Thu, 11 Sep 2025 09:12:35 GMT Adds Multi-Layer Graphs for investigations with drag-and-drop visibility controls. • Adds support for organizing investigation graphs into customizable layers to separate IOCs or ATT&CK techniques. • Enables auto-collection of new data into default and active layers within graphs. • Adds visibility controls to hide or show individual layers instantly to reduce visual noise. • Supports drag-and-drop movement of observables and objects between graph layers. • Provides real-time collaboration where layer changes are saved instantly and visible to the team. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/48413 https://changelog.sekoia.com/changelog/48413 Tue, 02 Sep 2025 12:18:22 GMT Sekoia Defend adds five new SOL functions for string math, conditionals, data quality, and datetime formatting. • tolower() and toupper() normalize text case for consistent analysis across mixed-case datasets • round() formats numerical results with specified decimal precision for professional reporting • iff() implements inline conditional logic for dynamic data categorization within queries • coalesce() handles missing data by returning the first non-null value from a list of expressions • format_datetime() applies Python strftime specifiers to timestamp values for tailored report formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/48360 https://changelog.sekoia.com/changelog/48360 Mon, 01 Sep 2025 09:08:57 GMT Sekoia.io adds detection rules for WIZ Critical Alerts, CrowdStrike Falcon EppDetections, and new MacOS/Windows threat patterns. • Adds a new rule to detect 'WIZ Issues Critical Alert' from the WIZ integration • Adds support for detecting 'Informational Severity EppDetection' from CrowdStrike Falcon • Adds support for detecting 'Intrusion Detection' severity events from CrowdStrike Falcon • Adds support for detecting 'Low Severity EppDetection' from CrowdStrike Falcon • Adds support for detecting 'Medium Severity EppDetection' from CrowdStrike Falcon • Adds support for detecting 'High Severity EppDetection' from CrowdStrike Falcon • Adds support for detecting 'Critical Severity EppDetection' from CrowdStrike Falcon • Adds a new rule to detect 'Entra ID Sign-In Via Known AiTM Phishing Kit (Rockstar 2FA)' from Microsoft Entra ID • Adds 8 new detection rules for MacOS threats including Chflags Hidden and Tmutil operations • Adds 5 new correlation detection rules for Windows threats including PowerShell infection chains Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/48156 https://changelog.sekoia.com/changelog/48156 Thu, 28 Aug 2025 07:19:52 GMT Adds Teams and Slack webhook notifications via Settings > Notifications for new alerts and cases. • Enables sending alert and case notifications to Microsoft Teams and Slack via webhook URLs in the Notifications settings • Makes the feature available to FRA 1 region users with a broader rollout scheduled for subsequent regions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/47231 https://changelog.sekoia.com/changelog/47231 Wed, 30 Jul 2025 11:38:00 GMT Intake Restricted Roles gain full dashboard access and intake management visibility. • Grants `Intake Restricted Roles` full access to dashboards for perimeter monitoring and key metrics tracking • Grants `Intake Restricted Roles` complete visibility over datasource monitoring and debugging via Intakes Management Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/46899 https://changelog.sekoia.com/changelog/46899 Fri, 18 Jul 2025 13:00:00 GMT Adds Event Telemetry datasource to SOL query builder for tracking intake data volume and lag. • Introduces `Event Telemetry` as a new data source in the SOL query builder to track intake-level data usage. • Enables visualization of telemetry metrics including event counts, message sizes, and lag per intake. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/46349 https://changelog.sekoia.com/changelog/46349 Mon, 30 Jun 2025 11:52:43 GMT Sekoia Endpoint Agent 1.8.0 adds Host Hygiene Compliance collectors and Hyper-V sandbox event telemetry. • `Host Hygiene Compliance collectors` for Windows, Linux, and macOS (disabled by default) • Collection of specific `Hyper-V sandbox events` (Windows) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/45828 https://changelog.sekoia.com/changelog/45828 Mon, 16 Jun 2025 12:13:57 GMT New Integrations Catalog and Custom Apps feature for building private integrations via Automation SDK and GitHub/GitLab sync • Adds the `Integrations Catalog` as a centralized hub to discover, filter, and manage all Sekoia.io integrations with sorting by Recent/Popular/All and filters by Features, Categories, and Content Types. • Enables creation of private custom integrations using the `Sekoia.io Automation SDK`, allowing users to define custom playbook actions, triggers, connectors, and intake formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/45311 https://changelog.sekoia.com/changelog/45311 Tue, 27 May 2025 08:55:23 GMT Assets page gains bulk actions (tags, revocation, criticality), visible tags column, advanced filtering, and recently used tag suggestions. • Adds bulk actions on the Assets page: adding tags, revoking multiple assets, changing criticality levels, and updating review statuses simultaneously • Adds a Visible Tags Column to the asset table that displays all associated tags for each asset and allows instant filtering by clicking a tag • Adds Advanced Filtering on the Assets page to pinpoint specific assets based on Criticality, Tags, Types, Source, and Status • Adds Recently Used Tags in the tagging interface to provide a convenient list of already used tags for quick selection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/44616 https://changelog.sekoia.com/changelog/44616 Wed, 21 May 2025 11:28:26 GMT Sekoia introduces a central Dashboards page for management and transparency. • Sekoia introduces a central Dashboards page for management and transparency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/44471 https://changelog.sekoia.com/changelog/44471 Thu, 15 May 2025 09:31:32 GMT Admins gain UI capability to reset user 2FA tokens; enhanced 2FA setup flow with immediate backup code generation. • Adds `Reset User 2FA` action to the Admin UI Settings > Users interface for resetting a specific user's two-factor authentication • Enhances the Profile → Security page to allow users to choose between TOTP apps and security devices during setup • Generates backup codes immediately during the new enhanced 2FA setup process Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/44431 https://changelog.sekoia.com/changelog/44431 Wed, 14 May 2025 13:23:05 GMT Sekoia.io Forwarder 2.7.2 adds RELP protocol support and configurable intake queue_size. • `queue_size` config key added to an intake definition to set a specific retention size in memory • `protocol: relp` value added to allow sending events via the RELP protocol instead of TCP Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/43485 https://changelog.sekoia.com/changelog/43485 Tue, 29 Apr 2025 06:36:37 GMT Sekoia Defend adds `Time-based Sigma` detection for filtering alerts by business hours and holidays • `Time-based Sigma` enables detection of suspicious activities outside normal working hours, weekends, public holidays, or custom dates. • `Time-based Sigma` reduces alert fatigue via time-window alert filters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/43116 https://changelog.sekoia.com/changelog/43116 Wed, 09 Apr 2025 08:35:23 GMT Sekoia Defend adds GA 'AI Cases' for automated incident correlation and summarization. • Adds `AI Cases` feature in `Defend Prime` and `Legacy XDR` plans that automatically creates security incidents by correlating related alerts over a 7-day period with AI summarization and dynamic priority rating. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/43117 https://changelog.sekoia.com/changelog/43117 Wed, 09 Apr 2025 07:39:33 GMT Sekoia.io API docs unified to OpenAPI 3.1 with global search and inline testing • Adds a **global search** feature in the API documentation to quickly locate specific endpoints. • Reorganizes all API endpoints into logical categories based on product functionality for easier navigation. • Includes region availability information for each API endpoint in the documentation. • Provides a unified, fully OpenAPI 3.1-compliant manifest available as a downloadable JSON schema. • Enables testing of endpoints directly from the documentation page using an API key. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/42706 https://changelog.sekoia.com/changelog/42706 Wed, 26 Mar 2025 13:21:16 GMT Sekoia.io Queries adds CSV export to download results as spreadsheets. • Adds `CSV` export format to Queries, allowing one-click download of search results as spreadsheets for analysis, reporting, and sharing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/42354 https://changelog.sekoia.com/changelog/42354 Fri, 14 Mar 2025 10:06:29 GMT Sekoia.io Forwarder 2.7.1 adds support for the USA region. • Adds support for the `USA` region. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/41322 https://changelog.sekoia.com/changelog/41322 Wed, 19 Feb 2025 08:02:18 GMT Sekoia Endpoint Agent 1.7.0 adds watchdog service and Linux audit optimizations • Adds a new `watchdog service` to ensure the agent stays running, restarting it after updates or if it stops/crashes • On Linux, introduces volume and cost optimization by discarding `exit_group syscall` events from audit rules • On Linux, improves collection reliability for the `parent.process` field which was previously missing in some events Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/41495 https://changelog.sekoia.com/changelog/41495 Wed, 12 Feb 2025 10:20:11 GMT Sekoia.io adds out-of-beta on-prem Playbooks for local environment execution. • Enables running automation playbooks directly within a local on-premises environment via the playbook runner component. • Allows admins to orchestrate Docker-based actions (e.g., disabling Active Directory users) from the Sekoia platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/41294 https://changelog.sekoia.com/changelog/41294 Thu, 06 Feb 2025 11:04:16 GMT Sekoia releases version 1.6.2 of the Mac Agent, enabling automatic event collection from macOS endpoints with no performance impact. • Sekoia releases version 1.6.2 of the Mac Agent, enabling automatic event collection from macOS endpoints with no performance impact. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/40925 https://changelog.sekoia.com/changelog/40925 Wed, 22 Jan 2025 13:32:53 GMT Public Beta release adds the Roy Assistant AI interface and Notebooks for incident response documentation to Sekoia.io. • Adds `Roy Assistant` as an interactive UI element accessible via the 'Ask Roy' button for AI-driven support. • Adds `Notebooks` feature for centralizing investigation queries, automation actions, and reporting in a single markdown document. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/40274 https://changelog.sekoia.com/changelog/40274 Thu, 09 Jan 2025 13:03:12 GMT Adds Beta Subscriptions page for unified subscription management and MSSP community allocation • Adds `Settings > Subscriptions` page to view and manage all subscriptions • Enables MSSPs to allocate purchased subscriptions directly from the product interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/39647 https://changelog.sekoia.com/changelog/39647 Mon, 06 Jan 2025 10:51:42 GMT Sekoia.io adds six new integrations (Olfeo, Ubika, ESET, Bitsight, EfficientIP, 1Password) and changes Mimecast auth error handling. • Adds `olfeo` intake for network security monitoring in GA • Adds `ubika_cloud_protector_traffic` intake for traffic analysis in GA • Adds `eset_protect` intake for endpoint protection monitoring in GA • Adds `bitsight_spm` intake for supply chain risk monitoring in GA • Adds `efficientip_solidserver_ddi` intake for DDI monitoring in GA • Adds `1password_epm` intake for enterprise password manager data in GA Breaking changes: • Mimecast Email Security intakes now treat authentication errors as `CRITICAL` level (previously `ERROR`) and automatically stop the intake after 5 failed attempts, with a 30-minute grace period for counter reset. • Fortinet Fortigate events using the `timestamp` field now use native timezone for calculations; the `eventtime` field is prioritized as the primary timestamp source if available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/39517 https://changelog.sekoia.com/changelog/39517 Wed, 04 Dec 2024 10:53:38 GMT Sekoia Defend adds fullscreen MITRE ATT&CK Matrix visualization to detection rules page • Adds fullscreen MITRE ATT&CK Matrix visualization to the detection rules page to display all tactics and techniques Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/39304 https://changelog.sekoia.com/changelog/39304 Thu, 28 Nov 2024 14:55:34 GMT Sekoia Forwarder 2.7.0 adds monitoring capabilities for integrations, including health status and event forwarding metrics. • Adds `enhanced monitoring capabilities` for the concentrator to monitor `performance` and `status` of integrations • Enables monitoring of the Sekoia forwarder to access **health status information** and advanced metrics of **event forwarding** Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/39333 https://changelog.sekoia.com/changelog/39333 Wed, 27 Nov 2024 15:22:45 GMT New Usage page (Beta) at Settings > Usage for tracking consumption, forecasting, and quota management. • Adds the `Settings > Usage` page to track platform usage across all communities • Adds predictive consumption forecasting based on historical data trends • Adds a history view to analyze data consumption trends over the past months • Adds multi-tenancy compatibility to view each community's consumption status • Adds a gauge to visualize progress towards fair use quotas • Adds monitoring for currently running playbook actions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/38097 https://changelog.sekoia.com/changelog/38097 Thu, 14 Nov 2024 16:49:28 GMT Sekoia Defend adds MITRE visualization with filters for configured intakes and detection gap identification. • Adds the ability to filter and enable detection rules based on `Configured intakes` within the Sekoia Defend MITRE preview. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/38508 https://changelog.sekoia.com/changelog/38508 Tue, 29 Oct 2024 08:07:15 GMT Sekoia.io introduces a new API version for its MISP feed to update and remove indicators instead of pushing duplicates. • Adds a `brand new API` to consume Sekoia Intelligence (CTI) into MISP • Enables updating `existing objects` and their properties in the MISP feed • Enables removing `expired indicators` from the MISP feed • Organizes MISP events by `source` in the new feed integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/37682 https://changelog.sekoia.com/changelog/37682 Mon, 28 Oct 2024 08:34:11 GMT New 'EDR agent ID' field on Host assets to enable EDR-targeted playbook actions • Adds `EDR agent ID` field to `Host` assets, populated from ECS `agent.id` and `agent.type` fields Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/38343 https://changelog.sekoia.com/changelog/38343 Wed, 23 Oct 2024 06:30:10 GMT Sekoia.io adds Intake v2 for data source management, Meta-Playbooks for multi-community automation, and EDR Agent ID support. • Adds `Intake v2` to the UI for enhanced data source management and easier integration setup • Adds `Meta-Playbooks` capability to manage automation across multiple communities simultaneously • Adds `EDR Agent ID` field access to enable quicker incident response workflows • Improves visualization of event, alert, and case queries in Enhanced Dashboards Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io https://changelog.sekoia.com/changelog/38212 https://changelog.sekoia.com/changelog/38212 Thu, 17 Oct 2024 10:04:11 GMT Sekoia.io adds Number, Column, Line, and Bar chart visualizations to the Query Builder for custom dashboards. • Adds `Number` visualization to display a single numeric value prominently in dashboards • Adds `Column chart` with `stacked` or `grouped` modes to compare values across categories • Adds `Line chart` support for visualizing trends over time with up to 200 data points • Adds `Bar chart` with `stacked` or `grouped` modes to compare values between different groups Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sekoia-io