Torq

No entries match these filters. Clear filters

1. changelog Oct 18, 2026 · issue 112

   Torq dashboards gain section separators and numeric-value filtering for Cases Dashboard widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Focus a Cases Dashboard widget on high-volume incidents by filtering to only cases above a specific event count.
   📍In the Cases Dashboard, open a widget's filter settings, select More Than, and enter your event-count threshold to scope the widget to high-volume cases only.
   • Adds separator support to dashboards, letting you group related widgets under titled sections for cleaner reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Cases Dashboard widgets can now filter by numeric values — Less Than, More Than, and Range — to focus any widget on cases meeting a specific threshold or event count.
   • Adds separator support to dashboards, letting you group related widgets under titled sections for cleaner reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. Query cases across your workspaces Sep 27, 2026 · release notes

   Adds Query cases across your workspaces step and cross-workspace API key for unified org-level case retrieval.

   • Adds Query cases across your workspaces step to return cases from all workspaces in one call
   • Adds cross-workspace API key type to scope a service account key to some or all workspaces

   2 details in Everything

3. Content Digest Sep 6, 2026 · release notes

   Torq adds BreachRx, Method Security, and Zscaler OneAPI ZIA integrations with new steps

   • Adds BreachRx integration with steps for incident management, playbook execution, and document uploads
   • Adds Method Security integration with steps for blueprint execution, skill search, and issue tracking
   • Adds Zscaler OneAPI ZIA integration with steps for firewall rule management, whitelist creation, and quota retrieval
   • Adds List Users step to the existing incident.io integration
   • Adds Get Network Alert Details and List Network Alerts steps to the existing Shodan integration

   +2 more show less

   • Adds quick action management steps (Create, Delete, List) and cross-workspace case querying to the Torq Cases integration
   • Adds Get Detection step and expanded filtering parameters (e.g. Certainty gte, Src IP, Tags) to the existing Vectra integration

   7 details in Everything

4. More ways to focus your case data Sep 3, 2026 · release notes

   Torq adds five new fields to Case Dashboards for tighter case data filtering.

   • Case Reviewer and Review Conclusion fields added to Cases Dashboards
   • Resolution Status field added to filter dashboards by status
   • Case Title field added to analyze case type frequency in dashboards
   • Restricted Status field added to exclude restricted cases from shared dashboards

   4 details in Everything

5. Scheduled reports now available in Cases Dashboards Aug 25, 2026 · release notes

   Torq adds scheduled case dashboard reports with filters, PDF attachments, and system triggers for recurring cadences

   • Adds scheduled reports to Cases Dashboards to automatically deliver case metric snapshots on a recurring cadence
   • Supports optional filters for case state, assignee, and severity in scheduled report configurations
   • Delivers reports via email with a dashboard link and an optional PDF attachment
   • Fires a system trigger on each scheduled report execution to enable downstream workflow integration

   4 details in Everything

6. Never miss a critical event in Torq Aug 23, 2026 · release notes

   Torq adds a Notification Inbox for centralized visibility into workflow failures, approvals, and AI alerts.

   • Introduces the Notification Inbox UI component providing a persistent view of critical events
   • Groups notifications by time and badges them by type (workflow failures, approval requests, AI credit alerts, case activity)
   • Links directly to relevant resources for immediate action

   3 details in Everything

7. Build AI Agents with Socrates or from the hub, and reuse them across the platform Aug 16, 2026 · release notes

   Torq introduces a dedicated hub for building, publishing, and reusing AI agents via Socrates or manual configuration.

   • Adds the AI Agents hub where agents live independently of workflows
   • Adds Socrates guided builder for creating AI agents step-by-step
   • Enables agent reuse across workflows, Socrates sessions, and Case Management

   3 details in Everything

8. Content Digest Aug 4, 2026 · release notes

   Torq adds FortiAnalyzer and Lupovis integrations plus new automation steps for Google Chat, OpenAI, Splunk, Sumo Logic, Trend Micro, and utilities

   • Adds FortiAnalyzer integration with Get System Status, Search Attack Logs - IPS Signatures, and Fetch Log Search Results by Task ID steps
   • Adds Lupovis integration with Top Exploited CVEs, Malicious IPs by Country, Get IPs by ASN, Get IP Address Info, Get IPs Linked to APT, Get CVEs by Vendor, Get Threat Groups by Technique or Tool, Get CVEs by CVSS and EPSS, and Run Insights Query steps
   • Adds Manage Space Members step to the Google Chat integration
   • Adds optional Skip SSL verification and Custom certificates PEM parameters to Unlock Account, List Computers, Remove User From Group, and Add User To Group steps in the Microsoft Active Directory integration
   • Adds Update a Conversation, Cancel a Response, Delete File, Create a Conversation, Create an Embedding, Delete a Model Response, Delete a Conversation, and List Files steps to the OpenAI integration

   +5 more show less

   • Adds Get Events from Search Job and Get Results from Search Job steps to the Splunk integration
   • Adds Query All Insights step to the Sumo Logic integration
   • Adds Collect File, Remove from Exception List, Get Exception List, Add Alert Note, Add to Block List, List Response Tasks, Get Alert Notes, Isolate Endpoint, Get Email Activity Data, Get Endpoint Activity Data, and Remove from Suspicious Object List steps to the Trend Micro integration
   • Adds optional Duration parameter (days, weeks, months, or years) to the Calculate the end date when provided the start date and a duration utility step
   • Adds optional Input parameter to the JSON parser utility step

   10 details in Everything

9. Build with Socrates Aug 2, 2026 · release notes

   Torq introduces Socrates Builder for chat-driven workflow creation and plan-before-build capabilities

   • Socrates can now build, modify, and troubleshoot workflows via chat
   • Plan mode allows Socrates to review requests, ask clarifying questions, and suggest solutions before applying changes in Build mode
   • Socrates tests and validates workflow changes as it builds, requiring explicit approval before publishing
   • Builder experience is unified with Investigator (previously Investigate > Socrates) and is accessible from the Torq homepage

   4 details in Everything

10. Extended list of observable types Jul 23, 2026 · release notes

    Torq extends observable type support to align with OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.8.0

    • Observable types are now extended to fully align with OCSF 1.8.0

    1 detail in Everything

11. Cases Dashboards: more ways to focus your data Jul 13, 2026 · release notes

    Torq Cases Dashboards now supports new dimensions (MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior., Security context, Group assignment) for custom widgets and filtering.

    • Adds MITRE ATT&CK mapping dimension to filter custom widgets by Tactic and Technique
    • Adds Security context dimension to build widgets using standardized case fields like mitigation actions
    • Adds Group assignment dimension to break down case workloads by assigned team

    3 details in Everything

12. Content Digest Jul 12, 2026 · release notes

    Torq adds Criminal IP, Mattermost, Opsin, Sekoia CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context., Vega integrations plus new Opsin/GreyNoise/OX/Recorded Future/XM Cyber steps and templates.

    • Adds Criminal IP integration with Get IP Summary, Get Domain Report, and Search Banners steps
    • Adds Mattermost integration with Create a team and Create a direct message channel steps
    • Adds Opsin integration with List AI Activity (now supports 13 new filter parameters like Filter alert ID) and List Issues View (supports Filter agent risk type) steps
    • Adds Sekoia CTI integration with Look Up IOC and Get Indicator Context steps
    • Adds Vega integration with Run Federated Query, Update Incidents, and Set Detections State steps

    +8 more show less

    • Adds Get Case Artifacts step to the Cortex Xpanse integration
    • Adds IP Context Lookup (v3), GNQL Metadata Query (v3), and Multi IP Context Lookup (v3) steps to the GreyNoise integration
    • Adds Run GraphQL Query, Get SBOM Vulnerable Libraries, and Check Scan in Progress steps to the OX Security integration; adds proxy/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. config params (HTTPS_PROXY, Custom certificates PEM) to Get Issues step
    • Adds Get Hits step to the Recorded Future integration; adds Fields to return and proxy params to Search Alerts step
    • Adds API base URL optional parameter to Send Message, Invite Users to Channel, Upload File steps in the Slack integration
    • Adds Get Access Token, Create a Label, and Suppress Entities steps to the XM Cyber integration; adds Base URL param to several listing steps
    • Adds Cryptographic Utils utility step with Skip SSL verification support
    • Adds Endpoint Persistence Threat Hunting via Microsoft Defender XDR template to the template library

    13 details in Everything

13. Team-based case assignment Jun 23, 2026 · release notes

    Torq adds case assignment to analyst groups and Group assignee filter

    • Enables assigning cases to analyst groups for team-level workload management
    • Adds Group assignee filter to surface cases relevant to a specific team

    2 details in Everything

14. Content Digest Jun 11, 2026 · release notes

    Torq adds 6 new integrations (Atlassian Rovo, CrowdStrike Falcon Shield, LayerX, Reco MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., BloodHound Enterprise, Tenable) and numerous new steps for existing tools.

    • Adds Atlassian Rovo MCP Server integration with List Tools and Create Session steps
    • Adds CrowdStrike Falcon Shield integration with 5 new steps including List Activity Events, List Affected Entities, Upload Custom Integration Data, List Security Checks, and List Device Inventory
    • Adds LayerX integration with 8 new steps for managing tags, policies, devices, and extensions
    • Adds Reco MCP Server integration with List Tools, Create Session, and Generic Tool Call steps
    • Adds SpecterOps BloodHound Enterprise integration with 9 new steps for fetching assets, findings, and attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately.

    +19 more show less

    • Adds Tenable integration with 5 new steps including Download Report, Export Analysis Request, and scan/report listing
    • Adds Get URL Rewrite Events step to the Abnormal Security integration
    • Adds Get MISP Report step to the ANY.RUN integration
    • Adds 12 new steps to the Drata integration: Create Risk, Get Asset, Get Risk, Get Policy, List Tasks, Get Device, Get Task, List Users, List Policies, Get Event, List Monitoring Test Failures, and Get Vendor
    • Adds 3 new steps to the Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integration: Enable Account by sAMAccount Name, Disable Account by sAMAccount Name, and Remove user from group by sAMAccount Name
    • Adds Azure cloud parameter to the Run commands on Azure CLI step
    • Adds Timestamp range start parameter to the List Threat Events V2 step in Mimecast
    • Adds 9 new steps to the Orca integration: Get Scheduled Report Files, List Scheduled Reports, Get Scheduled Report, Create Report Task, Get Report Task Status, Retrieve Security Score and Metrics, Get User Selected Compliance Frameworks, Unset Crown Jewel Assets, List Audit Log Actions, List Open Alerts by Severity, List Alert Remediation Actions, and Set Custom Remediation Text
    • Adds multiple parameters to Orca steps including Timeout, Skip SSL verification, HTTP proxy, HTTPS proxy, Max retries, Retry delay, Custom certificates PEM, and Send to Jira for Add Comment to Alert
    • Adds Orca base URL parameter to the Get CVE Details step in Orca
    • Adds parameters to the List CVEs step in Orca including Limit, HTTPS proxy, HTTP proxy, Custom certificates PEM, Retry delay, Max retries, Skip SSL verification, and Timeout
    • Adds List Users step to the Reco integration
    • Adds parameters to the Reco Update Alert Status step including Sort order, HTTPS proxy, Custom certificates PEM, Retry delay, Max retries, Retry on status, Skip SSL verification, and Timeout
    • Adds new Run Splunk API Query step to the Splunk integration
    • Adds Assign a group to case step to Torq Cases
    • Adds Case MITRE ATT&CK parameter to the Update case MITRE ATT&CK step in Torq Cases
    • Adds Group IDs parameter to the Query cases step in Torq Cases
    • Adds Case group ID parameter to the Create a case step in Torq Cases
    • Adds Object Utils utility step with Lookup MITRE ATT&CK functionality

    24 details in Everything

15. 26.06.9 Jun 2026 · release notes

    Torq Step Runner 26.06.9 adds PodInitializing status handling and orphaned pod deletion.

    • Added PodInitializing status handling for job lifecycle management
    • Reaper now deletes orphaned pods in addition to jobs

    2 details in Everything

16. Ingest endpoint security data into Torq with new native connectors May 10, 2026 · release notes

    Torq adds native SentinelOne and Microsoft Defender connectors for endpoint data ingestion

    • Adds SentinelOne native connector for continuous ingestion of endpoint security data
    • Adds Microsoft Defender native connector for continuous ingestion of endpoint security data

    2 details in Everything

17. Organization Viewer role May 6, 2026 · release notes

    Torq introduces Organization Viewer role for read-only org management access

18. Investigation-ready cases: Security context and MITRE ATT&CK details May 3, 2026 · release notes

    Cases gain built-in security context fields and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. structured data with dedicated filters

    • Adds built-in security context fields to every case for immediate investigation-ready context
    • Structures MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Tactics and Techniques as fields on cases
    • Adds dedicated filter categories to surface cases by threat context

    3 details in Everything

19. Group-based access control Apr 29, 2026 · release notes

    Torq adds group-based access control for Workspaces, restricteda cases, dashboards, and Interact with static or IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-synced members

    • Adds group-based access control to the Workspace scope for restricted cases and dashboards
    • Enables groups to be provisioned statically by manually adding members or dynamically with automatic syncing from an IdP

    2 details in Everything

20. 26.03.8 Mar 2026 · release notes

    Step Runner 26.03.8 adds support for custom labels and annotations on step jobs

21. 25.06.4 Jun 2025 · release notes

    Step Runner 25.06.4 adds Instance ID to execution responses for traceability

22. 25.05.6 May 2025 · release notes

    Step Runner 25.05.6 enhances logging and adds Docker user directive and chown for security

    • Adds user directive to Docker step configurations to control container process identity
    • Adds proper file ownership (chown) handling in Docker containers for improved security

    2 details in Everything

23. 25.03.6 Mar 2025 · release notes

    Step Runner 25.03.6 adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory metrics in Docker diagnostics and optimized K8s pod deletion

    • Adds cpu and memory usage metrics to Docker diagnostics output for better monitoring
    • Optimizes Kubernetes pod deletion to remove pod collections without requiring an initial pod list

    2 details in Everything