https://cybertoolchain.io/tools/torq New releases and features in Torq, tracked by The Cyber Toolchain. en Sun, 18 Oct 2026 07:50:06 GMT https://torq.io/product-updates/ https://torq.io/product-updates/ Sun, 18 Oct 2026 07:50:06 GMT Torq dashboards gain section separators and numeric-value filtering for Cases Dashboard widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds separator support to dashboards, letting you group related widgets under titled sections for cleaner reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Cases Dashboard widgets can now filter by numeric values — Less Than, More Than, and Range — to focus any widget on cases meeting a specific threshold or event count. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://torq.io/product-updates/ https://torq.io/product-updates/ Tue, 23 Jun 2026 00:00:00 GMT Torq adds case assignment to analyst groups and Group assignee filter • Enables assigning cases to analyst groups for team-level workload management • Adds `Group assignee` filter to surface cases relevant to a specific team Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/15412970-may-content-digest-formatted-draft https://kb.torq.io/en/articles/15412970-may-content-digest-formatted-draft Thu, 11 Jun 2026 00:00:00 GMT Torq adds 6 new integrations (Atlassian Rovo, CrowdStrike Falcon Shield, LayerX, Reco MCP, BloodHound Enterprise, Tenable) and numerous new steps for existing tools. • Adds `Atlassian Rovo MCP Server` integration with `List Tools` and `Create Session` steps • Adds `CrowdStrike Falcon Shield` integration with 5 new steps including `List Activity Events`, `List Affected Entities`, `Upload Custom Integration Data`, `List Security Checks`, and `List Device Inventory` • Adds `LayerX` integration with 8 new steps for managing tags, policies, devices, and extensions • Adds `Reco MCP Server` integration with `List Tools`, `Create Session`, and `Generic Tool Call` steps • Adds `SpecterOps BloodHound Enterprise` integration with 9 new steps for fetching assets, findings, and attack paths • Adds `Tenable` integration with 5 new steps including `Download Report`, `Export Analysis Request`, and scan/report listing • Adds `Get URL Rewrite Events` step to the Abnormal Security integration • Adds `Get MISP Report` step to the ANY.RUN integration • Adds 12 new steps to the Drata integration: `Create Risk`, `Get Asset`, `Get Risk`, `Get Policy`, `List Tasks`, `Get Device`, `Get Task`, `List Users`, `List Policies`, `Get Event`, `List Monitoring Test Failures`, and `Get Vendor` • Adds 3 new steps to the Microsoft Active Directory integration: `Enable Account by sAMAccount Name`, `Disable Account by sAMAccount Name`, and `Remove user from group by sAMAccount Name` • Adds `Azure cloud` parameter to the `Run commands on Azure CLI` step • Adds `Timestamp range start` parameter to the `List Threat Events V2` step in Mimecast • Adds 9 new steps to the Orca integration: `Get Scheduled Report Files`, `List Scheduled Reports`, `Get Scheduled Report`, `Create Report Task`, `Get Report Task Status`, `Retrieve Security Score and Metrics`, `Get User Selected Compliance Frameworks`, `Unset Crown Jewel Assets`, `List Audit Log Actions`, `List Open Alerts by Severity`, `List Alert Remediation Actions`, and `Set Custom Remediation Text` • Adds multiple parameters to Orca steps including `Timeout`, `Skip SSL verification`, `HTTP proxy`, `HTTPS proxy`, `Max retries`, `Retry delay`, `Custom certificates PEM`, and `Send to Jira` for `Add Comment to Alert` • Adds `Orca base URL` parameter to the `Get CVE Details` step in Orca • Adds parameters to the `List CVEs` step in Orca including `Limit`, `HTTPS proxy`, `HTTP proxy`, `Custom certificates PEM`, `Retry delay`, `Max retries`, `Skip SSL verification`, and `Timeout` • Adds `List Users` step to the Reco integration • Adds parameters to the Reco `Update Alert Status` step including `Sort order`, `HTTPS proxy`, `Custom certificates PEM`, `Retry delay`, `Max retries`, `Retry on status`, `Skip SSL verification`, and `Timeout` • Adds new `Run Splunk API Query` step to the Splunk integration • Adds `Assign a group to case` step to Torq Cases • Adds `Case MITRE ATT&CK` parameter to the `Update case MITRE ATT&CK` step in Torq Cases • Adds `Group IDs` parameter to the `Query cases` step in Torq Cases • Adds `Case group ID` parameter to the `Create a case` step in Torq Cases • Adds `Object Utils` utility step with `Lookup MITRE ATT&CK` functionality Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_24b6559d97 https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_24b6559d97 Mon, 01 Jun 2026 00:00:00 GMT Torq Step Runner 26.06.9 adds PodInitializing status handling and orphaned pod deletion. • Added `PodInitializing` status handling for job lifecycle management • Reaper now deletes orphaned pods in addition to jobs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://torq.io/product-updates/ https://torq.io/product-updates/ Sun, 10 May 2026 00:00:00 GMT Torq adds native SentinelOne and Microsoft Defender connectors for endpoint data ingestion • Adds `SentinelOne` native connector for continuous ingestion of endpoint security data • Adds `Microsoft Defender` native connector for continuous ingestion of endpoint security data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://torq.io/product-updates/ https://torq.io/product-updates/ Wed, 06 May 2026 00:00:00 GMT Torq introduces Organization Viewer role for read-only org management access • Adds Organization Viewer role with read-only access to the Organization Management page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://torq.io/product-updates/ https://torq.io/product-updates/ Sun, 03 May 2026 00:00:00 GMT Cases gain built-in security context fields and MITRE ATT&CK structured data with dedicated filters • Adds built-in security context fields to every case for immediate investigation-ready context • Structures MITRE ATT&CK Tactics and Techniques as fields on cases • Adds dedicated filter categories to surface cases by threat context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://torq.io/product-updates/ https://torq.io/product-updates/ Wed, 29 Apr 2026 00:00:00 GMT Torq adds group-based access control for Workspaces, restricteda cases, dashboards, and Interact with static or IdP-synced members • Adds group-based access control to the Workspace scope for `restricted cases` and `dashboards` • Enables groups to be provisioned statically by manually adding members or dynamically with automatic syncing from an IdP Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_bc0c2cee84 https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_bc0c2cee84 Sun, 01 Mar 2026 00:00:00 GMT Step Runner 26.03.8 adds support for custom labels and annotations on step jobs • Adds the ability to attach custom labels and annotations to step jobs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_bd82f773b5 https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_bd82f773b5 Sun, 01 Jun 2025 00:00:00 GMT Step Runner 25.06.4 adds Instance ID to execution responses for traceability • Adds `instance_id` field to Step Runner execution response payloads to improve traceability of specific task instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_4ae0d2c273 https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_4ae0d2c273 Thu, 01 May 2025 00:00:00 GMT Step Runner 25.05.6 enhances logging and adds Docker `user` directive and `chown` for security • Adds `user` directive to Docker step configurations to control container process identity • Adds proper file ownership (`chown`) handling in Docker containers for improved security Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_0ba7539aa0 https://kb.torq.io/en/articles/12616921-step-runner-version-updates#h_0ba7539aa0 Sat, 01 Mar 2025 00:00:00 GMT Step Runner 25.03.6 adds CPU/memory metrics in Docker diagnostics and optimized K8s pod deletion • Adds `cpu` and `memory` usage metrics to Docker diagnostics output for better monitoring • Optimizes Kubernetes pod deletion to remove pod collections without requiring an initial pod list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/torq