ContraForce Release Notes

​

Improvements

• Incidents that Microsoft syncs between Defender XDR and Sentinel now appear once instead of twice. Deduplication applies to workspaces with both detection modules connected, and produces one inbox entry, one notification, one webhook, one agent run and one SLA timer per real incident. The Defender and Sentinel forwarding toggles have been removed, and any previously configured value is ignored. See Parallel incident deduplication for how each forwarding scenario is resolved.
• Ticketing configuration has moved from Settings to Workspace Center, alongside Workspaces, Onboarding and SLA. Existing Settings links redirect automatically.

​

Bug Fixes

• A failed content rule deploy now records why it failed, so the reason can be reviewed in the audit trail instead of disappearing with the on-screen message.
• Importing rules from a Sentinel workspace in your own tenant now reports a clear permission error naming the Azure access required, instead of a generic “contact support” failure.
• ContraForce administrators can now view and edit a workspace’s module configuration through OmniView.

​

Bug Fixes

• Connecting Microsoft Sentinel now works with least-privilege roles - Contributor combined with either User Access Administrator or Role Based Access Control Administrator is accepted, alongside Owner and any custom role carrying the same permissions. Previously some correctly configured accounts were refused.
• Permission messages name the exact permission you are missing - when a connection cannot proceed, the message lists the specific Azure permissions required and where to grant them, instead of naming only a role. That means you can grant precisely what is needed rather than over-granting.
• A failed check is no longer reported as a missing permission - if the permission check itself cannot complete, because of a network problem or a temporary Azure issue, ContraForce now says so plainly instead of suggesting your access is misconfigured.

​

New Features

• Organization Settings now has an Audit tab - see who changed what across your organization in one place. It covers users added, removed, updated, and synced, group changes, organizational role and gamebook permission changes, organization and notification settings, and ticketing integration setup. Your existing webhook and API client activity now appears here too, so the whole organization reads as one trail.
• Every entry names the time, the person, and the target - each record shows when it happened, who did it and their email, a plain-language description of the activity, and the resource that changed. Narrow the view to a date range when you are looking into a specific window.

​

Bug Fixes

• Incidents closed in your security tools are now reflected in ContraForce - when an analyst closes an incident directly in Defender, Sentinel, CrowdStrike or SentinelOne, ContraForce now detects the closure, including when an incident is later reopened upstream or its classification is corrected.
• Connecting Microsoft Sentinel tells you immediately when access cannot be granted - the connection previously reported success and left a workspace that was never wired up in Azure. It now stops at the point of failure and names the resource group and the role that are missing, so you know exactly what to ask for.
• Gamebook history offers a retry instead of failing quietly - a brief interruption while loading gamebook history now shows a clear error with a retry, rather than an empty view.

​

New Features

• ContraForce is available as a Microsoft Sentinel solution - the platform is now packaged for distribution through Microsoft Sentinel Content Hub.

​

Improvements

• Temporary storage interruptions are reported clearly - transient faults now surface as a retryable error rather than a generic failure.

​

Bug Fixes

• Administrators can finish setup with any role that can approve ContraForce - completing an invitation previously required a Global Administrator or Privileged Role Administrator. Every role Microsoft Entra allows to grant that approval can now complete setup.
• A missing organization approval is no longer reported as the wrong problem - when an organization had not yet approved ContraForce, the setup page said the signed-in user’s role was insufficient. It now explains that approval is needed and offers to grant it in one click.
• Module permissions are checked before you are sent to Microsoft - the setup wizard now tells you up front when your role cannot approve a module’s permissions, instead of sending you to Microsoft only to be refused and returned with an error.
• Connecting Microsoft Sentinel checks the right level of ownership - owning a single resource group appeared to satisfy the subscription ownership requirement, allowing a connection that then failed without explanation. The check now looks at the subscription itself.
• Setup no longer reports success when nothing is connected - the final step said ContraForce would start delivering security even when no detection source was ready to send data. It now says what is still outstanding.

​

Improvements

• Manual investigations no longer pile up on a busy agent - an agent now takes at most three analyst-triggered investigations at a time. Trigger another while three are running and ContraForce tells you the agent is busy investigating other incidents so you can retry in a moment, instead of accepting work that slows down the investigations already under way.

​

Bug Fixes

• Long-running agent investigations are no longer shown as failed - when an agent’s investigation ran longer than the connection timeout, the run could be marked failed with a raw network error even though the agent was still working, and its result was then discarded. Run status now reflects what the agent actually did, and a result that arrives late corrects the record.
• Changing one incident severity no longer resets your other notification settings - toggling a severity switch on a workspace’s Notifications tab discarded that account’s agent run preferences and recipients, cost alert budget and thresholds, and spend approval settings. Every other setting is now preserved.
• Content Management Center loads reliably in all regions - the UK South portal returned “Operation failed” on every Content Management Center load. It now opens normally.

​

Security

• Indicators in incident notification emails are no longer clickable - URLs, domains, and IP addresses in incident emails are now shown in a defanged form, so your email client cannot turn a potentially malicious indicator into a live link. The View Incident button and recommended playbook links still work, and indicators inside the portal are unchanged.

​

Improvements

• Agents pick up the next queued incident sooner - an agent now frees up for the next queued incident after a 10-minute window, separate from the longer window used to decide a run never reported back. Queued incidents move through faster during busy periods.
• A more consistent interface - the command palette, What’s New panel, cookie consent notice, and page layouts have been rebuilt on the current design system.

​

New Features

• Ready-made detections for ContraForce activity in Sentinel - the ContraForce data connector now ships with analytic rules covering privileged access changes, destructive workspace actions, and machine credential activity, so suspicious ContraForce administration surfaces as Sentinel incidents without you writing the queries.

​

Improvements

• Agents no longer run twice on the same work - an agent is now limited to one run at a time, with further triggers queued behind it rather than starting alongside. Runs are more predictable and no longer duplicate effort during busy periods.
• SLA settings now live in Workspace Center - service level configuration has moved alongside the rest of your workspace settings.
• A quicker agent creation wizard - new agents default to On Queue mode, workspace aliases are shown so you can tell similar workspaces apart, and the agent name is prefilled.
• Standard operating procedures are now called Operating Procedures - page titles and breadcrumbs updated to match how teams refer to them.
• Detection content stays in step with your workspaces - reconciliation now detects and reports drift between the content ContraForce manages and what is actually deployed in your Sentinel workspaces, with clearer authoring and sync visibility.

​

Bug Fixes

• Agents pick up every incident during a burst - when several incidents arrived at once, an automatically triggered agent could miss some. All incidents in a burst are now processed.
• Completed agent runs are no longer left marked as failed - if the connection dropped at the moment a run reported completion, it could stay marked failed and go unbilled despite finishing its work. Completion is now recorded reliably.

​

New Features

• Stream ContraForce activity into Microsoft Sentinel - a ContraForce data connector is now available for Microsoft Sentinel. Once connected, workspace audit activity flows into a dedicated table in your Sentinel workspace, so ContraForce actions sit alongside the rest of your security telemetry for hunting, correlation, and retention. Each connection is scoped to a single workspace.

​

Improvements

• Consistent dialogs across the interface - opening an incident from a link in an email, a Teams card, or a webhook now shows the same incident view as clicking the row in the incidents table. Gamebook and module setup dialogs have been rebuilt to match the rest of the interface.
• Redesigned sign-in landing screens - the sign-in failure and admin consent screens now match the rest of the product.

​

Bug Fixes

• The Environments tab no longer flashes an error before it loads - opening the tab briefly showed a red “Environment unavailable” message before the content appeared. It now shows a loading indicator, and recovers on its own from momentary connection problems instead of reporting a failure.
• Administrators can open the Environments tab - administrators who could open every other tab on a workspace were refused access to Environments. They can now read it, in line with every other tab on that page.
• Granting directory access no longer re-approves every ContraForce permission - the consent prompt for user and license visibility asked an administrator to re-approve ContraForce’s entire permission set. It now runs through the Microsoft Defender XDR connection, so only that module’s permissions are involved.

​

New Features

• See your workspace’s licensing and endpoint coverage - a new Environment tab in workspace settings shows the security licenses in your tenant and how many seats are assigned, which users hold them, and which endpoints are onboarded to Defender versus still available to onboard. A capability matrix shows which response actions your current licensing supports, and anything that cannot be read is shown as unknown rather than reported as unavailable. Each card refreshes on demand and shows when it was last checked.

​

Improvements

• Investigation panels rebuilt on the new interface - entity insight and investigation panels have been rebuilt, with a redesigned process tree, an actionable related incidents view, and reworked sign-in and audit log inspectors.
• Agent model upgrades keep your throughput capacity - upgrading an agent’s model now carries over the throughput capacity your current deployment is tuned to, instead of resetting it to a default.

​

Bug Fixes

• Long-running investigations are no longer reported as failed - an agent investigation that ran past the gateway timeout could be marked failed and send a failure notification even though it had finished successfully. Runs are now given time to report their real outcome first.
• Agent run history shows every run in the selected range - the account view showed only a fraction of the runs performed, and did not change when the time range was widened. Counts and breakdowns now cover the entire selected range.

​

Bug Fixes

• Assign an owner to SentinelOne incidents - the owner control is no longer greyed out on SentinelOne incidents, so you can take ownership, hand work off, and see who is handling what. Ownership is tracked inside ContraForce and is not written back to SentinelOne, which has no owner field of its own.
• Incident owners now show in the all-workspaces view - for service providers, an owner assigned from inside a customer workspace previously appeared on the incident itself but left the owner column blank in the all-workspaces incident list. SentinelOne and CrowdStrike incidents now show the assigned owner in both places.

​

New Features

• V2 is now the default experience - every user now gets the modern ContraForce interface automatically. The classic view and the option to switch back to it have been removed.

​

Bug Fixes

• Improved incident detail layout on smaller screens - the Audit and Entities tables on the incident detail page no longer overflow or clip columns on narrower or laptop-width screens, and the layout gives the investigation panel more room instead of squeezing it against a fixed-width response panel.

​

New Features

• Agent status policy controls - choose No Change in the Status after run dropdown so an agent preserves the incident status unless a transition is deliberately configured.

​

Bug Fixes

• SLA-aware status options - SLA pause states are available only when SLA Management is enabled and the assigned workspace has an SLA configuration, preventing invalid or misleading agent policies.

​

New Features

• Multi-select and bulk actions in the incidents table - select multiple incidents at once and close or reassign them in a single step. Bulk close applies the classification and reason you choose to every incident, correctly mapped for each detection source, even when your selection spans multiple workspaces and sources. Any incidents you do not have permission to change are listed by workspace so nothing fails silently.

​

Bug Fixes

• Self-hosted ServiceNow customers can now enter their actual instance URL when configuring ticketing, instead of being limited to the standard hosted-instance name format. This restores incident sync and ticket creation for self-hosted ServiceNow deployments.
• Fixed the Detected Products card so Business Premium, Defender for Business, and other SMB-tier license SKUs are correctly recognized and displayed, instead of being hidden or shown as raw IDs and causing automation coverage to be misreported as “Not licensed.”

​

New Features

• Bring-your-own credential for Sentinel incident ingestion - connect Microsoft Sentinel to ContraForce using a credential you provision and control, scoped to incident ingestion only. The portal shows a one-time deployment card with the ingestion URL, client ID, and secret, and you can rotate or revoke the credential from the portal at any time. A leaked credential cannot be used to inject incidents into any other workspace.

​

Improvements

• Dedicated Gamebooks settings tab - gamebook configuration now has its own tab in workspace settings, with approver management and run-permission controls as a first-class area instead of being at the bottom of the General tab. The tab is deep-linkable and available to workspace owners.
• SOP Knowledge Base workflow overhaul - linking agents to an SOP is now a single search, select, and confirm pass with a full checkbox list, and already-linked agents are shown so they cannot be double-linked. Markdown SOPs can be edited and saved in place with a reviewable diff and a revert option before saving, and the preview dialog was redesigned with a comfortable reading width, document identity (name, version, and size), and an always-visible Close button.

​

New Features

• Content deployment to workspaces - deploy analytic rules from a content repository to one, several, or all of your Microsoft Sentinel workspaces. Each target is checked before you deploy, results are reported per workspace, and a single rule can be rolled back in one workspace without affecting the others.

​

Bug Fixes

• Fixed an issue where the incidents list could appear empty. If one incident carried a field value the portal did not recognize, the remaining incidents on that page stopped loading. Widening the date range or including closed incidents made it more likely to happen.

​

New Features

• Cost Management Center - a single place in the portal to track and manage agent spend, workspace licenses, and billing across all your workspaces.

​

New Features

• When creating a Security Delivery Agent in your own cloud, you can now choose the AI model and deployment type (Global Standard or Data Zone Standard) right in the creation wizard, with plain-language guidance on where data is processed. Only models available in your Agent Center’s region are offered, and Azure quota is verified before you continue — so a deployment can no longer fail at the last step because of missing capacity.

​

Improvements

• Upgrading an agent to the newest GPT-5.5 / GPT-5.6 models is now allowed only once the agent runtime supports them, preventing failed incident investigations from premature upgrades.
• New Agent Centers use serverless infrastructure for their database, billing only for actual usage.

​

Defender Automation Awareness

• The Security Delivery Agent now recognizes what Microsoft Defender’s own automation (automated investigation, attack disruption, and incident merging) has already handled. Incidents Defender resolved or merged are skipped before the agent spends any compute, and every skip is recorded in the activity log - eliminating duplicate work and reopened tickets. New Native Automations and Detected Products sections on the Defender XDR configuration tab show which automations are actually firing and which Defender products are licensed and emitting signal, with an on-demand Run detection action.

​

Agent Notifications

• Workspace teams can now opt in to email alerts when an autonomous agent run fails to submit a gamebook, so failed response actions no longer go unnoticed in an incident comment. The new toggle lives under workspace Notifications -> Agent Runs, reuses the existing agent-run recipient list, and is off by default.

​

Defender Response Actions

• Response actions on Microsoft Defender incidents (such as invalidating a user’s sessions) now run reliably on the first attempt. Previously they could fail intermittently and only succeed after several retries, depending on which server handled the request.

​

SOP Template Library

• Service providers can now browse a curated library of pre-built Classification and Response playbook templates covering common incident scenarios, and promote the ones that match their environment straight into their active SOP library instead of authoring from scratch. Every template is validated so the agent’s classification verdicts are reproducible and its response steps are complete and technically correct, giving new and existing service providers reliable, agent-ready triage and response coverage from day one.

​

Workspace Management

• Organization admins and workspace admins can once again manage who has access to a workspace (adding, editing, and removing users and groups), regardless of whether they personally hold the workspace Owner role. This restores access that was inadvertently narrowed to Owner-only in the redesigned workspace management screen.

​

Bug Fixes

• Workspace Owners can now manage incident notification settings even when the Sentinel module is not fully configured. Previously the Notifications page showed a “Configuration unavailable” warning and blocked incident severity preferences and recipients until Sentinel setup was finished, even though incident notifications are not exclusive to Sentinel.

​

Bug Fixes

• Closing a Microsoft Defender XDR incident as False Positive with the reason “Not Malicious” now saves correctly. Previously this specific reason could fail with “Request body is incorrect” and the incident stayed open.

​

Bug Fixes

• Manually triggered agent investigations now show the agent’s tool-by-tool activity live in the portal, the same as automatic on-queue runs. Previously a manual run showed no real-time progress, leaving analysts unsure whether the agent was working.

​

Bug Fixes

• Agent users are now protected in Workspace IAM and User Management. Previously an admin could change an agent’s role or remove it, which silently stopped the workspace’s AI agent from responding. Agent accounts are now clearly marked and locked from edits.

​

Bug Fixes

• Closing a Microsoft Defender XDR incident with a benign or true-positive classification reason (such as “Confirmed User Activity”, “Compromised User”, or “Not Malicious”) now succeeds. Previously these closes failed with “Request body is incorrect” and the incident stayed open.

​

Improvements

• Service providers can now turn off the agent metadata header on incident comments the Security Delivery Agent posts to Microsoft Sentinel and Defender. With it off, the comment shows only the agent’s written summary, for a cleaner read in the native security console.

​

Bug Fixes

• When adding a customer workspace, the detection and response module names now display in full instead of being cut off mid-name.

​

Improvements

• Analytic rule updates now deploy more reliably to Workspaces with auto-update enabled, and the rule version shown in the portal always matches what is running in Microsoft Sentinel.

​

Bug Fixes

• Mailbox entities in the incident investigation graph no longer offer user account containment actions (lockout, password reset, MFA reset, session invalidation). User containment remains available on the related user account entities, and mailbox entities without an applicable response action now show “No options available” instead of a misleading error message.

​

Bug Fixes

• The Security Delivery Agent no longer assigns itself to Microsoft Defender XDR incidents when its assign-self setting is turned off. Incidents the agent investigates keep their existing owner — or stay unassigned — unless the agent is explicitly configured to take ownership. Analysts updating an unassigned incident’s status still become its owner, as before.
• Manually triggering an agent investigation is now offered only to users whose role can complete it (Owner and Incident Responder), so runs no longer start and then fail partway with “Failed to submit the investigation result.”

​

New Features

• Connect SentinelOne FedRAMP GovCloud (s1gov.net) consoles, with a dedicated static egress IP you can add to your allowlist.

​

Security

• Ongoing security and reliability hardening across the platform, resolving findings from continuous code analysis. No change to day-to-day behavior.

​

Bug Fixes

• Automatic agent investigations that finished after a brief connection timeout are no longer shown as failed. When the agent completes the investigation and reports back, the run is now correctly recorded as completed with its usage.

​

Features

• Failed agent run notifications — Configure recipients per workspace to be emailed whenever an agent run fails, with the agent, run, and workspace context needed to act. Recipients are independent from Incident and Gamebook notifications.

​

Improvements

• Incident detail now fills the full height of large screens, removing the empty space that used to sit below the cards.
• The Add Users picker shows each person’s name and email, so people with the same name are easy to tell apart.
• Dropdown pickers now reveal their options as soon as you focus them, instead of appearing empty until you start typing.
• Corrected the “API Token” label casing on the ticketing details view.

​

Bug Fixes

• Automatic agents now process every incident during a burst. When many incidents arrive for the same customer at once, runs are queued and worked through one at a time per customer, so none are silently skipped.
• Microsoft Defender XDR incidents are no longer skipped when a newly created incident has a lower internal id than one already processed. Incidents are now tracked by when they were created, so anything visible in the Defender portal is reliably ingested.

​

Bug Fixes

• Fixed a sign-in issue that could trap the portal in a loop on Firefox; signing in now works reliably across Firefox, Chrome, and Edge.
• Fixed an issue where Microsoft Defender XDR incidents created during a brief polling interruption could be missed; incidents are now reliably re-scanned and ingested once polling recovers.

​

Performance

• Opening an incident is now dramatically faster. Incidents with many alerts that previously took 30 or more seconds to load now return in a few seconds, in the portal and through the API. Evidence loads on demand when you open the Evidence tab.

​

Bug Fixes

• Resolved an issue where some administrator accounts could be incorrectly denied access.
• The incident comments API now correctly identifies an incident’s closing comment.

​

Bug Fixes

• Turning on automated password resets for end-customer users is now reliable: after granting Microsoft consent the setting enables itself instead of needing a second click, and tenants that need an additional consent are guided through it instead of getting stuck.

​

Bug Fix

• Bulk Delete Email remediation now handles messages that share a reference correctly. Plan rows without a specific entity no longer collide, so every targeted email is actioned.

​

Feature

• Deployed security detection rules now stay up to date automatically as new versions are published, across all ContraForce regions.

​

Bug Fix

• Web Application Firewall analytic rules now deploy correctly; a rule name-matching issue had previously prevented them from being applied.

​

Feature

• New Reset MFA response action: responders can clear a user’s registered multi-factor authentication methods from a Gamebook so the user must re-enroll MFA at next sign-in — available in the portal and to the Security Delivery Agent, with no extra admin consent.

​

Bug Fix

• Approving a queued Gamebook now runs it. Previously the approval appeared to do nothing and the Approve button kept returning; approved response plans now dispatch and show a running state.

​

Bug Fix

• Log Search now runs KQL queries reliably again across Microsoft Sentinel and Microsoft Defender XDR workspaces; queries had begun returning an error instead of results.

​

Feature

• New plans, pricing, and a Billing & Plan management screen: plan tiers now carry entitlements, XDR Only vs. XDR + SIEM is gated by tier, extra workspaces are billed automatically, and investigations are metered with trial limits enforced.
• Service providers can now run automated password resets for end-customer users directly when the capability is enabled.
• Incident classifications are now consistent across detection modules, with a new Classification Trends widget showing how classifications break down over time.
• Admins can view and edit an account’s Trial End Date when changing its subscription status from the modernized Admin Center.
• ContraForce is now available on a UK-resident platform stack, with tooling to migrate existing customers from US to UK.

​

Bug Fix

• The Quarantine File gamebook now runs successfully (it previously failed with an invalid-hash error).
• Customers onboarded to Sentinel without the ContraForce Apollo deployment now reliably receive their incidents.

​

New Features

• You can now send an incident notification email to the end customer on demand from the incident’s Actions menu — pick recipients (with quick-select from saved workspace contacts), then either send the “View Incident” email or send and escalate the incident to Waiting on Customer. Every manual send is recorded in the incident’s audit trail.
• A new “Trigger webhook” action on the incident detail page lets you push the current incident to any of the workspace’s enabled webhooks on demand. The delivery is signed, audited, and appears in the webhook’s events log just like an automatic delivery, marked as manually triggered.
• End-customer workspaces now have a read-only Agents tab showing which AI agent is assigned and its configuration, plus a Run History view with a time filter and links to related incidents.

​

Bug Fixes

• Incident and gamebook links in notification emails now open regardless of how old the incident is or which time filter you have selected — deep links from emails, webhooks, and ITSM tools no longer fail with “couldn’t load incident.” Gamebook notification email subjects now also show the workspace, source, severity, and incident title at a glance.

​

Bug Fixes

• Incident closure metrics now keep the classification reason, so the “By reason” breakdown in Command Center is accurate. You can also now see incidents your service provider closed on your behalf in your own workspace’s Command Center.

​

Improvements

• You can now click a matched SOP chip in an AI agent’s investigation activity to open and read the full standard operating procedure that guided the agent’s classification.
• The Ticketing integration details page has a refreshed look and feel consistent with the latest ContraForce experience.

​

Bug Fixes

• Pre-onboarded workspaces now activate automatically once the customer connects their selected security modules and grants admin consent.
• Service providers can mark a pre-onboarded workspace as onboarded directly from the Onboarding tab.
• The User Management settings tab now prompts to connect tenant directory access when it’s missing.

​

Improvement

• Improved the reliability of Microsoft Sentinel incident detection — incidents keep flowing into ContraForce even when the underlying infrastructure isn’t reliably deployed or available, thanks to an automatic fallback ingestion path.

​

Bug Fix

• Fixed the Incidents page filter chips overflowing past the right edge of the table card on wider desktop screens; they now wrap and stay contained within the panel.

​

Improvement

• Redesigned the Log Search results experience: a readable, resizable, searchable grid where you can expand any record to see full detail, with reliable workspace switching and a Stop button that truly cancels a running query.

​

Bug Fix

• Fixed a Security Analytics issue where a rule could appear multiple times and Deploy/Undeploy didn’t always reflect the correct state.

​

New Features

• Get notified the moment a gamebook runs in a workspace, whether an analyst or the AI Agent started it. A new Gamebooks tab in workspace notification settings lets you toggle “Gamebook ran” and “Gamebook queued” events and maintain a dedicated recipient list, separate from incident notification recipients and gamebook approvers.
• New gamebook.run.v1 webhook event: subscribe a webhook to receive a signed delivery whenever a gamebook runs, ideal for automatically opening tickets in your ITSM.
• The workspace Notifications page is now organized into Incidents and Gamebooks tabs.

​

Bug Fix

• Log Search and Advanced Hunting now always run against the workspace you’ve selected — partner users querying a managed customer’s Microsoft Defender no longer see intermittent consent errors, and results stay scoped to the chosen workspace.

​

New Features

• One classification language across every detection module. Closing an incident now uses four clear verdicts (True Positive, False Positive, Benign Positive, Undetermined) with a curated reason list per verdict, consistent across Microsoft Sentinel, Microsoft Defender, SentinelOne, and CrowdStrike. The verdict you pick is preserved exactly in ContraForce, even when the connected security tool cannot store it.
• Classification Trends in Command Center. A new widget breaks down closed incidents by verdict, reason, and detection module. Click any verdict to jump straight to the matching incidents in the inbox.
• Filter the inbox by classification and reason. New filters, columns, and shareable links let you slice closed incidents by how they were classified.
• Closures made in your security tools now flow into ContraForce. When an incident is closed directly in the vendor console, ContraForce records the closure with its classification, adds an audit entry, and counts it in your closure metrics.
• New incident.closed.v1 webhook. Subscribed integrations are notified whenever an incident closes, including the classification, reason, and whether an analyst or an upstream tool closed it.

​

Bug Fixes

• Agent Center: Models & Quotas now shows only self-hosted agents. ContraForce-hosted (Our Cloud) agents no longer appear in configuration that only applies to your own cloud.
• Agent Center: usage chart is readable in light theme. Axis labels no longer render invisible against a light background.
• Agent Center: run cost is no longer shown for ContraForce-hosted agents. Cost figures appear only for agents running in your own cloud, where they reflect your actual spend.
• Agent model upgrades reliably switch the running agent to the new model. Updating an agent’s model from Models & Quotas now re-points the agent’s runtime at the newly provisioned model deployment and notifies you when the upgrade completes, with success and failure counts per agent.

​

New Features

• Restart a failed Agent Center deployment. When an Agent Center deployment fails, you can now delete it and start fresh with different settings (region, resource group, or subscription) instead of only retrying the same configuration. We also remind you to remove the old Azure resource group so it doesn’t sit idle.

​

Bug Fixes

• Agent updates now tell you whether they actually finished. You get a clear success or failure notification when a background agent update completes — with actionable detail (like a permissions issue) on failure — instead of only a “started” message.
• Cleaner agent investigation comments on forwarded incidents. Agent investigation comments on Microsoft Defender incidents forwarded to Sentinel now appear as a single, clean activity card instead of broken fragments.
• More reliable Sentinel onboarding. Onboarding now verifies subscription-owner access before deploying, preventing customers from being onboarded without the required ContraForce infrastructure.

​

Bug Fixes

• SLA chip no longer sticks on “At Risk” once the target is met. When an incident’s time-to-first-response (or resolution) crossed into At Risk but was then handled in time, the SLA chip kept showing “At Risk”; it now flips to On Track once met. Only a genuine breach stays red.
• Re-onboarding a previously-removed workspace now works cleanly. Removing a pre-onboarded customer workspace could leave the customer’s account record pointing at the deleted workspace, stranding them with no access on the next sign-in. Removing a workspace now cleans up those records, so re-onboarding the same customer provisions them correctly.

​

Improvements

• SLA state changes are now recorded in the incident audit trail. Every SLA tier change (At Risk, Breached, or Met) for both the response and resolution clocks, plus SLA clock pause and resume, now appears as an entry in the incident’s audit tab, so you can see exactly when and how an incident tracked against its SLA.

​

Bug Fixes

• Fixed an issue where a SentinelOne detection module could appear connected while silently failing to pull threats. Configuration problems are now surfaced immediately, and a module cannot be enabled until it is fully configured, closing a hidden detection-coverage gap.

​

New Features

• See the SLA applied to a workspace. Workspace settings now has a read-only SLA tab showing the response and resolution targets configured for that workspace, so customers and service providers can confirm what’s in effect at a glance. The configuration name on an incident’s SLA timeline links straight to it.

​

Bug Fixes

• SLA now tracks on service-provider-managed workspaces. When a service provider assigned an SLA configuration to a customer workspace, that workspace’s incidents weren’t picking it up. Assigned configurations now track correctly, and SLA chips no longer freeze in cross-workspace views.
• Delete Email gamebook runs again. The delete-email response action was failing with “Unable to run the delete email gamebook” because the mail entity wasn’t resolved to the identifier the mailbox provider expected. It now resolves the message and completes the action.
• Command palette shortcut works in the new UI. Ctrl+K (Windows/Linux) and ⌘K (macOS) now open Quick actions in the V2 portal, and the shortcut hint shows the correct key for your OS.
• Consistent incident view from agent history. Clicking an incident in an agent’s Execution History now opens the V2 incident view, matching the rest of the portal.

​

Security

• Hardened email lookups. The delete-email path now guards its mailbox lookup against message-identifier injection.

​

New Features

• Incident SLA tracking. Configure per-workspace response and resolution targets for each severity. The incident inbox gains “Time to First Response” and “MTTR” columns showing a live countdown chip on every row — “SLA 12m left”, “At Risk 5m left”, “Breached 3m over”, or “On Track” once settled. Chips tick down without re-loading and update in real time when any analyst changes status or assignment from any session. The incident detail header carries the same chip alongside a dedicated SLA tab with the configured targets and the running clock. Entering an On Hold or Waiting on Customer status (introduced 2026-05-27) freezes both the response and resolution clocks; resuming continues from where they left off. Available as an opt-in feature — contact your ContraForce contact to enable it on your tenant.

​

New Features

• Security Delivery Agents now read the actual content of phishing emails. Body, headers, embedded URLs, and attachment metadata are fetched automatically using your existing Microsoft 365 Response connection, so the agent can flag social-engineering patterns, sender spoofing, and suspicious links without an analyst opening the message.
• New “On Hold” and “Waiting on Customer” incident statuses. Analysts can pause incidents that are blocked on a vendor RFI, a scheduled change window, or a pending customer reply, instead of leaving them as Active. The new statuses are ContraForce-native and don’t write back to the upstream source.
• Vendor-side status changes now appear in the audit timeline. When an incident is closed or reopened from the Azure portal (or another upstream tool), an attributed audit row is now recorded in ContraForce, so the CF view and the upstream view never silently disagree.
• Per-run agent token breakdown and dollar cost. Every Security Delivery Agent run records its prompt / cached / completion token counts and the USD cost, visible on the per-agent execution history and the agent-center “Recent runs” strip. A row-level “Breakdown” link opens the detailed dialog.

​

Improvements

• Agent token-usage telemetry. Per-run baseline, per-tool-call sizes, and per-turn API usage are now captured so upcoming agent cost optimizations are measurable.

​

Bug Fixes

• Stale Microsoft sessions now silently recover. When a signed-in user’s Microsoft session quietly went stale — token expiry, signing in elsewhere, or a Conditional Access change — the portal was dropping them on a “We couldn’t load your session” error screen and forcing a manual retry. The portal now routes them through interactive re-authentication silently and returns them to where they were, keeping analysts in flow.
• MSP-managed agent configurations now save webhooks correctly. When an MSP managing a customer workspace tried to save an Agent configuration that referenced a webhook on a classification card, the save was failing with “Failed to save agent configuration” and leaving the webhook orphaned. The save now succeeds and the webhook binding is persisted as expected.

​

Improvements

• Dependency refresh for security and reliability. Updated the third-party libraries the platform depends on to pick up the latest bug fixes, security patches, and performance improvements. No visible behavior changes — customers benefit from a more reliable platform with fewer known vulnerabilities.

​

New Features

​

Bug Fixes

​

Bug Fixes

• AI Query Assistant restored. The natural-language KQL generator is working again. Analysts can ask for a query in plain English and get a usable KQL statement back, instead of the silent error the endpoint had been returning.
• Module configuration no longer crashes for un-consented tenants. Self-service onboarded users who hadn’t yet completed Entra admin consent for the ContraForce API were hitting a JSON-parse cascade on the Sentinel, Defender XDR, and Agent Center module configuration pages. The pages now detect the missing consent and surface an actionable “Connect tenant” prompt that walks the admin through the grant flow, so customers can self-unblock without contacting support.

​

New Features

​

Improvements

• Pagination tokens returned from POST /api/v2/incidents/across-workspaces are now opaque to API consumers. Partners continue to round-trip tokens unchanged from response to next request; only the internal token format has changed. A token that has been hand-modified or hand-built is rejected with 400 VALIDATION_ERROR rather than failing further down the stack. See the worked example under Cross-Workspace Endpoints.

​

New Features

• A refreshed visual language built around higher-density, more scannable information.
• Reorganized navigation that surfaces the actions analysts actually reach for.
• Reworked incident, gamebook, agent, SOP, log search, and command pages with consistent layouts and a unified design system. Prefer the classic experience? Open the user menu (top right) and pick Switch to classic experience. Your choice is remembered per browser, so you can move between the two while you get used to v2.

​

Bug Fixes

• Resolved an intermittent issue that could prevent the v2 incident agent from starting an investigation.

​

Bug Fixes

• GET /workspaces/{workspaceId}/incidents/{source}/{incidentId} now returns the full incident detail (alerts, entities, investigation details, evidence, and the gamebook catalog) by default. Previously the endpoint returned the same lightweight payload as the cross-workspace list, with the richer fields hidden behind an undocumented ?withDetails=true query parameter. Partners integrating from Logic Apps, Power Automate, or any OpenAPI-driven client now get the documented response without needing to know the flag exists.
• Cross-workspace incident requests that target a workspace where the requested incident source is not enabled (for example, asking for a Defender XDR incident on a workspace where only Sentinel is onboarded) now return a clear 404 NOT_FOUND with a message naming the source, instead of an opaque 500 or 502. The same applies when an incident does not exist in the workspace’s underlying tenant — partners receive a 404 they can handle, not an upstream-error response.
• The portal’s incident detail page and gamebook workbench now display a friendly “Incident unavailable” banner with a working breadcrumb when a stale or deleted incident is opened from a saved link, instead of hanging on a loading skeleton.

  ​

  Improvements

• The cross-workspace incidents list (POST /incidents/across-workspaces) now publishes its pagination protocol in the OpenAPI spec. The continuation-token mechanism (isFirstCall, workspacePageTokens on the request, sourcePageTokens and moreIncidentsAvailable on the response) is fully described so partners can build paging loops against a documented contract.

​

Bug Fixes

• The workspace selector in the top navigation now filters the Workspaces page, the Log Search page’s workspace and module selector, and the Agent Center (including the Overview tab and the Recent Runs strip). Previously these pages ignored the selector and continued to show data from every workspace you have access to, which made it hard to focus on a subset of customers.

​

Bug Fixes

• Microsoft Sentinel and Microsoft Defender XDR module setup now accepts administrators whose subscription permissions come from inheritance (management group or tenant root), Entra group membership, or the Contributor and User Access Administrator combination. The form previously rejected these valid permission patterns with a “you must have Owner” message even when the user could fully administer the subscription.
• Fixed a stuck-loading state on the module configuration screens when viewing a workspace owned by a tenant other than your active tenant. The Azure role prerequisite would spin indefinitely; it now resolves immediately so you can see why the module cannot be configured.

​

Portal

• Introduced an in-portal release notes side panel. When new releases ship, a release-notes indicator appears in the top navigation with an unread badge showing how many you have not yet seen. The panel is also reachable from the user-avatar dropdown so you can revisit the release history at any time.

  ​

  Bug Fixes

• Resolved a character-encoding issue that prevented certain punctuation marks from displaying correctly in incident classifications.
• Fixed an issue where Microsoft Defender XDR agent investigation comments could render as broken JSON when the comment payload was larger than Defender’s per-comment character limit. Long agent investigation comments now stitch back together correctly in both the Microsoft Defender XDR portal and the ContraForce incident view.

​

v2 API

• Incident management is now available in the v2 API. Customers integrating ContraForce through the v2 OpenAPI specification can read and update incidents programmatically, alongside the existing v1 endpoints.

​

SOP Knowledge Base

• The SOP upload experience now accepts Microsoft Word (.docx) files. Uploaded Word documents are stored, indexed, and searchable alongside your existing PDF and Markdown SOPs, so you can publish SOPs straight from your Word library without converting them first.

​

Agent Center

• Added a new Models & Quotas panel that shows the AI models powering your Security Delivery Agents, including version, capacity, and live per-region usage with a progress bar — so you can see capacity headroom at a glance.
• Restricted models now display a badge and a direct link to the access-request flow, making it clear which models require additional access and where to ask for it.
• You can now upgrade a deployed agent to a newer model directly from the Agent Center without filing a ticket. The upgrade flow lists the models actually available in your environment, and upgraded agents start using the new model immediately.
• Redesigned the Resources tab with grouped cards organized by resource role, plus a live health chip on each resource (Available, Degraded, Unavailable, or Unknown). When something goes wrong, you can identify the unhealthy resource without leaving the portal.

​

Bug Fixes

• Fixed an issue where Organization Admins could not create workspaces or Security Delivery Agents despite having the correct role assignment.
• Fixed an issue where Microsoft Defender XDR incident comments displayed as fragmented “(N of M)” pieces instead of complete messages.

​

Incident Management

• Comments posted on Microsoft Defender and SentinelOne incidents now show the original author from the source platform, matching the experience already in place for Microsoft Sentinel incidents.

​

Bug Fixes

• Fixed an issue where bulk-closing incidents did not refresh the aggregate counts on the Command Dashboard.
• Fixed an issue where bulk incident updates could silently fail mid-operation, leaving some incidents unchanged.

​

Bug Fixes

• Fixed a security issue where deleted user accounts could retain portal access until the next sign-in cycle.

​

Portal

• Users can now opt into the new UI experience individually from their profile, allowing teams to evaluate the new design at their own pace before broader rollout.
  • Let us know if you’d like to enable the new UI for your team or have any feedback on the design!

​

Bug Fixes

• Improved SentinelOne incident polling reliability and refined threat-handling behavior.

​

Bug Fixes

• Fixed an issue where analysts could lose visibility into an incident after Microsoft Defender merged it with another incident.

​

OmniView

• Introduced the OmniView Metrics Dashboard, surfacing customer health scores, operational and business metrics, and a flagged-accounts view in a single analytics dashboard.
• The Account Overview page has been redesigned with a health-score summary, configured modules, and Security Delivery Agent activity metrics so service providers can assess each account at a glance.

​

Bug Fixes

• Fixed an issue where a user’s organization role could revert to its original value after a User Management sync.
• Fixed an issue where Microsoft Sentinel marketplace scanned sources failed to display when duplicate data source records existed with different casing.
• Fixed an issue where analytic rule queries returned no results when data source ID casing did not match exactly.
• Fixed an issue where Sync Users deactivated service accounts not matching identities in their directory.

​

Incident Management

• The Command Palette now supports searching incidents across all of your workspaces, so you can jump directly to an incident regardless of which workspace it belongs to.

​

API Reference

• Published an actively maintained OpenAPI specification for the v2 ContraForce API, making it easier to generate clients and integrate ContraForce with your own tooling.

​

Agent Center

• Agent creation now validates available GPT quota during setup, surfacing capacity issues before you finish configuring the agent.

​

Bug Fixes

• Fixed an “Agent not found” toast that appeared when OmniView admins loaded executions for a managed account’s agent.

​

Bug Fixes

• Fixed an issue where EventCast webhook configurations were not delivered correctly for MSP tenants.

​

Agent Center

• The SOP Knowledge Base is now integrated directly into agent deployment — agents pick up relevant SOPs as part of the configuration flow, removing the need to attach them as a separate step.

​

Agent Center

• Starter SOP templates are available for new customers, providing ready-made examples that accelerate Security Delivery Agent onboarding.
  • Reach out to your ContraForce contact to get these SOPs for your organization and start customizing them for your team.
• SOPs now persist with full backend support, ensuring uploaded procedures are durably stored and accessible to agents at runtime.

​

REST API

• Customer API Clients are now available. Create and manage API clients with scoped permissions and workspace-level access from a new portal experience that includes a creation wizard, a details page with scope and audit tabs, and a request-log viewer for monitoring usage.

​

Workspace Management

• The subscription picker for the Microsoft Sentinel module and Agent Center configuration now supports searching by subscription ID, making it easier to locate the right subscription in tenants with many subscriptions.

​

Performance Improvements

• Added additional health monitoring across all platform services for improved reliability and faster detection of service disruptions.

​

Bug Fixes

• Fixed an issue where Gamebook orchestration could stall on timer cancellation, leaving Gamebooks stuck in a Running state.

​

User Profile

• You can now set your preferred time zone in your user profile, and the platform will display all dates and times in your local zone.
• Hovering over any date or time displays a tooltip showing the original UTC value, removing ambiguity when collaborating across time zones.

​

Bug Fixes

• Fixed an issue where the incident audit log could fail to render certain entries from the unified incident pipeline.

​

Incident Management

• When you close an incident with a comment, that comment now appears in the Comments tab in addition to the Summary, keeping the full conversation history in one place.

​

Incident Management

• Comments posted by Security Delivery Agents now display with a distinct visual treatment so analysts can quickly distinguish AI-generated comments from human analyst input.
• Incident notification emails now include the source platform in the subject line, making it easier to filter and route alerts.

​

Workspace Management

• Added a read-only Workspace Reader workspace role that gives end customers and auditors view-only access to incidents and reports without permission to make changes.

​

Agent Center

• Security Delivery Agents now support a configurable Should Assign Self option that controls whether an agent automatically assigns itself as the incident owner during processing.

​

Bug Fixes

• Fixed an issue where the workspace name was missing from the Role Assignment view in User Management.
• Improved reliability when removing role assignments so changes apply consistently on the first attempt.

​

Log Search

• Introduced an AI Query Assistant for Advanced Hunting Log Search. Describe what you’re looking for in plain language and the assistant generates the corresponding query for you.

​

Incident Management

• Incident tables and dashboards now auto-refresh, so the data you see stays current without manually refreshing the page.

​

Bug Fixes

• Improved error handling for SentinelOne Gamebook actions so failures surface clearly instead of leaving Gamebooks in an ambiguous state.

​

Agent Center

• Introduced the SOP Knowledge Base — a centralized library of security operating procedures for your Security Delivery Agents. Upload SOPs via drag-and-drop with type selection and metadata, browse and filter them in a dedicated list view, and preview content in a slide-over detail panel.
• Link SOPs to specific agents and update procedures over time with edit, re-upload, and cascade-delete actions. Each agent’s details page now includes an SOP section showing its associated procedures.

​

Workspace Management

• Onboarding role validation now accepts Cloud Application Administrator and Application Administrator in addition to Global Administrator, supporting least-privilege Microsoft Entra ID deployments.

​

Performance Improvements

• Removed the cookie consent banner by switching analytics to session-only storage, simplifying first-load behavior for portal users.

​

Agent Center

• You can now review a complete history of every Security Delivery Agent execution from the Execution History tab on the Agent Details page. Each entry captures the timestamp, trigger source, incident, data source, severity, AI token usage, and outcome — providing full visibility for compliance and troubleshooting.
• The portal now displays a notification when a Security Delivery Agent update is available, so you can update without checking manually.

​

Workspace Management

• Organization Admins can now permanently delete inactive accounts and all associated data, preventing stale accounts from consuming resources or cluttering the platform.

​

Bug Fixes

• Fixed an issue where the Configure and Save button on the agent configuration page was always enabled, even when no changes had been made or the user lacked the required permissions.

​

Bug Fixes

• Fixed an error that prevented non-partner users from loading the multi-workspace incident list.

​

Agent Center

• Security Delivery Agents can now automatically detect and respond to Microsoft Defender for Endpoint incidents without requiring Microsoft Sentinel forwarding. Once configured, ContraForce polls Defender for Endpoint for new incidents and triggers your agent automatically — enabling a fully autonomous response workflow for environments using Defender for Endpoint directly.

​

Bug Fixes

• Fixed an issue where users in tenants with 50 or more Microsoft Entra ID group memberships silently lost real-time incident updates and portal connectivity.

​

Gamebook Improvements

• Reviewers can now Deny a Gamebook queued for approval, removing it from the queue rather than leaving it pending indefinitely.

​

Bug Fixes

• Fixed a permissions issue where users with the Incident Analyst role could submit a Gamebook for approval, but it could execute instead of waiting for review.

​

Bug Fixes

• Fixed a layout issue where incident table filters appeared misaligned on screens under 1800px wide.
• Fixed an issue where the Link Ticket dialog only showed Jira projects A–F (approximately 10 results) and search had no effect, preventing analysts from linking incidents to projects not in the initial list.
• Fixed an issue where Security Delivery Agents failed to update incident status due to a validation error, causing automation rules to not apply correctly.
• Fixed an issue where audit log entries for agent-triggered status changes and owner assignments recorded the incorrect account ID.

​

CMS Updates

• Improved detection rule reliability by fixing issues with multi-table rule deployment.
• Improved several detection rules for better accuracy and fewer false positives.

​

Workspace Management

• You can now delete a pre-onboarded tenant that hasn’t completed setup, simplifying workspace cleanup.
• Workspace tags now display more relevant contextual information, replacing the outdated “Configuration (XDR + SIEM)” label.

​

Gamebook Improvements

• Added a Workspace column to the Gamebook Activity view, making it easier to identify which workspace each Gamebook execution belongs to.

​

Bug Fixes

• Fixed a crash on the incidents list when viewing multiple workspaces caused by a module configuration change.
• Fixed “Last Modification” in Group Management displaying “0 days ago” instead of the actual date.

​

Agent Center

• Improved Security Delivery Agent reliability when investigating workspaces where certain Gamebook extensions are not enabled.

​

Bug Fixes

• Fixed an issue where Gamebooks could get stuck in a pending or running status.
• Fixed visual rendering issues in several portal components.

​

Incident Management

• Added an Assign to me quick-action button to incident details and the incident modal, enabling analysts to claim incidents faster.
• Incident IDs now appear consistently in the breadcrumb, URL, and page header for easier reference and sharing.
• Consolidated workspace filtering — individual table workspace filters have been replaced by the global workspace filter at the top of the page for a cleaner, more consistent experience.

​

Gamebook Improvements

• The Gamebook approval button now displays an informative tooltip explaining why approval is unavailable when prerequisites haven’t been met.

​

Bug Fixes

• Fixed an issue in the Agent Center where pressing Enter during agent creation would prematurely submit the form.
• Fixed a data source usage query failure affecting Google Workspace Reports.

​

Dock Panel Navigation

• The dock panel now opens to the Browse tab by default when expanded, providing faster access to workspaces and navigation.
• The Recent tab now correctly displays workspaces you’ve recently accessed, improving workspace discovery.
• Added a visual indicator to the active dock panel tab, making it easier to see which tab is currently selected.

​

Bug Fixes

• Fixed an issue where the dock panel collapsed when navigating between workspaces.
• Reduced unnecessary re-renders when interacting with dock panel tabs.

​

Incident Details Redesign

• The incident details experience has been redesigned with improved entity organization, clearer section navigation, and faster load times.
• Entity lists in incident details now show enriched context directly in the list view.
• Incident tabs have been reordered to show Comments first, followed by Audit, improving the workflow for analysts reviewing incident activity.

​

Data Source Activity Monitoring

• Data source activity charts now update in real-time, giving administrators immediate visibility into ingestion health without refreshing.
• Added a new “Last Seen” indicator to quickly identify stale or disconnected data sources.

​

Agent Center

• Improved agent investigation messaging — when an agent investigation takes longer than expected, the notification now indicates that the agent will continue working in the background rather than showing a timeout error.

​

Bug Fixes

• Fixed time zone display issues in incident timestamps.
• Resolved entity context panel occasionally not loading for certain entity types.
• Fixed an issue where the Agent Center failed to display available agent updates.
• Removed an inaccurate tooltip from the Log Search run button.

​

Agent Deployment

• Simplified agent deployment with a new guided wizard that validates Azure prerequisites before provisioning.
• Added deployment status notifications so administrators know when agents are ready.

​

Filter Persistence

• Filters across the Command dashboard, Incidents, and Gamebooks pages now persist across sessions, reducing repetitive filter configuration.

​

Bug Fixes

• Fixed agent configuration page not loading when no agents were deployed.
• Resolved intermittent failures when saving notification preferences.
• Fixed Gamebook Activity filter not correctly displaying queued Gamebooks.

​

Platform Performance

• Optimized incident list queries, reducing load times by up to 40% for high-volume workspaces.
• Improved caching for workspace metadata, reducing redundant API calls during navigation.
• The Incidents page now defaults to a 3-hour time filter instead of 24 hours, improving initial load times for high-volume workspaces.

​

Gamebook Execution

• Gamebook execution logs now stream in real-time, providing immediate feedback during manual and automated runs.

​

Bug Fixes

• Fixed memory leak in the incident polling service.
• Resolved rare race condition causing duplicate incident entries in the UI.
• Fixed an issue where pre-onboarding a new workspace did not correctly assign owner access to the administrator.
• Fixed an issue where administrators could not access agent configuration from the Agent Center.

​

Workspace Manager

• Added tooltips to the CMS and Settings icons in the Workspace Manager, matching the tooltip pattern used elsewhere in the portal.

​

Bug Fixes

• Fixed an issue where workspace group membership changes were not reflected until page refresh.
• Resolved CMS rule deployment failures for workspaces with special characters in their names.
• Fixed entity search returning incomplete results for IP addresses.
• Corrected tooltip alignment issues in the Command dashboard widgets.
• Fixed entity context menu in the Gamebooks workbench requiring a second click to show available actions.
• Fixed an error when viewing the Alert Rule tab for incidents from Microsoft Defender for Endpoint and other non-Sentinel sources.
• Fixed incident closure failing for Microsoft Defender for Endpoint incidents.
• Fixed the Configure and save button remaining clickable after completing Microsoft Sentinel configuration.

​

Content Management System (CMS) Migration

• Analytical rules, security content, and CMS capabilities are now fully integrated into the IRIS platform, delivering a unified experience for managing detection rules and security content without switching between tools.

​

Platform Upgrade to .NET 10

• The platform has been upgraded to .NET 10, improving performance, security, and long-term supportability across all services.

​

Agent Center Enhancements

• Administrators can now update agent container images directly from the Agent Center, reducing operational overhead when deploying new agent versions.
• Agent efficacy improvements: agents now have access to sign-in logs, directory logs, device timelines, and related incidents as investigation tools — enabling richer, more accurate automated investigations.
• Default AI model capacity increased to 150K tokens per minute, improving agent throughput for high-volume environments.

​

Gamebook Fixes

• Resolved an issue where the gamebook approval button was not functioning correctly in the incident detail modal.

​

Notification Settings

• Users can now toggle severity-based notifications without requiring recipients to be configured first, simplifying initial notification setup.

​

Filtering Experience

• Filters across the portal now persist as you navigate between pages, eliminating the need to re-apply filters repeatedly.

​

Bug Fixes

• Fixed an issue where API error responses with empty bodies caused client-side errors.
• Fixed null reference errors when agents array was uninitialized.
• Resolved issues with SentinelOne and Azure response module configuration logic.
• Fixed security rule detail page errors.

​

Command 2.0 Dashboard

• The Command page has been redesigned with a new dashboard layout featuring at-a-glance operational metrics, giving security teams immediate visibility into their security posture.

​

New Dashboard Widgets

• Incident Tracker Overview — Track open, in-progress, and resolved incidents across all workspaces in a single view.
• Closed Incident Rule Trends — Understand which detection rules are driving the most resolved incidents over time.
• Workspace Closed Incident Trends — Compare incident resolution performance across workspaces.
• Gamebook Activity Widget — Monitor active gamebook executions and their current status in real time.
• Gamebook History Widget — Review past gamebook runs with outcomes and timing for post-incident analysis.

​

Agent Deployment Improvements

• Added support for selecting preferred AI models in the Agent Center.
• Continued support for standard agent deployment alongside newer deployment options for existing customers.

​

CrowdStrike Integration Enhancements

• Incident descriptions from CrowdStrike are now automatically generated with richer context.
• CrowdStrike incident comments are now fetched from audit logs, providing a complete conversation history within IRIS.

​

SentinelOne Integration Enhancements

• Added support for SentinelOne threat classifications (verdicts), giving analysts clearer disposition information.
• Fixed incident description formatting for SentinelOne incidents.

​

Bug Fixes

• Fixed workspace filter not resetting to “All Workspaces” correctly.
• Resolved inaccurate time filtering for the 24-hour filter option.
• Fixed custom time filter unable to change from an existing custom selection.
• Fixed duplicate rule entity mapping errors.

​

Audit Trail System

• A comprehensive audit trail is now available for incident updates, entity investigations, and status changes. Security teams can review a full history of who did what and when — critical for compliance and post-incident review.
• Audit logs for user sign-in and directory events are now queryable within the platform.

​

Agent Improvements for General Availability

• Agents now automatically trigger investigations on new incidents, reducing mean-time-to-respond without manual intervention.
• Real-time gamebook status updates are now streamed to the UI — no more refreshing to see investigation progress.
• Gamebook execution results are now visible directly on the Gamebook page.
• Agent response flow improved with better error handling and detailed comments when issues occur.
• Prevented duplicate agent investigations on the same incident.
• Agent UI refined for general availability readiness.

​

Workspace Group Management

• Group member details, including member lists, are now visible in the group viewing slider within workspace settings.

​

Data Source Activity

• The data source activity graph has been enhanced for better readability and alignment.

​

Bug Fixes

• Fixed time filter refresh behavior on the incidents page.
• Fixed agent response button remaining active when agent is not properly configured.
• Fixed Defender incident comment creation for comments exceeding 1,000 characters.
• Resolved incorrect log search results for Microsoft Defender data sources.
• Fixed data source query results mapping to use column names instead of index positions, improving reliability.

​

Ticketing Orchestrator

• Introduced a new ticketing orchestration layer that improves reliability and consistency when creating and managing tickets across integrated ticketing systems (Jira, ServiceNow, Autotask).

​

Agent Flow Optimization

• The agent investigation and response flow has been optimized for performance, with improved classification mapping and enriched logging for better troubleshooting.

​

Time Filter Improvements

• Time filters throughout the portal now correctly display in local time instead of UTC, and the refresh behavior has been improved.

​

Bug Fixes

• Fixed ticket creation for Microsoft Defender incidents in Autotask.
• Resolved entity context menu appearing for non-Microsoft sourced incidents.

​

CMS 3.0 Release

• The Content Management System has been finalized with an updated user interface, improved rule details pages, and refined commenting capabilities for security content collaboration.

​

Notification System

• A new notification settings system allows workspace administrators to configure alert recipients, severity thresholds, and notification preferences per workspace — ensuring the right people are notified about the right events.
• Notification recipients can be added and removed directly from workspace settings.

​

Agent Center

• A redesigned Agent Center creation experience with step validation, an Azure region picker for selecting agent resource locations, and an improved configuration details view.
• Agent deployment reliability has been significantly increased with improved error handling and processing time.

​

Feature Flag Cleanup

• Gamebooks 2.0 and Workspace Management features are now generally available — feature flags have been removed, making these capabilities available to all users by default.

​

Bug Fixes

• Fixed deployment table routing when switching workspaces.
• Fixed notification delivery issues identified during QA.
• Resolved IAM management component flag check issues.