New-Scale Security Operations PlatformNew-Scale Security Operations Platform Release Notes

AI monitoring

Automated timelines

Risk management

Centralized dashboards

AI monitoring

Automated timelines

Risk management

Centralized dashboards

Identity and privilege monitoring to detect misuse and unauthorized role changes

Prompt and model abuse detection for early signs of injection and manipulation

Agent lifecycle monitoring with visibility into agent creation, modification, and usage

Comprehensive coverage aligned with the OWASP Agentic Top 10

The Discard_EM_USER value restricts Attack Surface Insights from creating user entities from an event. Attack Surface Insights continues to create device entities.

The Discard_EM_HOST value restricts Attack Surface Insights from creating device entities from an event. Attack Surface Insights continues to create user entities.

An identifying entity attribute value or context data contains a hyphen

The prefix before @ or - delimiters is administrator, admin, or root

MFA Capable

MFA Registered

SSPR Registered

Auth Methods Registered

Manager

MFA Capable

MFA Registered

SSPR Registered

Auth Methods Registered

Manager

AI/LLM Web Domains

AI/LLM Web Categories

AI/LLM Applications

Unsafe Countries – A context table you can populate with default country codes for any countries from which your organization views activity to be suspicious.

Credentials Dumping Processes – A context table that contains a list of processes that are used for credentials dumping. This table is populated by default with a specific set of processes.

The header row of the table results is locked in place so that it stays visible as you scroll vertically through the rows of your table. No more loosing your place in long tables as the header row disappears.

Readability has been improved by minimizing white space in and around the table. The new compact display allows more data to fit on the page at once.

The options for formatting text in each column have been simplified and clarified. Options now include truncating or wrapping text. In addition, a new Reset Columns control has been added to the toolbar so you can apply column formatting to all of the columns in the entire table with a single click.

A field options menu has been added for each cell in the table. When you click on a specific cell, a drop-down menu opens. Consistent with other field options menus in the Search application, it allows you to take actions such as, copy the field value, add the field to the current query, or visualize the field data in a Dashboard.

A Details link has been added to the far right side of each result row in the table. Use this link to open either the Event or Detection tabs in the Details panel.

Case Number – The unique case ID assigned to the case.

Case Closed Reason – The pre-defined reason for why a case was closed:

Case Close Supporting Reason – The optional free text comment you can enter to explain why a case was closed.

Hours Time to Close – Hours taken to close a case, from the alert Creation Timestamp Time to the Case Closed Timestamp Time.

Alerts : Case Creation Timestamp Date – When a case was created

Alerts : Case Number – The unique ID assigned to the case

Case Closure Count by Reason – A column chart that shows the total number of cases closed by case closed reason.

Mean time to close (hours) – A single value-style visualization that shows the average hours taken to close a case.

Closed Case Reason by Month – A line graph that shows the number of cases closed per month for each case closed reason.

Case Closed Details – A table that shows up to 5000 most recently created cases and their Case Number, alert Creation Timestamp Time, Case Creation Timestamp Time, Case Closed Timestamp Time, Case Closed Reason, Time to Close, and Time to Resolution.

Stage

Queue

Assignee

Priority

MITRE TTPs

Use cases

Tags

Notes

isRandomHostName() – Checks whether a host name is likely to have been randomly generated

isRandomDomain() – Checks whether a second-level domain is likely to have been randomly generated

contextGetValue() – Retrieves the value from a specified column in a context table using a key value.

To test an analytics rule, you can now directly select Testing. The severity of the analytics rule is automatically changed to None.

When you apply analytics rule changes, you can now easily identify which analytics rules will be tested with a new Testing status under the Change column.

Analytics rules you're testing do not create Threat Center cases or alerts unless they are triggered with other analytics rules that aren't being tested.

Prof-AI-T-U-QLength – An abnormal number of tokens for a single successful AI request has been observed for this user. If the number of tokens is not available, tokens are estimated at one token per four letters.

Prof-RA-R-UPlt-RN – This is the first time this user has assigned this role on this platform.

Prof-GCreate-U-P-UD – This is the first time users in this department have created a group on this platform.

Prof-AI-AC-O-UD – This is the first time a user in this department has created an AI agent.

NumSP-AI-TS-UO-QLength – An abnormal sum of tokens in successful AI requests has been observed for the organization and attributed to this user. If the number of tokens is not available, tokens are estimated at one token per four letters.

Prof-RA-R-UDPlt-RN – This is the first time this role was assigned by users in this department on this platform.

Prof-AI-TI-O-TN – This is the first time this AI agent tool has been invoked.

NumSP-Web-AIA-U-AILLMBytesOut – An abnormal volume of outbound data to AI/LLM web applications has been observed for this user.

Prof-AI-AC-PLT-UD – This is the first time a user in this department has created an AI agent with this platform.

Prof-AI-TI-U-TN – This is the first time this AI agent tool has been invoked by this user.

Prof-AI-T-O-QLength – An abnormal number of tokens for a single successful AI request has been observed for the organization. If the number of tokens is not available, tokens are estimated at one token per four letters.

NumCP-Web-AIA-U-AILLMSessionCount – An abnormal number of AI/LLM web sessions has been observed for this user.

Prof-AI-AS-Plt-U – This is the first time this user has shared an AI agent on this platform.

Prof-AI-AC-O-AT – This is the first time a user in the organization has created an AI agent.

NumCP-AI-QC-U – An abnormal number of successful AI requests have been performed by this user. AI requests consist of one or more prompts.

Prof-UCreate-U-Plt-U – This is the first time this user has created a user account on this platform.

Prof-AI-PI-O-U-Exec – This is the first time an AI request that attempts to cause the agent to execute a command or a script has been sent by this user.

Prof-FDel-UnixLogFiles-O-U – This is the first time a log file deletion has been observed for this user in Unix systems.

Prof-AI-AC-O-PLT – This is the first time a user in the organization has created an AI agent with this platform.

NumCP-AI-MC-U – An abnormal amount of AI agent modifications have been observed for a user.

Fact-PC-OpenClawInstall – OpenClaw has been installed using the command line tool 'curl'. There is nothing inherently malicious about OpenClaw, however, by default it uses insecure practices and may expose significant security flaws.

Prof-AI-AC-O-U – This is the first time this user has created an AI agent.

Prof-AI-TI-UTN-FN – This is the first time this AI agent tool function has been invoked by this user.

NumSP-AI-TS-U-QLength – An abnormal sum of tokens in successful AI requests has been observed for this user. If the number of tokens is not available, tokens are estimated at one token per four letters.

Prof-RA-U-Plt-U – This is the first time a role has been assigned by this user on this platform.

Fact-PC-TFE-Write – The Tasks folder in system32 and syswow64 are globally writable paths that can be abused using shell built-ins such as 'copy', 'echo', 'type', 'file createnew' to stage or execute payloads. This sigma rule is authored by Sreeman. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/799acec38b9e0696cc1d5767a9416033f620aca0/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml

Prof-UCreate-U-Plt-UD – This is the first time users in this department have created a user account on this platform.

Fact-AI-PI-IgnoreInsruct – An AI request attempting to cause the agent to ignore instructions has been sent.

Prof-GCreate-U-P-U – This is the first time this user has created a group on this platform.

Prof-RA-R-Plt-RN – This is the first time this role was assigned on this platform.

NumCP-AI-QC-UO – An abnormal number of successful AI requests for the organization have been performed by this user. AI requests may consist of one or more prompts.

Prof-AI-AC-PLT-U – This is the first time this user has created an AI agent with this platform.

Fact-AI-PI-Base64 – An AI request with a base64 string has been sent. While not inherently malicious, Base64 encoding in an AI request may indicate prompt obfuscation.

NumCP-AI-QC-WID – An abnormal number of successful AI requests has been observed for this workspace. AI requests may consist of one or more prompts.

Prof-DL-O-Sig – This is the first time a kernel module or driver has been loaded with this signature for the organization.

Fact-AI-PI-ShowSystemPrompt – An AI request attempting to display the AI system prompt has been sent.

Fact-DL-MissingSig – A kernel driver missing a valid signature has been loaded.

Fact-Web-AIA-U-BlockedAILLM – An HTTP communication attempt involving an AI application (e.g., ChatGPT, GitHub Copilot) has been blocked. This may indicate shadow AI usage, attempted policy evasion, or early stage data leak behavior.

NumCP-FDel-UnixLogFilesC-U – An abnormal number of log files have been deleted by this user in Unix systems.

Fact-PC-CryptoTool – A process with a name that contains "miner" or "mining" was executed.

Prof-EL-E-U-SC – This is the first time this user has successfully logged into an endpoint from this country, determined by geolocation lookup.

Fact-PCbcdedit-BootEM – bcdedit.exe usage (e.g., delete, deletevalue, import, safeboot, network) tied to boot configuration tampering which may indicate attempts to damage the system or maintain persistence. This sigma rule is authored by @neu5ron. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml

Fact-PCecho-TFE – Tasks Folder Evasion. The Tasks folder in system32 and syswow64 are globally writable paths that can be abused using shell built-ins such as 'echo' to stage or execute payloads. This sigma rule is authored by Sreeman. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml

Fact-PCcopy-TFE – Tasks Folder Evasion. The Tasks folder in system32 and syswow64 are globally writable paths that can be abused using shell built-ins such as 'copy' to stage or execute payloads. This sigma rule is authored by Sreeman. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/799acec38b9e0696cc1d5767a9416033f620aca0/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml

Fact-PCcsi-AP – PowerShell starting the C# Interactive Console (csi.exe), which may be used to execute code in an unusual or hidden way. This sigma rule is authored by Michael R. (@nahamike01). The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_use_of_csharp_console.yml

Fact-PCtype-TFE – Tasks Folder Evasion. The Tasks folder in system32 and syswow64 are globally writable paths that can be abused using shell built-ins such as 'type' to stage or execute payloads. This sigma rule is authored by Sreeman. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml

Fact-PCreg-SRH – Attempt to export sensitive Windows registry hives using reg.exe, which may be used to collect credentials or system secrets. This sigma rule is authored by Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml

Fact-PCrundll32-PwrshellDll-PCL – rundll32.exe to execute PowerShell related code through DLL loading techniques. This sigma rule is authored by Markus Neis, Nasreddine Bencherchali (Nextron Systems). The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml

Fact-PCnltest-DomDisc – Windows command line tools to identify domain trust relationships, which may be used during reconnaissance. This sigma rule is authored by E.M. Anhaus, Tony Lambert, oscd.community, omkar72. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml

Fact-PCpwrshell-AC – PowerShell commands that attempt to access or record audio from the system microphone. This sigma rule is authored by E.M. Anhaus (Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems). The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml

Fact-PCwmic-WebExec – The WMIC (WMI Command Line) process has been used to invoke a remote XSL script. This sigma rule is authored by Markus Neis, Florian Roth. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Fact-PCpwrshell-HidExec – The PowerShell process has been executed with a hidden or non-interactive console window. This sigma rule is authored by Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix). The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml

Fact-PCschtasks-TC – The SchTasks (Scheduled Tasks) process has been spawned by a command associated with the 'PowerSploit' or 'Empire' attack tools. This sigma rule is authored by Markus Neis, @Karneades and is licensed under Detection Rule License (DRL), https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md. Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml

NumCP-WebF-EC-WebDomain – An abnormal number of error responses to an HTTP requests to an internal resources have been observed for this domain.

NumSP-Network-BytesToExtIP-SEDP-Bytes – An abnormal amount of bytes have been sent using SSH, Telnet, SMTP, DNS, FTP, HTTP or HTTPS protocols in communication to an external IP from this endpoint to this port.

NumDCP-Network-DPC-SEDE-DP – An abnormal number of unique destination ports have been accessed from this source endpoint to this destination endpoint in internal communication.

NumDCP-FDel-U-DE – An abnormal number of unique remote destination endpoints have been observed in file deletion events on this endpoint for this user.

NumCP-WebF-EC-U-Id – An abnormal number of error responses to an HTTP requests have been observed for this user.

NumDCP-Network-DIPC-SE-DIP – An abnormal number of unique IPs have been accessed from this endpoint.

NumDCP-Network-DEC-SE-DE – An abnormal number of unique endpoints have been accessed from this source endpoint in internal communication.

NumCP-WebF-EC-SIP – An abnormal number of error responses to an HTTP requests to an internal resources from this IP have been observed.

Fact-PCmsiexec-WebExec – The MsiExec process (Windows Installer) has been used to execute a remote script using a web addresses parameter. This sigma rule is authored by Florian Roth (Nextron Systems) and is licensed under Detection Rule License (DRL), https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md. Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_msiexec_web_install.yml

NumDC-Git-RepoC-U-Object – An abnormal number of unique repository endpoints where secrets are generally stored, which may indicate unauthorized enumeration or insider reconnaissance activity. Repository name is parsed into the object field which is being counted here.