August 2026 release notes

August brought graph-native detection content and a full set of compliance dashboards, including views for industrial networks. Ask kymeer investigations can now be saved, shared and worked on together, and MSSPs get clearer controls over tenants and capacity.

Detection

• 124 graph detection rules. A library of 124 graph-native rules, mapped to MITRE ATT&CK, now loads from content packs.
• New graph checks. Rules can match a known value, combine conditions, match on a relationship between entities and flag rare values.
• More sources in the graph. Cloud, mail and Linux audit events now feed the entity graph, so graph rules can see them.
• What is running. The Rules page lists the graph rules that are actually running.

Triage

• AI verdict on every signal. Signal cards show the AI analyst's verdict.
• Clear consequences. When you record a verdict, kymeer shows what it will change. Repeated false-positive verdicts on the same pattern suppress it for your tenant.
• Acknowledge and pivot. Acknowledge a signal from the action bar. From any event, jump to the entity it concerns, the incident it belongs to and the rule behind it.
• Tune from the signal. Tune a noisy rule for your tenant straight from a signal, or start a drop rule from it.
• Live workspace. The risk gauge and blast-radius graph update while you have an incident open.

Ask kymeer

• Saved queries. Save a question and run it again later.
• Share and reuse. Share an answer, export it, attach it to a case or add it to a dashboard.
• Investigate together. Invite colleagues to an investigation. Comment, mention people and record conclusions in one place.

Compliance and OT

• 20 compliance dashboards. Twelve general dashboards and eight for industrial networks.
• OT visibility. The protocol classifier recognises 11 industrial protocol families, including Modbus, DNP3, S7comm, FINS and SLMP/MELSEC.
• Daily log review. Analysts record a sign-off for each day's log review, and missed days are flagged.
• Regulator clocks. The regulator dashboard shows reporting clocks for CERT-In (6 hours), RBI (6 hours), NIS2 (24 hours) and GDPR (72 hours).
• Erasure in search. Once an erasure is approved, that person's events inside the approved window are withheld from search. kymeer refuses to approve an erasure for a person it cannot find in the data.

Collection

• New agent sensors. You can turn on sensors for DNS queries, network connections, file integrity, the Linux journal, the macOS unified log and persistence.
• Installers. The Windows installer is updated, and agent bundles are available for arm64.
• Collector groups. Group collectors and see how many are healthy. The console shows whether a group can lose one collector and still cope.
• Adaptive shipping. Collectors send more data at once when the link is healthy and back off under pressure.
• Safer acknowledgement. Ingest confirms an event only after it is written to a replicated write-ahead log.
• One field dictionary. Events are now normalised to kymeer's own field dictionary.

MSSP and access

• Rule requests. The detection catalogue is owned by the platform. An MSSP describes the rule it needs, the platform team decides, and the answer goes back to the requester.
• Tenant onboarding. New pages cover onboarding, entitlements, daily ingest allocations and the MSSP's overall envelope.
• Platform access record. MSSPs can see each time a platform operator entered one of their tenants, the reason and what was done. The MSSP is emailed when this happens.
• Moving tenants. Only a platform administrator can move a tenant from one MSSP to another.