July 2026 release notes

July was the largest release so far. Analysts get workable cases, a forensic timeline, graph investigation and a focused Triage Mode. Behind the scenes, AI-built parsers, reviewed drop rules and a full set of dashboards and report packs arrived.

Investigation

Cases you can work. Set status, assign an owner, comment, add tasks and close a case. Each case keeps a timeline, and kymeer can write a closing report.
Forensic timeline. Each incident gets a timeline, a kill-chain graph and an exportable report. Every statement in the report cites its evidence.
Graph investigation. Explore the entity graph, find paths between two entities and scrub through time.
Triage Mode. Work through incidents one at a time with verdict buttons, or triage several at once.
Entity 360 and UEBA. Each user or device has a profile with its timeline, risk breakdown and peers. A leaderboard ranks entities by risk.

Collection and parsing

Parser Factory scoring. Every AI-built parser now gets a quality score. The score flags values the parser found but failed to map.
Manual parsers. Select part of a raw log line and bind it to a field, then test and save the parser.
Incomplete parses. An event whose parser left out fields is flagged, with the missing fields named. An administrator can correct the parser.
Unidentified devices. Devices a collector cannot identify wait in a queue until someone confirms their type.
Drop rules. A tenant can choose events that are never stored. A rule starts inactive, and a different person must activate it.
Agents. A native Windows Event Log sensor is added. Enrolment tokens now have a lifetime you choose, and you can list and revoke them.
Retention. Events now stay in the hot tier for 30 days.

Detection and governed AI

Broader day-one content. Detection content that spans the ATT&CK tactics is now on by default for every tenant.
AI-proposed rules. The AI SOC analyst proposes rules, which are backtested on your recent events. A rule stays inactive until a person approves it.
Reasoning you sign off. The analyst's reasoning is shown on the incident, and a person must approve its verdict before anyone acts on it.
Threat intel and privacy. Free blocklist feeds sync on a schedule and are matched locally. Tenants can pseudonymise or mask chosen personal-data fields before events are stored.

Dashboards and reports

Dashboards. New curated dashboards include SOC Command Center, Incident Response, Vulnerability Exposure, ATT&CK coverage, UEBA and a firewall overview. You can describe a layout in plain language or define computed metrics.
MSSP views. Tenant Health and an all-tenant overview show every client tenant in one place.
Reports. 36 report packs run on evidence queries. A board-ready brief summarises posture in plain English.
Vulnerabilities. A device-by-device view can be sorted, filtered and exported.

Access and platform

Sign-in by emailed code. Users can sign in with a one-time code sent by email. Administrators must enrol an authenticator app, and any user can enrol one from the Account page.
Three-tier onboarding. The platform onboards MSSPs, and MSSPs onboard tenants. Menus follow each user's role.
Branding. Each tenant can set its own accent colour and logo.
Notifications. Users choose which notifications they receive, as single alerts or digests. Browser push notifications are supported, and the console installs as an app.
Compliance. A consent and lawful-basis ledger is added. Erasure is blocked while a legal hold applies.