June 2026 release notes

In June, kymeer started checking events against detection rules as they arrive, and incidents now open in a single triage workspace. This release also adds behavioural analytics, self-service device onboarding and a guarded workflow for erasure requests.

Detection

Live detection. Incoming events are checked against detection rules as they arrive. A match opens an incident straight away.
Fewer failed-login incidents. A correlation rule can now require a success after a run of failures for the same user or source. A blocked attempt on its own no longer opens a high-severity incident.
One incident per silent device. When a device or collector stops sending logs, kymeer keeps a single incident and raises its risk while the outage lasts.
Shared rule library. Every tenant gets the shared rule library, with rules on by default. A tenant can switch a rule off for itself without affecting other tenants.
Sigma import with review. Platform administrators can import Sigma rules. kymeer checks each translation against the original rule. An imported rule stays disabled until it passes two separate review gates.
Readable logic and coverage. Rule logic is shown as a tree instead of one long line. A new MITRE ATT&CK matrix shows what your enabled rules cover, and you can export it to ATT&CK Navigator.

Investigation

Incident workspace. Incidents open in one triage panel with the evidence, saved AI analysis and the related case. Evidence stays with the incident.
Log search. Filter parsed events field by field, or search unparsed events by keyword.
IP intelligence. Location, network owner (ASN) and reputation now appear on events and in the incident panel.
Behavioural analytics. kymeer builds a baseline for each user and machine and compares it with similar entities. It flags convergence, where several users or machines reach the same rare destination, and logins to an asset from a new country.
Plain-English cases. The Passive Auditor draws an attack-vector graph for related activity. It writes a short summary with next steps. High-scoring cases also appear in Incidents.

Collection

Self-service onboarding. Register a device and copy an install command that already holds its enrolment token.
Live logs. Follow a device's logs in near real time from its page. You can also set custom log paths for each agent.
Connectors. A new connector framework pulls data from APIs with paging and checkpoints. It stores credentials encrypted and also accepts JSON pushed over HTTP.
Linux agent. The agent now reports process creation and installed packages. A new view matches packages against known vulnerabilities.

Governed AI

Live egress switch. A platform switch stops all calls to external AI models. kymeer reads it live and blocks calls if it cannot read it.
Plain-language search. Questions in plain language now run against normalised fields.

Response and compliance

Automation and response. Every action carries a danger level. A destructive run needs approval from someone other than the person who started it.
On-premises remediation. Actions that must reach devices inside a customer network are queued by the platform. The collector then runs them on site and reports back.
Data-rights console. Export runs on demand. Erasure needs a one-time code, approval by a second person and a 48-hour cooling-off period before the data is crypto-shredded.

MSSP operations

Service models. Each tenant gets a service model at onboarding. For tenants the MSSP operates, MSSP admins can switch into the tenant to do SOC work. For self-run tenants, the MSSP manages settings only and cannot see tenant data.